feat(frontend): add MCP Inspector to Quick Connect

[GallaGit]

Closes #1002.

What

• New MCP Inspector entry in the server page's Quick Connect list.
• Its modal shows a ready-to-run command that pre-fills the connection: npx @modelcontextprotocol/inspector --server-url "<endpoint>" --transport http, plus a plain link to the local Inspector (http://localhost:6274/) and sign-in steps (OAuth or X-API-Key).
• Helper packages/frontend/src/lib/inspector-url.ts builds the command; only the server URL goes in, never keys or tokens.
• e2e test in mcp-server-connect-clients.spec.ts (cloud and self-hosted).

Why CLI flags instead of a ?serverUrl= deep link

As discussed in the issue, Inspector v2 ignores serverUrl deep links unless they also carry the per-launch session token, which is secret. Pre-filling through CLI flags avoids putting any credential in a URL, and the Inspector hands its own token to the page it opens.

Testing

Manually tested locally with Docker: Quick Connect modal shows the pre-filled command; Inspector v2.10.1 connects with X-API-Key and tools/list succeeds.

Lint and TypeScript are clean on the touched files.

[github-actions]

👋 Welcome, @GallaGit, and thanks for opening your first PR on AnythingMCP!

A few quick pointers:

• Make sure CI is green before requesting review (Backend, Frontend, Playwright, CodeQL, Trivy).
• If this is a new adapter, the parametrised catalog.spec.ts test will validate it automatically.
• Sign off your commits if you can — it's not blocking, just nice to have.

Someone from the core team will look at this within ~48h. If you don't hear back, please ping us in Discussions / Q&A.

⭐ While you wait — if you find AnythingMCP useful, a star helps others discover it.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[GallaGit]

Modal content from the local test (Inspector v2.10.1), screenshots below:

Connect to MCP Inspector

Run this command in your terminal (Node 22.19 or later). It starts the Inspector already pointed at this server:

npx @modelcontextprotocol/inspector --server-url "http://localhost:4000/mcp/cmv3xrtzy00032smpmt7vmhog" --transport http

The Inspector opens in your browser. If it doesn't, open it here:
Open in MCP Inspector (http://localhost:6274/)

The Inspector hands its session token (MCP_INSPECTOR_API_TOKEN) to the page it opens, so you don't need to copy it.

Sign in with OAuth when the Inspector asks (connect, sign in and approve access), or use an API key: add --header "X-API-Key: <your key>" to the command, or set an X-API-Key header in the server's settings in the Inspector.

[GallaGit]

I have read the CLA Document and I hereby sign the CLA

[GallaGit]

recheck

[helpcodeai]

Thanks @GallaGit. Going with CLI flags instead of a ?serverUrl= link is the right call given how the v2 token works. I checked it against the 2.10.1 package: --server-url, --transport http and --header are all accepted, the engines field says Node >= 22.19, and the Inspector injects its token into the page even at the bare http://localhost:6274/ URL, so the plain link and the sentence in the modal are accurate. Nothing secret goes into a URL, and inspectorCommand only ever gets the endpoint the page already shows.

I ran it locally: frontend tsc and lint are clean, and the whole Playwright suite passes (131 tests, your two new ones included).

Some non-blocking notes, fine to merge without them:

• .env.example defaults to MCP_AUTH_MODE=oauth2 and the modal tells people to sign in with OAuth. If you get a minute, try that path once (the Inspector registers http://localhost:6274/oauth/callback, which our DCR accepts as a loopback URI) and add a line to the PR about how it went.
• --header "X-API-Key: ..." leaves the key in shell history. Maybe mention the Inspector's own header field first and the flag second.
• inspector-url.ts and the e2e spec are missing the trailing newline.

CI on fork PRs has to be started by us, so that part's on our side. It's good to go once it's green.

[GallaGit]

Thanks a lot for the thorough review and for running the suite! I pushed a small follow-up: the modal now suggests the Inspector's own header field first and the --header flag as an alternative, and I added the missing trailing newlines. I'll try the OAuth path in the Inspector and report back here.

[GallaGit]

Tried the OAuth path: with MCP_AUTH_MODE=oauth2 (local Docker build of this branch) and Inspector v2.10.1 started from the Quick Connect command with no --header, clicking Connect went through discovery, dynamic client registration, the consent screen (approved it) and the localhost:6274/oauth/callback redirect, and the token exchange succeeded. The MCP requests after that returned 200. So the OAuth sentence in the modal holds up.