MCP Inspector’s pattern checks diverge

The [1.0.4 security release](https://github.com/modelcontextprotocol/inspector/releases/tag/1.0.4) for the deprecated v1 branch strips server‑supplied patterns before validating tool‑output and elicitation schemas, including patterns reached through `$ref`. Other constraints apply when validation runs. A value that violates a server’s pattern can therefore be accepted, with a skipped‑check note. If a schema cannot be transformed safely, such as one declaring `$id` or anchors, the result is not validated. Read that qualifier before treating the result as a contract test.

For tool‑output and app‑elicitation schemas, 2.14.0 uses a linear‑time matcher with per‑pattern and per‑schema limits. Patterns beyond those bounds are marked unverified and are not evaluated.

Both address GHSA‑2fw8‑7jmw‑r937. Skipped or unverified is not evidence of a pattern match. We did not test these implementations.

Original graphic: OpenTools Team. Pattern‑evaluation modes from the linked release notes; not a test result.