Docker: HEALTHCHECK always reports unhealthy when the web UI is served over HTTPS (INSPECTOR_TLS_*) #2825

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

Web

Inspector version

2.13.0 (v2/main @ d7f6cee, built from source)

Node version

v22.23.4

Operating system (and browser, for the web client)

Linux (Debian), Chrome for Testing 153 (headless, via Playwright)

Transport

Not applicable / never connected

MCP server under inspection

None needed — the web UI is never connected to a server.

Steps to reproduce

1. Generate a self-signed cert: openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 1 -subj /CN=localhost -addext subjectAltName=DNS:localhost,IP:127.0.0.1
2. Start the web UI with TLS: CLIENT_PORT=7274 INSPECTOR_TLS_KEY_PATH=key.pem INSPECTOR_TLS_CERT_PATH=cert.pem mcp-inspector --web
3. curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1:7274/ → 200
4. Run the image's probe: CLIENT_PORT=7274 node scripts/docker-healthcheck.mjs; echo $?

Expected behavior

The healthcheck reports healthy (exit 0) for a container serving HTTPS, as it does for HTTP.

Actual behavior

The probe exits 1 (unhealthy). probeUrl() in scripts/docker-healthcheck.mjs always builds http://<host>:<port>/ (here http://127.0.0.1:7274/), but with both TLS paths set the server only speaks HTTPS, so every probe fails and a correctly running TLS container is reported unhealthy forever (and restarted by orchestrators that act on health).

Reproduced outside a container by running the script directly (Docker Hub was unreachable from my environment, so I could not build the image); the script is the same file the Dockerfile copies into the image.

Logs, errors, or screenshots

Suggested fix: use https: when INSPECTOR_TLS_KEY_PATH and INSPECTOR_TLS_CERT_PATH are both set, and skip certificate verification for this loopback-only probe (a self-signed or private-CA cert is the normal case). Also consider probing /healthz (#2438) rather than /, which reads and token-injects index.html on every probe.

Already prototyped a fix?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory process).