# Release

Cut an Inspector v2 release, two PRs and then a GitHub Release.

- Repository: https://github.com/modelcontextprotocol/inspector (11208 stars)
- Category: Git and review
- License: see repository
- Last updated: 2026-10-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add modelcontextprotocol/inspector --skill release -g -a claude-code -y`
Codex: `npx skills add modelcontextprotocol/inspector --skill release -g -a codex -y`
Cursor: `npx skills add modelcontextprotocol/inspector --skill release -g -a cursor -y`
Gemini CLI: `npx skills add modelcontextprotocol/inspector --skill release -g -a gemini-cli -y`

## Description

Cut an Inspector v2 release, two PRs and then a GitHub Release. PR 1 puts the npm audit, any fixes it forces, and the version bump on v2/main; PR 2 merges v2/main into main and is smoke-tested from the production build with a ledger artifact for the maintainers; the maintainer then drafts the Release with a script and publishes it. Also covers the v1 line and what the publish jobs gate on.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Cutting a release

Background on what ships and why (the `files` allowlist, the bundling rules, the
container image) is in [`docs/publishing.md`](../../../docs/publishing.md). This
skill is the procedure.

A v2 release is cut from **`main`**, after the milestone's work has been merged
there from `v2/main`, not from `v2/main` itself. The v1 line releases
independently from `v1/main` to the `v1-latest` tag and never touches `main`.

Publishing is automated by release-gated jobs in
`.github/workflows/main.yml` (`github.event_name == 'release'`), all downstream
of `needs: [build, coverage]`, so a release cannot publish with either the build
job or the coverage gate red:

- **`package`**, asserts the release tag matches the root `package.json`
  version, installs, runs `npm run pack:verify` as the pre-publish gate, then
  `npm pack`s the tarball and uploads it as an artifact. It holds **no**
  `id-token`.
- **`publish`**, `needs: [package]`; holds `id-token: write` and only downloads
  that tarball and runs `npm publish <tgz> --access public --provenance`. No
  checkout, no dependency install, no build, the split keeps install scripts
  away from the OIDC publish token (#2483).
- **`publish-github-container-registry`**, the GHCR image.

## The shape: two PRs, then the Release

There is **one version number** (only the root `package.json` has one, the
clients carry none), and the release moves through **two pull requests** in
order. They are not interchangeable and neither one's content belongs on the
other.

The rest: https://github.com/modelcontextprotocol/inspector/blob/HEAD/.claude/skills/release/SKILL.md