The MCP Inspector is the official debugging tool for MCP servers, a small browser-based interface that is started on demand via npx. It is the fastest way to manually test the MCP server without an intermediary language model. You call tools with self-built arguments and see the raw JSON-RPC traffic in both directions.

The inspector runs locally, the connection comes from your computer. Therefore, the MCP server does not need to be publicly accessible. localhost, *.ddev.site, internal DNS names, and self-signed certificates work as long as your operating system trusts the CA.

• enableMcp is enabled (see Configuration).
• mcpAllowedRedirectUris and mcpAllowedOrigins are not required. localhost, 127.0.0.1, and [:] are always accepted regardless of these settings.
• mcpAllowHttp should only be set to 1 if your TYPO3 URL is pure HTTP. In production, the value remains 0.
• The backend group has enable_mcp_access and the required feature rights (see Permissions & Scopes).
• Node.js version 18 or newer is installed. You do not need to install the inspector itself; npx fetches it as needed.
• curl -sS [typo3-url]/aisuite-mcp/health returns 200 from this computer.

By default, the inspector occupies localhost for the interface and localhost for its internal proxy.

1. Start Inspector. In a terminal on your computer:

On the first start, the package is downloaded (about 30 MB). After that, the output names the URL of the interface, usually localhost, and opens it in the default browser.

2. Configure connection. In the left area, select Transport Type Streamable HTTP, enter the URL [typo3-url]/aisuite-mcp, and set authentication to OAuth 2.1. The exact designation depends on the inspector version.

3. Complete OAuth. After Connect, the inspector registers at [typo3-url]/aisuite-mcp/oauth/register and opens the authorization page in a new tab. There, follow the TYPO3 backend login and consent to the scopes. The browser redirects to localhost/oauth/callback, the inspector exchanges the code for an access token and stores it in the browser's localStorage. The connection display changes to Connected, and the tabs Tools, Resources, and Prompts become usable.

The actual benefit of the inspector lies in calling tools directly with self-built JSON arguments, without a language model. The right area shows the raw JSON-RPC request and response for each call. This allows for quick identification of schema deviations and permission issues.

A good starting order is:

If readServerInfo does not go through, the problem lies with the connection or permissions and not with the respective tool.

Nothing happens when clicking on Connect, and nothing is logged in TYPO3. The server is not reachable from your computer, or DNS or TLS fails locally. Check with curl [typo3-url]/aisuite-mcp/health from the same computer; for self-signed certificates, run mkcert -install.

The browser reports a certificate problem during the redirect. The CA of the TYPO3 host is not known to the browser. Trust the CA at the operating system level and restart the browser. A curl -k does not help here; browsers are stricter with OAuth redirects.

The terminal where npx @modelcontextprotocol/inspector runs outputs requests and responses at the debug level, while the browser console adds client-side errors. The OAuth credentials and tokens are stored in the localStorage of the origin localhost. Closing a tab does not lose them, but deleting the site data does. Other client-independent cases are collected under Connecting Clients.