feat(core): port v1.5 InspectorClient + transports + auth subsystem (#1302) (#1306)

* wip(core): bulk-copy v1.5 InspectorClient runtime files (#1302)

Verbatim ports from origin/v1.5/main into v2/main core/:

- logging/ (2 files)
- storage/ + storage/adapters/ (4 files)
- auth/ + auth/browser/ + auth/node/ + auth/remote/ (16 files)
- mcp/config.ts + mcp/node/ (4 files, stdio transport)
- mcp/remote/ + mcp/remote/node/ (12 files, HTTP/SSE transport)
- mcp/inspectorClient.ts (~2169 LOC), messageTrackingTransport,
  fetchTracking, oauthManager, index, state/index

Total: ~7,800 LOC of source files, copied unmodified via
`git show origin/v1.5/main:<path> > <dest>`.

Also:
- Add deps: pino, hono, @hono/node-server, atomically, zustand, @types/node
- tsconfig.app.json: extend paths to resolve new node-only deps from
  core/, add "node" to types, disable erasableSyntaxOnly (v1.5 code
  uses parameter properties — TODO to re-enable in follow-up)

Compiles down to 47 type errors, all in three categories:
- 24 TS2305: v2 dropped v1.5 type exports (InspectorClientOptions,
  CreateTransport, InspectorClientEnvironment, AppRendererClient,
  SamplingCreateMessage class, ElicitationCreateMessage class,
  jsonUtils helpers, OAuth events). Per user direction, will re-add
  these to v2's diverged files (types.ts, samplingCreateMessage.ts,
  etc.) so the ported code stays verbatim.
- 15 TS7006: implicit-any params in v1.5 code (v1.5 tsconfig was
  looser than v2's noImplicitAny). Need explicit annotations.
- 8 other TS errors: ../package.json import, Transport|null narrowing,
  hono Context generic mismatch, one unused parameter.

Tests not yet ported (19 files, ~11,170 LOC).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* wip(core): integrate ported v1.5 InspectorClient + port tests (#1302)

Source integration (typecheck + build now pass):
- Re-add v1.5 types/classes dropped during v2 evolution:
  - types.ts: CreateTransport*, AppRendererClient, InspectorClient{Environment,Options}
  - samplingCreateMessage.ts / elicitationCreateMessage.ts: classes + keep v2's
    InspectorPending{Sampling,Elicitation} interface
  - inspectorClientEventTarget.ts: oauth* event keys
  - json/jsonUtils.ts: convertParameterValue / convertToolParameters /
    convertPromptArguments + ParameterSchema
- inspectorClient.ts: replace `../package.json` import (v2 has no
  core/package.json) with a hardcoded identity constant
- remote/node/server.ts: cast hono Context for streamSSE (hono's
  generic typing tightened since v1.5)
- oauth-callback-server.ts: drop unused hostname field
- tsconfig: enable @types/node, add paths for new bare-module deps
  (pino, zustand, hono, atomically) in app + test configs
- vite.config.ts: mirror those module aliases for the unit project
  (which runs from repoRoot)

Tests ported (19 files, ~11K LOC) under clients/web/src/test/core/:
- All core/__tests__/auth/* (7 files)
- inspectorClient.test.ts + 4 OAuth variants
- mcp/oauthManager.test.ts, jsonUtils.test.ts
- transport, remote-transport, remote-server-config, storage-adapters
- helpers/oauth-client-fixtures.ts
Bulk-rewrote `from "../mcp/…"` → `from "@inspector/core/mcp/…"` etc.

