From dd0985cb11d3a1449d2658efa4e8cb17cbd4abeb Mon Sep 17 00:00:00 2001
From: Edison-A-N <Edison.A.N@hotmail.com>
Date: Sun, 2 Nov 2025 11:39:35 +0800
Subject: [PATCH 01/37] fix: enhance  resolution and enum handling in anyOf
 schemas

---
 client/src/utils/schemaUtils.ts | 92 +++++++++++++++++----------------
 1 file changed, 48 insertions(+), 44 deletions(-)

diff --git a/client/src/utils/schemaUtils.ts b/client/src/utils/schemaUtils.ts
index 36587021..d1ed1e96 100644
--- a/client/src/utils/schemaUtils.ts
+++ b/client/src/utils/schemaUtils.ts
@@ -149,20 +149,46 @@ export function isPropertyRequired(
  * Resolves $ref references in JSON schema
  * @param schema The schema that may contain $ref
  * @param rootSchema The root schema to resolve references against
+ * @param visitedRefs Optional set of visited $ref paths to detect circular references
  * @returns The resolved schema without $ref
  */
 export function resolveRef(
   schema: JsonSchemaType,
   rootSchema: JsonSchemaType,
+  visitedRefs: Set<string> = new Set(),
 ): JsonSchemaType {
+  if (!schema) return schema;
+
   if (!("$ref" in schema) || !schema.$ref) {
+    // Recursively resolve $ref in anyOf (and other nested structures)
+    if (schema.anyOf && Array.isArray(schema.anyOf)) {
+      const resolvedAnyOf = schema.anyOf.map((item) => {
+        if (typeof item === "object" && item !== null) {
+          return resolveRef(item, rootSchema, visitedRefs);
+        }
+        return item;
+      });
+      return {
+        ...schema,
+        anyOf: resolvedAnyOf,
+      };
+    }
     return schema;
   }
 
   const ref = schema.$ref;
 
-  // Handle simple #/properties/name references
+  // Handle all #/ formats (#/properties/, #/$defs/, etc.)
   if (ref.startsWith("#/")) {
+    // Check for circular reference
+    if (visitedRefs.has(ref)) {
+      console.warn(`Circular reference detected: ${ref}`);
+      return schema;
+    }
+
+    // Add current ref to visited set
+    visitedRefs.add(ref);
+
     const path = ref.substring(2).split("/");
     let current: unknown = rootSchema;
 
@@ -176,12 +202,16 @@ export function resolveRef(
         current = (current as Record<string, unknown>)[segment];
       } else {
         // If reference cannot be resolved, return the original schema
+        visitedRefs.delete(ref); // Clean up on failure
         console.warn(`Could not resolve $ref: ${ref}`);
         return schema;
       }
     }
 
-    return current as JsonSchemaType;
+    const resolved = current as JsonSchemaType;
+
+    // Recursively resolve nested structures (anyOf, oneOf, items, properties)
+    return resolveRef(resolved, rootSchema, visitedRefs);
   }
 
   // For other types of references, return the original schema
@@ -195,54 +225,28 @@ export function resolveRef(
  * @returns A normalized schema or the original schema
  */
 export function normalizeUnionType(schema: JsonSchemaType): JsonSchemaType {
-  // Handle anyOf with exactly string and null (FastMCP pattern)
+  // Handle anyOf with exactly 2 items (type and null) - unified handling
+  // Preserves enum and other properties automatically
   if (
     schema.anyOf &&
     schema.anyOf.length === 2 &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "string") &&
     schema.anyOf.some((t) => (t as JsonSchemaType).type === "null")
   ) {
-    return { ...schema, type: "string", anyOf: undefined, nullable: true };
-  }
+    const nonNullItem = schema.anyOf.find((t) => {
+      const item = t as JsonSchemaType;
+      return item?.type !== "null";
+    }) as JsonSchemaType;
 
-  // Handle anyOf with exactly boolean and null (FastMCP pattern)
-  if (
-    schema.anyOf &&
-    schema.anyOf.length === 2 &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "boolean") &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "null")
-  ) {
-    return { ...schema, type: "boolean", anyOf: undefined, nullable: true };
-  }
-
-  // Handle anyOf with exactly number and null (FastMCP pattern)
-  if (
-    schema.anyOf &&
-    schema.anyOf.length === 2 &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "number") &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "null")
-  ) {
-    return { ...schema, type: "number", anyOf: undefined, nullable: true };
-  }
-
-  // Handle anyOf with exactly integer and null (FastMCP pattern)
-  if (
-    schema.anyOf &&
-    schema.anyOf.length === 2 &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "integer") &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "null")
-  ) {
-    return { ...schema, type: "integer", anyOf: undefined, nullable: true };
-  }
-
-  // Handle anyOf with exactly array and null (FastMCP pattern)
-  if (
-    schema.anyOf &&
-    schema.anyOf.length === 2 &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "array") &&
-    schema.anyOf.some((t) => (t as JsonSchemaType).type === "null")
-  ) {
-    return { ...schema, type: "array", anyOf: undefined, nullable: true };
+    // Only process if non-null item has type or enum
+    if (nonNullItem?.type || nonNullItem?.enum) {
+      return {
+        ...schema,
+        ...nonNullItem,
+        type: nonNullItem?.type || (nonNullItem?.enum ? "string" : undefined),
+        nullable: true,
+        anyOf: undefined,
+      };
+    }
   }
 
   // Handle array type with exactly string and null

From 3549220acc8ba301c87bb4d7085b08c25059aaca Mon Sep 17 00:00:00 2001
From: olaservo <olahungerford@gmail.com>
Date: Sun, 25 Jan 2026 06:09:08 -0700
Subject: [PATCH 02/37] feat(client): display tool annotation badges in Tools
 tab

Add visual badges to show tool annotations (readOnlyHint, destructiveHint,
idempotentHint, openWorldHint) when a tool is selected. Badges appear below
the tool description with color-coded styling:
- Read-only: blue
- Destructive: red
- Idempotent: gray outline
- Open-world: purple

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 client/src/components/ToolsTab.tsx | 61 ++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index d872e629..19d8fa0c 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -24,6 +24,7 @@ import {
   CompatibilityCallToolResult,
   ListToolsResult,
   Tool,
+  ToolAnnotations,
 } from "@modelcontextprotocol/sdk/types.js";
 import {
   Loader2,
@@ -56,6 +57,63 @@ import {
 const hasMeta = (tool: Tool): tool is Tool & { _meta: unknown } =>
   typeof (tool as { _meta?: unknown })._meta !== "undefined";
 
+// Type guard to safely detect the optional annotations field
+const hasAnnotations = (
+  tool: Tool,
+): tool is Tool & { annotations: ToolAnnotations } =>
+  typeof (tool as { annotations?: unknown }).annotations !== "undefined" &&
+  (tool as { annotations?: unknown }).annotations !== null;
+
+// Helper to render annotation badges
+const AnnotationBadges = ({
+  annotations,
+}: {
+  annotations: ToolAnnotations;
+}) => {
+  const badges: {
+    label: string;
+    variant: "default" | "destructive" | "secondary" | "outline";
+  }[] = [];
+
+  if (annotations.readOnlyHint === true) {
+    badges.push({ label: "Read-only", variant: "secondary" });
+  }
+  if (annotations.destructiveHint === true) {
+    badges.push({ label: "Destructive", variant: "destructive" });
+  }
+  if (annotations.idempotentHint === true) {
+    badges.push({ label: "Idempotent", variant: "outline" });
+  }
+  if (annotations.openWorldHint === true) {
+    badges.push({ label: "Open-world", variant: "default" });
+  }
+
+  if (badges.length === 0) return null;
+
+  return (
+    <div className="flex flex-wrap gap-1 mt-2">
+      {badges.map(({ label, variant }) => (
+        <span
+          key={label}
+          className={cn(
+            "inline-flex items-center px-2 py-0.5 rounded text-xs font-medium",
+            variant === "destructive" &&
+              "bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200",
+            variant === "secondary" &&
+              "bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-200",
+            variant === "outline" &&
+              "bg-gray-100 text-gray-800 dark:bg-gray-700 dark:text-gray-200 border border-gray-300 dark:border-gray-600",
+            variant === "default" &&
+              "bg-purple-100 text-purple-800 dark:bg-purple-900 dark:text-purple-200",
+          )}
+        >
+          {label}
+        </span>
+      ))}
+    </div>
+  );
+};
+
 const ToolsTab = ({
   tools,
   listTools,
@@ -213,6 +271,9 @@ const ToolsTab = ({
                 <p className="text-sm text-gray-600 dark:text-gray-400 whitespace-pre-wrap max-h-48 overflow-y-auto">
                   {selectedTool.description}
                 </p>
+                {hasAnnotations(selectedTool) && (
+                  <AnnotationBadges annotations={selectedTool.annotations} />
+                )}
                 {Object.entries(selectedTool.inputSchema.properties ?? []).map(
                   ([key, value]) => {
                     // First resolve any $ref references

From dad17c6cc246fddf6d3fb8578f5088e57b930e58 Mon Sep 17 00:00:00 2001
From: olaservo <olahungerford@gmail.com>
Date: Sun, 25 Jan 2026 06:57:56 -0700
Subject: [PATCH 03/37] feat(client): show all tool annotations with
 explicit/implied states
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Display all 4 tool annotation badges (Read-only, Destructive, Idempotent,
Open-world) for every tool, showing:
- ✓/✗ prefix to indicate true/false value
- Green badge for true, gray for false
- Solid border for explicitly set values
- Dashed border + dimmed for implied defaults
- Tooltip explaining if value is explicit or implied

Follows MCP spec defaults:
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 client/src/components/ToolsTab.tsx | 88 +++++++++++++++++++-----------
 1 file changed, 56 insertions(+), 32 deletions(-)

diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index 19d8fa0c..659e3180 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -65,49 +65,69 @@ const hasAnnotations = (
   (tool as { annotations?: unknown }).annotations !== null;
 
 // Helper to render annotation badges
+// Shows all 4 annotation values with their state (true/false/implied default)
 const AnnotationBadges = ({
   annotations,
 }: {
-  annotations: ToolAnnotations;
+  annotations: ToolAnnotations | undefined;
 }) => {
-  const badges: {
-    label: string;
-    variant: "default" | "destructive" | "secondary" | "outline";
-  }[] = [];
+  // Spec defaults: readOnlyHint=false, destructiveHint=true, idempotentHint=false, openWorldHint=true
+  const getValueAndImplied = (
+    value: boolean | undefined,
+    defaultValue: boolean,
+  ): { value: boolean; implied: boolean } => ({
+    value: value ?? defaultValue,
+    implied: value === undefined,
+  });
 
-  if (annotations.readOnlyHint === true) {
-    badges.push({ label: "Read-only", variant: "secondary" });
-  }
-  if (annotations.destructiveHint === true) {
-    badges.push({ label: "Destructive", variant: "destructive" });
-  }
-  if (annotations.idempotentHint === true) {
-    badges.push({ label: "Idempotent", variant: "outline" });
-  }
-  if (annotations.openWorldHint === true) {
-    badges.push({ label: "Open-world", variant: "default" });
-  }
+  const readOnly = getValueAndImplied(annotations?.readOnlyHint, false);
+  const destructive = getValueAndImplied(annotations?.destructiveHint, true);
+  const idempotent = getValueAndImplied(annotations?.idempotentHint, false);
+  const openWorld = getValueAndImplied(annotations?.openWorldHint, true);
 
-  if (badges.length === 0) return null;
+  const badges = [
+    {
+      label: "Read-only",
+      value: readOnly.value,
+      implied: readOnly.implied,
+    },
+    {
+      label: "Destructive",
+      value: destructive.value,
+      implied: destructive.implied,
+    },
+    {
+      label: "Idempotent",
+      value: idempotent.value,
+      implied: idempotent.implied,
+    },
+    {
+      label: "Open-world",
+      value: openWorld.value,
+      implied: openWorld.implied,
+    },
+  ];
 
   return (
     <div className="flex flex-wrap gap-1 mt-2">
-      {badges.map(({ label, variant }) => (
+      {badges.map(({ label, value, implied }) => (
         <span
           key={label}
+          title={
+            implied
+              ? `${value ? "Yes" : "No"} (implied default)`
+              : `${value ? "Yes" : "No"} (explicitly set)`
+          }
           className={cn(
-            "inline-flex items-center px-2 py-0.5 rounded text-xs font-medium",
-            variant === "destructive" &&
-              "bg-red-100 text-red-800 dark:bg-red-900 dark:text-red-200",
-            variant === "secondary" &&
-              "bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-200",
-            variant === "outline" &&
-              "bg-gray-100 text-gray-800 dark:bg-gray-700 dark:text-gray-200 border border-gray-300 dark:border-gray-600",
-            variant === "default" &&
-              "bg-purple-100 text-purple-800 dark:bg-purple-900 dark:text-purple-200",
+            "inline-flex items-center px-2 py-0.5 rounded text-xs font-medium border",
+            implied && "border-dashed opacity-60",
+            !implied && "border-solid",
+            value
+              ? "bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200 border-green-300 dark:border-green-700"
+              : "bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400 border-gray-300 dark:border-gray-600",
           )}
         >
-          {label}
+          {value ? "✓" : "✗"} {label}
         </span>
       ))}
     </div>
@@ -271,9 +291,13 @@ const ToolsTab = ({
                 <p className="text-sm text-gray-600 dark:text-gray-400 whitespace-pre-wrap max-h-48 overflow-y-auto">
                   {selectedTool.description}
                 </p>
-                {hasAnnotations(selectedTool) && (
-                  <AnnotationBadges annotations={selectedTool.annotations} />
-                )}
+                <AnnotationBadges
+                  annotations={
+                    hasAnnotations(selectedTool)
+                      ? selectedTool.annotations
+                      : undefined
+                  }
+                />
                 {Object.entries(selectedTool.inputSchema.properties ?? []).map(
                   ([key, value]) => {
                     // First resolve any $ref references

From 1cadda06c04bf33559ca5662eda8b5ed745dd65f Mon Sep 17 00:00:00 2001
From: olaservo <olahungerford@gmail.com>
Date: Sun, 25 Jan 2026 07:03:21 -0700
Subject: [PATCH 04/37] feat(client): add MCP spec descriptions to annotation
 tooltips

Enhance tooltips to include descriptions from the MCP specification:
- Read-only: Tool does not modify its environment
- Destructive: Tool may perform destructive updates (delete/overwrite data)
- Idempotent: Calling repeatedly with same args has no additional effect
- Open-world: Tool may interact with external entities beyond its local environment

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 client/src/components/ToolsTab.tsx | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index 659e3180..2128d599 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -85,39 +85,42 @@ const AnnotationBadges = ({
   const idempotent = getValueAndImplied(annotations?.idempotentHint, false);
   const openWorld = getValueAndImplied(annotations?.openWorldHint, true);
 
+  // Descriptions from MCP spec
   const badges = [
     {
       label: "Read-only",
       value: readOnly.value,
       implied: readOnly.implied,
+      description: "Tool does not modify its environment",
     },
     {
       label: "Destructive",
       value: destructive.value,
       implied: destructive.implied,
+      description:
+        "Tool may perform destructive updates (delete/overwrite data)",
     },
     {
       label: "Idempotent",
       value: idempotent.value,
       implied: idempotent.implied,
+      description: "Calling repeatedly with same args has no additional effect",
     },
     {
       label: "Open-world",
       value: openWorld.value,
       implied: openWorld.implied,
+      description:
+        "Tool may interact with external entities beyond its local environment",
     },
   ];
 
   return (
     <div className="flex flex-wrap gap-1 mt-2">
-      {badges.map(({ label, value, implied }) => (
+      {badges.map(({ label, value, implied, description }) => (
         <span
           key={label}
-          title={
-            implied
-              ? `${value ? "Yes" : "No"} (implied default)`
-              : `${value ? "Yes" : "No"} (explicitly set)`
-          }
+          title={`${description}\n\nValue: ${value ? "Yes" : "No"} (${implied ? "implied default" : "explicitly set"})`}
           className={cn(
             "inline-flex items-center px-2 py-0.5 rounded text-xs font-medium border",
             implied && "border-dashed opacity-60",

From d73fb1c30f4fe35873e9d706005a29944853e5dd Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 12:36:30 +0000
Subject: [PATCH 05/37] fix: display tool title field in Inspector UI

Display the MCP tool 'title' field when present in the Inspector UI, with fallback to 'name' when not present. This aligns with the MCP specification where 'title' is the human-friendly display name and 'name' is the programmatic identifier.

