# Mcp Explorer

> MCP Explorer - because the official NXP Inspector (@modelcontextprotocol/inspector) is terrible! Also this has an API layer!

- **Type:** MCP server
- **Install:** `agentstack add mcp-ventz-mcp-explorer`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [ventz](https://agentstack.voostack.com/s/ventz)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [ventz](https://github.com/ventz)
- **Source:** https://github.com/ventz/mcp-explorer

## Install

```sh
agentstack add mcp-ventz-mcp-explorer
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# MCP Explorer

A web-based GUI for exploring and interacting with [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) servers. Connect to any MCP server, browse its capabilities, and execute tools, read resources, and test prompts — all from your browser.

## Features

- **Connect to any MCP server** — supports both Streamable HTTP and SSE transports (auto-detects)
- **Authentication** — Bearer token, custom header, or no auth
- **Browse Tools** — list all tools, view schemas, fill in parameters, and execute them
- **Browse Resources** — list and read resources exposed by the server
- **Browse Prompts** — list prompts, fill in arguments, and retrieve rendered output
- **Parameter Store** — save and reuse frequently used parameter values across sessions
- **URL History** — remembers previously connected server URLs
- **Clean UI** — minimal, responsive interface with tabbed navigation

## Quick Start

### Prerequisites

- Python 3.13+
- [uv](https://docs.astral.sh/uv/) (recommended) or pip

### Install & Run

```bash
# Clone the repo
git clone https://github.com/ventz/mcp-explorer.git
cd mcp-explorer

# Install dependencies
uv sync

# Run the server
uv run python app.py
```

Open [http://localhost:8000](http://localhost:8000) in your browser.

### Using pip

```bash
pip install fastapi 'uvicorn[standard]' jinja2 mcp
python app.py
```

## Usage

1. Enter an MCP server URL (e.g., `http://localhost:3000/mcp`)
2. Optionally configure authentication (Bearer token or custom header)
3. Click **Connect**
4. Use the tabs to explore **Tools**, **Resources**, and **Prompts**
5. Select an item to view its details, fill in parameters, and execute

## Project Structure

```
mcp-explorer/
├── app.py              # FastAPI backend — MCP client + API routes
├── pyproject.toml       # Python project metadata & dependencies
├── templates/
│   └── index.html       # Main HTML template
└── static/
    ├── app.js           # Frontend application logic
    └── style.css        # Styles
```

## API Endpoints

| Method | Path                | Description                  |
|--------|---------------------|------------------------------|
| GET    | `/`                 | Web UI                       |
| GET    | `/health`           | Health check                 |
| POST   | `/api/connect`      | Connect to an MCP server     |
| POST   | `/api/disconnect`   | Disconnect                   |
| GET    | `/api/status`       | Connection status             |
| GET    | `/api/tools`        | List available tools         |
| POST   | `/api/tools/call`   | Execute a tool               |
| GET    | `/api/resources`    | List available resources     |
| POST   | `/api/resources/read` | Read a resource            |
| GET    | `/api/prompts`      | List available prompts       |
| POST   | `/api/prompts/get`  | Get a rendered prompt        |

## Security & Deployment Notes

This is a local developer tool. It connects to whatever URL you give it and has
no authentication of its own, so keep the following in mind:

- **Binds to `127.0.0.1` by default.** Only processes on your machine can reach
  it. Override with `MCP_EXPLORER_HOST` only if you understand that exposing the
  proxy lets anyone who can reach it connect outward through your machine.
- **SSRF guard.** Requests to link-local (including the cloud metadata address
  `169.254.169.254`), multicast, and reserved addresses are always refused.
  Loopback and private (RFC1918) addresses are allowed by default so you can
  reach local MCP servers; set `MCP_EXPLORER_BLOCK_PRIVATE=1` to refuse those
  too (useful if you ever expose the server).
- **Run as a single worker.** Connection state is held in-process, so do not run
  under multiple uvicorn workers — each worker would have its own state.
- **Auth credentials** are only saved to `localStorage` when you tick
  **Remember**; otherwise the token is used for the connection but not stored.

## Protocol

Uses the official `mcp` Python SDK, which negotiates the latest MCP protocol
version (`2025-11-25`) during initialization and terminates the session
(`DELETE /mcp`) on disconnect. The negotiated version is reported by
`/api/status`.

## License

MIT

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [ventz](https://github.com/ventz)
- **Source:** [ventz/mcp-explorer](https://github.com/ventz/mcp-explorer)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-ventz-mcp-explorer
- Seller: https://agentstack.voostack.com/s/ventz
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.