Current state:
- typecheck: 0 errors
- build: passes (vite v8, 788 modules)
- unit tests: 1014 / 1034 pass (937 pre-existing + 77 new core tests)
- 20 failures in 13 files; failure modes:
  - 13 file-load failures needing the v1.5 `test-servers/` package
    (@modelcontextprotocol/inspector-test-server) which isn't in v2 yet
    or real fs/network not available in happy-dom
  - 7 assertion failures in discovery.test.ts + state-machine.test.ts
    (SDK 1.29 vs 1.25 API drift — mocks don't match new shape)

Coverage gate not yet checked against new files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* wip(core): port test-servers, more types, partial test integration (#1302)

- Port v1.5 test-servers/ package (12 files, ~5K LOC) under
  repo-root/test-servers/, wire @modelcontextprotocol/inspector-test-server
  alias in both vite.config.ts (regex form) and tsconfig.test.json.
- Add deps: express ^5, yaml ^2, @types/express ^5.
- Re-export InspectorClientOptions/Environment/Transport* from inspectorClient.ts
  so v1.5 tests that import them from that module path keep resolving.
- Switch InspectorClientEventMap to use SamplingCreateMessage /
  ElicitationCreateMessage classes (matches v1.5 event payload contracts)
  while keeping the InspectorPending{Sampling,Elicitation} interfaces in
  the *.ts modules for v2 consumers that still use them.
- Fix verbatim-module-syntax issue in test-servers and drop unused stdio
  config field.
- Adjust inspectorClient.test.ts task types to TaskWithOptionalCreatedAt
  (SDK 1.29 tightened Task shape vs v1.5's 1.25).
- Drop spurious maxMessages/maxFetchRequests/maxStderrLogEvents from
  remote-transport.test.ts (never on InspectorClientOptions).

State:
- typecheck: 0 errors
- build: passes
- unit tests: 1099 / 1270 pass
- 171 failures in 10 test files, almost all integration tests that need
  real HTTP/fs/network (happy-dom can't host them). Next: add a node-env
  vitest project to run these properly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(core): port v1.5 InspectorClient + transports + auth subsystem (#1302)

Bulk-port of the v1.5 core runtime (~7,800 LOC source + ~16K LOC tests +
~5K LOC test-servers/) into v2. Files copied verbatim from origin/v1.5/main
via `git show >`; only minimal adapters added on the v2 side.

Subsystems landed
-----------------
- core/logging/, core/storage/, core/auth/ (browser + node + remote)
- core/mcp/ runtime: inspectorClient.ts (2169 LOC), oauthManager,
  messageTrackingTransport, fetchTracking, config, index
- core/mcp/node/ (stdio transport)
- core/mcp/remote/ + remote/node/ (HTTP/SSE transport + Hono server)
- test-servers/ package (composable MCP test servers, fixtures, harness)

v2 adapter layer
----------------
- types.ts: append CreateTransport*, AppRendererClient,
  InspectorClient{Environment,Options} (v2 had pruned these — v1.5 needs them)
- samplingCreateMessage / elicitationCreateMessage: keep v1.5 classes AND
  v2's Inspector Pending* interfaces in the same files
- inspectorClientEventTarget: add oauth* event keys; switch pending
  sampling/elicitation payloads to the classes (matches v1.5 contracts)
- json/jsonUtils: append convertParameterValue/convertToolParameters/
  convertPromptArguments + ParameterSchema
- inspectorClient.ts: re-export Options/Environment/Transport* so tests
  that import these from `inspectorClient.js` keep resolving; replace
  `../package.json` import with a hardcoded identity (v2 has no core/package.json)
- remote/node/server.ts: cast hono Context for streamSSE (hono generic
  tightened since v1.5)
- oauth-callback-server: drop unused hostname field
- tsconfig.app.json / tsconfig.test.json: add @types/node + paths for
  pino/zustand/hono/@hono/node-server/atomically/express/yaml, disable
  erasableSyntaxOnly (parameter-property syntax from v1.5)
- vite.config.ts: regex-form module aliases (so the package's exports
  field handles subpaths like `hono/streaming`, `zustand/middleware`),
  alias for @modelcontextprotocol/inspector-test-server → test-servers/src

Tests
-----
- 19 v1.5 test files copied under clients/web/src/test/core/,
  imports rewired to @inspector/core/* and @modelcontextprotocol/inspector-test-server
- 1004 unit tests pass; 298 storybook tests pass; coverage gate passes

