From 8d56836c0020d9211edd40bdebb6126c6dd64a7c Mon Sep 17 00:00:00 2001
From: Hugo Richard <hugo.richard@vercel.com>
Date: Tue, 19 May 2026 09:23:53 +0100
Subject: [PATCH] fix(module): add shell:true for npx spawn on Windows

---
 .changeset/inspector-windows-spawn.md                 | 11 +++++++++++
 .../src/runtime/server/mcp/devtools/index.ts          |  1 +
 2 files changed, 12 insertions(+)
 create mode 100644 .changeset/inspector-windows-spawn.md

diff --git a/.changeset/inspector-windows-spawn.md b/.changeset/inspector-windows-spawn.md
new file mode 100644
index 0000000..6f11972
--- /dev/null
+++ b/.changeset/inspector-windows-spawn.md
@@ -0,0 +1,11 @@
+---
+"@nuxtjs/mcp-toolkit": patch
+---
+
+Fix "spawn npx ENOENT" error when launching the MCP Inspector on Windows.
+
+Since the Node.js CVE-2024-27980 mitigation (Node 18.20.2 / 20.12.2), `child_process.spawn` no longer resolves `.cmd`/`.bat` shims on Windows without `shell: true`. This caused the DevTools "Launch Inspector" button to throw `ENOENT` on every Windows machine.
+
+`shell: true` is now passed only when `process.platform === 'win32'`, leaving the default behaviour unchanged on Linux and macOS.
+
+Closes #259.
diff --git a/packages/nuxt-mcp-toolkit/src/runtime/server/mcp/devtools/index.ts b/packages/nuxt-mcp-toolkit/src/runtime/server/mcp/devtools/index.ts
index 2b00b70..e247501 100644
--- a/packages/nuxt-mcp-toolkit/src/runtime/server/mcp/devtools/index.ts
+++ b/packages/nuxt-mcp-toolkit/src/runtime/server/mcp/devtools/index.ts
@@ -193,6 +193,7 @@ async function launchMcpInspector(nuxt: Nuxt, options: ModuleOptions): Promise<v
     ], {
       stdio: ['ignore', 'pipe', 'pipe'],
       env,
+      shell: globalThis.process.platform === 'win32',
     })
 
     const childProcess = inspectorProcess