Apps sandbox proxy omitted from package

[paulswithers]

Describe the bug
I started MCP Inspector via `npx @modelcontextprotocol/inspector. I tried connecting to an MCP server, going to the Apps tab, and opening an app, but it threw this error.

To Reproduce
Steps to reproduce the behavior:

1. Clear cache and run npx @modelcontextprotocol/inspector
2. Connect to an MCP server that has an MCP App
3. Go to the Apps tab
4. Click on the MCP App in the left-hand navigation and select "open" from the dropdown and click "Open App"
5. The "Sandbox not loaded" error occurs

Expected behavior
The app should display when selecting "open" and clicking "Open App".
I was able to resolve the problem by:

1. Going to the git repo and went to clients/web/static/sandbox_proxy.html
2. Copying the raw contents
3. Going to my _npx directory and the cached node_modules/@modelcontextprotocol/inspector/clients/web folder
4. Creating a subdirectory "static"
5. Creating a file sandbox_proxy.html and pasting in the raw contents from the git repo
6. Restarting npx @modelcontextprotocol/inspector

Additional context
Clearing the npx cache didn't solve it. I cross-referenced with NPM site and there's no "static" folder in @modelcontextprotocol/inspector/clients/web. I'm not sure if this is a CI/CD issue that's just not adding the static contents to NPM.

[cliffhall]

Triage: Priority = High

Scored 11/16 with the priority rubric added to AGENTS.md in #1891, as part of the backlog triage in #1872. Added to project board #28 with Status Incoming — meaning filed and scored but not yet approved for work. A maintainer decides whether it moves to Todo.

Axis	Score	Reasoning
Severity / impact	4/5	sandbox_proxy.html isn't where the installed package looks for it, so the Apps tab fails closed for anyone running via npx. The whole MCP Apps surface is unreachable.
Urgency / staleness	5/5	A packaging defect in the published artifact, hitting users now.
Signal bonuses	+2	bug label (+1), high engagement (4 reactions) (+1)
Total	11	Lands in the High band (9-11).

Related issues. One connected issue:

• Allow configuring the advertised MCP Apps sandbox URL #1862 — the other sandbox-path issue — configuring the advertised sandbox URL

Worth a second look. The v1 analogue (#1082, closed under the deprecation sweep) was the same ENOENT against the old server/static path, which suggests the packaging invariant has broken twice in two different layouts and may deserve a pack:verify assertion rather than another one-off fix.

Scores are a starting point, not a verdict — the rubric is meant to be overruled when it's plainly wrong, provided the reason is written down.

[Brl23]

This issue was addressed already in v1 with #1113. I've confirmed locally that making similar changes addresses the issue in v2. I would raise a PR, but I'm not allowed because I'm not a robot.

[cliffhall]

Verified. Will fix in 2.2.0 or sooner.