Known follow-ups (out-of-scope here, tracked in TODOs)
------------------------------------------------------
- 13 integration test files are excluded from the unit project (spawn real
  HTTP/stdio servers; run real OAuth flows; mock SDK auth → happy-dom CORS).
  Needs a node-env vitest project. Files listed under `test.projects[0].test.exclude`.
- Source files exercised only by those integration tests are excluded from
  the coverage gate pending the node-env project. Listed under
  `test.coverage.exclude` with comment.
- Manual smoke tests against real stdio / HTTP / OAuth server per the AC
  on #1302 still need verification locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs/fix: address #1306 review (AGENTS tree, #1307 links, @types/node, .substr)

- AGENTS.md: expand the project-structure tree to include all v1.5-ported
  subsystems (core/auth/{browser,node,remote}, core/storage, core/logging,
  core/mcp/{node,remote/{,node}}, core/mcp/state) plus the new top-level
  test-servers/ directory (with a note about its @modelcontextprotocol/
  inspector-test-server alias).
- vite.config.ts: reference #1307 from both the test exclude block and the
  coverage exclude block so the next person editing either sees the
  marching order for shrinking the lists.
- package.json: restore @types/node to ^24 (an earlier `npm install
  --save-dev @types/node@^22` accidentally pinned it lower than the repo
  was using; nothing here required ^22).
- core/mcp/fetchTracking.ts: replace deprecated .substr(2, 9) with
  .slice(2, 11) to match the convention in core/mcp/inspectorClient.ts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-05-15 15:36:17 -04:00 • committed by GitHub
commit 0ead1deea6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -0,0 +1,507 @@
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { createMcpServer } from "./test-server-fixtures.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
import type { Request, Response } from "express";
import express from "express";
import { createServer as createHttpServer, Server as HttpServer } from "http";
import { createServer as createNetServer } from "net";
import * as crypto from "node:crypto";
import type { ServerConfig } from "./test-server-fixtures.js";
import {
setupOAuthRoutes,
createBearerTokenMiddleware,
} from "./test-server-oauth.js";
import {
setTestServerControl,
type ServerControl,
} from "./test-server-control.js";
export interface RecordedRequest {
method: string;
params?: Record<string, unknown>;
headers?: Record<string, string>;
metadata?: Record<string, string>;
response: unknown;
timestamp: number;
}
/**
* Find an available port starting from the given port
*/
async function findAvailablePort(startPort: number): Promise<number> {
return new Promise((resolve, reject) => {
const server = createNetServer();
server.listen(startPort, "127.0.0.1", () => {
const port = (server.address() as { port: number })?.port;
server.close(() => resolve(port || startPort));
});
server.on("error", (err: NodeJS.ErrnoException) => {
if (err.code === "EADDRINUSE") {
// Try next port
findAvailablePort(startPort + 1)
.then(resolve)
.catch(reject);
} else {
reject(err);
}
});
});
}
/**
* Extract headers from Express request
*/
function extractHeaders(req: Request): Record<string, string> {
const headers: Record<string, string> = {};
for (const [key, value] of Object.entries(req.headers)) {
if (typeof value === "string") {
headers[key] = value;
} else if (Array.isArray(value) && value.length > 0) {
const lastValue = value[value.length - 1];
if (typeof lastValue === "string") {
headers[key] = lastValue;
}
}
}
return headers;
}
// With this test server, your test can hold an instance and you can get the server's recorded message history at any time.
//
export class TestServerHttp {
private config: ServerConfig;
private readonly configWithCallback: ServerConfig;
private readonly serverControl: ServerControl;
private _closing = false;
private recordedRequests: RecordedRequest[] = [];
private httpServer?: HttpServer;
