MCP Inspector 2.14.0 Security Fixes: Apps Sandbox, Import, ReDoS

Updated November 6, 2026. Package lab on @modelcontextprotocol/inspector 2.13.0 and 2.14.0; ReDoS probe on ajv@8.20.0 (Linux).

MCP Inspector 2.14.0 shipped at 23:55:33 UTC on November 4, 2026 with three privately reported Moderate security fixes against the v2 line. The release notes name GHSA-h9j8-vj8g-v3gg (MCP App CSP frame escape), GHSA-rwv7-mh2c-ff2p (unsafe server.json import and URL elicitation), and GHSA-2fw8-7jmw-r937 (tool outputSchema ReDoS, also fixed on deprecated v1 as 1.0.4).

On November 6 we pulled both npm packages, compared the shipped sandbox_proxy.html, and reproduced the advisory ReDoS timing shape with Ajv on a loopback probe. The practical takeaway for AgentOps teams: upgrade the web Inspector before you use it to review untrusted MCP Apps or import third-party server.json files. CLI and TUI users sit outside the Apps-tab issue, but the ReDoS and import paths still matter if you stay on the web client.

What Landed in 2.14.0

The official release notes group the security work into three bullets that match the three GitHub Security Advisories. An MCP App can no longer leave its sandbox frame while keeping the host bridge. Importing a server.json file shows the exact command before save and rejects packages with invalid or empty environment-variable names or unsafe tokens. URL elicitations open only http and https schemes, and the HTML preview CSP now precedes all document markup. Server-supplied schema patterns for tool output and app elicitation run through a linear-time matcher with per-pattern and per-schema limits.

The same cut raises the Node engine floor to ^22.23.4 || ^24.22.1 || >=26.12.1, matching the October 2026 Node security releases. npm prints EBADENGINE on older runtimes; the field is advisory, so the Inspector still starts. Load-test latency metrics now count successful calls only, with failures reported separately as errorLatencyMs.

Who Is Actually Exposed

Advisory text is clear that CLI and TUI users are outside the Apps sandbox issue because those clients never render MCP Apps. The frame-escape bug needs the web Apps tab on the default opaque-origin (srcdoc) path. Apps that request a dedicated origin through _meta.ui.domain load on a different path. The ReDoS and import issues still apply to web users who connect untrusted servers or import registry documents.

Choose 2.14.0 immediately when your team reviews third-party MCP Apps in the web UI, imports registry server.json files, or connects Inspector to servers you do not fully trust. Stay on CLI or TUI alone if you never open the Apps tab and never import registry packages, then still plan the ReDoS upgrade if any teammate uses the web client for tool calls. Skip panic if you already pin @latest at 2.14.0 or newer and confirm the package version in your install logs.

GHSA-h9j8: Apps Sandbox Frame Escape

GHSA-h9j8-vj8g-v3gg (Moderate, CVSS 6.1) describes an MCP App on the default srcdoc path that sets location.href to an attacker origin. Sandbox flags persist across that move, so the attacker page still has origin null and still passes the proxy check event.source === inner.contentWindow. The proxy also kept relaying host messages with targetOrigin "*".

The advisory PoC showed data leaving despite connect-src 'none', private tool output arriving at the attacker page, and a forged tools/call reaching the host. Impact is sandbox isolation failure for reviewers who rely on the Inspector to show what an untrusted app can contact. Developers testing their own trusted apps face low practical risk. Severity is Moderate with user interaction required: someone must render the app from a connected server.

Our package lab compared the shipped clients/web/static/sandbox_proxy.html from npm 2.13.0 and 2.14.0. The file grew from 18,442 bytes to 27,791 bytes (+9,349). The 2.14.0 copy adds navigatedAway, loadSrcdocWatchingForNavigation, and a user-facing message that the Inspector removed the frame and stopped relaying messages. Comments in 2.14.0 also document that CSP cannot stop a frame from leaving its own document, which corrects the earlier assumption in the relay path.