Changes:
- Updated tool list rendering to display tool.title || tool.name
- Updated tool details header to display selectedTool.title || selectedTool.name

Fixes #1053

Co-authored-by: Ola Hungerford <olaservo@users.noreply.github.com>
---
 client/src/components/ToolsTab.tsx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index 9e1b5d56..c581e98a 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -173,7 +173,7 @@ const ToolsTab = ({
                 <IconDisplay icons={(tool as WithIcons).icons} size="sm" />
               </div>
               <div className="flex flex-col flex-1 min-w-0">
-                <span className="truncate">{tool.name}</span>
+                <span className="truncate">{tool.title || tool.name}</span>
                 <span className="text-sm text-gray-500 text-left line-clamp-2">
                   {tool.description}
                 </span>
@@ -196,7 +196,9 @@ const ToolsTab = ({
                 />
               )}
               <h3 className="font-semibold">
-                {selectedTool ? selectedTool.name : "Select a tool"}
+                {selectedTool
+                  ? selectedTool.title || selectedTool.name
+                  : "Select a tool"}
               </h3>
             </div>
           </div>

From 919590eb569d139d31f66464dd5a12cd97b94efe Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 12:37:55 +0000
Subject: [PATCH 06/37] fix: include LICENSE file in published npm packages

Add LICENSE file to each workspace (cli, client, server) and update
their package.json files to include LICENSE in the published packages.

Fixes #1036

Co-authored-by: Ola Hungerford <olaservo@users.noreply.github.com>
---
 cli/LICENSE         | 216 ++++++++++++++++++++++++++++++++++++++++++++
 cli/package.json    |   3 +-
 client/LICENSE      | 216 ++++++++++++++++++++++++++++++++++++++++++++
 client/package.json |   3 +-
 server/LICENSE      | 216 ++++++++++++++++++++++++++++++++++++++++++++
 server/package.json |   3 +-
 6 files changed, 654 insertions(+), 3 deletions(-)
 create mode 100644 cli/LICENSE
 create mode 100644 client/LICENSE
 create mode 100644 server/LICENSE

diff --git a/cli/LICENSE b/cli/LICENSE
new file mode 100644
index 00000000..4a939857
--- /dev/null
+++ b/cli/LICENSE
@@ -0,0 +1,216 @@
+The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
+
+Contributions for which relicensing consent has been obtained are licensed under Apache-2.0. Contributions made by authors who originally licensed their work under the MIT License and who have not yet granted explicit permission to relicense remain licensed under the MIT License.
+
+No rights beyond those granted by the applicable original license are conveyed for such contributions.
+
+---
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright
+      owner or by an individual or Legal Entity authorized to submit on behalf
+      of the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+---
+
+MIT License
+
+Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+Creative Commons Attribution 4.0 International (CC-BY-4.0)
+
+Documentation in this project (excluding specifications) is licensed under
+CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
+the full license text.
diff --git a/cli/package.json b/cli/package.json
index ce521bee..e45c72a4 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -12,7 +12,8 @@
     "mcp-inspector-cli": "build/cli.js"
   },
   "files": [
-    "build"
+    "build",
+    "LICENSE"
   ],
   "scripts": {
     "build": "tsc",
diff --git a/client/LICENSE b/client/LICENSE
new file mode 100644
index 00000000..4a939857
--- /dev/null
+++ b/client/LICENSE
@@ -0,0 +1,216 @@
+The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
+
+Contributions for which relicensing consent has been obtained are licensed under Apache-2.0. Contributions made by authors who originally licensed their work under the MIT License and who have not yet granted explicit permission to relicense remain licensed under the MIT License.
+
+No rights beyond those granted by the applicable original license are conveyed for such contributions.
+
+---
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright
+      owner or by an individual or Legal Entity authorized to submit on behalf
+      of the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+---
+
+MIT License
+
+Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+Creative Commons Attribution 4.0 International (CC-BY-4.0)
+
+Documentation in this project (excluding specifications) is licensed under
+CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
+the full license text.
diff --git a/client/package.json b/client/package.json
index 1feec212..c5b10133 100644
--- a/client/package.json
+++ b/client/package.json
@@ -12,7 +12,8 @@
   },
   "files": [
     "bin",
-    "dist"
+    "dist",
+    "LICENSE"
   ],
   "scripts": {
     "dev": "vite --port 6274",
diff --git a/server/LICENSE b/server/LICENSE
new file mode 100644
index 00000000..4a939857
--- /dev/null
+++ b/server/LICENSE
@@ -0,0 +1,216 @@
+The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
+
+Contributions for which relicensing consent has been obtained are licensed under Apache-2.0. Contributions made by authors who originally licensed their work under the MIT License and who have not yet granted explicit permission to relicense remain licensed under the MIT License.
+
+No rights beyond those granted by the applicable original license are conveyed for such contributions.
+
+---
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright
+      owner or by an individual or Legal Entity authorized to submit on behalf
+      of the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+---
+
+MIT License
+
+Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+---
+
+Creative Commons Attribution 4.0 International (CC-BY-4.0)
+
+Documentation in this project (excluding specifications) is licensed under
+CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
+the full license text.
diff --git a/server/package.json b/server/package.json
index 622b889d..10506f35 100644
--- a/server/package.json
+++ b/server/package.json
@@ -11,7 +11,8 @@
     "mcp-inspector-server": "build/index.js"
   },
   "files": [
-    "build"
+    "build",
+    "LICENSE"
   ],
   "scripts": {
     "build": "tsc",

From dd027374636888a830bc22f389ccabcfc7fa7af2 Mon Sep 17 00:00:00 2001
From: Koichi ITO <koic.ito@gmail.com>
Date: Wed, 4 Feb 2026 22:26:13 +0900
Subject: [PATCH 07/37] Enable Dependabot for GitHub Actions (#1048)

Configure Dependabot to automatically detect updates to the actions used in
GitHub Actions (e.g., `actions/checkout`) and create pull requests for them.

For example, `actions/checkout@v4` is likely updatable, as v6 is already available:
https://github.com/modelcontextprotocol/inspector/blob/9f3b4ff/.github/workflows/main.yml#L15

This PR enables Dependabot to update such GitHub Actions dependencies.

Updates to outdated actions packages in `.github/workflows` are intentionally not included in this PR,
as they will be updated by the initial Dependabot run as part of verifying its behavior.

Based on experience, checking for updates on a weekly interval should work well.
---
 .github/dependabot.yml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..5ace4600
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

From 613c650c40b055231300fe99eaf04bc9f869de43 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 13:26:54 +0000
Subject: [PATCH 08/37] Bump actions/setup-node from 4 to 6

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/cli_tests.yml | 2 +-
 .github/workflows/e2e_tests.yml | 2 +-
 .github/workflows/main.yml      | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cli_tests.yml b/.github/workflows/cli_tests.yml
index ede7643e..3b46b431 100644
--- a/.github/workflows/cli_tests.yml
+++ b/.github/workflows/cli_tests.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: package.json
           cache: npm
diff --git a/.github/workflows/e2e_tests.yml b/.github/workflows/e2e_tests.yml
index 378905b4..abf260c3 100644
--- a/.github/workflows/e2e_tests.yml
+++ b/.github/workflows/e2e_tests.yml
@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         id: setup_node
         with:
           node-version-file: package.json
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d01f7175..fbc4cf42 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Check formatting
         run: npx prettier --check .
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
           cache: npm
@@ -51,7 +51,7 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
           cache: npm

From bde1d59e8fcf1c7739ba5d25184d35d73bbfa60c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 13:27:00 +0000
Subject: [PATCH 09/37] Bump actions/upload-artifact from 4 to 6

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 6.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/e2e_tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/e2e_tests.yml b/.github/workflows/e2e_tests.yml
index 378905b4..fa12b62c 100644
--- a/.github/workflows/e2e_tests.yml
+++ b/.github/workflows/e2e_tests.yml
@@ -51,7 +51,7 @@ jobs:
         run: npm run test:e2e
 
       - name: Upload Playwright Report and Screenshots
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: steps.playwright-tests.conclusion != 'skipped'
         with:
           name: playwright-report

From 742f27dc7abf31cc85d1658593ecf97c6b183d14 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 13:27:04 +0000
Subject: [PATCH 10/37] Bump actions/attest-build-provenance from 2 to 3

Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2 to 3.
- [Release notes](https://github.com/actions/attest-build-provenance/releases)
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-build-provenance/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/attest-build-provenance
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index d01f7175..7c5bb174 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -109,7 +109,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.push.outputs.digest }}

From a68211b3e40520bca80cb8810e7d47bd222669e3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 13:27:09 +0000
Subject: [PATCH 11/37] Bump actions/cache from 4 to 5

Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/e2e_tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/e2e_tests.yml b/.github/workflows/e2e_tests.yml
index 378905b4..c3f27a4a 100644
--- a/.github/workflows/e2e_tests.yml
+++ b/.github/workflows/e2e_tests.yml
@@ -29,7 +29,7 @@ jobs:
       # Cache Playwright browsers
       - name: Cache Playwright browsers
         id: cache-playwright
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/ms-playwright # The default Playwright cache path
           key: ${{ runner.os }}-playwright-${{ hashFiles('package-lock.json') }} # Cache key based on OS and package-lock.json

From 0f253927d1cc52d036ca6c1d06913b5a99560723 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 13:27:13 +0000
Subject: [PATCH 12/37] Bump actions/github-script from 7 to 8

Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 8.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v8)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/claude.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 23a66f86..52ca5ce4 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -33,7 +33,7 @@ jobs:
           github.event_name == 'pull_request_review_comment' ||
           github.event_name == 'pull_request_review'
         id: pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             let prNumber;

From f97725760a6cc626d4f4ed775ebf4093503ea56b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 4 Feb 2026 20:42:32 -0700
Subject: [PATCH 13/37] Bump the npm_and_yarn group across 1 directory with 3
 updates (#1065)

Bumps the npm_and_yarn group with 2 updates in the / directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) and [diff](https://github.com/kpdecker/jsdiff).


Updates `@modelcontextprotocol/sdk` from 1.25.2 to 1.26.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.25.2...v1.26.0)

Updates `diff` from 4.0.2 to 4.0.4
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](https://github.com/kpdecker/jsdiff/compare/v4.0.2...v4.0.4)

Updates `hono` from 4.11.3 to 4.11.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.11.3...v4.11.7)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.26.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.11.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 167 ++++++++++++++++++++++++++++++----------------
 1 file changed, 109 insertions(+), 58 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0055b433..0cecbf66 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -227,6 +227,7 @@
       "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@csstools/css-calc": "^2.1.3",
         "@csstools/css-color-parser": "^3.0.9",
@@ -240,7 +241,8 @@
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
       "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/@babel/code-frame": {
       "version": "7.27.1",
@@ -273,7 +275,6 @@
       "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@babel/generator": "^7.28.5",
@@ -819,6 +820,7 @@
         }
       ],
       "license": "MIT-0",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -839,6 +841,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -863,6 +866,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@csstools/color-helpers": "^5.1.0",
         "@csstools/css-calc": "^2.1.4"
@@ -1558,9 +1562,9 @@
       "license": "MIT"
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.7",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.7.tgz",
-      "integrity": "sha512-vUcD0uauS7EU2caukW8z5lJKtoGMokxNbJtBiwHgpqxEXokaHCBkQUmCHhjFB1VUTWdqj25QoMkMKzgjq+uhrw==",
+      "version": "1.19.9",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
+      "integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
       "license": "MIT",
       "engines": {
         "node": ">=18.14.1"
@@ -1884,6 +1888,7 @@
       "integrity": "sha512-kazxw2L9IPuZpQ0mEt9lu9Z98SqR74xcagANmMBU16X0lS23yPc0+S6hGLUz8kVRlomZEs/5S/Zlpqwf5yu6OQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/fake-timers": "30.2.0",
@@ -1912,6 +1917,7 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -1928,6 +1934,7 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -1946,6 +1953,7 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -1959,6 +1967,7 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -1977,7 +1986,8 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@jest/environment-jsdom-abstract/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -1985,6 +1995,7 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -1995,6 +2006,7 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -2007,6 +2019,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -2026,6 +2039,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -2036,6 +2050,7 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -2057,6 +2072,7 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2072,6 +2088,7 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2090,6 +2107,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -2103,6 +2121,7 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -2117,7 +2136,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@jest/expect": {
       "version": "29.7.0",
@@ -2186,6 +2206,7 @@
       "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "jest-regex-util": "30.0.1"
@@ -2200,6 +2221,7 @@
       "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
@@ -2414,12 +2436,12 @@
       "link": true
     },
     "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.25.2",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.25.2.tgz",
-      "integrity": "sha512-LZFeo4F9M5qOhC/Uc1aQSrBHxMrvxett+9KLHt7OhcExtoiRN9DKgbZffMP/nxjutWDQpfMDfP3nkHI4X9ijww==",
+      "version": "1.26.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.26.0.tgz",
+      "integrity": "sha512-Y5RmPncpiDtTXDbLKswIJzTqu2hyBKxTNsgKqKclDbhIgg1wgtf1fRuvxgTnRfcnxtvvgbIEcqUOzZrJ6iSReg==",
       "license": "MIT",
       "dependencies": {
-        "@hono/node-server": "^1.19.7",
+        "@hono/node-server": "^1.19.9",
         "ajv": "^8.17.1",
         "ajv-formats": "^3.0.1",
         "content-type": "^1.0.5",
@@ -2427,14 +2449,15 @@
         "cross-spawn": "^7.0.5",
         "eventsource": "^3.0.2",
         "eventsource-parser": "^3.0.0",
-        "express": "^5.0.1",
-        "express-rate-limit": "^7.5.0",
-        "jose": "^6.1.1",
+        "express": "^5.2.1",
+        "express-rate-limit": "^8.2.1",
+        "hono": "^4.11.4",
+        "jose": "^6.1.3",
         "json-schema-typed": "^8.0.2",
         "pkce-challenge": "^5.0.0",
         "raw-body": "^3.0.0",
         "zod": "^3.25 || ^4.0",
-        "zod-to-json-schema": "^3.25.0"
+        "zod-to-json-schema": "^3.25.1"
       },
       "engines": {
         "node": ">=18"
@@ -3945,7 +3968,8 @@
       "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
       "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
@@ -4195,7 +4219,6 @@
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.2.tgz",
       "integrity": "sha512-LPM2G3Syo1GLzXLGJAKdqoU35XvrWzGJ21/7sgZTUpbkBaOasTj8tjwn6w+hCkqaa1TfJ/w67rJSwYItlJ2mYw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -4234,7 +4257,6 @@
       "integrity": "sha512-cisd7gxkzjBKU2GgdYrTdtQx1SORymWyaAFhaxQPK9bYO9ot3Y5OikQRvY0VYQtvwjeQnizCINJAenh/V7MK2w==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.2.2"
@@ -4246,7 +4268,6 @@
       "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "peerDependencies": {
         "@types/react": "^18.0.0"
       }
@@ -4387,7 +4408,6 @@
       "integrity": "sha512-N9lBGA9o9aqb1hVMc9hzySbhKibHmB+N3IpoShyV6HyQYRGIhlrO5rQgttypi+yEeKsKI4idxC8Jw6gXKD4THA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.49.0",
         "@typescript-eslint/types": "8.49.0",
@@ -4770,7 +4790,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5243,7 +5262,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -6053,9 +6071,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/diff": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
-      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz",
+      "integrity": "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.3.1"
@@ -6083,7 +6101,8 @@
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
       "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/domexception": {
       "version": "4.0.0",
@@ -6341,7 +6360,6 @@
       "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -6639,7 +6657,6 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -6679,10 +6696,13 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "7.5.1",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-7.5.1.tgz",
-      "integrity": "sha512-7iN8iPMDzOMHPUYllBEsQdWVB6fPDMPqwjBaFrgr4Jgr/+okjvzAy+UHlYYL/Vs0OsOrMkwS6PJDkFlJwoxUnw==",
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.2.1.tgz",
+      "integrity": "sha512-PCZEIEIxqwhzw4KF0n7QF4QqruVTcF73O5kFKUnGOyjbCCgizBBiFaYpd/fnBLUMPw/BWw9OsiN7GgrNYr7j6g==",
       "license": "MIT",
+      "dependencies": {
+        "ip-address": "10.0.1"
+      },
       "engines": {
         "node": ">= 16"
       },
@@ -7254,11 +7274,10 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.11.3",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.3.tgz",
-      "integrity": "sha512-PmQi306+M/ct/m5s66Hrg+adPnkD5jiO6IjA7WhWw0gSBSo1EcRegwuI1deZ+wd5pzCGynCcn2DprnE4/yEV4w==",
+      "version": "4.11.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.7.tgz",
+      "integrity": "sha512-l7qMiNee7t82bH3SeyUCt9UF15EVmaBvsppY2zQtrbIhl/yzBTny+YUxsVjSjQ6gaqaeVtZmGocom8TzBlA4Yw==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=16.9.0"
       }
@@ -7459,6 +7478,15 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
+    "node_modules/ip-address": {
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.0.1.tgz",
+      "integrity": "sha512-NWv9YLW4PoW2B7xtzaS3NCot75m6nK7Icdv0o3lfMceJVRfSoQwqD4wEH5rLwoKJwUiZ/rfpiVBhnaF0FK4HoA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
@@ -7733,7 +7761,6 @@
       "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/core": "^29.7.0",
         "@jest/types": "^29.6.3",
@@ -8074,6 +8101,7 @@
       "integrity": "sha512-zbBTiqr2Vl78pKp/laGBREYzbZx9ZtqPjOK4++lL4BNDhxRnahg51HtoDrk9/VjIy9IthNEWdKVd7H5bqBhiWQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/environment-jsdom-abstract": "30.2.0",
@@ -8099,6 +8127,7 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -8115,6 +8144,7 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -8133,6 +8163,7 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -8146,6 +8177,7 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -8164,7 +8196,8 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/jest-environment-jsdom/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -8172,6 +8205,7 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -8182,6 +8216,7 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -8194,6 +8229,7 @@
       "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 14"
       }
@@ -8204,6 +8240,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -8223,6 +8260,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -8233,6 +8271,7 @@
       "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@asamuzakjp/css-color": "^3.2.0",
         "rrweb-cssom": "^0.8.0"
@@ -8247,6 +8286,7 @@
       "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "whatwg-mimetype": "^4.0.0",
         "whatwg-url": "^14.0.0"
@@ -8261,6 +8301,7 @@
       "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "whatwg-encoding": "^3.1.1"
       },
@@ -8274,6 +8315,7 @@
       "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.0",
         "debug": "^4.3.4"
@@ -8288,6 +8330,7 @@
       "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.2",
         "debug": "4"
@@ -8302,6 +8345,7 @@
       "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
@@ -8315,6 +8359,7 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -8336,6 +8381,7 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8351,6 +8397,7 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8369,6 +8416,7 @@
       "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "cssstyle": "^4.2.1",
         "data-urls": "^5.0.0",
@@ -8409,6 +8457,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -8422,6 +8471,7 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -8436,7 +8486,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/jest-environment-jsdom/node_modules/tough-cookie": {
       "version": "5.1.2",
@@ -8444,6 +8495,7 @@
       "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "tldts": "^6.1.32"
       },
@@ -8457,6 +8509,7 @@
       "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "punycode": "^2.3.1"
       },
@@ -8470,6 +8523,7 @@
       "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "xml-name-validator": "^5.0.0"
       },
@@ -8483,6 +8537,7 @@
       "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "iconv-lite": "0.6.3"
       },
@@ -8496,6 +8551,7 @@
       "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -8506,6 +8562,7 @@
       "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "tr46": "^5.1.0",
         "webidl-conversions": "^7.0.0"
@@ -8520,6 +8577,7 @@
       "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -9114,7 +9172,6 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -9153,7 +9210,6 @@
       "integrity": "sha512-SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "abab": "^2.0.6",
         "acorn": "^8.8.1",
@@ -9492,6 +9548,7 @@
       "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "lz-string": "bin/bin.js"
       }
@@ -10369,7 +10426,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -10545,6 +10601,7 @@
       "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "ansi-regex": "^5.0.1",
         "ansi-styles": "^5.0.0",
@@ -10560,6 +10617,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -10714,7 +10772,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -10727,7 +10784,6 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -10741,7 +10797,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/react-refresh": {
       "version": "0.18.0",
@@ -11149,7 +11206,8 @@
       "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
       "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/run-applescript": {
       "version": "7.1.0",
@@ -11815,7 +11873,6 @@
       "integrity": "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
         "arg": "^5.0.2",
@@ -11954,7 +12011,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -11978,6 +12034,7 @@
       "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "tldts-core": "^6.1.86"
       },
@@ -11990,7 +12047,8 @@
       "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
       "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/tmpl": {
       "version": "1.0.5",
@@ -12163,7 +12221,6 @@
       "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.9.2.tgz",
       "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@cspotcode/source-map-support": "^0.8.0",
         "@tsconfig/node10": "^1.0.7",
@@ -12220,7 +12277,6 @@
       "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "~0.27.0",
         "get-tsconfig": "^4.7.5"
@@ -12774,7 +12830,6 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -12983,7 +13038,6 @@
       "integrity": "sha512-ITcnkFeR3+fI8P1wMgItjGrR10170d8auB4EpMLPqmx6uxElH3a/hHGQabSHKdqd4FXWO1nFIp9rRn7JQ34ACQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -13077,7 +13131,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -13497,7 +13550,6 @@
       "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
       "dev": true,
       "license": "ISC",
-      "peer": true,
       "bin": {
         "yaml": "bin.mjs"
       },
@@ -13585,15 +13637,14 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
       "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
     },
     "node_modules/zod-to-json-schema": {
-      "version": "3.25.0",
-      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.0.tgz",
-      "integrity": "sha512-HvWtU2UG41LALjajJrML6uQejQhNJx+JBO9IflpSja4R03iNWfKXrj6W2h7ljuLyc1nKS+9yDyL/9tD1U/yBnQ==",
+      "version": "3.25.1",
+      "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.1.tgz",
+      "integrity": "sha512-pM/SU9d3YAggzi6MtR4h7ruuQlqKtad8e9S0fmxcMi+ueAK5Korys/aWcV9LIIHTVbj01NdzxcnXSN+O74ZIVA==",
       "license": "ISC",
       "peerDependencies": {
         "zod": "^3.25 || ^4"