private transport?: StreamableHTTPServerTransport | SSEServerTransport;
private baseUrl?: string;
private currentRequestHeaders?: Record<string, string>;
private currentLogLevel: string | null = null;
/** One McpServer per connection (SSE and streamable-http both use this; SDK allows only one transport per server) */
private mcpServersBySession?: Map<string, McpServer>;
constructor(config: ServerConfig) {
this.config = config;
this.serverControl = {
isClosing: () => this._closing,
};
this.configWithCallback = {
...config,
onLogLevelSet: (level: string) => {
this.currentLogLevel = level;
},
serverControl: this.serverControl,
};
}
/**
* Set up message interception for a transport to record incoming messages
* This wraps the transport's onmessage handler to record requests/notifications
*/
private setupMessageInterception(
transport: StreamableHTTPServerTransport | SSEServerTransport,
): void {
const originalOnMessage = transport.onmessage;
transport.onmessage = async (message) => {
const timestamp = Date.now();
const method =
"method" in message && typeof message.method === "string"
? message.method
: "unknown";
const params = "params" in message ? message.params : undefined;
// Extract metadata from params if present - it's probably not worth the effort
// to type it properly here - so we'll just pry the metadata out if exists.
const metadata =
params && typeof params === "object" && "_meta" in params
? ((params as Record<string, unknown>)._meta as Record<
string,
string
>)
: undefined;
try {
// Let the server handle the message
if (originalOnMessage) {
await originalOnMessage.call(transport, message);
}
// Record successful request/notification
this.recordedRequests.push({
method,
params,
headers: { ...this.currentRequestHeaders },
metadata: metadata ? { ...metadata } : undefined,
response: { processed: true },
timestamp,
});
} catch (error) {
// Record error
this.recordedRequests.push({
method,
params,
headers: { ...this.currentRequestHeaders },
metadata: metadata ? { ...metadata } : undefined,
response: {
error: error instanceof Error ? error.message : String(error),
},
timestamp,
});
throw error;
}
};
}
/**
* Start the server using the configuration from ServerConfig
*/
async start(): Promise<number> {
setTestServerControl(this.serverControl);
const serverType = this.config.serverType ?? "streamable-http";
const requestedPort = this.config.port;
// If a port is explicitly requested, find an available port starting from that value
// Otherwise, use 0 to let the OS assign an available port
const port = requestedPort ? await findAvailablePort(requestedPort) : 0;
if (serverType === "streamable-http") {
return this.startHttp(port);
} else {
return this.startSse(port);
}
}
private async startHttp(port: number): Promise<number> {
const app = express();
app.use(express.json());
// Create HTTP server
this.httpServer = createHttpServer(app);
// Set up OAuth if enabled (BEFORE MCP routes)
if (this.config.oauth?.enabled) {
// We need baseUrl, but it's not set yet - we'll set it after server starts
setupOAuthRoutes(app, this.config.oauth);
}
// Store transports and one McpServer per session (SDK allows only one transport per server)
const transports: Map<string, StreamableHTTPServerTransport> = new Map();
this.mcpServersBySession = new Map();
// Bearer token middleware for MCP routes if requireAuth
const mcpMiddleware: express.RequestHandler[] = [];
if (this.config.oauth?.enabled && this.config.oauth.requireAuth) {
mcpMiddleware.push(createBearerTokenMiddleware(this.config.oauth));
}
// Set up Express route to handle MCP requests
app.post("/mcp", ...mcpMiddleware, async (req: Request, res: Response) => {
// If middleware already sent a response (401), don't continue
if (res.headersSent) {
return;
}
// Capture headers for this request
this.currentRequestHeaders = extractHeaders(req);
const sessionId = req.headers["mcp-session-id"] as string | undefined;
if (sessionId) {
// Existing session - use the transport for this session
const transport = transports.get(sessionId);
if (!transport) {
