MCP Inspector exempts localhost, 127.0.0.1 and [::1] from its CIMD metadata HTTPS requirement

GitHub·low signalXBlueskyLinkedInCopy link

PR #2326, merged 2026-09-11, fixes config validation that rejected every non-HTTPS CIMD client metadata URL with no loopback exemption, a check that also ran against `client.json` on disk so it could not be edited around. Because every test server in the repo speaks plain HTTP, reproducing CIMD by hand required standing up a self-signed HTTPS listener with `NODE_TLS_REJECT_UNAUTHORIZED=0`. The exemption is exactly the three literals the SDK itself exempts; `localhost.` and `tenant.app.localhost` are still rejected, with a test pinning that.