GHSA-rwv7: server.json Import and URL Elicitation

GHSA-rwv7-mh2c-ff2p (Moderate) covers three related input-validation gaps. Imported runtimeArguments were spliced into stdio commands for npx, uvx, docker run, or dnx without flag filtering, while the UI often showed only a benign package identifier. Elicitation URLs were passed to window.open without an http(s) scheme check. HTML preview CSP injection used a regex replace that a crafted comment before the real <head> could bypass.

2.14.0 shows the exact command before save, rejects invalid or empty environment-variable names and unsafe tokens, refuses non-http(s) elicitation schemes with a reason, and places the preview CSP ahead of all document markup. For AgentOps reviewers, the import change matters as much as the Apps sandbox: a registry document is a supply-chain surface that previously could hide flags behind a friendly label.

GHSA-2fw8: Tool Output Schema ReDoS

GHSA-2fw8-7jmw-r937 (Moderate, CVSS 6.5) notes that Inspector treated a remote server outputSchema as trusted validator input and ran it synchronously on the UI path with no complexity limit. A classic catastrophic pattern such as ^(a+)+$ with a near-match string can stall the client. The issue also affects deprecated v1 through 1.0.3, fixed in 1.0.4.

We ran a loopback Ajv 8.20.0 probe with the same pattern and near-match shape the advisory cites. Validation time moved from about 5.7 ms at 20 characters to about 355 ms at 26 characters, with clear nonlinear growth. That matches the advisory helper probe order of magnitude and shows why unbounded main-thread schema patterns are unsafe in a developer tool that talks to untrusted servers.

v2.14.0 evaluates patterns with a linear-time matcher and marks over-limit patterns unverified instead of evaluating them. Deprecated v1.0.4 takes a different route: it strips server-supplied pattern regexes (including through $ref) before validation and notes skipped checks. Choose v2.14.0 when you want bounded evaluation; choose v1.0.4 only if you must stay on the v1 line and accept stripped patterns. Neither path marks an over-limit or stripped pattern as passed.

Upgrade Steps and Operator Checklist

For the active v2 line, run npx @modelcontextprotocol/inspector@latest. For deprecated v1 security fixes only, run npx @modelcontextprotocol/inspector@v1-latest (or move to v2). Confirm the printed version is 2.14.0 or newer before you open the Apps tab against a third-party server.

• Pin or refresh to 2.14.0 (or 1.0.4 on v1) in every shared developer image and CI job that launches Inspector.
• Treat web Apps-tab reviews of untrusted MCP Apps as a sensitive workflow until every machine is on 2.14.0.
• When importing server.json, read the exact command the UI now shows before Import & Save.
• Refuse elicitation URLs that are not http or https; 2.14.0 should block them, and operators should still verify the scheme.
• Prefer dedicated origins (_meta.ui.domain) for apps you ship, and keep untrusted apps off shared review laptops when possible.
• Pair Inspector upgrades with the broader MCP server hygiene covered in our {il(“https://agentopsguide.com/ai-agent-security-tools/”,”AI agent security tools guide”)} and {il(“https://agentopsguide.com/mcp-servers/”,”MCP servers pillar”)}.

How This Fits AgentOps Practice

Inspector sits in the same trust boundary as other agent tooling: it connects to servers, renders app UI, and can spawn local stdio commands from registry metadata. The November 4 release is a reminder that developer inspection tools need the same least-privilege and input-validation discipline as production LLM gateways and MCP gateways. Teams that already track MCP CVEs from our FastMCP security advisories coverage should add Inspector 2.14.0 to the same patch board.

Related AgentStack reading: MCP explained, Microsoft Agent Framework MCP approval defaults, and CrowdStrike AI Kill Switch. Those pieces cover protocol basics, approval defaults, and runtime kill switches. This note covers the inspection client that many teams use before any of those controls land in production.

FAQ