MCP Inspector's app fingerprint identifies a proxy with process authority
MCP Inspector is a development tool for testing MCP servers. It includes a proxy that can communicate with local MCP processes and, in its intended workflow, spawn local server commands. That makes an exposed Inspector more consequential than a static documentation viewer.
On November 12, 2026, the AutoPR ZoomEye SDK probe used sub_type=all, page 1 and page size 1. app="MCP Inspector" returned 31 matches. title="MCP Inspector" returned 375. Both requests succeeded. The application fingerprint is the stronger product signal, while the title count may include pages that discuss the tool without running it.
The Inspector project documents a proxy server that can run and communicate with local MCP processes. Its security guidance says authentication is required by default and warns that exposing the Inspector beyond loopback lets anyone who can reach the page drive the backend, including process spawning and stored MCP credentials. The environment documentation names MCP_INSPECTOR_API_TOKEN and the legacy MCP_PROXY_AUTH_TOKEN. Host and origin controls decide which browser and reverse-proxy paths may reach the interface.
A recent advisory, GHSA-2rq8-f55p-j2jp, described a proxy session token leak to a query-controlled proxy origin. That issue reinforces the review method: the Inspector needs a trustworthy origin, a protected token and a network boundary that matches its intended local use.
For each confirmed Inspector instance, identify the host owner, bind address and reverse-proxy route. Check whether it is bound only to loopback, whether authentication is enabled and whether the API token is unique. Review the allowed-host list and confirm that a proxy does not rewrite the original host into an unexpected trusted value. Test that a direct connection to the container or host port is denied from untrusted networks.
The proxy's process authority is the central control. Review the MCP server definitions, command paths, environment variables and storage files. Determine which credentials are available to a spawned process. If the Inspector has access to a Docker socket or a shared home directory, a page-level exposure can reach the development environment and its secrets.
Treat browser access as part of the identity model. An unguessable path is not an authentication factor. Require a strong token or an authenticated reverse proxy, set a short lifetime where possible and avoid sharing the same token across developers. Review logs for unexpected process starts, command changes, failed origin checks and access from addresses outside the development network.
The 31 application matches are a useful candidate list and the 375 title matches provide a wider pool for manual review. Neither number proves that every matching host exposes process execution. The owner review, bind address, token state and allowed origins provide that evidence.
Top comments (0)