From ee29c34bd78eb7862446b7dda07cb05af21cb43e Mon Sep 17 00:00:00 2001
From: Bob Dickinson <bob.dickinson@gmail.com>
Date: Thu, 5 Feb 2026 16:34:25 -0800
Subject: [PATCH 14/37] Fixed test failures induced by MCP SDK update (added
 session id generator to Streamable test server).  Cleanup up some port usage
 to avoid potential issues (always use port 0 for servers). Added
 stdout/stderr to cli status assertion failures to make CLI test failures
 easier to debug from test output.

---
 cli/__tests__/helpers/assertions.ts       | 16 ++++++++--
 cli/__tests__/helpers/fixtures.ts         |  8 ++---
 cli/__tests__/helpers/test-server-http.ts | 37 ++++++++++++++---------
 3 files changed, 41 insertions(+), 20 deletions(-)

diff --git a/cli/__tests__/helpers/assertions.ts b/cli/__tests__/helpers/assertions.ts
index e3ed9d02..3631c00b 100644
--- a/cli/__tests__/helpers/assertions.ts
+++ b/cli/__tests__/helpers/assertions.ts
@@ -1,18 +1,30 @@
 import { expect } from "vitest";
 import type { CliResult } from "./cli-runner.js";
 
+function formatCliOutput(result: CliResult): string {
+  const out = result.stdout?.trim() || "(empty)";
+  const err = result.stderr?.trim() || "(empty)";
+  return `stdout: ${out}\nstderr: ${err}`;
+}
+
 /**
  * Assert that CLI command succeeded (exit code 0)
  */
 export function expectCliSuccess(result: CliResult) {
-  expect(result.exitCode).toBe(0);
+  expect(
+    result.exitCode,
+    `CLI exited with code ${result.exitCode}. ${formatCliOutput(result)}`,
+  ).toBe(0);
 }
 
 /**
  * Assert that CLI command failed (non-zero exit code)
  */
 export function expectCliFailure(result: CliResult) {
-  expect(result.exitCode).not.toBe(0);
+  expect(
+    result.exitCode,
+    `CLI unexpectedly exited with code ${result.exitCode}. ${formatCliOutput(result)}`,
+  ).not.toBe(0);
 }
 
 /**
diff --git a/cli/__tests__/helpers/fixtures.ts b/cli/__tests__/helpers/fixtures.ts
index 5914f485..c7f10fc7 100644
--- a/cli/__tests__/helpers/fixtures.ts
+++ b/cli/__tests__/helpers/fixtures.ts
@@ -1,7 +1,7 @@
-import fs from "fs";
-import path from "path";
-import os from "os";
-import crypto from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import * as crypto from "crypto";
 import { getTestMcpServerCommand } from "./test-server-stdio.js";
 
 /**
diff --git a/cli/__tests__/helpers/test-server-http.ts b/cli/__tests__/helpers/test-server-http.ts
index 4626ef51..d5eadc3f 100644
--- a/cli/__tests__/helpers/test-server-http.ts
+++ b/cli/__tests__/helpers/test-server-http.ts
@@ -6,6 +6,7 @@ import type { Request, Response } from "express";
 import express from "express";
 import { createServer as createHttpServer, Server as HttpServer } from "http";
 import { createServer as createNetServer } from "net";
+import { randomUUID } from "crypto";
 import * as z from "zod/v4";
 import type { ServerConfig } from "./test-fixtures.js";
 
@@ -187,22 +188,24 @@ export class TestServerHttp {
   }
 
   /**
-   * Start the server with the specified transport
+   * Start the server with the specified transport.
+   * When requestedPort is omitted, uses port 0 so the OS assigns a unique port (avoids EADDRINUSE when tests run in parallel).
    */
   async start(
     transport: "http" | "sse",
     requestedPort?: number,
   ): Promise<number> {
-    const port = requestedPort
-      ? await findAvailablePort(requestedPort)
-      : await findAvailablePort(transport === "http" ? 3001 : 3000);
-
-    this.url = `http://localhost:${port}`;
+    const port =
+      requestedPort !== undefined ? await findAvailablePort(requestedPort) : 0;
 
     if (transport === "http") {
-      return this.startHttp(port);
+      const actualPort = await this.startHttp(port);
+      this.url = `http://localhost:${actualPort}`;
+      return actualPort;
     } else {
-      return this.startSse(port);
+      const actualPort = await this.startSse(port);
+      this.url = `http://localhost:${actualPort}`;
+      return actualPort;
     }
   }
 
@@ -213,8 +216,10 @@ export class TestServerHttp {
     // Create HTTP server
     this.httpServer = createHttpServer(app);
 
-    // Create StreamableHTTP transport
-    this.transport = new StreamableHTTPServerTransport({});
+    // Create StreamableHTTP transport (stateful so it can handle multiple requests per session)
+    this.transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: () => randomUUID(),
+    });
 
     // Set up Express route to handle MCP requests
     app.post("/mcp", async (req: Request, res: Response) => {
@@ -292,10 +297,12 @@ export class TestServerHttp {
     // Connect transport to server
     await this.mcpServer.connect(this.transport);
 
-    // Start listening
+    // Start listening (port 0 = OS assigns a unique port)
     return new Promise((resolve, reject) => {
       this.httpServer!.listen(port, () => {
-        resolve(port);
+        const assignedPort = (this.httpServer!.address() as { port: number })
+          ?.port;
+        resolve(assignedPort ?? port);
       });
       this.httpServer!.on("error", reject);
     });
@@ -371,10 +378,12 @@ export class TestServerHttp {
     // Note: SSE transport is created per request, so we don't store a single instance
     this.transport = undefined;
 
-    // Start listening
+    // Start listening (port 0 = OS assigns a unique port)
     return new Promise((resolve, reject) => {
       this.httpServer!.listen(port, () => {
-        resolve(port);
+        const assignedPort = (this.httpServer!.address() as { port: number })
+          ?.port;
+        resolve(assignedPort ?? port);
       });
       this.httpServer!.on("error", reject);
     });

From 2af3410b8e41444dc7e1e0f8d46f19ff1e6ec622 Mon Sep 17 00:00:00 2001
From: Cliff Hall <cliff@futurescale.com>
Date: Thu, 5 Feb 2026 22:02:20 -0500
Subject: [PATCH 15/37] Add MCP Apps support to Inspector (#1044)

* Fix MCP Apps rendering issue and add comprehensive logging

- Fixed AppRenderer useEffect dependency array to include resourceContent
  This ensures the component re-evaluates when resource content arrives
- Added detailed console logging throughout the app lifecycle:
  * Resource fetch and response tracking in App.tsx
  * Setup conditions and AppBridge creation in AppRenderer.tsx
  * HTML parsing and iframe rendering steps
  * PostMessageTransport and AppBridge connection status
  * App tool filtering and selection in AppsTab.tsx
- Refactored AppsTab selectedTool rendering for better tracking

The issue was that resourceContent prop updates weren't triggering
the AppRenderer setup effect. Now the effect properly responds to
both resourceUri and resourceContent changes.

Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com>

* Fix MCP Apps iframe rendering issue

The app was getting stuck on 'Loading MCP App...' because the iframe was
hidden (display: none) until the oninitialized event fired. However, the
PostMessage handshake requires the iframe to be visible to complete.

This fix:
- Sets loading to false immediately after writing HTML to the iframe
- Makes the iframe visible before establishing PostMessage transport
- Allows the AppBridge initialization handshake to complete successfully
- Removes redundant setLoading(false) from oninitialized callback

The iframe is now visible and ready for PostMessage communication before
the AppBridge connect() call, enabling proper initialization.

Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com>

* Fix MCP Apps HTML extraction to match spec

The AppRenderer was incorrectly checking for a 'type' field in resource
contents, but TextResourceContents objects only have uri, mimeType, and
text fields according to the MCP specification.

Fixed by checking for the presence of the 'text' field directly instead
of checking a non-existent 'type' field. This allows the HTML content
to be properly extracted and rendered in the iframe.

Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com>

* Add comprehensive tests for MCP Apps support

- Add tests for AppsTab component (13 tests)
- Add tests for AppRenderer component (17 tests)
- Update jest.config.cjs to handle ES modules from @modelcontextprotocol/ext-apps
- All 478 tests pass successfully

Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com>

* Add MCP Apps support to Inspector

- Add AppsTab component for detecting and listing MCP apps
- Add AppRenderer component with full AppBridge integration
- Implement UI resource fetching and sandboxed iframe rendering
- Add PostMessage transport for bidirectional JSON-RPC communication
- Include comprehensive test coverage (30 new tests)
- Auto-populate apps when tab becomes active
- Support theme awareness and configurable permissions

Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com>

* Prefer structuredContent over content field in tool responses

Some MCP servers return different data in structuredContent vs content fields.
This change ensures that when structuredContent is present, it is used
exclusively for display instead of showing both fields.

Changes:
- Modified ToolResults.tsx to only show content when structuredContent is absent
- Removed unused checkContentCompatibility function
- Updated test cases to reflect new behavior

Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com>

* Revert "Prefer structuredContent over content field in tool responses"

This reverts commit 3b054b4da08517cce53ef23e60c07bb32b0fa8f5.

Claude did not do the right thing.

* feat: integrate @mcp-ui/client for MCP application rendering

This commit implements the integration of `@mcp-ui/client` to handle the
rendering of Model Context Protocol (MCP) applications within the inspector.
It includes refactoring the rendering logic, improving resource fetching
in the main application state, and setting up a secure sandbox environment.

Changes per file:

- client/package.json:
  - Added `@mcp-ui/client` as a dependency.

- client/src/components/AppRenderer.tsx:
  - Refactored to use `McpUiAppRenderer` from `@mcp-ui/client`.
  - Implemented HTML parsing logic for MCP resource responses.
  - Configured host context (theme) and sandbox URL for the renderer.
  - Replaced iframe-based manual rendering with the official component.

- client/src/App.tsx:
  - Added `fetchingResources` state to prevent duplicate concurrent resource requests.
  - Enhanced `readResource` with better error handling and state tracking.
  - Optimized resource content mapping to better support application state.

- client/src/components/AppsTab.tsx:
  - Updated to use `getToolUiResourceUri` utility from `@modelcontextprotocol/ext-apps`
    instead of manual metadata property access.
  - Simplified tool filtering and selection logic.

- client/public/sandbox_proxy.html:
  - Added a sandbox proxy page to facilitate secure communication between
    the inspector and the rendered MCP applications.

- client/bin/client.js:
  - Added server rewrites to ensure `sandbox_proxy.html` is served correctly.
  - Implemented specific `Cache-Control` headers for `sandbox_proxy.html` to
    prevent stale cached versions.

- client/vite.config.ts:
  - Explicitly configured `publicDir: "public"` to ensure the sandbox proxy
    is included in the build output.

