diff --git a/packages/node-modules-inspector/src/node/cli.ts b/packages/node-modules-inspector/src/node/cli.ts
index f8cfbb06..e2b4408b 100644
--- a/packages/node-modules-inspector/src/node/cli.ts
+++ b/packages/node-modules-inspector/src/node/cli.ts
@@ -118,6 +118,7 @@ cli
   .option('--host <host>', 'Host', { default: process.env.HOST || '127.0.0.1' })
   .option('--port <port>', 'Port', { default: process.env.PORT || 9999 })
   .option('--open', 'Open browser', { default: true })
+  .option('--auth', 'Require the one-time-code auth handshake before RPC calls', { default: true })
   .action(async (options) => {
     const host = options.host
     const port = await resolveDevServerPort(devframe, {
@@ -135,6 +136,10 @@ cli
         root: options.root,
         config: options.config,
         depth: Number(options.depth),
+        // Forwarded to createDevServer's own auth resolution (not consumed by
+        // devframe.setup) — `--no-auth` opts out of the interactive OTP gate
+        // for trusted automation (e.g. the e2e suite driving a headless browser).
+        auth: options.auth,
       },
       openBrowser: options.open ? url : false,
     })
diff --git a/test/e2e/utils/orchestrate.mjs b/test/e2e/utils/orchestrate.mjs
index 2ba934d1..bac3d1c6 100644
--- a/test/e2e/utils/orchestrate.mjs
+++ b/test/e2e/utils/orchestrate.mjs
@@ -144,7 +144,11 @@ async function startServers() {
   start(
     'dev',
     'node',
-    ['packages/node-modules-inspector/bin.mjs', '--port', String(PORT_DEV), '--host', '127.0.0.1', '--no-open'],
+    // `--no-auth` skips devframe's interactive OTP handshake — a headless
+    // Playwright browser can't complete the "open the printed magic link"
+    // step, and the RPC calls the SPA makes on load would otherwise be
+    // rejected as untrusted (DF0036).
+    ['packages/node-modules-inspector/bin.mjs', '--port', String(PORT_DEV), '--host', '127.0.0.1', '--no-open', '--no-auth'],
   )
   start(
     'build',