Skip to content

Commit ee020ff

Browse files
cliffhallclaude
andcommitted
docs: settle the v1 policy wording as "security fixes only"
Reverses the direction the Copilot round took in 33cc036. That commit normalized the six v1-policy sites onto "security and bug fixes" because that was the majority wording — but majority is the wrong tiebreak here. The policy is set by what we told contributors: the #1819 backlog close note, posted to 120 closed PRs, says "v1 will receive security fixes only", and the five PRs retained for 1.0.5 are all security fixes. So the two sites that already said "security fixes only" were the correct ones, and the four that said otherwise are now aligned to them: - AGENTS.md: the `v1` label description, the branch-role table, and the v1 board line. - README.md: the "Repo status" callout. CONTRIBUTORS.md and AGENTS.md's Project Status bullet already read correctly and are unchanged. This is the substance of #1813, which is why that issue's PR is now reduced to its PR-template-link half — the wording work landed here to avoid two PRs editing the same lines in opposite directions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU
1 parent eebf9f2 commit ee020ff

3 files changed

Lines changed: 13 additions & 12 deletions

File tree

‎AGENTS.md‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ This is an application for inspecting MCP servers. Has three incarnations, Web,
55
## Project Structure
66

77
```
8-
inspector/
8+
v2/main/
99
├── clients/
1010
│ ├── web/ # Web client (Vite + React + Mantine)
1111
│ │ ├── src/ # Browser source (React app, hooks, components)
@@ -123,9 +123,9 @@ If you've already built a change locally, share the **prompt** you used and scre
123123
**Every PR must reference an issue. No exceptions, regardless of who opens it.** The PR body's first line is `Closes #<ISSUE_NUMBER>` (see the [Issue-driven Work Style](#issue-driven-work-style) rules below). A PR with no linked issue has no board card, so the work is invisible to the project board and untracked — if you're about to open one and there's no issue yet, create the issue first. This holds for a maintainer's own one-line fix as much as for a feature.
124124

125125
## Project Status and Direction
126-
* The v1/main branch currently contains the legacy version of the Inspector, which is in deprecated maintenance mode — **security and bug fixes only**, no new features. It is **published straight from the branch** to the `v1-latest` npm dist-tag — v1 releases never pass through `main`, and v1 PRs therefore target `v1/main` directly.
126+
* The v1/main branch currently contains the legacy version of the Inspector, which we are creating security fixes for in deprecated maintenance mode. It is **published straight from the branch** to the `v1-latest` npm dist-tag — v1 releases never pass through `main`, and v1 PRs therefore target `v1/main` directly.
127127

128-
* The v2/main branch currently contains the new version of the Inspector, which is actively being developed and maintained. All new features, bug fixes, and refactors should be implemented in this branch. It acts as the **develop branch**: work accumulates here continuously and is merged into `main` at milestone releases.
128+
* The v2/main branch currently contains the the new version of the Inspector, which is actively being developed and maintained. All new features, bug fixes, and refactors should be implemented in this branch. It acts as the **develop branch**: work accumulates here continuously and is merged into `main` at milestone releases.
129129

130130
* The main branch is the default branch for the repo, and it currently points to the latest v2 release. It is not a development branch, and no new features or bug fixes should be implemented here. It is only used for releases of the v2 Inspector via merge from v2/main, which is what publishes the `latest` npm dist-tag.
131131

@@ -151,7 +151,7 @@ All work should be driven by items on the project board.
151151
- Before starting work, check the board for the relevant item.
152152
- **Every board item is a real GitHub issue.** Do not create draft items (board cards with no issue number). If you find work that needs tracking, create an actual issue and add that to the board. Before creating a new issue, check the board for a matching item to avoid duplicates — **never create a duplicate**.
153153
- **Label by version — every issue and every PR, no exceptions.** Each one carries **exactly one** of `v1` or `v2` at creation. There is no unlabeled state and no "decide later": an issue with neither label belongs to no version line, appears in no version-filtered query, and is effectively invisible.
154-
- `v1` — work targeting `v1/main` (the deprecated line: security and bug fixes only)
154+
- `v1` — work targeting `v1/main` (the deprecated line: security fixes only)
155155
- `v2` — work targeting `v2/main` (active development; the default for anything new)
156156

157157
Set the label at **create time** — `gh issue create --label v2 ...`, `gh pr create --label v2 ...` — never by backfilling later, since unlabeled items are exactly the ones missed when filtering by version. **If the target version isn't obvious, it's `v2`**: v2 is where all new work goes, and `v1` is reserved for the narrow case of patching the deprecated line. Only ask when the issue is specifically a fix *for released v1 behavior* and it's unclear whether v2 still has the bug. Note the label is a repo tag and is **not** the board — see the callout above; a `v2` issue also needs a board card with a Status.
@@ -165,7 +165,7 @@ All work should be driven by items on the project board.
165165
```
166166

