MCP Inspector

The MCP Inspector is the official debugging tool for MCP servers, a small browser-based interface that is started on demand via npx. It is the fastest way to test the MCP server by hand, without a language model in between. You call tools with arguments you build yourself and see the raw JSON-RPC traffic in both directions. For scripts, there is also a CLI mode without an interface, see the MCP Inspector README.

The Inspector runs locally, the connection comes from your computer. The MCP server therefore does not need to be publicly reachable. localhost, *.ddev.site, internal DNS names and self-signed certificates work as long as your operating system trusts the CA.

• enableMcp is enabled (see Configuration).
• mcpAllowedRedirectUris and mcpAllowedOrigins are not needed. localhost, 127.0.0.1 and [::1] are always accepted regardless of these settings.
• Only set mcpAllowHttp to 1 if your TYPO3 URL is plain HTTP and the host is neither localhost, 127.0.0.1, [::1] nor *.ddev.site. These hosts are exempt anyway. In production, the value stays 0.
• The backend group has enable_mcp_access and the required feature permissions (see Permissions & Scopes).
• Node.js version 22.19 or newer is installed (see the MCP Inspector README). You do not need to install the Inspector itself, npx fetches it on demand.
• curl -sS [typo3-url]/aisuite-mcp/health returns 200 from this computer.

1. Start the Inspector. Run the following command in a terminal on your computer. The option --transport http is required because the path /aisuite-mcp does not end in /mcp:

The output shows the URL of the interface (127.0.0.1) including an access token and opens it in the default browser. Open the interface via exactly this URL, because it contains the access token.

2. Configure the connection. The start command already sets up the server with the transport Streamable HTTP and the URL [typo3-url]/aisuite-mcp. In the server settings, choose OAuth as authentication or, for a static token, enter the header Authorization: Bearer [token]. What the fields are called and where they are located is described in the MCP Inspector README.

3. Complete OAuth. When connecting, the Inspector registers itself at [typo3-url]/aisuite-mcp/oauth/register and opens the authorization page. There, you sign in with your TYPO3 backend credentials, even if you are already signed in to the backend, and consent to the scopes. The browser redirects back to 127.0.0.1/oauth/callback. This address is covered by the localhost exception, an entry in mcpAllowedRedirectUris is not needed. The Inspector exchanges the code for an access token and stores it itself. After that, tools, resources and prompts are ready for testing.

The real benefit of the Inspector is calling tools directly with JSON arguments you build yourself, without a language model. The interface shows the raw JSON-RPC request and the response for every call. This lets you narrow down schema deviations and permission problems very quickly.

This order has proven useful as a starting point:

If even readServerInfo does not get through, the problem lies with the connection or permissions and not with the individual tool.

Nothing happens when connecting, and there is nothing in the TYPO3 log. The server cannot be reached from your computer, or DNS or TLS fails locally. Check with curl [typo3-url]/aisuite-mcp/health from the same computer, with self-signed certificates run mkcert -install.

The browser reports a certificate problem during the redirect. The browser does not know the CA of the TYPO3 host. Trust the CA at operating system level and restart the browser. A curl -k does not help here, browsers are stricter with OAuth redirects.

Further error messages are shown in the terminal in which the Inspector runs and in the browser console. The Inspector stores the OAuth credentials and tokens itself. To reset the sign-in, reset the OAuth state in the Inspector's server settings and connect again. Further client-independent cases are collected under Connecting Clients.