Connection settings

Most servers work with only a transport and URL. Change connection settings when the browser cannot reach the server directly, when you want clearer names for saved servers, when OAuth needs pre-registered credentials, or when long-running tools need more time.

Choose Auto, Direct, or Via Proxy

The Inspector uses Auto mode by default: it tries a direct browser connection first, then falls back to the configured Inspector proxy if direct access fails because of CORS or network policy.

Connection mode	Use it when	Avoid it when
Auto	You want the Inspector to try Direct first and fall back to the proxy when needed.	You need to test one specific connection path.
Direct	The server is local, public, or reachable from your browser.	The browser blocks the request because of CORS or network policy.
Via Proxy	The browser is blocked by CORS, or you need to test proxy behavior.	The server works directly; proxying adds another moving part.

Name saved servers

Set a display name when several saved servers have similar URLs. Changing only the display name updates labels in the dashboard, server list, header, command palette, and server picker. It does not reconnect the server or clear auth tokens.

Add headers only when the server requires them

Use custom headers for server-specific requirements such as bearer tokens, API keys, or version headers. Header values are used for the live connection only. They are intentionally not saved or restored after a reload, so supply them again at runtime. Prefer OAuth when the server supports it.

Copy Config includes current form values. Remove OAuth tokens, API keys, and other secrets before sharing exported configuration.

Configure OAuth

By default the inspector relies on Dynamic Client Registration (DCR), so no credentials are needed. Use the Authentication dialog when the upstream auth server doesn’t expose registration_endpoint (common for proxy-mode servers fronting Slack, WorkOS, or GitHub). OAuth client secrets are runtime-only and are not restored after a reload.

Field	When to set it
Client ID	Use a pre-registered OAuth client instead of DCR.
Client Secret	Use a confidential client; the SDK switches token endpoint auth away from `none`.
Scope	Request a provider-specific space-separated scope list.

When a server protects the whole connection, it enters pending_auth. Click Authenticate, complete the provider flow, and return to the Inspector. If a popup is blocked, use the open-auth-page fallback link. Mixed-auth servers behave differently: the anonymous connection remains ready, and the Inspector shows This server is using mixed auth with an Authenticate action. Public operations remain available. You can authenticate up front, or wait for a protected tool, resource, or prompt to return a wire-level OAuth challenge and then authenticate. The classification comes from RFC 9728 protected-resource metadata discovered by the official MCP SDK after a successful anonymous connection. The Inspector does not use host-specific rules or interpret tool-level isError text as an OAuth challenge. Browser OAuth session values are encrypted at rest with AES-256-GCM. The non-extractable origin key is kept in IndexedDB, while versioned ciphertext envelopes remain in localStorage so popup storage events and reload persistence continue to work.

Configuration Import/Export

Use Copy Config to export the current connection form as JSON. Paste JSON into the URL field to populate the form in another Inspector instance. Example configuration:

{
  "url": "https://mcp.example.com/mcp",
  "transportType": "http",
  "connectionMode": "auto",
  "headers": {
    "Authorization": "Bearer token123"
  },
  "requestTimeout": 10000,
  "resetTimeoutOnProgress": true,
  "maxTotalTimeout": 60000,
  "oauth": {
    "clientId": "your-client-id",
    "clientSecret": "your-client-secret",
    "scope": "read write"
  }
}

The paste detection only works in the URL field. Remove OAuth tokens, API keys, and other secrets before sharing a copied config.

URL and tabs

The Inspector keeps the active tab in the page URL (?tab=...). Switching tabs updates the query string so a refresh or shared link restores the same view.

Tune timeouts for long work

Use timeout settings only when a valid tool call or resource read needs more time.

Setting	Default	What it controls
Request timeout	`10000` ms	Time allowed for one request.
Maximum total timeout	`60000` ms	Total time allowed across retries and progress updates.

If a request times out, first confirm the server eventually responds. Then raise the timeout to match the expected tool runtime.

Get Started

MCP Server

MCP Apps

MCP Client

MCP Agent

Tooling

Connection settings

Choose Auto, Direct, or Via Proxy

Name saved servers

Add headers only when the server requires them

Configure OAuth

Configuration Import/Export

URL and tabs

Tune timeouts for long work

​Choose Auto, Direct, or Via Proxy

​Name saved servers

​Add headers only when the server requires them

​Configure OAuth

​Configuration Import/Export

​URL and tabs

​Tune timeouts for long work

Choose Auto, Direct, or Via Proxy

Name saved servers

Add headers only when the server requires them

Configure OAuth

Configuration Import/Export

URL and tabs

Tune timeouts for long work