- client/src/components/__tests__/AppRenderer.test.tsx:
  - Updated tests to mock the new `@mcp-ui/client` component.
  - Adjusted assertions to verify correct props are passed to the renderer.
  - Enhanced mock MCP client to include required methods like `getServerCapabilities`.

* Potential fix for code scanning alert no. 37: Client-side cross-site scripting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Update package-lock.json
 - npm install
 - npm audit fix

* Potential fix for code scanning alert no. 38: Client-side cross-site scripting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 39: Client-side cross-site scripting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* prettier

* Update client/src/components/AppsTab.tsx

Co-authored-by: Ola Hungerford <olahungerford@gmail.com>

* prettier

* In AppsTab.test.tsx, fetch button by aria-label

* relative imports

* Remove sanitization logic from sandbox_proxy.html. It's breaking the app rendering. Will sort out what best practices for this HTML is later

* In sandbox_proxy.html,formatting
In AppsTab.tsx
  - Add app window
    - when an app is selected,
      - show input form for apps that have an input schema
      - button shows app
      - if app is shown, show maximize button
        - if maximized,
          - show minimize button
          - hide app list
* In AppsTab.test.tsx
  - test new layout and controls
* In AppRenderer.tsx
    - accept toolInput
    - pass to McpUiAppRenderer

* In AppsTab.tsx, if an app has no inputSchema, just show it, otherwise show the form and the "back to form" button when showing the app.

* In AppsTab.test.tsx
  - test new behavior

* In ListPane.tsx
  - remove the Clear button

* In ListPane.test.tsx
  - remove test for clear button

* In AppRenderer.tsx,
  - remove onReadResource and resourceContent, not needed since mcpClient is being passed

* In App.tsx and AppsTab.tsx,
  - remove the passing of these variables

* In AppRenderer.test.tsx, and AppsTab.test.tsx
  - remove tests that fail after having removed onReadResource and resourceContent

* Serving the sandbox_proxy.html from a separate port, using the proxy instead of the webclient server.

* In App.tsx
  - pass the path to the sandbox endpoint on the proxy to the AppsTab

* In AppsTab.tsx
  - accept the sandboxPath property and pass it to the AppRenderer

* In AppRenderer.tsx
  - accept the sandboxPath property and pass it to the McpUiAppRenderer

* In client.js
  - remove the rewrite and header config for sandbox_proxy.html

* In server/src/index.ts
  - add a /sandbox endpoint that reads and returns the sandbox_proxy.html file with no-cache header

* In server/package.json
  - add shx for cross-platform copy function
  - in build script, copy static folder to build folder

* Moved sandbox_proxy.html from client/public to server/static

* In client.js
  - return to original state

* In vite.config.ts
  - return to original state

* Potential fix for code scanning alert no. 41: Missing rate limiting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* In AppRenderer.tsx
  - add open link handler that handles link requests from the UI. Makes sure that the URL starts with http or https

* In sandbox_proxy.html
  - refactor to match [basic-host](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/basic-host) example
  - creates an nested iframe for security.
  - in this implementation, for simplicity the sandbox.ts is inlined in sandbox_proxy.html as javascript

* prettier

* In AppRenderer.tsx
  - add support for handling McpUiMessageRequest messages from the UI
  - show message in a toast

* Add logging message handler to AppRenderer

In App.tsx
  - pass an onNotification function to the AppsTab that adds a notification to the notification array

In AppsTab.tsx
  - Accept the onNotification function and pass it to the AppRenderer

In AppRenderer.tsx
  - Accept the onNotification function
  - added an handleLoggingMessage function that takes a LoggingMessageNotificationParams object, wraps it with a method and params prop to make it a ServerNotification shape, and pass it to the onNotification function
   - pass handleLoggingMessage to McpUiAppRenderer

* In ResourcesTab.test.tsx
  - fix @ import that wasn't resolving

* In AppRenderer.tsx
  - remove fetch and evaluation of resourceUri, as the mcpClient handles that (review request)

* In AppRenderer.test.tsx
  - remove test for no resourceUri found

* Merge branch 'main' into full-apps-support-final

Resolved Conflicts:
- package-lock.json

* Fixed mismatch with sanboxRateLimiter and the express version

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Cliff Hall <cliffhall@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Ola Hungerford <olahungerford@gmail.com>
---
 cli/package.json                              |   2 +-
 client/jest.config.cjs                        |   7 +
 client/package.json                           |   2 +
 client/src/App.tsx                            |  89 ++-
 client/src/components/AppRenderer.tsx         | 128 ++++
 client/src/components/AppsTab.tsx             | 530 ++++++++++++++
 client/src/components/ListPane.tsx            |  20 +-
 .../components/__tests__/AppRenderer.test.tsx | 115 +++
 .../src/components/__tests__/AppsTab.test.tsx | 481 +++++++++++++
 .../__tests__/AuthDebugger.test.tsx           |   8 +-
 .../components/__tests__/ListPane.test.tsx    |   8 +-
 .../__tests__/ResourcesTab.test.tsx           |   2 +-
 package-lock.json                             | 660 +++++++++++++-----
 server/package.json                           |   8 +-
 server/src/index.ts                           |  29 +
 server/static/sandbox_proxy.html              | 197 ++++++
 16 files changed, 2090 insertions(+), 196 deletions(-)
 create mode 100644 client/src/components/AppRenderer.tsx
 create mode 100644 client/src/components/AppsTab.tsx
 create mode 100644 client/src/components/__tests__/AppRenderer.test.tsx
 create mode 100644 client/src/components/__tests__/AppsTab.test.tsx
 create mode 100644 server/static/sandbox_proxy.html

diff --git a/cli/package.json b/cli/package.json
index ce521bee..52f66b6f 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -25,7 +25,7 @@
     "test:cli-metadata": "vitest run metadata.test.ts"
   },
   "devDependencies": {
-    "@types/express": "^5.0.6",
+    "@types/express": "^5.0.0",
     "tsx": "^4.7.0",
     "vitest": "^4.0.17"
   },
diff --git a/client/jest.config.cjs b/client/jest.config.cjs
index 9b793eae..70485296 100644
--- a/client/jest.config.cjs
+++ b/client/jest.config.cjs
@@ -13,8 +13,15 @@ module.exports = {
         tsconfig: "tsconfig.jest.json",
       },
     ],
+    "^.+\\.m?js$": [
+      "ts-jest",
+      {
+        tsconfig: "tsconfig.jest.json",
+      },
+    ],
   },
   extensionsToTreatAsEsm: [".ts", ".tsx"],
+  transformIgnorePatterns: ["node_modules/(?!(@modelcontextprotocol)/)"],
   testRegex: "(/__tests__/.*|(\\.|/)(test|spec))\\.(jsx?|tsx?)$",
   // Exclude directories and files that don't need to be tested
   testPathIgnorePatterns: [
diff --git a/client/package.json b/client/package.json
index 1feec212..1ac32027 100644
--- a/client/package.json
+++ b/client/package.json
@@ -25,6 +25,8 @@
     "cleanup:e2e": "node e2e/global-teardown.js"
   },
   "dependencies": {
+    "@mcp-ui/client": "^6.0.0",
+    "@modelcontextprotocol/ext-apps": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "@radix-ui/react-checkbox": "^1.1.4",
     "@radix-ui/react-dialog": "^1.1.3",
diff --git a/client/src/App.tsx b/client/src/App.tsx
index 39fc2812..5a69495b 100644
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -51,6 +51,7 @@ import {
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { Button } from "@/components/ui/button";
 import {
+  AppWindow,
   Bell,
   Files,
   FolderTree,
@@ -75,6 +76,7 @@ import SamplingTab, { PendingRequest } from "./components/SamplingTab";
 import Sidebar from "./components/Sidebar";
 import ToolsTab from "./components/ToolsTab";
 import TasksTab from "./components/TasksTab";
+import AppsTab from "./components/AppsTab";
 import { InspectorConfig } from "./lib/configurationTypes";
 import {
   getMCPProxyAddress,
@@ -126,6 +128,9 @@ const App = () => {
   const [resourceContentMap, setResourceContentMap] = useState<
     Record<string, string>
   >({});
+  const [fetchingResources, setFetchingResources] = useState<Set<string>>(
+    new Set(),
+  );
   const [prompts, setPrompts] = useState<Prompt[]>([]);
   const [promptContent, setPromptContent] = useState<string>("");
   const [tools, setTools] = useState<Tool[]>([]);
@@ -308,11 +313,13 @@ const App = () => {
       ...(serverCapabilities?.prompts ? ["prompts"] : []),
       ...(serverCapabilities?.tools ? ["tools"] : []),
       ...(serverCapabilities?.tasks ? ["tasks"] : []),
+      "apps",
       "ping",
       "sampling",
       "elicitations",
       "roots",
       "auth",
+      "metadata",
     ];
 
     if (!validTabs.includes(originatingTab)) return;
@@ -440,11 +447,13 @@ const App = () => {
         ...(serverCapabilities?.prompts ? ["prompts"] : []),
         ...(serverCapabilities?.tools ? ["tools"] : []),
         ...(serverCapabilities?.tasks ? ["tasks"] : []),
+        "apps",
         "ping",
         "sampling",
         "elicitations",
         "roots",
         "auth",
+        "metadata",
       ];
 
       const isValidTab = validTabs.includes(hash);
@@ -473,6 +482,13 @@ const App = () => {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [mcpClient, activeTab]);
 
+  useEffect(() => {
+    if (mcpClient && activeTab === "apps" && serverCapabilities?.tools) {
+      void listTools();
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [mcpClient, activeTab, serverCapabilities?.tools]);
+
   useEffect(() => {
     localStorage.setItem("lastCommand", command);
   }, [command]);
@@ -757,11 +773,13 @@ const App = () => {
             ...(serverCapabilities?.prompts ? ["prompts"] : []),
             ...(serverCapabilities?.tools ? ["tools"] : []),
             ...(serverCapabilities?.tasks ? ["tasks"] : []),
+            "apps",
             "ping",
             "sampling",
             "elicitations",
             "roots",
             "auth",
+            "metadata",
           ];
 
           if (validTabs.includes(originatingTab)) {
@@ -851,22 +869,48 @@ const App = () => {
   };
 
   const readResource = async (uri: string) => {
+    if (fetchingResources.has(uri) || resourceContentMap[uri]) {
+      return;
+    }
+
+    console.log("[App] Reading resource:", uri);
+    setFetchingResources((prev) => new Set(prev).add(uri));
     lastToolCallOriginTabRef.current = currentTabRef.current;
 
-    const response = await sendMCPRequest(
-      {
-        method: "resources/read" as const,
-        params: { uri },
-      },
-      ReadResourceResultSchema,
-      "resources",
-    );
-    const content = JSON.stringify(response, null, 2);
-    setResourceContent(content);
-    setResourceContentMap((prev) => ({
-      ...prev,
-      [uri]: content,
-    }));
+    try {
+      const response = await sendMCPRequest(
+        {
+          method: "resources/read" as const,
+          params: { uri },
+        },
+        ReadResourceResultSchema,
+        "resources",
+      );
+      console.log("[App] Resource read response:", {
+        uri,
+        responseLength: JSON.stringify(response).length,
+        hasContents: !!(response as { contents?: unknown[] }).contents,
+      });
+      const content = JSON.stringify(response, null, 2);
+      setResourceContent(content);
+      setResourceContentMap((prev) => ({
+        ...prev,
+        [uri]: content,
+      }));
+    } catch (error) {
+      console.error(`[App] Failed to read resource ${uri}:`, error);
+      const errorString = (error as Error).message ?? String(error);
+      setResourceContentMap((prev) => ({
+        ...prev,
+        [uri]: JSON.stringify({ error: errorString }),
+      }));
+    } finally {
+      setFetchingResources((prev) => {
+        const next = new Set(prev);
+        next.delete(uri);
+        return next;
+      });
+    }
   };
 
