MCP Inspector obscured executable server arguments during registry import review

The MCP Inspector registry import view summarized a server package but concealed runtimeArguments or packageArguments that would ultimately be passed to executable package runners.

GHSA-rwv7-mh2c-ff2p documents the gap between what a user reviewed and the actual argv later executed. Approval could therefore cover more dangerous options than the UI disclosed.

The review interface displayed a package identity while runtimeArguments and packageArguments that would be passed to the actual executable were hidden in a collapsed or secondary view. Those flags can change where package managers fetch code or which Docker volumes and permissions a server receives. A user who approves only the visible name may therefore approve an execution environment they did not actually inspect. The advisory reports a fix in MCP Inspector 2.14.0. The vulnerability requires a malicious or manipulated server registry manifest to be imported and later executed; it is not proof that ordinary registry packages were compromised. A secure review must bind the user's approval to the final resolved argv and privilege set.

The displayed package label was not the complete executable request. A registry manifest could add npm, uvx or Docker arguments that change a program's source, mounted files or privileges, while the review UI emphasized the benign package name. The consequential object to approve is the resolved command and argument vector, not a shortened registry description. This is distinct from the Inspector iframe and schema-validation defects, which arise after content or tool results reach the browser.