Dockerfile ENV defaults and docs/environment-variables.md can drift independently

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

All / shared core

Inspector version

2.7.0 (git tag) — static code-review finding, not run locally

Node version

N/A — static code review, no live run performed

Operating system (and browser, for the web client)

N/A — static code review

Transport

Not applicable / never connected

MCP server under inspection

N/A — this is a static code-review finding against the 2.7.0 tag source (Dockerfile, docs/environment-variables.md), not a live reproduction against a running MCP server.

Steps to reproduce

Found via static review of the 2.7.0 tag source, not a live run.

1. The Dockerfile hardcodes CLIENT_PORT=6274, MCP_SANDBOX_PORT=6275, and MCP_APP_ORIGIN_PORT=6278 as ENV defaults.
2. docs/environment-variables.md documents the same defaults separately, in prose.
3. Nothing cross-checks the two the way verify-typecheck-coverage.mjs cross-checks code against a declared invariant elsewhere in the project.

I have not changed one and observed the other going stale live; flagging the absence of an enforcement mechanism between the shipped defaults and the documented ones.

Expected behavior

A script (in the same spirit as verify-typecheck-coverage.mjs) cross-checks the Dockerfile's ENV port defaults against docs/environment-variables.md and fails CI if they diverge.

Actual behavior

Nothing currently enforces that the two stay in sync; a future change to one without the other would go unnoticed until a user hits the mismatch.

Suggested fix: add a small script (run in CI) that parses both sources and asserts the default values match.

Logs, errors, or screenshots

No response

Already prototyped a fix?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory process).

Read Dockerfile and docs/environment-variables.md first, then inspect verify-typecheck-coverage.mjs for the project's invariant-checking pattern. Trace how such checks are run in CI. Done means the current port defaults pass and CI fails when the Dockerfile and documentation values diverge.