chore: merge v2/main for the v2.1.0 milestone release

.gitattributes

@@ -0,0 +1 @@
+package-lock.json linguist-generated=true

.github/ISSUE_TEMPLATE/1-bug_report.yml

@@ -0,0 +1,163 @@
+name: Bug report
+description: Report something broken in the Inspector (web, CLI, or TUI)
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug — **issues are how work reaches the Inspector.**
+
+        This repository accepts **issues, not pull requests**: design and
+        implementation are done by the maintainers through a prompt-driven
+        workflow ([`CONTRIBUTING.md`](https://github.com/modelcontextprotocol/inspector/blob/main/CONTRIBUTING.md)).
+        So if you have already prototyped a fix locally, **the prompt you used
+        plus screenshots is worth more to us than a diff** — there is a field
+        for it at the bottom of this form.
+
+        > 🔒 **Do not report security vulnerabilities here.** Use the
+        > [private advisory process](https://github.com/modelcontextprotocol/inspector/security/advisories/new)
+        > instead — see [`SECURITY.md`](https://github.com/modelcontextprotocol/inspector/blob/main/SECURITY.md).
+
+  - type: dropdown
+    id: version-line
+    attributes:
+      label: Which version line?
+      description: >
+        v2 is the current Inspector. v1 is deprecated and takes **security
+        fixes only**, so a v1 bug report gets a different answer. When in
+        doubt, it's v2.
+      options:
+        - v2 — current (`@modelcontextprotocol/inspector@latest`)
+        - v1 — deprecated (`@v1-latest`, security fixes only)
+    validations:
+      required: true
+
+  - type: dropdown
+    id: client
+    attributes:
+      label: Which client?
+      description: The Inspector ships three clients from one package.
+      options:
+        - Web
+        - CLI
+        - TUI
+        - All / shared core
+    validations:
+      required: true
+
+  - type: input
+    id: inspector-version
+    attributes:
+      label: Inspector version
+      description: The version you actually ran, not "latest".
+      placeholder: "2.0.0"
+    validations:
+      required: true
+
+  - type: input
+    id: node-version
+    attributes:
+      label: Node version
+      description: >
+        Output of `node --version`. The current v2 line requires Node >=
+        22.19.0; the deprecated v1 line has its own, older floor.
+      placeholder: "v22.19.0"
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating system (and browser, for the web client)
+      placeholder: "macOS 15.5, Chrome 140"
+    validations:
+      required: false
+
+  - type: dropdown
+    id: transport
+    attributes:
+      label: Transport
+      description: How the Inspector was connected to the MCP server under inspection.
+      options:
+        - stdio
+        - Streamable HTTP
+        - SSE (legacy)
+        - Not applicable / never connected
+    validations:
+      required: true
+
+  - type: textarea
+    id: mcp-server
+    attributes:
+      label: MCP server under inspection
+      description: >
+        Which server, and how it is configured — the command or URL, the
+        protocol era you connected with (auto / legacy / modern), and whether
+        OAuth is involved. Redact tokens and secrets.
+      placeholder: |
+        Server: @modelcontextprotocol/server-everything (npx)
+        Protocol era: modern
+        OAuth: no
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Numbered steps, starting from a fresh launch of the Inspector.
+      placeholder: |
+        1. Run `npx @modelcontextprotocol/inspector`
+        2. Add the server above and connect
+        3. Open the Tools tab and call `echo`
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What you expected to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What happened instead.
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs, errors, or screenshots
+      description: >
+        Console output, the Inspector's Protocol or Network tab, or a
+        screenshot. Redact tokens and secrets first. Screenshots can be pasted
+        directly into this field.
+    validations:
+      required: false
+
+  - type: textarea
+    id: prompt
+    attributes:
+      label: Already prototyped a fix?
+      description: >
+        Please don't attach a diff or open a pull request — share the **exact
+        prompt(s)** you used to produce the change, plus what you verified and
+        any before/after screenshots. We reproduce it through our own workflow
+        so it lands with the right conventions, tests, and coverage.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: acknowledgements
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched existing issues and this is not a duplicate.
+          required: true
+        - label: This is not a security vulnerability report (those go through the private advisory process).
+          required: true