167167
Milestones are **release** buckets (`v2.1.0`, `v2.2.0`, …), so pick by *when the work ships*, not by size. If a new issue plainly can't make the current milestone, say so and put it in the next one rather than leaving it blank. Sub-issues normally inherit their parent's milestone — if a sub-task must ship with its parent, they belong in the same one.
168-
- When work begins, create a feature branch and set the item's Status to **In Progress**.
168+
- When work begins, create a feature branch and set the item's Status to **In Progress** (or **V2 Go Live** for a card in the go-live phases, #1804).
169169
- **Branch names start with the target version segment.** The first path segment must be the version whose base branch the PR targets — `v2/` for work on `v2/main`, `v1/` for work on `v1/main` — followed by the usual type and slug: `v2/ci/restore-claude-workflow`, `v2/fix/oauth-scope-union`, `v1/fix/proxy-ssrf-pin`. Not `ci/restore-claude-workflow`. This keeps the two lines legible in `git branch -a` and in the PR list once v1 and v2 branches coexist on the same remote, and it matches the base branches themselves (`v2/main`, `v1/main`).
170170
- When work is complete:
171171
- Run `npm run ci` from the root — the mandatory pre-push gate (see [Mandatory pre-push gate](#mandatory-pre-push-gate)). `npm run validate` is the fast inner-loop check and is **not** a substitute: it runs no coverage gate, no smokes, and no Storybook tests.
@@ -184,12 +184,12 @@ All work should be driven by items on the project board.
184184
| --- | --- | --- | --- |
185185
| `v2/main` | **Develop.** All active v2 work lands here. | **Yes** — every v2 PR | nothing directly; reaches npm via `main` |
186186
| `main` | **Release.** The repo's default branch; holds the latest released v2. Not a development branch. | **No** — it only receives milestone merges from `v2/main` | `latest` |
187-
| `v1/main` | **Maintenance.** The deprecated v1 line, security and bug fixes only, no active development. | **Yes** — every v1 PR, directly | `v1-latest`, published straight from this branch |
187+
| `v1/main` | **Maintenance.** The deprecated v1 line, security fixes only, no active development. | **Yes** — every v1 PR, directly | `v1-latest`, published straight from this branch |
188188

189189
So v2 flows `feature branch → v2/main → (milestone) main → npm latest`, while v1 is flat: `feature branch → v1/main → npm v1-latest`, with no merge into `main` at any point. The two lines are published independently under separate dist-tags, which is why a v1 fix does **not** need to be forward-ported to reach users on v1 (`npx @modelcontextprotocol/inspector@v1-latest`).
190190
- **Project Boards**:
191191
- v2 - https://github.com/orgs/modelcontextprotocol/projects/28 (active board — all new work goes here)
192-
- v1 - https://github.com/orgs/modelcontextprotocol/projects/11 (legacy inspector version, no new activity except security and bug fixes)
192+
- v1 - https://github.com/orgs/modelcontextprotocol/projects/11 (legacy inspector version, no new activity except security fixes)
193193

194194
#### V2 board (#28) `gh` recipes
195195

@@ -205,7 +205,7 @@ gh project field-list 28 --owner modelcontextprotocol --format json \
205205
| Project node ID | `PVT_kwDOCt2Azc4BJVxt` |
206206
| Status field ID | `PVTSSF_lADOCt2Azc4BJVxtzg5iI8c` |
207207

208-
Status option IDs (`--single-select-option-id`) — **last verified 2026-07-31**, when `V2 Go Live` was removed from the board along with the go-live phases it tracked. The four below are the complete current set; anything else (`V2 Go Live` `b3a6966e`, `SDK V2 + New Spec` `1bbb6f57`, `Building CLI / TUI / CORE` `4ac261ee`, `Building Web` `c28da89f`, `MCP Apps Extension` `73d0b807`) is a removed column whose id is now rejected.
208+
Status option IDs (`--single-select-option-id`) — **last verified 2026-07-27**.
209209

210210
| Status | Option ID |
211211
| --- | --- |
@@ -393,3 +393,4 @@ The dev/prod web backend protects every `/api/*` route with `x-mcp-remote-auth:
393393
3. `sessionStorage` — backstop for navigations that land without either of the above.
394394

395395
Injection is a no-op when auth is disabled (`DANGEROUSLY_OMIT_AUTH`), and the global name is the shared `INSPECTOR_API_TOKEN_GLOBAL` constant in `core/mcp/remote/constants.ts`.
396+

‎CONTRIBUTORS.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,9 @@ targets:
7373
| v1 | `v1/main` | `v1` | `v1-latest` |
7474
| v2 | `v2/main` | `v2` | `latest` |
7575

76-
- **v1** (`v1/main`) is the legacy Inspector — it takes **security and bug
77-
fixes only**, and is published straight from that branch to the `v1-latest`
78-
npm tag (`npx @modelcontextprotocol/inspector@v1-latest`).
76+
- **v1** (`v1/main`) is the legacy Inspector — it takes **security fixes
77+
only**, and is published straight from that branch to the `v1-latest` npm
78+
tag (`npx @modelcontextprotocol/inspector@v1-latest`).
7979
- **v2** (`v2/main`) is where all current work happens — when in doubt, target
8080
v2. `v2/main` is the develop branch; it is merged into `main` at milestone
8181
releases, and `main` is what publishes the `latest` npm tag. Nothing targets

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ npx @modelcontextprotocol/inspector --cli # CLI
1414
npx @modelcontextprotocol/inspector --tui # TUI
1515
```
1616

17-
> **Repo status.** This is the **v2** line of the Inspector. Active development happens on **`v2/main`** (the develop branch — all v2 PRs target it), which is merged into **`main`** at milestone releases; `main` is the default branch and holds the latest released v2, published to the npm `latest` tag. The legacy **v1** line lives on **`v1/main`** — security and bug fixes only, published straight from that branch to the npm `v1-latest` tag (`npx @modelcontextprotocol/inspector@v1-latest`). See [`AGENTS.md`](./AGENTS.md) for branch/board conventions.
17+
> **Repo status.** This is the **v2** line of the Inspector. Active development happens on **`v2/main`** (the develop branch — all v2 PRs target it), which is merged into **`main`** at milestone releases; `main` is the default branch and holds the latest released v2, published to the npm `latest` tag. The legacy **v1** line lives on **`v1/main`** — security fixes only, published straight from that branch to the npm `v1-latest` tag (`npx @modelcontextprotocol/inspector@v1-latest`). See [`AGENTS.md`](./AGENTS.md) for branch/board conventions.
1818
1919
## Project layout
2020

0 commit comments

Comments
 (0)