   const subscribeToResource = async (uri: string) => {
@@ -1308,6 +1352,10 @@ const App = () => {
                   <ListTodo className="w-4 h-4 mr-2" />
                   Tasks
                 </TabsTrigger>
+                <TabsTrigger value="apps">
+                  <AppWindow className="w-4 h-4 mr-2" />
+                  Apps
+                </TabsTrigger>
                 <TabsTrigger value="ping">
                   <Bell className="w-4 h-4 mr-2" />
                   Ping
@@ -1497,6 +1545,19 @@ const App = () => {
                       error={errors.tasks}
                       nextCursor={nextTaskCursor}
                     />
+                    <AppsTab
+                      sandboxPath={`${getMCPProxyAddress(config)}/sandbox`}
+                      tools={tools}
+                      listTools={() => {
+                        clearError("tools");
+                        listTools();
+                      }}
+                      error={errors.tools}
+                      mcpClient={mcpClient}
+                      onNotification={(notification) => {
+                        setNotifications((prev) => [...prev, notification]);
+                      }}
+                    />
                     <ConsoleTab />
                     <PingTab
                       onPingClick={() => {
diff --git a/client/src/components/AppRenderer.tsx b/client/src/components/AppRenderer.tsx
new file mode 100644
index 00000000..e0c25980
--- /dev/null
+++ b/client/src/components/AppRenderer.tsx
@@ -0,0 +1,128 @@
+import { useMemo, useState } from "react";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import {
+  Tool,
+  ContentBlock,
+  ServerNotification,
+  LoggingMessageNotificationParams,
+} from "@modelcontextprotocol/sdk/types.js";
+import {
+  AppRenderer as McpUiAppRenderer,
+  type McpUiHostContext,
+  type RequestHandlerExtra,
+} from "@mcp-ui/client";
+import {
+  type McpUiMessageRequest,
+  type McpUiMessageResult,
+} from "@modelcontextprotocol/ext-apps/app-bridge";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import { AlertCircle } from "lucide-react";
+import { useToast } from "@/lib/hooks/useToast";
+
+interface AppRendererProps {
+  sandboxPath: string;
+  tool: Tool;
+  mcpClient: Client | null;
+  toolInput?: Record<string, unknown>;
+  onNotification?: (notification: ServerNotification) => void;
+}
+
+const AppRenderer = ({
+  sandboxPath,
+  tool,
+  mcpClient,
+  toolInput,
+  onNotification,
+}: AppRendererProps) => {
+  const [error, setError] = useState<string | null>(null);
+  const { toast } = useToast();
+
+  const hostContext: McpUiHostContext = useMemo(
+    () => ({
+      theme: document.documentElement.classList.contains("dark")
+        ? "dark"
+        : "light",
+    }),
+    [],
+  );
+
+  const handleOpenLink = async ({ url }: { url: string }) => {
+    let isError = true;
+    if (url.startsWith("https://") || url.startsWith("http://")) {
+      window.open(url, "_blank");
+      isError = false;
+    }
+    return { isError };
+  };
+
+  const handleMessage = async (
+    params: McpUiMessageRequest["params"],
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    _extra: RequestHandlerExtra,
+  ): Promise<McpUiMessageResult> => {
+    const message = params.content
+      .filter((block): block is ContentBlock & { type: "text" } =>
+        Boolean(block.type === "text"),
+      )
+      .map((block) => block.text)
+      .join("\n");
+
+    if (message) {
+      toast({
+        description: message,
+      });
+    }
+
+    return {};
+  };
+
+  const handleLoggingMessage = (params: LoggingMessageNotificationParams) => {
+    if (onNotification) {
+      onNotification({
+        method: "notifications/message",
+        params,
+      } as ServerNotification);
+    }
+  };
+
+  if (!mcpClient) {
+    return (
+      <Alert>
+        <AlertCircle className="h-4 w-4" />
+        <AlertDescription>Waiting for MCP client...</AlertDescription>
+      </Alert>
+    );
+  }
+
+  return (
+    <div className="flex flex-col h-full">
+      {error && (
+        <Alert variant="destructive" className="mb-4">
+          <AlertCircle className="h-4 w-4" />
+          <AlertDescription>{error}</AlertDescription>
+        </Alert>
+      )}
+
+      <div
+        className="flex-1 border rounded overflow-hidden"
+        style={{ minHeight: "400px" }}
+      >
+        <McpUiAppRenderer
+          client={mcpClient}
+          onOpenLink={handleOpenLink}
+          onMessage={handleMessage}
+          onLoggingMessage={handleLoggingMessage}
+          toolName={tool.name}
+          hostContext={hostContext}
+          toolInput={toolInput}
+          sandbox={{
+            url: new URL(sandboxPath, window.location.origin),
+          }}
+          onError={(err) => setError(err.message)}
+        />
+      </div>
+    </div>
+  );
+};
+
+export default AppRenderer;
diff --git a/client/src/components/AppsTab.tsx b/client/src/components/AppsTab.tsx
new file mode 100644
index 00000000..1943c439
--- /dev/null
+++ b/client/src/components/AppsTab.tsx
@@ -0,0 +1,530 @@
+import { useEffect, useState, useCallback, useRef } from "react";
+import { TabsContent } from "@/components/ui/tabs";
+import { Button } from "@/components/ui/button";
+import { Alert, AlertDescription } from "@/components/ui/alert";
+import {
+  AlertCircle,
+  X,
+  Play,
+  ChevronRight,
+  Maximize2,
+  Minimize2,
+} from "lucide-react";
+import { Tool, ServerNotification } from "@modelcontextprotocol/sdk/types.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { getToolUiResourceUri } from "@modelcontextprotocol/ext-apps/app-bridge";
+import AppRenderer from "./AppRenderer";
+import ListPane from "./ListPane";
+import IconDisplay, { WithIcons } from "./IconDisplay";
+import { Label } from "@/components/ui/label";
+import { Checkbox } from "@/components/ui/checkbox";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { Textarea } from "@/components/ui/textarea";
+import { Input } from "@/components/ui/input";
+import DynamicJsonForm, { DynamicJsonFormRef } from "./DynamicJsonForm";
+import { JsonSchemaType, JsonValue } from "@/utils/jsonUtils";
+import {
+  generateDefaultValue,
+  isPropertyRequired,
+  normalizeUnionType,
+  resolveRef,
+} from "@/utils/schemaUtils";
+
+interface AppsTabProps {
+  sandboxPath: string;
+  tools: Tool[];
+  listTools: () => void;
+  error: string | null;
+  mcpClient: Client | null;
+  onNotification?: (notification: ServerNotification) => void;
+}
+
+// Type guard to check if a tool has UI metadata
+const hasUIMetadata = (tool: Tool): boolean => {
+  return !!getToolUiResourceUri(tool);
+};
+
+const AppsTab = ({
+  sandboxPath,
+  tools,
+  listTools,
+  error,
+  mcpClient,
+  onNotification,
+}: AppsTabProps) => {
+  const [appTools, setAppTools] = useState<Tool[]>([]);
+  const [selectedTool, setSelectedTool] = useState<Tool | null>(null);
+  const [params, setParams] = useState<Record<string, unknown>>({});
+  const [isAppOpen, setIsAppOpen] = useState(false);
+  const [isMaximized, setIsMaximized] = useState(false);
+  const [hasValidationErrors, setHasValidationErrors] = useState(false);
+  const formRefs = useRef<Record<string, DynamicJsonFormRef | null>>({});
+
+  // Function to check if any form has validation errors
+  const checkValidationErrors = useCallback(() => {
+    const errors = Object.values(formRefs.current).some(
+      (ref) => ref && !ref.validateJson().isValid,
+    );
+    setHasValidationErrors(errors);
+    return errors;
+  }, []);
+
+  // Filter tools that have UI metadata
+  useEffect(() => {
+    const filtered = tools.filter(hasUIMetadata);
+    console.log("[AppsTab] Filtered app tools:", {
+      totalTools: tools.length,
+      appTools: filtered.length,
+      appToolNames: filtered.map((t) => t.name),
+    });
+    setAppTools(filtered);
+
+    // If current selected tool is no longer available, reset selection
+    if (selectedTool && !filtered.find((t) => t.name === selectedTool.name)) {
+      setSelectedTool(null);
+      setIsAppOpen(false);
+    }
+  }, [tools, selectedTool]);
+
+  useEffect(() => {
+    if (selectedTool) {
+      const initialParams = Object.entries(
+        selectedTool.inputSchema.properties ?? [],
+      ).map(([key, value]) => {
+        // First resolve any $ref references
+        const resolvedValue = resolveRef(
+          value as JsonSchemaType,
+          selectedTool.inputSchema as JsonSchemaType,
+        );
+        return [
+          key,
+          generateDefaultValue(
+            resolvedValue,
+            key,
+            selectedTool.inputSchema as JsonSchemaType,
+          ),
+        ];
+      });
+      setParams(Object.fromEntries(initialParams));
+      setHasValidationErrors(false);
+      formRefs.current = {};
+    } else {
+      setParams({});
+      setIsAppOpen(false);
+    }
+  }, [selectedTool]);
+
+  const handleRefresh = useCallback(() => {
+    listTools();
+  }, [listTools]);
+
+  const handleCloseApp = useCallback(() => {
+    setIsAppOpen(false);
+  }, []);
+
+  const handleOpenApp = useCallback(() => {
+    if (!checkValidationErrors()) {
+      setIsAppOpen(true);
+    }
+  }, [checkValidationErrors]);
+
+  const handleSelectTool = useCallback((tool: Tool) => {
+    setSelectedTool(tool);
+    const hasFields =
+      tool.inputSchema.properties &&
+      Object.keys(tool.inputSchema.properties).length > 0;
+    setIsAppOpen(!hasFields);
+  }, []);
+
+  const handleDeselectTool = useCallback(() => {
+    setSelectedTool(null);
+    setIsAppOpen(false);
+    setIsMaximized(false);
+  }, []);
+
+  return (
+    <TabsContent value="apps" className="space-y-4">
+      <div
+        className={
+          isMaximized
+            ? "grid grid-cols-1 gap-4"
+            : "grid grid-cols-1 md:grid-cols-2 gap-4"
+        }
+      >
+        {!isMaximized && (
+          <ListPane
+            items={appTools}
+            listItems={handleRefresh}
+            setSelectedItem={handleSelectTool}
+            renderItem={(tool) => {
+              return (
+                <div className="flex items-start w-full gap-2">
+                  <div className="flex-shrink-0 mt-1">
+                    <IconDisplay icons={(tool as WithIcons).icons} size="sm" />
+                  </div>
+                  <div className="flex flex-col flex-1 min-w-0">
+                    <span className="truncate font-semibold">{tool.name}</span>
+                    {tool.description && (
+                      <span className="text-sm text-gray-500 text-left line-clamp-2">
+                        {tool.description}
+                      </span>
+                    )}
+                  </div>
+                  <ChevronRight className="w-4 h-4 flex-shrink-0 text-gray-400 mt-1" />
+                </div>
+              );
+            }}
+            title="MCP Apps"
+            buttonText="Refresh Apps"
+          />
+        )}
+
+        <div className="bg-card border border-border rounded-lg shadow">
+          <div className="p-4 border-b border-gray-200 dark:border-border">
+            <div className="flex items-center justify-between">
+              <div className="flex items-center gap-2">
+                {selectedTool && (
+                  <IconDisplay
+                    icons={(selectedTool as WithIcons).icons}
+                    size="md"
+                  />
+                )}
+                <h3 className="font-semibold">
+                  {selectedTool ? selectedTool.name : "Select an app"}
+                </h3>
+              </div>
+              <div className="flex items-center gap-2">
+                {selectedTool && isAppOpen && (
+                  <Button
+                    onClick={() => setIsMaximized(!isMaximized)}
+                    variant="ghost"
+                    size="sm"
+                    aria-label={isMaximized ? "Minimize" : "Maximize"}
+                  >
+                    {isMaximized ? (
+                      <Minimize2 className="w-4 h-4" />
+                    ) : (
+                      <Maximize2 className="w-4 h-4" />
+                    )}
+                  </Button>
+                )}
+                {selectedTool && (
+                  <Button
+                    onClick={handleDeselectTool}
+                    variant="ghost"
+                    size="sm"
+                    aria-label="Close app"
+                  >
+                    <X className="w-4 h-4" />
+                  </Button>
+                )}
+              </div>
+            </div>
+          </div>
+
+          <div className="p-4">
+            {error && (
+              <Alert variant="destructive" className="mb-4">
+                <AlertCircle className="h-4 w-4" />
+                <AlertDescription>{error}</AlertDescription>
+              </Alert>
+            )}
+
+            {selectedTool ? (
+              (() => {
+                const hasFields =
+                  selectedTool.inputSchema.properties &&
+                  Object.keys(selectedTool.inputSchema.properties).length > 0;
+
+                return (
+                  <div className="space-y-4">
+                    {!isAppOpen ? (
+                      <div className="space-y-4">
+                        {selectedTool.description && (
+                          <p className="text-sm text-gray-600 dark:text-gray-400 whitespace-pre-wrap">
+                            {selectedTool.description}
+                          </p>
+                        )}
+
+                        <div className="space-y-4 border rounded-lg p-4 bg-muted/30">
+                          <h4 className="font-medium text-sm">App Input</h4>
+                          {Object.entries(
+                            selectedTool.inputSchema.properties ?? [],
+                          ).map(([key, value]) => {
+                            // First resolve any $ref references
+                            const resolvedValue = resolveRef(
+                              value as JsonSchemaType,
+                              selectedTool.inputSchema as JsonSchemaType,
+                            );
+                            const prop = normalizeUnionType(resolvedValue);
+                            const inputSchema =
+                              selectedTool.inputSchema as JsonSchemaType;
+                            const required = isPropertyRequired(
+                              key,
+                              inputSchema,
+                            );
+
+                            return (
+                              <div key={key} className="space-y-2">
+                                <div className="flex justify-between">
+                                  <Label
+                                    htmlFor={key}
+                                    className="block text-sm font-medium text-gray-700 dark:text-gray-300"
+                                  >
+                                    {key}
+                                    {required && (
+                                      <span className="text-red-500 ml-1">
+                                        *
+                                      </span>
+                                    )}
+                                  </Label>
+                                  {prop.nullable ? (
+                                    <div className="flex items-center space-x-2">
+                                      <Checkbox
+                                        id={`${key}-null`}
+                                        checked={params[key] === null}
+                                        onCheckedChange={(checked: boolean) =>
+                                          setParams({
+                                            ...params,
+                                            [key]: checked
+                                              ? null
+                                              : prop.type === "array"
+                                                ? undefined
+                                                : prop.default !== null
+                                                  ? prop.default
+                                                  : prop.type === "boolean"
+                                                    ? false
+                                                    : prop.type === "string"
+                                                      ? ""
+                                                      : undefined,
+                                          })
+                                        }
+                                      />
+                                      <label
+                                        htmlFor={`${key}-null`}
+                                        className="text-sm font-medium text-gray-700 dark:text-gray-300"
+                                      >
+                                        null
+                                      </label>
+                                    </div>
+                                  ) : null}
+                                </div>
+
+                                <div
+                                  className={`${prop.nullable && params[key] === null ? "pointer-events-none opacity-50" : ""}`}
+                                >
+                                  {prop.type === "boolean" ? (
+                                    <div className="flex items-center space-x-2">
+                                      <Checkbox
+                                        id={key}
+                                        checked={!!params[key]}
+                                        onCheckedChange={(checked: boolean) =>
+                                          setParams({
+                                            ...params,
+                                            [key]: checked,
+                                          })
+                                        }
+                                      />
+                                      <label
+                                        htmlFor={key}
+                                        className="text-sm font-medium text-gray-700 dark:text-gray-300"
+                                      >
+                                        {prop.description ||
+                                          "Toggle this option"}
+                                      </label>
+                                    </div>
+                                  ) : prop.type === "string" && prop.enum ? (
+                                    <Select
+                                      value={
+                                        params[key] === undefined
+                                          ? ""
+                                          : String(params[key])
+                                      }
+                                      onValueChange={(value) => {
+                                        setParams({
+                                          ...params,
+                                          [key]:
+                                            value === "" ? undefined : value,
+                                        });
+                                      }}
+                                    >
+                                      <SelectTrigger id={key}>
+                                        <SelectValue
+                                          placeholder={
+                                            prop.description ||
+                                            "Select an option"
+                                          }
+                                        />
+                                      </SelectTrigger>
+                                      <SelectContent>
+                                        {prop.enum.map((option) => (
+                                          <SelectItem
+                                            key={option}
+                                            value={option}
+                                          >
+                                            {option}
+                                          </SelectItem>
+                                        ))}
+                                      </SelectContent>
+                                    </Select>
+                                  ) : prop.type === "string" ? (
+                                    <Textarea
+                                      id={key}
+                                      placeholder={prop.description}
+                                      value={
+                                        params[key] === undefined
+                                          ? ""
+                                          : String(params[key])
+                                      }
+                                      onChange={(e) => {
+                                        setParams({
+                                          ...params,
+                                          [key]:
+                                            e.target.value === ""
+                                              ? undefined
+                                              : e.target.value,
+                                        });
+                                      }}
+                                    />
+                                  ) : prop.type === "object" ||
+                                    prop.type === "array" ? (
+                                    <DynamicJsonForm
+                                      ref={(ref) =>
+                                        (formRefs.current[key] = ref)
+                                      }
+                                      schema={{
+                                        type: prop.type,
+                                        properties: prop.properties,
+                                        description: prop.description,
+                                        items: prop.items,
+                                      }}
+                                      value={
+                                        (params[key] as JsonValue) ??
+                                        generateDefaultValue(prop)
+                                      }
+                                      onChange={(newValue: JsonValue) => {
+                                        setParams({
+                                          ...params,
+                                          [key]: newValue,
+                                        });
+                                        setTimeout(checkValidationErrors, 100);
+                                      }}
+                                    />
+                                  ) : prop.type === "number" ||
+                                    prop.type === "integer" ? (
+                                    <Input
+                                      type="number"
+                                      id={key}
+                                      placeholder={prop.description}
+                                      value={
+                                        params[key] === undefined
+                                          ? ""
+                                          : String(params[key])
+                                      }
+                                      onChange={(e) => {
+                                        const value = e.target.value;
+                                        if (value === "") {
+                                          setParams({
+                                            ...params,
+                                            [key]: undefined,
+                                          });
