MCP Inspector 2.4.0 renders elicitation forms inside MCP Apps and adds a keychain-free secret store

MCP Inspector 2.4.0 shipped on 2026-08-26, six days after 2.3.0. The most protocol-visible change is negotiated app-rendered form elicitations (PR #2083): when a server raises an elicitation while an MCP App is active and both sides support it, the form renders inside the app's own UI instead of the Inspector's generic dialog. Related fixes in the same release read MCP App UI resource metadata from _meta.ui and honor _meta.ui.domain with a dedicated app origin.

Credential handling gets a storage answer for headless and minimal environments: a SecretStore abstraction with file-backed and in-memory backends for hosts that have no OS keychain (PR #2076), with a real cross-process lock on the secrets file (PR #2088). On the OAuth side, the refresh_token grant becomes opt-out per server (PR #2114), the requested scope persists when a token response omits it (PR #2118), and the fallback authorization-server URL keeps the server's path instead of resetting to the domain root (PR #2136).

Two smaller changes serve interoperability directly: all three Inspector clients now flag tool schemas that will not port across clients (PR #2121), and request _meta accepts complex JSON values rather than flat strings (PR #2094). The release also pins esbuild past GHSA-g7r4-m6w7-qqqr in the web, CLI, and TUI packages; no advisory was published against the Inspector itself in this window.