MCP Inspector 2.5.0 revokes OAuth tokens when you clear them, and stops retrying a subscription that was never acknowledged

The official MCP Inspector released 2.5.0 on 2026-09-02, continuing the authorization work of its recent releases.

The headline change is that clearing OAuth credentials now revokes them. Previously clearing tokens discarded them locally, which leaves a live token sitting at the authorization server until it expires on its own; 2.5.0 sends an RFC 7009 revocation request instead. Alongside it, the client now accepts RFC 8414 authorization-server metadata when it is served at the OpenID Connect well-known path, which is where a good number of identity providers put it.

Two transport fixes are worth noting for anyone using Inspector to debug a server. A Streamable HTTP call is now cancelled by closing its stream, which is the mechanism the transport actually provides. And a subscriptions/listen stream that the server never acknowledges now reports why it ended rather than retrying eight times, which is a diagnostic improvement against exactly the class of host behavior that has produced interop trouble elsewhere: the Ruby SDK's 1.4.0 shipped an opt-out for hosts that cannot hold such a stream open, five days before this release.

The rest of the release is refactoring and test work, including a large decomposition of the web app's root component and a move of the repository's agent recipes into skills. No security advisories accompany the release.