fix(web): DANGEROUSLY_OMIT_AUTH=false still disables /api auth

[sbguangha]

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

Web

Inspector version

2.6.0 (local checkout of v2/main / tag 2.6.0)

Node version

v24.18.1

Operating system (and browser, for the web client)

Windows 11

Transport

Not applicable / never connected

MCP server under inspection

Not applicable. This is the web backend auth gate for /api/*, before any MCP server is attached.

Steps to reproduce

1. Launch the Inspector web backend with DANGEROUSLY_OMIT_AUTH=false (or any non-empty value other than true / 1), e.g. a compose file that sets the flag to false intending to keep auth on.
2. Open a /api/* route without a bearer token.
3. Observe the startup banner.

Expected behavior

Only an explicit true / 1 should omit auth, matching the docs (-e DANGEROUSLY_OMIT_AUTH=true) and the same repo’s DANGEROUSLY_BIND_ALL_INTERFACES helper (which already refuses !!value because the string "false" is truthy in JS).

false, 0, empty, and other non-empty junk should keep /api/* bearer auth.

Actual behavior

!!process.env.DANGEROUSLY_OMIT_AUTH treats every non-empty string as on. DANGEROUSLY_OMIT_AUTH=false disables the token gate and prints Auth: disabled.

Logs, errors, or screenshots

On v2/main / main the assignment is still:

const dangerouslyOmitAuth = !!process.env.DANGEROUSLY_OMIT_AUTH

resolve-bind-host.ts already documents why !!value is unsafe for the bind-all flag.

Already prototyped a fix?

Prompt used:

In MCP Inspector web backend, DANGEROUSLY_OMIT_AUTH uses !!process.env which treats the string "false" as true and disables /api bearer auth. Match DANGEROUSLY_BIND_ALL_INTERFACES: only "true" and "1" (trim, case-insensitive) omit auth. Add regression tests. Do not change unrelated config.

Before: any non-empty value omitted auth. After: only true/1 omit auth.

Verified:

npx vitest run --project=integration src/test/integration/server/web-server-config.test.ts

98 passed (local prototype; per CONTRIBUTING I am not opening a PR).

I searched existing issues; no open report for this exact flag.