+                                        } else {
+                                          const num = Number(value);
+                                          setParams({
+                                            ...params,
+                                            [key]: isNaN(num) ? value : num,
+                                          });
+                                        }
+                                      }}
+                                    />
+                                  ) : (
+                                    <DynamicJsonForm
+                                      ref={(ref) =>
+                                        (formRefs.current[key] = ref)
+                                      }
+                                      schema={{
+                                        type: prop.type,
+                                        properties: prop.properties,
+                                        description: prop.description,
+                                        items: prop.items,
+                                      }}
+                                      value={params[key] as JsonValue}
+                                      onChange={(newValue: JsonValue) => {
+                                        setParams({
+                                          ...params,
+                                          [key]: newValue,
+                                        });
+                                        setTimeout(checkValidationErrors, 100);
+                                      }}
+                                    />
+                                  )}
+                                </div>
+                              </div>
+                            );
+                          })}
+
+                          <Button
+                            onClick={handleOpenApp}
+                            className="w-full"
+                            disabled={hasValidationErrors}
+                          >
+                            <Play className="w-4 h-4 mr-2" />
+                            Open App
+                          </Button>
+                        </div>
+                      </div>
+                    ) : (
+                      <div className="space-y-4">
+                        {hasFields && (
+                          <div className="flex justify-end">
+                            <Button
+                              onClick={handleCloseApp}
+                              variant="outline"
+                              size="sm"
+                            >
+                              Back to Input
+                            </Button>
+                          </div>
+                        )}
+                        <div className="h-[600px]">
+                          <AppRenderer
+                            sandboxPath={sandboxPath}
+                            tool={selectedTool}
+                            mcpClient={mcpClient}
+                            toolInput={params}
+                            onNotification={onNotification}
+                          />
+                        </div>
+                      </div>
+                    )}
+                  </div>
+                );
+              })()
+            ) : (
+              <div className="flex flex-col items-center justify-center py-12 text-muted-foreground space-y-4">
+                <AlertCircle className="w-12 h-12 opacity-20" />
+                <p>Select an app from the list to get started</p>
+                {appTools.length === 0 && (
+                  <p className="text-xs text-center max-w-[200px]">
+                    No MCP Apps available. Apps are tools that include a{" "}
+                    <code className="bg-muted px-1 rounded">
+                      _meta.ui.resourceUri
+                    </code>
+                  </p>
+                )}
+              </div>
+            )}
+          </div>
+        </div>
+      </div>
+    </TabsContent>
+  );
+};
+
+export default AppsTab;
diff --git a/client/src/components/ListPane.tsx b/client/src/components/ListPane.tsx
index 8cc2c1fe..e88aadb5 100644
--- a/client/src/components/ListPane.tsx
+++ b/client/src/components/ListPane.tsx
@@ -6,7 +6,7 @@ import { useState, useMemo, useRef } from "react";
 type ListPaneProps<T> = {
   items: T[];
   listItems: () => void;
-  clearItems: () => void;
+  clearItems?: () => void;
   setSelectedItem: (item: T) => void;
   renderItem: (item: T) => React.ReactNode;
   title: string;
@@ -101,14 +101,16 @@ const ListPane = <T extends object>({
         >
           {buttonText}
         </Button>
-        <Button
-          variant="outline"
-          className="w-full mb-4"
-          onClick={clearItems}
-          disabled={items.length === 0}
-        >
-          Clear
-        </Button>
+        {clearItems && (
+          <Button
+            variant="outline"
+            className="w-full mb-4"
+            onClick={clearItems}
+            disabled={items.length === 0}
+          >
+            Clear
+          </Button>
+        )}
         <div className="space-y-2 overflow-y-auto max-h-96">
           {filteredItems.map((item, index) => (
             <div
diff --git a/client/src/components/__tests__/AppRenderer.test.tsx b/client/src/components/__tests__/AppRenderer.test.tsx
new file mode 100644
index 00000000..beb57e1a
--- /dev/null
+++ b/client/src/components/__tests__/AppRenderer.test.tsx
@@ -0,0 +1,115 @@
+import { render, screen, fireEvent } from "@testing-library/react";
+import "@testing-library/jest-dom";
+import { describe, it, jest, beforeEach } from "@jest/globals";
+import AppRenderer from "../AppRenderer";
+import { Tool } from "@modelcontextprotocol/sdk/types.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { RequestHandlerExtra } from "@mcp-ui/client";
+import { McpUiMessageResult } from "@modelcontextprotocol/ext-apps";
+
+// Mock the ext-apps module
+jest.mock("@modelcontextprotocol/ext-apps/app-bridge", () => ({
+  getToolUiResourceUri: (tool: Tool) => {
+    const meta = (tool as Tool & { _meta?: { ui?: { resourceUri?: string } } })
+      ._meta;
+    return meta?.ui?.resourceUri || null;
+  },
+}));
+
+// Mock toast hook
+const mockToast = jest.fn();
+jest.mock("@/lib/hooks/useToast", () => ({
+  useToast: () => ({
+    toast: mockToast,
+  }),
+}));
+
+// Mock @mcp-ui/client
+jest.mock("@mcp-ui/client", () => ({
+  AppRenderer: ({
+    toolName,
+    onMessage,
+  }: {
+    toolName: string;
+    onMessage?: (
+      params: { role: "user"; content: { type: "text"; text: string }[] },
+      extra: RequestHandlerExtra,
+    ) => Promise<McpUiMessageResult>;
+  }) => (
+    <div data-testid="mcp-ui-app-renderer">
+      <div data-testid="tool-name">{toolName}</div>
+      <button
+        data-testid="trigger-message"
+        onClick={() =>
+          onMessage?.(
+            { role: "user", content: [{ type: "text", text: "Test message" }] },
+            {} as RequestHandlerExtra,
+          )
+        }
+      >
+        Trigger Message
+      </button>
+    </div>
+  ),
+}));
+
+describe("AppRenderer", () => {
+  const mockTool: Tool = {
+    name: "testApp",
+    description: "Test app with UI",
+    inputSchema: {
+      type: "object" as const,
+      properties: {},
+    },
+    _meta: {
+      ui: {
+        resourceUri: "ui://test-app",
+      },
+    },
+  } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+  const mockMcpClient = {
+    request: jest.fn(),
+    getServerCapabilities: jest.fn().mockReturnValue({}),
+    setNotificationHandler: jest.fn(),
+  } as unknown as Client;
+
+  const defaultProps = {
+    sandboxPath: "/sandbox",
+    tool: mockTool,
+    mcpClient: mockMcpClient,
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("should display waiting state when mcpClient is null", () => {
+    render(<AppRenderer {...defaultProps} mcpClient={null} />);
+    expect(screen.getByText(/Waiting for MCP client/i)).toBeInTheDocument();
+  });
+
+  it("should render McpUiAppRenderer when client is ready", () => {
+    render(<AppRenderer {...defaultProps} />);
+
+    expect(screen.getByTestId("mcp-ui-app-renderer")).toBeInTheDocument();
+    expect(screen.getByTestId("tool-name")).toHaveTextContent("testApp");
+  });
+
+  it("should set minimum height on container", () => {
+    render(<AppRenderer {...defaultProps} />);
+
+    const container = screen.getByTestId("mcp-ui-app-renderer").parentElement;
+    expect(container).toHaveStyle({ minHeight: "400px" });
+  });
+
+  it("should show toast when onMessage is triggered", () => {
+    render(<AppRenderer {...defaultProps} />);
+
+    fireEvent.click(screen.getByTestId("trigger-message"));
+
+    expect(mockToast).toHaveBeenCalledWith({
+      description: "Test message",
+    });
+  });
+});
diff --git a/client/src/components/__tests__/AppsTab.test.tsx b/client/src/components/__tests__/AppsTab.test.tsx
new file mode 100644
index 00000000..27868fca
--- /dev/null
+++ b/client/src/components/__tests__/AppsTab.test.tsx
@@ -0,0 +1,481 @@
+import { render, screen, fireEvent } from "@testing-library/react";
+import "@testing-library/jest-dom";
+import { describe, it, jest, beforeEach } from "@jest/globals";
+import AppsTab from "../AppsTab";
+import { Tool } from "@modelcontextprotocol/sdk/types.js";
+import { Tabs } from "../ui/tabs";
+
+// Mock AppRenderer component
+jest.mock("../AppRenderer", () => {
+  return function MockAppRenderer({
+    tool,
+    toolInput,
+  }: {
+    tool: Tool;
+    toolInput?: Record<string, unknown>;
+  }) {
+    return (
+      <div data-testid="app-renderer">
+        <div>Tool: {tool.name}</div>
+        <div data-testid="tool-input">{JSON.stringify(toolInput)}</div>
+      </div>
+    );
+  };
+});
+
+describe("AppsTab", () => {
+  const mockAppTool: Tool = {
+    name: "weatherApp",
+    description: "Weather app with UI",
+    inputSchema: {
+      type: "object" as const,
+      properties: {},
+    },
+    _meta: {
+      ui: {
+        resourceUri: "ui://weather-app",
+      },
+    },
+  } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+  const mockRegularTool: Tool = {
+    name: "regularTool",
+    description: "Regular tool without UI",
+    inputSchema: {
+      type: "object" as const,
+      properties: {},
+    },
+  };
+
+  const defaultProps = {
+    tools: [],
+    listTools: jest.fn(),
+    error: null,
+    mcpClient: null,
+  };
+
+  const renderAppsTab = (props = {}) => {
+    return render(
+      <Tabs defaultValue="apps">
+        <AppsTab {...defaultProps} {...props} />
+      </Tabs>,
+    );
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("should display message when no apps are available", () => {
+    renderAppsTab();
+
+    expect(screen.getByText(/No MCP Apps available/i)).toBeInTheDocument();
+    expect(screen.getByText(/_meta\.ui\.resourceUri/)).toBeInTheDocument();
+  });
+
+  it("should filter and display only tools with UI metadata", () => {
+    renderAppsTab({
+      tools: [mockAppTool, mockRegularTool],
+    });
+
+    // Should show the app tool
+    expect(screen.getByText("weatherApp")).toBeInTheDocument();
+    expect(screen.getByText("Weather app with UI")).toBeInTheDocument();
+
+    // Should not show the regular tool
+    expect(screen.queryByText("regularTool")).not.toBeInTheDocument();
+  });
+
+  it("should display multiple app tools in a grid", () => {
+    const mockAppTool2: Tool = {
+      name: "calendarApp",
+      description: "Calendar app with UI",
+      inputSchema: {
+        type: "object" as const,
+        properties: {},
+      },
+      _meta: {
+        ui: {
+          resourceUri: "ui://calendar-app",
+        },
+      },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [mockAppTool, mockAppTool2],
+    });
+
+    expect(screen.getByText("weatherApp")).toBeInTheDocument();
+    expect(screen.getByText("calendarApp")).toBeInTheDocument();
+  });
+
+  it("should call listTools when refresh button is clicked", () => {
+    const mockListTools = jest.fn();
+    renderAppsTab({
+      tools: [mockAppTool],
+      listTools: mockListTools,
+    });
+
+    const refreshButton = screen.getByRole("button", { name: /refresh/i });
+    fireEvent.click(refreshButton);
+
+    expect(mockListTools).toHaveBeenCalledTimes(1);
+  });
+
+  it("should display error message when error prop is provided", () => {
+    const errorMessage = "Failed to fetch tools";
+    renderAppsTab({
+      error: errorMessage,
+    });
+
+    expect(screen.getByText(errorMessage)).toBeInTheDocument();
+  });
+
+  it("should open app renderer when an app card is clicked and Open App button is clicked if fields exist", () => {
+    const toolWithFields: Tool = {
+      name: "fieldsApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          field1: { type: "string" },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://fields" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [toolWithFields],
+    });
+
+    const appCard = screen.getByText("fieldsApp").closest("div");
+    expect(appCard).toBeTruthy();
+    fireEvent.click(appCard!);
+
+    // Should see the input form now, not the renderer yet
+    expect(screen.queryByTestId("app-renderer")).not.toBeInTheDocument();
+    expect(screen.getByText("App Input")).toBeInTheDocument();
+
+    // Click Open App button
+    const openAppButton = screen.getByRole("button", { name: /open app/i });
+    fireEvent.click(openAppButton);
+
+    // AppRenderer should be rendered
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    expect(screen.getByText("Tool: fieldsApp")).toBeInTheDocument();
+  });
+
+  it("should close app renderer when close button is clicked", () => {
+    renderAppsTab({
+      tools: [mockAppTool],
+    });
+
+    // Open the app
+    const appCard = screen.getByText("weatherApp").closest("div");
+    fireEvent.click(appCard!);
+    // weatherApp has no properties in mockAppTool, so it should be open immediately
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+
+    // Close the app (Deselect tool)
+    const closeButton = screen.getByRole("button", { name: /close app/i });
+    fireEvent.click(closeButton);
+
+    // AppRenderer should be removed
+    expect(screen.queryByTestId("app-renderer")).not.toBeInTheDocument();
+  });
+
+  it("should handle tool without description", () => {
+    const toolWithoutDescription: Tool = {
+      name: "noDescriptionApp",
+      inputSchema: {
+        type: "object" as const,
+        properties: {},
+      },
+      _meta: {
+        ui: {
+          resourceUri: "ui://no-description-app",
+        },
+      },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [toolWithoutDescription],
+    });
+
+    expect(screen.getByText("noDescriptionApp")).toBeInTheDocument();
+  });
+
+  it("should reset selected tool when tools list changes and selected tool is removed", () => {
+    const { rerender } = renderAppsTab({
+      tools: [mockAppTool],
+    });
+
+    // Select the app
+    const appCard = screen.getByText("weatherApp").closest("div");
+    fireEvent.click(appCard!);
+    // weatherApp has no properties in mockAppTool, so it should be open immediately
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+
+    // Update tools list to remove the selected tool
+    rerender(
+      <Tabs defaultValue="apps">
+        <AppsTab {...defaultProps} tools={[]} />
+      </Tabs>,
+    );
+
+    // AppRenderer should be removed
+    expect(screen.queryByTestId("app-renderer")).not.toBeInTheDocument();
+  });
+
+  it("should maintain selected tool when tools list updates but includes the same tool", () => {
+    const { rerender } = renderAppsTab({
+      tools: [mockAppTool],
+    });
+
+    // Select the app
+    const appCard = screen.getByText("weatherApp").closest("div");
+    fireEvent.click(appCard!);
+    // weatherApp has no properties in mockAppTool, so it should be open immediately
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+
+    // Update tools list with the same tool
+    rerender(
+      <Tabs defaultValue="apps">
+        <AppsTab {...defaultProps} tools={[mockAppTool]} />
+      </Tabs>,
+    );
+
+    // AppRenderer should still be rendered
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+  });
+
+  it("should maximize and minimize the app window", () => {
+    renderAppsTab({
+      tools: [mockAppTool],
+    });
+
+    // Select the app
+    const appCard = screen.getByText("weatherApp").closest("div");
+    fireEvent.click(appCard!);
+    // weatherApp has no properties in mockAppTool, so it should be open immediately
+
+    // Now Maximize button should be visible
+    expect(
+      screen.getByRole("button", { name: /maximize/i }),
+    ).toBeInTheDocument();
+
+    // Initially, ListPane should be visible
+    expect(screen.getByText("MCP Apps")).toBeInTheDocument();
+
+    // Click Maximize
+    const maximizeButton = screen.getByRole("button", { name: /maximize/i });
+    fireEvent.click(maximizeButton);
+
+    // ListPane should be hidden
+    expect(screen.queryByText("MCP Apps")).not.toBeInTheDocument();
+
+    // Click Minimize
+    const minimizeButton = screen.getByRole("button", { name: /minimize/i });
+    fireEvent.click(minimizeButton);
+
+    // ListPane should be visible again
+    expect(screen.getByText("MCP Apps")).toBeInTheDocument();
+  });
+
+  it("should reset maximized state when app is closed", () => {
+    renderAppsTab({
+      tools: [mockAppTool],
+    });
+
+    // Select the app
+    const appCard = screen.getByText("weatherApp").closest("div");
+    fireEvent.click(appCard!);
+    // weatherApp has no properties in mockAppTool, so it should be open immediately
+
+    // Maximize
+    fireEvent.click(screen.getByRole("button", { name: /maximize/i }));
+    expect(screen.queryByText("MCP Apps")).not.toBeInTheDocument();
+
+    // Close app (deselect tool)
+    fireEvent.click(screen.getByRole("button", { name: /close app/i }));
+
+    // ListPane should be visible again
+    expect(screen.getByText("MCP Apps")).toBeInTheDocument();
+  });
+
+  it("should display app cards in the list", () => {
+    renderAppsTab({
+      tools: [mockAppTool],
+    });
+
+    const appItem = screen.getByText("weatherApp").closest("div");
+    expect(appItem).toBeTruthy();
+  });
+
+  it("should handle empty resourceContentMap", () => {
+    renderAppsTab({
+      tools: [mockAppTool],
+    });
+
+    // Open the app
+    const appCard = screen.getByText("weatherApp").closest("div");
+    fireEvent.click(appCard!);
+    // weatherApp has no properties in mockAppTool, so it should be open immediately
+
+    // AppRenderer should still be rendered
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+  });
+
+  it("should handle various input types and pass them to AppRenderer", () => {
+    const toolWithComplexSchema: Tool = {
+      name: "complexApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          text: { type: "string" },
+          toggle: { type: "boolean" },
+          number: { type: "number" },
+          choice: { type: "string", enum: ["a", "b"] },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://complex" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [toolWithComplexSchema],
+    });
+
+    fireEvent.click(screen.getByText("complexApp"));
+
+    // Fill the form
+    fireEvent.change(screen.getByLabelText("text"), {
+      target: { value: "hello" },
+    });
+    // Checkboxes are often rendered with a label next to them, let's look for the text
+    const toggleLabel = screen.getByText(/Toggle this option/i);
+    fireEvent.click(toggleLabel);
+    fireEvent.change(screen.getByLabelText("number"), {
+      target: { value: "42" },
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: /open app/i }));
+
+    const toolInput = JSON.parse(
+      screen.getByTestId("tool-input").textContent || "{}",
+    );
+    expect(toolInput.text).toBe("hello");
+    expect(toolInput.toggle).toBe(true);
+    expect(toolInput.number).toBe(42);
+  });
+
+  it("should handle nullable fields", () => {
+    const toolWithNullable: Tool = {
+      name: "nullableApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          nullableField: { type: ["string", "null"] },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://nullable" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [toolWithNullable],
+    });
+
+    fireEvent.click(screen.getByText("nullableApp"));
+
+    // Check the 'null' checkbox
+    const nullCheckbox = screen.getByLabelText("null");
+    fireEvent.click(nullCheckbox);
+
+    fireEvent.click(screen.getByRole("button", { name: /open app/i }));
+
+    const toolInput = JSON.parse(
+      screen.getByTestId("tool-input").textContent || "{}",
+    );
+    expect(toolInput.nullableField).toBe(null);
+  });
+
+  it("should allow going back to input form from app renderer", () => {
+    const toolWithFields: Tool = {
+      name: "fieldsApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          field1: { type: "string" },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://fields" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [toolWithFields],
+    });
+
+    fireEvent.click(screen.getByText("fieldsApp"));
+    fireEvent.click(screen.getByRole("button", { name: /open app/i }));
+
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+
+    const backButton = screen.queryByRole("button", { name: /back to input/i });
+    expect(backButton).toBeInTheDocument();
+  });
+
+  it("should skip input form if tool has no input fields", () => {
+    const toolNoFields: Tool = {
+      name: "noFieldsApp",
+      inputSchema: {
+        type: "object",
+        properties: {},
+      },
+      _meta: { ui: { resourceUri: "ui://no-fields" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [toolNoFields],
+    });
+
+    fireEvent.click(screen.getByText("noFieldsApp"));
+
+    // Should see the renderer immediately
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    expect(screen.getByText("Tool: noFieldsApp")).toBeInTheDocument();
+
+    // Should NOT see the back button
+    expect(
+      screen.queryByRole("button", { name: /back to input/i }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("should allow going back to input form from app renderer if fields exist", () => {
+    const toolWithFields: Tool = {
+      name: "fieldsApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          field1: { type: "string" },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://fields" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [toolWithFields],
+    });
+
+    fireEvent.click(screen.getByText("fieldsApp"));
+
+    // Should see input form first
+    expect(screen.getByText("App Input")).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: /open app/i }));
+
+    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+
+    const backButton = screen.getByRole("button", { name: /back to input/i });
+    fireEvent.click(backButton);
+
+    expect(screen.queryByTestId("app-renderer")).not.toBeInTheDocument();
+    expect(screen.getByText("App Input")).toBeInTheDocument();
+  });
+});
diff --git a/client/src/components/__tests__/AuthDebugger.test.tsx b/client/src/components/__tests__/AuthDebugger.test.tsx
index 5d5042ea..b05a4898 100644
--- a/client/src/components/__tests__/AuthDebugger.test.tsx
+++ b/client/src/components/__tests__/AuthDebugger.test.tsx
@@ -8,8 +8,8 @@ import {
 import "@testing-library/jest-dom";
 import { describe, it, beforeEach, jest } from "@jest/globals";
 import AuthDebugger, { AuthDebuggerProps } from "../AuthDebugger";
-import { TooltipProvider } from "@/components/ui/tooltip";
-import { SESSION_KEYS } from "@/lib/constants";
+import { TooltipProvider } from "../ui/tooltip";
+import { SESSION_KEYS } from "../../lib/constants";
 