res.status(404).json({ error: "Session not found" });
return;
}
try {
await transport.handleRequest(req, res, req.body);
} catch (error) {
// If response already sent (e.g., by OAuth middleware), don't send another
if (!res.headersSent) {
res.status(500).json({
error: error instanceof Error ? error.message : String(error),
});
}
}
} else {
// New session - create a new transport and a new McpServer (one server per connection)
const sessionMcpServer = createMcpServer(this.configWithCallback);
const newTransport = new StreamableHTTPServerTransport({
sessionIdGenerator: () => crypto.randomUUID(),
onsessioninitialized: (sessionId: string) => {
transports.set(sessionId, newTransport);
this.mcpServersBySession!.set(sessionId, sessionMcpServer);
},
onsessionclosed: async (sessionId: string) => {
const mcp = this.mcpServersBySession?.get(sessionId);
transports.delete(sessionId);
this.mcpServersBySession?.delete(sessionId);
if (mcp) await mcp.close();
},
});
// Set up message interception for this transport
this.setupMessageInterception(newTransport);
// Connect this session's MCP server to this transport
await sessionMcpServer.connect(newTransport);
try {
await newTransport.handleRequest(req, res, req.body);
} catch (error) {
// If response already sent (e.g., by OAuth middleware), don't send another
if (!res.headersSent) {
res.status(500).json({
error: error instanceof Error ? error.message : String(error),
});
}
}
}
});
// Handle GET requests for SSE stream - this enables server-initiated messages
app.get("/mcp", ...mcpMiddleware, async (req: Request, res: Response) => {
// Get session ID from header - required for streamable-http
const sessionId = req.headers["mcp-session-id"] as string | undefined;
if (!sessionId) {
res.status(400).json({
error: "Bad Request: Mcp-Session-Id header is required",
});
return;
}
// Look up the transport for this session
const transport = transports.get(sessionId);
if (!transport) {
res.status(404).json({
error: "Session not found",
});
return;
}
// Let the transport handle the GET request
this.currentRequestHeaders = extractHeaders(req);
try {
await transport.handleRequest(req, res);
} catch (error) {
if (!res.headersSent) {
res.status(500).json({
error: error instanceof Error ? error.message : String(error),
});
}
}
});
// Start listening on localhost only to avoid macOS firewall prompts
// Use port 0 to let the OS assign an available port if no port was specified
return new Promise((resolve, reject) => {
this.httpServer!.listen(port, "127.0.0.1", () => {
const address = this.httpServer!.address();
const assignedPort =
typeof address === "object" && address !== null ? address.port : port;
this.baseUrl = `http://localhost:${assignedPort}`;
resolve(assignedPort);
});
this.httpServer!.on("error", reject);
});
}
private async startSse(port: number): Promise<number> {
const app = express();
app.use(express.json());
// Create HTTP server
this.httpServer = createHttpServer(app);
// Set up OAuth if enabled (BEFORE MCP routes)
// Note: We use port 0 to let OS assign port, so we can't know the actual port yet
// But the routes use relative paths, so they should work regardless
if (this.config.oauth?.enabled) {
// Use placeholder URL - actual baseUrl will be set after server starts
setupOAuthRoutes(app, this.config.oauth);
}
// Bearer token middleware for SSE routes if requireAuth
const sseMiddleware: express.RequestHandler[] = [];
if (this.config.oauth?.enabled && this.config.oauth.requireAuth) {
sseMiddleware.push(createBearerTokenMiddleware(this.config.oauth));
}
// One McpServer per connection (same pattern as streamable-http)
this.mcpServersBySession = new Map();
const sseTransports: Map<string, SSEServerTransport> = new Map();
// GET handler for SSE connection (establishes the SSE stream)
app.get("/sse", ...sseMiddleware, async (req: Request, res: Response) => {
this.currentRequestHeaders = extractHeaders(req);
const sessionMcpServer = createMcpServer(this.configWithCallback);
const sseTransport = new SSEServerTransport("/sse", res);
const sessionId = sseTransport.sessionId;
