
Research
/Security News
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.
@ramarivera/mcpjam-inspector
Advanced tools
MCPJam Inspector is the local development client for ChatGPT apps, MCP ext-apps, and MCP servers. Build and test your apps with a full widget emulator, chat with any LLM, and inspect your server’s tools, resources, prompts, and OAuth flows.
No more ngrok or ChatGPT subscription needed. MCPJam is the fastest way to iterate on any MCP project.
Start up the MCPJam inspector:
npx @ramarivera/mcpjam-inspector@latest
To force a port (browser is disabled by default):
npx @ramarivera/mcpjam-inspector@latest --port 16274
To open the browser when needed:
npx @ramarivera/mcpjam-inspector@latest --port 16274 --open
We recommend starting MCPJam inspector via npx:
npx @ramarivera/mcpjam-inspector@latest
npx @ramarivera/mcpjam-inspector@latest --port 16274
npx @ramarivera/mcpjam-inspector@latest --port 16274 --open
We have a Mac and Windows desktop app:
Run MCPJam using Docker:
docker run -p 6274:6274 mcpjam/mcp-inspector
| Capability | Description |
|---|---|
| ChatGPT Apps SDK | Local development for ChatGPT Apps SDK support. Full support for the windows.openai API: widgetState, callTool, structuredContent, sendFollowUpMessage, displayMode, CSP, and more. No more ngrok or ChatGPT subscription needed. Read more |
| MCP ext-apps (Claude) | Full local development for MCP Apps (SEP-1865). Support for all JSON-RPC message types, such as tools/call, ui/initialize, ui/message, ui/open-link, and more. Read more |
| OAuth Debugger | Debug your MCP server's OAuth implementation at every step. Visually inspect every network message. Supports all protocol versions (03-26, 06-18, and 11-25). Support for client pre-registration, DCR, and CIMD. Read more |
| LLM playground | Chat with your MCP server against any LLM in the playground. We provide frontier models such as GPT-5 and Claude Sonnet for free, or bring your own API key. Playground supports ChatGPT apps and MCP Apps. Read more |
| MCP server debugging | Connect to and test any MCP server local or remote. Manually invoke MCP tools, resources, resource templates, and elicitation flows. View all JSON-RPC logs. Support for all features from the official MCP inspector. |
| Server info | View server icons, version, capabilities, instructions, and ChatGPT widget metadata exposed by the server. Read more |
Develop ChatGPT apps and MCP apps (Claude) in MCPJam's Apps Builder. Apps Builder is a local emulator to quickly view and iterate on your widgets.
window.openai messages in the logs.
View every step of the OAuth handshake in detail, with guided explanations. Test with every version of the OAuth spec (03-26, 06-18, and 11-25). Support for client pre-registration, Dynamic Client Registration (DCR), and Client ID Metadata Documents (CIMD).
Try your server against any LLM model. We provide frontier models like GPT-5, Claude Sonnet, Gemini 2.5 for free, or bring your own API key. View your server's token usage.
MCPJam contains all of the tooling to test your MCP server. Test your server's tools, resources, prompts, templates, with full JSON-RPC observability. MCPJam has all features from the original inspector and more.
We're grateful for you considering contributing to MCPJam. Please read our contributing guide.
Join our Discord community where the contributors hang out at.
Some of our partners and favorite frameworks:
This project is licensed under the Apache License 2.0 - see the LICENSE.
FAQs
MCPJam Inspector
The npm package @ramarivera/mcpjam-inspector receives a total of 8 weekly downloads. As such, @ramarivera/mcpjam-inspector popularity was classified as not popular.
We found that @ramarivera/mcpjam-inspector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.