 const mockOAuthTokens = {
   access_token: "test_access_token",
@@ -55,7 +55,7 @@ import {
   discoverOAuthProtectedResourceMetadata,
 } from "@modelcontextprotocol/sdk/client/auth.js";
 import { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
-import { EMPTY_DEBUGGER_STATE } from "@/lib/auth-types";
+import { EMPTY_DEBUGGER_STATE } from "../../lib/auth-types";
 
 // Mock local auth module
 jest.mock("@/lib/auth", () => ({
@@ -106,7 +106,7 @@ jest.mock("@/lib/auth", () => ({
   discoverScopes: jest.fn().mockResolvedValue("read write" as never),
 }));
 
-import { discoverScopes } from "@/lib/auth";
+import { discoverScopes } from "../../lib/auth";
 
 // Type the mocked functions properly
 const mockDiscoverAuthorizationServerMetadata =
diff --git a/client/src/components/__tests__/ListPane.test.tsx b/client/src/components/__tests__/ListPane.test.tsx
index 26b5b9a4..e930a52a 100644
--- a/client/src/components/__tests__/ListPane.test.tsx
+++ b/client/src/components/__tests__/ListPane.test.tsx
@@ -13,7 +13,6 @@ describe("ListPane", () => {
   const defaultProps = {
     items: mockItems,
     listItems: jest.fn(),
-    clearItems: jest.fn(),
     setSelectedItem: jest.fn(),
     renderItem: (item: (typeof mockItems)[0]) => <div>{item.name}</div>,
     title: "List tools",
@@ -36,6 +35,13 @@ describe("ListPane", () => {
       expect(
         screen.getByRole("button", { name: "Load Tools" }),
       ).toBeInTheDocument();
+      expect(
+        screen.queryByRole("button", { name: "Clear" }),
+      ).not.toBeInTheDocument();
+    });
+
+    it("should render Clear button when clearItems prop is provided", () => {
+      renderListPane({ clearItems: jest.fn() });
       expect(screen.getByRole("button", { name: "Clear" })).toBeInTheDocument();
     });
 
diff --git a/client/src/components/__tests__/ResourcesTab.test.tsx b/client/src/components/__tests__/ResourcesTab.test.tsx
index d564b02c..355fa4d6 100644
--- a/client/src/components/__tests__/ResourcesTab.test.tsx
+++ b/client/src/components/__tests__/ResourcesTab.test.tsx
@@ -1,6 +1,6 @@
 import { render, screen, fireEvent } from "@testing-library/react";
 import "@testing-library/jest-dom";
-import { Tabs } from "@/components/ui/tabs";
+import { Tabs } from "../ui/tabs";
 import ResourcesTab from "../ResourcesTab";
 import { ResourceTemplate, Resource } from "@modelcontextprotocol/sdk/types.js";
 