sseTransports.set(sessionId, sseTransport);
this.mcpServersBySession!.set(sessionId, sessionMcpServer);
// Clean up on connection close
res.on("close", async () => {
const mcp = this.mcpServersBySession?.get(sessionId);
sseTransports.delete(sessionId);
this.mcpServersBySession?.delete(sessionId);
if (mcp) await mcp.close();
});
// Intercept messages
this.setupMessageInterception(sseTransport);
// Connect this connection's MCP server to this transport
await sessionMcpServer.connect(sseTransport);
});
// POST handler for SSE message sending (SSE uses GET for stream, POST for sending messages)
app.post("/sse", ...sseMiddleware, async (req: Request, res: Response) => {
this.currentRequestHeaders = extractHeaders(req);
const sessionId = req.query.sessionId as string | undefined;
if (!sessionId) {
res.status(400).json({ error: "Missing sessionId query parameter" });
return;
}
const transport = sseTransports.get(sessionId);
if (!transport) {
res.status(404).json({ error: "No transport found for sessionId" });
return;
}
try {
await transport.handlePostMessage(req, res, req.body);
} catch (error) {
const errorMessage =
error instanceof Error ? error.message : String(error);
res.status(500).json({
error: errorMessage,
});
}
});
// Start listening on localhost only to avoid macOS firewall prompts
// Use port 0 to let the OS assign an available port if no port was specified
return new Promise((resolve, reject) => {
this.httpServer!.listen(port, "127.0.0.1", () => {
const address = this.httpServer!.address();
const assignedPort =
typeof address === "object" && address !== null ? address.port : port;
this.baseUrl = `http://localhost:${assignedPort}`;
resolve(assignedPort);
});
this.httpServer!.on("error", reject);
});
}
/**
* Stop the server. Set closing before closing transport so in-flight tools can skip sending.
*/
async stop(): Promise<void> {
this._closing = true;
// Close all per-connection McpServers (SSE and streamable-http both use the map)
if (this.mcpServersBySession) {
for (const mcp of this.mcpServersBySession.values()) {
await mcp.close();
}
this.mcpServersBySession.clear();
this.mcpServersBySession = undefined;
}
if (this.transport) {
await this.transport.close();
this.transport = undefined;
}
if (this.httpServer) {
return new Promise((resolve) => {
// Force close all connections
this.httpServer!.closeAllConnections?.();
this.httpServer!.close(() => {
this.httpServer = undefined;
setTestServerControl(null);
resolve();
});
});
} else {
setTestServerControl(null);
}
}
/**
* Get all recorded requests
*/
getRecordedRequests(): RecordedRequest[] {
return [...this.recordedRequests];
}
/**
* Clear recorded requests
*/
clearRecordings(): void {
this.recordedRequests = [];
}
/**
* Wait until a recorded request matches the predicate, or reject after timeout.
* Use instead of polling getRecordedRequests() with manual delays.
*/
waitUntilRecorded(
predicate: (req: RecordedRequest) => boolean,
options?: { timeout?: number; interval?: number },
): Promise<RecordedRequest> {
const { timeout = 5000, interval = 10 } = options ?? {};
const start = Date.now();
return new Promise<RecordedRequest>((resolve, reject) => {
const check = () => {
const req = this.getRecordedRequests().find(predicate);
if (req) {
resolve(req);
return;
}
if (Date.now() - start >= timeout) {
reject(
new Error(
`Timeout (${timeout}ms) waiting for recorded request matching predicate`,
),
);
return;
}
setTimeout(check, interval);
};
check();
});
}
/**
* Get the server URL with the appropriate endpoint path
*/
get url(): string {
if (!this.baseUrl) {
throw new Error("Server not started");
}
const serverType = this.config.serverType ?? "streamable-http";
const endpoint = serverType === "sse" ? "/sse" : "/mcp";
return `${this.baseUrl}${endpoint}`;
}
/**
* Get the most recent log level that was set
*/
getCurrentLogLevel(): string | null {
return this.currentLogLevel;
}
}
/**
* Create an HTTP/SSE MCP test server
*/
export function createTestServerHttp(config: ServerConfig): TestServerHttp {
return new TestServerHttp(config);
}