MCP Inspector 2.14.0 was timestamped at 23:55:33 UTC on November 4 in the project’s release feed. The 2.14.0 release notes say the update fixes three vulnerabilities reported privately against v2. They identify one of the three, GHSA-2fw8-7jmw-r937, as also affecting the deprecated v1 line; the release notes point to v1.0.4 as the fix there. The page does not assign severity or give a broader affected-version range. The update also changes several behaviors developers can see while using the Inspector.
For MCP Apps, the proxy enforces a sandbox-frame policy built from the app’s approved Content Security Policy grants. If a frame starts to leave the document loaded by the host, the proxy closes the relay, removes the frame and tells the host why. The release notes associate this change with GHSA-h9j8-vj8g-v3gg.
Importing a server.json file now displays the exact command before saving. Additionally, the Inspector rejects packages containing an invalid or empty environment-variable name or unsafe tokens.
The release notes group these import checks with two other changes under GHSA-rwv7-mh2c-ff2p: URL elicitations now open only http and https URLs, refusing other schemes with a provided reason, and the HTML preview’s CSP now appears before all document markup. These three distinct updates—the import validation, the URL scheme restriction, and the CSP ordering—are all categorized together within this specific release-note entry.
In v2.14.0, server-supplied patterns in tool-output and app-elicitation schemas use a linear-time matcher, with limits applied per pattern and per schema. A pattern over those limits is reported as unverified instead of being evaluated. The release notes associate this behavior with GHSA-2fw8-7jmw-r937. The notes say over-limit patterns are not evaluated; they are not marked as having passed validation.
The deprecated v1.0.4 release takes a different route. Its release notes say server-supplied pattern regexes are stripped before validation, including patterns reachable through $ref. The elicitation form also stops passing those patterns to the browser’s native field validation, and the result identifies checks that were skipped. If a schema cannot be transformed safely, such as one with $id or anchors, v1.0.4 reports it as not validated rather than evaluating it. Because the patterns are no longer evaluated, a value that fails a server’s pattern is accepted with a note; other schema constraints still apply. That differs from v2.14.0, where the linear-time matcher evaluates patterns within limits and labels over-limit cases unverified.
The release instructions give separate commands for the two lines. For v2, the notes specify npx @modelcontextprotocol/inspector@latest. For the deprecated v1 line, v1.0.4 specifies npx @modelcontextprotocol/inspector@v1-latest, or a move to v2 using @latest. The Node engine field now lists ^22.23.4 || ^24.22.1 || >=26.12.1, corresponding to the October 2026 Node security releases. On older versions, npm prints EBADENGINE; the field is advisory, and the Inspector still runs.
Load-test measurements also have specific definitions in 2.14.0. --load latency, latencyMs and the --load-max-p99 gate count successful calls only. Failed calls are reported separately as errorLatencyMs, and tool-error text is shown. If a load run has no successful call, --load-max-p99 fails with a message that there is no p99 to check.
Two additional release-note changes concern session cleanup and OAuth callbacks: closing or reloading a web tab reaps its backend session and stdio child, and the OAuth callback listener acts only on the state for that flow. The release presents these as specific Inspector changes, not as a general statement about MCP security across products.