MCP Inspector

Use this guide to connect MCP Inspector to the Calculator server you secured in the previous quickstart, and see ThunderID's scope enforcement from Inspector's seat.

What You Will Learn

• Connect MCP Inspector to the scope-protected Calculator server

• Watch a tool disappear from the tool list the moment its scope is missing from the token

Prerequisites

• About 5 minutes

• Completed Secure Your MCP Server: the Calculator server registered and runnable, thunderid.cert exported, and the Calculator Inspector application and CORS entry created

• Node.js 20+ (for MCP Inspector)

1

Run ThunderID and the Calculator Server

This guide continues directly from Secure Your MCP Server. If ThunderID and the Calculator server from that guide are not already running, start them again.

Run ThunderID with the method you chose there, then start the Calculator server from the same directory as server.py:

uv run server.py

The server listens at http://localhost:8000/mcp.

2

Connect with MCP Inspector

You already registered the Calculator Inspector application and allowed its origin in CORS in Secure Your MCP Server, so reuse both here. Launch Inspector from the same directory as server.py, reusing the exported certificate:

NODE_EXTRA_CA_CERTS=./thunderid.cert npx @modelcontextprotocol/inspector

Running this from a clone of the repository?

If you launch this command from inside a clone of the ThunderID repository (for example, from samples/apps/mcp-calculator-sample/server/), it fails with npm error code EBADDEVENGINES, because npm walks up to the repository's root package.json, which pins pnpm as the package manager. Launch Inspector from a directory outside the repository instead, and point NODE_EXTRA_CA_CERTS at the absolute path of thunderid.cert.

Inspector opens in your browser at http://localhost:6274.

1. Set Transport Type to Streamable HTTP and URL to http://localhost:8000/mcp.
2. Expand the Authentication section.
3. Under OAuth 2.0 Flow, enter the Client ID you copied earlier. Leave Client Secret empty.
4. Click Connect. A browser tab opens with ThunderID's sign-in page. Sign in with your test user.
5. Open the Tools tab and click List Tools. You see add, subtract, multiply, and divide.

Now see scope enforcement from the client's seat: click Disconnect, then in the Auth panel's Scope field, type add subtract multiply, leaving out divide, and Connect again. Sign in once more and list the tools. divide is gone, because the token Inspector requests this time never carries that scope, and the server hides any tool the token's scopes do not cover.

If the sign-in page never appears, see the "Sign-in page never appears" note in the Launch and Connect step of the server quickstart.

Success

The tools you see in Inspector are exactly the ones your token's scopes allow. Remove divide from the scope list, reconnect, and the tool vanishes from the list.

What's Next

Claude Code

Connect Claude Code to the same server using Dynamic Client Registration.

Connect Claude Code →

Build an MCP Client

Build your own MCP client that authenticates with ThunderID, instead of connecting an existing one.

Build an MCP Client →

Securing MCP

Authorization patterns for MCP servers, audience binding, and AuthZEN policy decisions.

MCP Authorization →

Example Source Code

Check out the complete Calculator MCP Sample in the ThunderID repository.