MCP Explorer

A web-based GUI for exploring and interacting with Model Context Protocol (MCP) servers. Connect to any MCP server, browse its capabilities, and execute tools, read resources, and test prompts — all from your browser.

Features

• Connect to any MCP server — supports both Streamable HTTP and SSE transports (auto-detects)
• Both protocol eras — speaks the stateless 2026-07-28 spec and the older initialize-handshake revisions, negotiated automatically or pinned by hand
• Authentication — OAuth 2.1 (PKCE, discovery, CIMD/DCR), Bearer token, custom header, or none
• Browse Tools — list all tools, view schemas, fill in parameters, and execute them
• Browse Resources — list and read resources, including URI templates (repo://{owner}/{name}/blob/{path}), which get a form and are expanded per RFC 6570
• Browse Prompts — list prompts, fill in arguments, and retrieve rendered output
• Parameter Store — save and reuse frequently used parameter values across sessions
• URL History — remembers previously connected server URLs
• Clean UI — minimal, responsive interface with tabbed navigation

Quick Start

Prerequisites

• Python 3.13+
• uv (recommended) or pip

Install & Run

# Clone the repo
git clone https://github.com/ventz/mcp-explorer.git
cd mcp-explorer

# Install dependencies
uv sync

# Run the server
uv run python app.py

Open http://localhost:8000 in your browser.

Using pip

pip install fastapi 'uvicorn[standard]' jinja2 'mcp>=2.0.0'
python app.py

Usage

1. Enter an MCP server URL (e.g., http://localhost:3000/mcp)
2. Optionally configure authentication (OAuth 2.1, Bearer token, or custom header)
3. Optionally pick a protocol mode — Auto suits almost everything
4. Click Connect
5. Use the tabs to explore Tools, Resources, and Prompts
6. Select an item to view its details, fill in parameters, and execute

The badge next to the status dot shows the negotiated protocol version and the transport actually in use.

OAuth 2.1

Select OAuth 2.1 as the auth type and click Connect. Nothing else is required — no token to paste, no client to pre-register. The explorer follows the MCP authorization spec end to end:

1. It calls the server, which answers 401 with a pointer to its metadata: WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"
2. It fetches that Protected Resource Metadata (RFC 9728) to learn which authorization server to trust.
3. It discovers that server's metadata, registers a client (or uses one you supplied), and builds an authorization URL with PKCE S256 and an RFC 8707 resource indicator naming the MCP server the token is for.
4. It opens the consent page in a browser pop-up.
5. You approve; the authorization server redirects back to http://localhost:8000/oauth/callback; the explorer exchanges the code for a token and finishes connecting.

[!IMPORTANT] Allow pop-ups for localhost:8000. Step 4 is a real browser navigation to your identity provider — it cannot happen inside the page. If your browser blocks the pop-up, the connection cannot complete on its own.

You are not stuck if that happens: an Open authorization page ↗ link appears in the OAuth row for as long as the grant is pending. Click it to run the same flow in a normal tab. Better, allow pop-ups once for this origin:

• Chrome / Edge — click the blocked-pop-up icon in the address bar → Always allow pop-ups and redirects from http://localhost:8000
• Firefox — Options on the yellow notification bar → Allow pop-ups for localhost
• Safari — *Safari → Settings → Websites →

... View full README on GitHub