.github/ISSUE_TEMPLATE/2-feature_request.yml

@@ -0,0 +1,88 @@
+name: Feature request
+description: Suggest an improvement to the Inspector
+# `v2` is safe to declare statically here: v1 takes security fixes only and
+# cannot receive a feature, so a feature request is v2 by construction. The bug
+# form can't do this — its version line is a reporter's answer, and `labels:`
+# is static.
+labels: ["enhancement", "v2"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting an improvement.
+
+        **Maintainers do the implementation here** — this repository accepts
+        **issues, not pull requests**
+        ([`CONTRIBUTING.md`](https://github.com/modelcontextprotocol/inspector/blob/main/CONTRIBUTING.md)).
+        That makes a sharply-stated **problem** the most valuable thing you can
+        give us: it is what we design against, and it survives after a specific
+        solution turns out not to fit.
+
+        So please describe the problem first, and treat the solution section as
+        one possible answer rather than the request itself.
+
+        > **This form targets v2.** The v1 line is deprecated and takes
+        > **security fixes only** — it does not take new features.
+
+  - type: dropdown
+    id: client
+    attributes:
+      label: Which client?
+      options:
+        - Web
+        - CLI
+        - TUI
+        - All / shared core
+        - Not sure
+    validations:
+      required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: >
+        What are you trying to do, and what makes it hard or impossible today?
+        Describe the situation, not the feature — including how often you hit
+        it and what you do instead right now.
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Solution you have in mind (optional)
+      description: >
+        If you have a concrete idea, describe it here. It's fine to leave this
+        blank — the problem above is the part we need.
+    validations:
+      required: false
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives or workarounds you have tried
+    validations:
+      required: false
+
+  - type: textarea
+    id: prompt
+    attributes:
+      label: Already built it locally?
+      description: >
+        Please don't attach a diff or open a pull request — share the **exact
+        prompt(s)** you used, plus screenshots of the result. We reproduce the
+        work through our own workflow so it lands with the right conventions,
+        tests, and coverage.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: acknowledgements
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched existing issues and this is not a duplicate.
+          required: true
+        - label: This is a request for the Inspector itself, not for the MCP specification or an SDK.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,57 @@
+# Issue chooser configuration.
+#
+# Blank issues are disabled so every report lands in a form. The bug form
+# requires the facts triage needs first (client, version line, transport); the
+# feature form requires the client and a problem statement, and is v2-only.
+#
+# Security reports are deliberately a *contact link* rather than a template:
+# a template would still open a public issue, which is exactly what a
+# vulnerability report must not do. These links leave GitHub's issue flow and
+# go straight to the private advisory form. See SECURITY.md.
+blank_issues_enabled: false
+contact_links:
+  - name: 🔒 Security vulnerability (v1 or v2) — report privately
+    url: https://github.com/modelcontextprotocol/inspector/security/advisories/new
+    about: >
+      Never report a vulnerability in a public issue. Private vulnerability
+      reporting is enabled on this repository — this link opens the advisory
+      form, which is the fastest route to a maintainer. v1 is deprecated and
+      takes security fixes only, so this is the channel for a v1 security
+      issue.
+
+  - name: 📜 Security policy (supported versions, what to include)
+    url: https://github.com/modelcontextprotocol/inspector/blob/main/SECURITY.md
+    about: >
+      Which versions are supported, how reports are handled, and what to
+      include in one.
+
+  - name: 🤝 Contribution policy — why there is no "New pull request"
+    url: https://github.com/modelcontextprotocol/inspector/blob/main/CONTRIBUTING.md
+    about: >
+      This repository accepts issues, not pull requests — maintainers do the
+      implementation. If you already built a change locally, open an issue and
+      share the prompt you used rather than a diff.
+
+  - name: 📖 MCP documentation
+    url: https://modelcontextprotocol.io
+    about: >
+      Guides and reference for the Model Context Protocol itself. Start here
+      for "how does MCP work" questions.
+
+  - name: 📐 MCP specification — protocol questions and proposals
+    url: https://github.com/modelcontextprotocol/modelcontextprotocol/issues
+    about: >
+      If the behavior you're reporting is defined by the protocol rather than
+      by this tool, file it against the specification repository instead.
+
+  - name: 🧰 MCP TypeScript SDK
+    url: https://github.com/modelcontextprotocol/typescript-sdk/issues
+    about: >
+      The Inspector is built on the TypeScript SDK. If the bug reproduces
+      against the SDK directly (outside the Inspector), file it there.
+
+  - name: 💬 MCP Contributor Discord (#inspector-dev)
+    url: https://discord.gg/6CSzBmMkjX
+    about: >
+      Questions, usage help, and day-to-day Inspector development discussion.
+      Also where to say hello if you'd like to work on the Inspector with us.