diff --git a/package-lock.json b/package-lock.json
index 0cecbf66..e1633c5b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -60,47 +60,11 @@
         "mcp-inspector-cli": "build/cli.js"
       },
       "devDependencies": {
-        "@types/express": "^5.0.6",
+        "@types/express": "^5.0.0",
         "tsx": "^4.7.0",
         "vitest": "^4.0.17"
       }
     },
-    "cli/node_modules/@types/express": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.6.tgz",
-      "integrity": "sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/body-parser": "*",
-        "@types/express-serve-static-core": "^5.0.0",
-        "@types/serve-static": "^2"
-      }
-    },
-    "cli/node_modules/@types/express-serve-static-core": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.1.tgz",
-      "integrity": "sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/node": "*",
-        "@types/qs": "*",
-        "@types/range-parser": "*",
-        "@types/send": "*"
-      }
-    },
-    "cli/node_modules/@types/serve-static": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-2.2.0.tgz",
-      "integrity": "sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/http-errors": "*",
-        "@types/node": "*"
-      }
-    },
     "cli/node_modules/commander": {
       "version": "13.1.0",
       "resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
@@ -115,6 +79,8 @@
       "version": "0.19.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
+        "@mcp-ui/client": "^6.0.0",
+        "@modelcontextprotocol/ext-apps": "^1.0.0",
         "@modelcontextprotocol/sdk": "^1.25.2",
         "@radix-ui/react-checkbox": "^1.1.4",
         "@radix-ui/react-dialog": "^1.1.3",
@@ -227,7 +193,6 @@
       "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@csstools/css-calc": "^2.1.3",
         "@csstools/css-color-parser": "^3.0.9",
@@ -241,8 +206,7 @@
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
       "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
-      "license": "ISC",
-      "peer": true
+      "license": "ISC"
     },
     "node_modules/@babel/code-frame": {
       "version": "7.27.1",
@@ -275,6 +239,7 @@
       "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@babel/generator": "^7.28.5",
@@ -820,7 +785,6 @@
         }
       ],
       "license": "MIT-0",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -841,7 +805,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -866,7 +829,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@csstools/color-helpers": "^5.1.0",
         "@csstools/css-calc": "^2.1.4"
@@ -1636,9 +1598,9 @@
       }
     },
     "node_modules/@isaacs/brace-expansion": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.0.tgz",
-      "integrity": "sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.1.tgz",
+      "integrity": "sha512-WMz71T1JS624nWj2n2fnYAuPovhv7EUhk69R6i9dsVyzxt5eM3bjwvgk9L+APE1TRscGysAVMANkB0jh0LQZrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1888,7 +1850,6 @@
       "integrity": "sha512-kazxw2L9IPuZpQ0mEt9lu9Z98SqR74xcagANmMBU16X0lS23yPc0+S6hGLUz8kVRlomZEs/5S/Zlpqwf5yu6OQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/fake-timers": "30.2.0",
@@ -1917,7 +1878,6 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -1934,7 +1894,6 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -1953,7 +1912,6 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -1967,7 +1925,6 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -1986,8 +1943,7 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@jest/environment-jsdom-abstract/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -1995,7 +1951,6 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -2006,7 +1961,6 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -2019,7 +1973,6 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -2039,7 +1992,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -2050,7 +2002,6 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -2072,7 +2023,6 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2088,7 +2038,6 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2107,7 +2056,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -2121,7 +2069,6 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -2136,8 +2083,7 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@jest/expect": {
       "version": "29.7.0",
@@ -2206,7 +2152,6 @@
       "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "jest-regex-util": "30.0.1"
@@ -2221,7 +2166,6 @@
       "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
@@ -2423,6 +2367,111 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@mcp-ui/client": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@mcp-ui/client/-/client-6.0.0.tgz",
+      "integrity": "sha512-dHIQGjFOoBWBntSRUJH5YFeq7xi2rEPS0EwokeNAnMg6xrjGjvNd6vTWDHFRC04OlO/ogvM1r5+xUoo0OETaaQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@modelcontextprotocol/ext-apps": "^0.3.1",
+        "@modelcontextprotocol/sdk": "^1.24.0",
+        "@quilted/threads": "^3.1.3",
+        "@r2wc/react-to-web-component": "^2.0.4",
+        "@remote-dom/core": "^1.8.0",
+        "@remote-dom/react": "^1.2.2",
+        "zod": "^3.23.8"
+      },
+      "peerDependencies": {
+        "react": "^18 || ^19",
+        "react-dom": "^18 || ^19"
+      }
+    },
+    "node_modules/@mcp-ui/client/node_modules/@modelcontextprotocol/ext-apps": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/ext-apps/-/ext-apps-0.3.1.tgz",
+      "integrity": "sha512-Iivz2KwWK8xlRbiWwFB/C4NXqE8VJBoRCbBkJCN98ST2UbQvA6kfyebcLsypiqylJS467XOOaBcI9DeQ3t+zqA==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "workspaces": [
+        "examples/*"
+      ],
+      "optionalDependencies": {
+        "@oven/bun-darwin-aarch64": "^1.2.21",
+        "@oven/bun-darwin-x64": "^1.2.21",
+        "@oven/bun-darwin-x64-baseline": "^1.2.21",
+        "@oven/bun-linux-aarch64": "^1.2.21",
+        "@oven/bun-linux-aarch64-musl": "^1.2.21",
+        "@oven/bun-linux-x64": "^1.2.21",
+        "@oven/bun-linux-x64-baseline": "^1.2.21",
+        "@oven/bun-linux-x64-musl": "^1.2.21",
+        "@oven/bun-linux-x64-musl-baseline": "^1.2.21",
+        "@oven/bun-windows-x64": "^1.2.21",
+        "@oven/bun-windows-x64-baseline": "^1.2.21",
+        "@rollup/rollup-darwin-arm64": "^4.53.3",
+        "@rollup/rollup-darwin-x64": "^4.53.3",
+        "@rollup/rollup-linux-arm64-gnu": "^4.53.3",
+        "@rollup/rollup-linux-x64-gnu": "^4.53.3",
+        "@rollup/rollup-win32-arm64-msvc": "^4.53.3",
+        "@rollup/rollup-win32-x64-msvc": "^4.53.3"
+      },
+      "peerDependencies": {
+        "@modelcontextprotocol/sdk": "^1.24.0",
+        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "zod": "^3.25.0 || ^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@modelcontextprotocol/ext-apps": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/ext-apps/-/ext-apps-1.0.0.tgz",
+      "integrity": "sha512-d5vGKBhWkRoa3xlKOynF8kd+sTSY2D3QSjTMCs46/ddOUOSn5e/E0SaShixFm7H7mNlj4uY0RuU0jAsPM/0qwA==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "workspaces": [
+        "examples/*"
+      ],
+      "optionalDependencies": {
+        "@oven/bun-darwin-aarch64": "^1.2.21",
+        "@oven/bun-darwin-x64": "^1.2.21",
+        "@oven/bun-darwin-x64-baseline": "^1.2.21",
+        "@oven/bun-linux-aarch64": "^1.2.21",
+        "@oven/bun-linux-aarch64-musl": "^1.2.21",
+        "@oven/bun-linux-x64": "^1.2.21",
+        "@oven/bun-linux-x64-baseline": "^1.2.21",
+        "@oven/bun-linux-x64-musl": "^1.2.21",
+        "@oven/bun-linux-x64-musl-baseline": "^1.2.21",
+        "@oven/bun-windows-x64": "^1.2.21",
+        "@oven/bun-windows-x64-baseline": "^1.2.21",
+        "@rollup/rollup-darwin-arm64": "^4.53.3",
+        "@rollup/rollup-darwin-x64": "^4.53.3",
+        "@rollup/rollup-linux-arm64-gnu": "^4.53.3",
+        "@rollup/rollup-linux-x64-gnu": "^4.53.3",
+        "@rollup/rollup-win32-arm64-msvc": "^4.53.3",
+        "@rollup/rollup-win32-x64-msvc": "^4.53.3"
+      },
+      "peerDependencies": {
+        "@modelcontextprotocol/sdk": "^1.24.0",
+        "react": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^17.0.0 || ^18.0.0 || ^19.0.0",
+        "zod": "^3.25.0 || ^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@modelcontextprotocol/inspector-cli": {
       "resolved": "cli",
       "link": true
@@ -2440,6 +2489,7 @@
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.26.0.tgz",
       "integrity": "sha512-Y5RmPncpiDtTXDbLKswIJzTqu2hyBKxTNsgKqKclDbhIgg1wgtf1fRuvxgTnRfcnxtvvgbIEcqUOzZrJ6iSReg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@hono/node-server": "^1.19.9",
         "ajv": "^8.17.1",
@@ -2544,6 +2594,149 @@
         "node": ">= 8"
       }
     },
+    "node_modules/@oven/bun-darwin-aarch64": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-darwin-aarch64/-/bun-darwin-aarch64-1.3.6.tgz",
+      "integrity": "sha512-27rypIapNkYboOSylkf1tD9UW9Ado2I+P1NBL46Qz29KmOjTL6WuJ7mHDC5O66CYxlOkF5r93NPDAC3lFHYBXw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@oven/bun-darwin-x64": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-darwin-x64/-/bun-darwin-x64-1.3.6.tgz",
+      "integrity": "sha512-I82xGzPkBxzBKgbl8DsA0RfMQCWTWjNmLjIEkW1ECiv3qK02kHGQ5FGUr/29L/SuvnGsULW4tBTRNZiMzL37nA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@oven/bun-darwin-x64-baseline": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-darwin-x64-baseline/-/bun-darwin-x64-baseline-1.3.6.tgz",
+      "integrity": "sha512-nqtr+pTsHqusYpG2OZc6s+AmpWDB/FmBvstrK0y5zkti4OqnCuu7Ev2xNjS7uyb47NrAFF40pWqkpaio5XEd7w==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@oven/bun-linux-aarch64": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-linux-aarch64/-/bun-linux-aarch64-1.3.6.tgz",
+      "integrity": "sha512-YaQEAYjBanoOOtpqk/c5GGcfZIyxIIkQ2m1TbHjedRmJNwxzWBhGinSARFkrRIc3F8pRIGAopXKvJ/2rjN1LzQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oven/bun-linux-aarch64-musl": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-linux-aarch64-musl/-/bun-linux-aarch64-musl-1.3.6.tgz",
+      "integrity": "sha512-FR+iJt17rfFgYgpxL3M67AUwujOgjw52ZJzB9vElI5jQXNjTyOKf8eH4meSk4vjlYF3h/AjKYd6pmN0OIUlVKQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oven/bun-linux-x64": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-linux-x64/-/bun-linux-x64-1.3.6.tgz",
+      "integrity": "sha512-egfngj0dfJ868cf30E7B+ye9KUWSebYxOG4l9YP5eWeMXCtenpenx0zdKtAn9qxJgEJym5AN6trtlk+J6x8Lig==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oven/bun-linux-x64-baseline": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-linux-x64-baseline/-/bun-linux-x64-baseline-1.3.6.tgz",
+      "integrity": "sha512-jRmnX18ak8WzqLrex3siw0PoVKyIeI5AiCv4wJLgSs7VKfOqrPycfHIWfIX2jdn7ngqbHFPzI09VBKANZ4Pckg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oven/bun-linux-x64-musl": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-linux-x64-musl/-/bun-linux-x64-musl-1.3.6.tgz",
+      "integrity": "sha512-YeXcJ9K6vJAt1zSkeA21J6pTe7PgDMLTHKGI3nQBiMYnYf7Ob3K+b/ChSCznrJG7No5PCPiQPg4zTgA+BOTmSA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oven/bun-linux-x64-musl-baseline": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-linux-x64-musl-baseline/-/bun-linux-x64-musl-baseline-1.3.6.tgz",
+      "integrity": "sha512-7FjVnxnRTp/AgWqSQRT/Vt9TYmvnZ+4M+d9QOKh/Lf++wIFXFGSeAgD6bV1X/yr2UPVmZDk+xdhr2XkU7l2v3w==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oven/bun-windows-x64": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-windows-x64/-/bun-windows-x64-1.3.6.tgz",
+      "integrity": "sha512-Sr1KwUcbB0SEpnSPO22tNJppku2khjFluEst+mTGhxHzAGQTQncNeJxDnt3F15n+p9Q+mlcorxehd68n1siikQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@oven/bun-windows-x64-baseline": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/@oven/bun-windows-x64-baseline/-/bun-windows-x64-baseline-1.3.6.tgz",
+      "integrity": "sha512-PFUa7JL4lGoyyppeS4zqfuoXXih+gSE0XxhDMrCPVEUev0yhGNd/tbWBvcdpYnUth80owENoGjc8s5Knopv9wA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
     "node_modules/@playwright/test": {
       "version": "1.57.0",
       "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.57.0.tgz",
@@ -2560,6 +2753,67 @@
         "node": ">=18"
       }
     },
+    "node_modules/@preact/signals-core": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@preact/signals-core/-/signals-core-1.12.2.tgz",
+      "integrity": "sha512-5Yf8h1Ke3SMHr15xl630KtwPTW4sYDFkkxS0vQ8UiQLWwZQnrF9IKaVG1mN5VcJz52EcWs2acsc/Npjha/7ysA==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/preact"
+      }
+    },
+    "node_modules/@quilted/events": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@quilted/events/-/events-2.1.3.tgz",
+      "integrity": "sha512-4fHaSLND8rmZ+tce9/4FNmG5UWTRpFtM54kOekf3tLON4ZLLnYzjjldELD35efd7+lT5+E3cdkacqc56d+kCrQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@preact/signals-core": "^1.8.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@quilted/threads": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/@quilted/threads/-/threads-3.3.1.tgz",
+      "integrity": "sha512-0ASnjTH+hOu1Qwzi9NnsVcsbMhWVx8pEE8SXIHknqcc/1rXAU0QlKw9ARq0W43FAdzyVeuXeXtZN27ZC0iALKg==",
+      "license": "MIT",
+      "dependencies": {
+        "@quilted/events": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "@preact/signals-core": "^1.8.0"
+      },
+      "peerDependenciesMeta": {
+        "@preact/signals-core": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@r2wc/core": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@r2wc/core/-/core-1.3.0.tgz",
+      "integrity": "sha512-aPBnND92Itl+SWWbWyyxdFFF0+RqKB6dptGHEdiPB8ZvnHWHlVzOfEvbEcyUYGtB6HBdsfkVuBiaGYyBFVTzVQ==",
+      "license": "MIT"
+    },
+    "node_modules/@r2wc/react-to-web-component": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@r2wc/react-to-web-component/-/react-to-web-component-2.1.0.tgz",
+      "integrity": "sha512-m/PzgUOEiL1HxmvfP5LgBLqB7sHeRj+d1QAeZklwS4OEI2HUU+xTpT3hhJipH5DQoFInDqDTfe0lNFFKcrqk4w==",
+      "license": "MIT",
+      "dependencies": {
+        "@r2wc/core": "^1.3.0"
+      },
+      "peerDependencies": {
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0"
+      }
+    },
     "node_modules/@radix-ui/number": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/@radix-ui/number/-/number-1.1.1.tgz",
@@ -3504,6 +3758,61 @@
       "integrity": "sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw==",
       "license": "MIT"
     },
+    "node_modules/@remote-dom/core": {
+      "version": "1.10.1",
+      "resolved": "https://registry.npmjs.org/@remote-dom/core/-/core-1.10.1.tgz",
+      "integrity": "sha512-MlbUOGuHjOrB7uOkaYkIoLUG8lDK8/H1D7MHnGkgqbG6jwjwQSlGPHhbwnD6HYWsTGpAPOP02Byd8wBt9U6TEw==",
+      "license": "MIT",
+      "dependencies": {
+        "@remote-dom/polyfill": "^1.5.1",
+        "htm": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "@preact/signals-core": "^1.3.0"
+      },
+      "peerDependenciesMeta": {
+        "@preact/signals-core": {
+          "optional": true
+        },
+        "preact": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@remote-dom/polyfill": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/@remote-dom/polyfill/-/polyfill-1.5.1.tgz",
+      "integrity": "sha512-eaWdIVKZpNfbqspKkRQLVxiFv/7vIw8u0FVA5oy52YANFbO/WVT0GU+PQmRt/QUSijaB36HBAqx7stjo8HGpVQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@remote-dom/react": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@remote-dom/react/-/react-1.2.2.tgz",
+      "integrity": "sha512-PkvioODONTr1M0StGDYsR4Ssf5M0Rd4+IlWVvVoK3Zrw8nr7+5mJkgNofaj/z7i8Aep78L28PCW8/WduUt4unA==",
+      "license": "MIT",
+      "dependencies": {
+        "@remote-dom/core": "^1.7.0",
+        "@types/react": "^18.0.0",
+        "htm": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "peerDependencies": {
+        "react": "^17.0.0 || ^18.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@rolldown/pluginutils": {
       "version": "1.0.0-beta.53",
       "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-beta.53.tgz",
@@ -3546,7 +3855,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3560,7 +3868,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3630,7 +3937,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3728,7 +4034,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3770,7 +4075,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3812,7 +4116,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3968,8 +4271,7 @@
       "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
       "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
@@ -4073,22 +4375,21 @@
       "license": "MIT"
     },
     "node_modules/@types/express": {
-      "version": "4.17.25",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.25.tgz",
-      "integrity": "sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@types/express/-/express-5.0.6.tgz",
+      "integrity": "sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/body-parser": "*",
-        "@types/express-serve-static-core": "^4.17.33",
-        "@types/qs": "*",
-        "@types/serve-static": "^1"
+        "@types/express-serve-static-core": "^5.0.0",
+        "@types/serve-static": "^2"
       }
     },
     "node_modules/@types/express-serve-static-core": {
-      "version": "4.19.7",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.19.7.tgz",
-      "integrity": "sha512-FvPtiIf1LfhzsaIXhv/PHan/2FeQBbtBDtfX2QfvPxdUelMDEckK08SM6nqo1MIZY3RUlfA+HV8+hFUSio78qg==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.1.tgz",
+      "integrity": "sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4207,18 +4508,12 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@types/mime": {
-      "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
-      "integrity": "sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/node": {
       "version": "22.19.2",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.2.tgz",
       "integrity": "sha512-LPM2G3Syo1GLzXLGJAKdqoU35XvrWzGJ21/7sgZTUpbkBaOasTj8tjwn6w+hCkqaa1TfJ/w67rJSwYItlJ2mYw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -4234,7 +4529,6 @@
       "version": "15.7.15",
       "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
       "integrity": "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@types/qs": {
@@ -4255,8 +4549,8 @@
       "version": "18.3.27",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.27.tgz",
       "integrity": "sha512-cisd7gxkzjBKU2GgdYrTdtQx1SORymWyaAFhaxQPK9bYO9ot3Y5OikQRvY0VYQtvwjeQnizCINJAenh/V7MK2w==",
-      "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.2.2"
@@ -4268,6 +4562,7 @@
       "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "peerDependencies": {
         "@types/react": "^18.0.0"
       }
@@ -4293,25 +4588,13 @@
       }
     },
     "node_modules/@types/serve-static": {
-      "version": "1.15.10",
-      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.15.10.tgz",
-      "integrity": "sha512-tRs1dB+g8Itk72rlSI2ZrW6vZg0YrLI81iQSTkMmOqnqCaNr/8Ek4VwWcN5vZgCYWbg/JJSGBlUaYGAOP73qBw==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-2.2.0.tgz",
+      "integrity": "sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/http-errors": "*",
-        "@types/node": "*",
-        "@types/send": "<1"
-      }
-    },
-    "node_modules/@types/serve-static/node_modules/@types/send": {
-      "version": "0.17.6",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.6.tgz",
-      "integrity": "sha512-Uqt8rPBE8SY0RK8JB1EzVOIZ32uqy8HwdxCnoCOsYrvnswqmFZ/k+9Ikidlk/ImhsdvBsloHbAlewb2IEBV/Og==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@types/mime": "^1",
         "@types/node": "*"
       }
     },
@@ -4408,6 +4691,7 @@
       "integrity": "sha512-N9lBGA9o9aqb1hVMc9hzySbhKibHmB+N3IpoShyV6HyQYRGIhlrO5rQgttypi+yEeKsKI4idxC8Jw6gXKD4THA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.49.0",
         "@typescript-eslint/types": "8.49.0",
@@ -4790,6 +5074,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5262,6 +5547,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -5895,7 +6181,6 @@
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/data-uri-to-buffer": {
@@ -6101,8 +6386,7 @@
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
       "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/domexception": {
       "version": "4.0.0",
@@ -6360,6 +6644,7 @@
       "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -6657,6 +6942,7 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -6994,7 +7280,6 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
       "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
-      "dev": true,
       "license": "ISC"
     },
     "node_modules/fsevents": {
@@ -7140,7 +7425,6 @@
       "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
       "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
       "deprecated": "Glob versions prior to v9 are no longer supported",
-      "dev": true,
       "license": "ISC",
       "dependencies": {
         "fs.realpath": "^1.0.0",
@@ -7278,10 +7562,17 @@
       "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.7.tgz",
       "integrity": "sha512-l7qMiNee7t82bH3SeyUCt9UF15EVmaBvsppY2zQtrbIhl/yzBTny+YUxsVjSjQ6gaqaeVtZmGocom8TzBlA4Yw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=16.9.0"
       }
     },
+    "node_modules/htm": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/htm/-/htm-3.1.1.tgz",
+      "integrity": "sha512-983Vyg8NwUE7JkZ6NmOqpCZ+sh1bKv2iYTlUkzlWmA5JD2acKoxd4KVxbMmxX/85mtfdnDmTFoNKcg5DGAvxNQ==",
+      "license": "Apache-2.0"
+    },
     "node_modules/html-encoding-sniffer": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-3.0.0.tgz",
@@ -7465,7 +7756,6 @@
       "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
       "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
       "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
-      "dev": true,
       "license": "ISC",
       "dependencies": {
         "once": "^1.3.0",
@@ -7478,6 +7768,15 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
+    "node_modules/interpret": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/interpret/-/interpret-1.4.0.tgz",
+      "integrity": "sha512-agE4QfB2Lkp9uICn7BAqoscw4SZP9kTE2hxiFI3jBPmXJfdqiahTbUuKGsMoN2GtqL9AxhYioAcVvgsb1HvRbA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
     "node_modules/ip-address": {
       "version": "10.0.1",
       "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.0.1.tgz",
@@ -7520,7 +7819,6 @@
       "version": "2.16.1",
       "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
       "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "hasown": "^2.0.2"
@@ -7761,6 +8059,7 @@
       "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/core": "^29.7.0",
         "@jest/types": "^29.6.3",
@@ -8101,7 +8400,6 @@
       "integrity": "sha512-zbBTiqr2Vl78pKp/laGBREYzbZx9ZtqPjOK4++lL4BNDhxRnahg51HtoDrk9/VjIy9IthNEWdKVd7H5bqBhiWQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/environment-jsdom-abstract": "30.2.0",
@@ -8127,7 +8425,6 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -8144,7 +8441,6 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -8163,7 +8459,6 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -8177,7 +8472,6 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -8196,8 +8490,7 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/jest-environment-jsdom/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -8205,7 +8498,6 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -8216,7 +8508,6 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -8229,7 +8520,6 @@
       "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 14"
       }
@@ -8240,7 +8530,6 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -8260,7 +8549,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -8271,7 +8559,6 @@
       "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@asamuzakjp/css-color": "^3.2.0",
         "rrweb-cssom": "^0.8.0"
@@ -8286,7 +8573,6 @@
       "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "whatwg-mimetype": "^4.0.0",
         "whatwg-url": "^14.0.0"
@@ -8301,7 +8587,6 @@
       "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "whatwg-encoding": "^3.1.1"
       },
@@ -8315,7 +8600,6 @@
       "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.0",
         "debug": "^4.3.4"
@@ -8330,7 +8614,6 @@
       "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.2",
         "debug": "4"
@@ -8345,7 +8628,6 @@
       "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
@@ -8359,7 +8641,6 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -8381,7 +8662,6 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8397,7 +8677,6 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8416,7 +8695,6 @@
       "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "cssstyle": "^4.2.1",
         "data-urls": "^5.0.0",
@@ -8457,7 +8735,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -8471,7 +8748,6 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -8486,8 +8762,7 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/jest-environment-jsdom/node_modules/tough-cookie": {
       "version": "5.1.2",
@@ -8495,7 +8770,6 @@
       "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "peer": true,
       "dependencies": {
         "tldts": "^6.1.32"
       },
@@ -8509,7 +8783,6 @@
       "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "punycode": "^2.3.1"
       },
@@ -8523,7 +8796,6 @@
       "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "xml-name-validator": "^5.0.0"
       },
@@ -8537,7 +8809,6 @@
       "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "iconv-lite": "0.6.3"
       },
@@ -8551,7 +8822,6 @@
       "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -8562,7 +8832,6 @@
       "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "tr46": "^5.1.0",
         "webidl-conversions": "^7.0.0"
@@ -8577,7 +8846,6 @@
       "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -9172,6 +9440,7 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -9210,6 +9479,7 @@
       "integrity": "sha512-SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "abab": "^2.0.6",
         "acorn": "^8.8.1",
@@ -9548,7 +9818,6 @@
       "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "lz-string": "bin/bin.js"
       }
@@ -9743,7 +10012,6 @@
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
       "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "dev": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -10156,7 +10424,6 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
       "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -10181,7 +10448,6 @@
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
       "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/path-scurry": {
@@ -10426,6 +10692,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -10601,7 +10868,6 @@
       "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "ansi-regex": "^5.0.1",
         "ansi-styles": "^5.0.0",
@@ -10617,7 +10883,6 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -10772,6 +11037,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -10784,6 +11050,7 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -10797,8 +11064,7 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/react-refresh": {
       "version": "0.18.0",
@@ -10912,6 +11178,17 @@
         "node": ">=8.10.0"
       }
     },
+    "node_modules/rechoir": {
+      "version": "0.6.2",
+      "resolved": "https://registry.npmjs.org/rechoir/-/rechoir-0.6.2.tgz",
+      "integrity": "sha512-HFM8rkZ+i3zrV+4LQjwQ0W+ez98pApMGM3HUrN04j3CqzPOzl9nmP15Y8YXNm8QHGv/eacOVEjqhmWpkRV0NAw==",
+      "dependencies": {
+        "resolve": "^1.1.6"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
     "node_modules/redent": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/redent/-/redent-3.0.0.tgz",
@@ -10955,7 +11232,6 @@
       "version": "1.22.11",
       "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
       "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "is-core-module": "^2.16.1",
@@ -11206,8 +11482,7 @@
       "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
       "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/run-applescript": {
       "version": "7.1.0",
@@ -11437,6 +11712,39 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/shelljs": {
+      "version": "0.8.5",
+      "resolved": "https://registry.npmjs.org/shelljs/-/shelljs-0.8.5.tgz",
+      "integrity": "sha512-TiwcRcrkhHvbrZbnRcFYMLl30Dfov3HKqzp5tO5b4pt6G/SezKcYhmDg15zXVBswHmctSAQKznqNW2LO5tTDow==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "glob": "^7.0.0",
+        "interpret": "^1.0.0",
+        "rechoir": "^0.6.2"
+      },
+      "bin": {
+        "shjs": "bin/shjs"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/shx": {
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/shx/-/shx-0.3.4.tgz",
+      "integrity": "sha512-N6A9MLVqjxZYcVn8hLmtneQWIJtp8IKzMP4eMnx+nqkvXoqinUPCbUFLp2UcWTEIUONhlk0ewxr/jaVGlc+J+g==",
+      "license": "MIT",
+      "dependencies": {
+        "minimist": "^1.2.3",
+        "shelljs": "^0.8.5"
+      },
+      "bin": {
+        "shx": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/side-channel": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
@@ -11841,7 +12149,6 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
       "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11873,6 +12180,7 @@
       "integrity": "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
         "arg": "^5.0.2",
@@ -12011,6 +12319,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -12034,7 +12343,6 @@
       "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "tldts-core": "^6.1.86"
       },
@@ -12047,8 +12355,7 @@
       "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
       "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/tmpl": {
       "version": "1.0.5",
@@ -12221,6 +12528,7 @@
       "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.9.2.tgz",
       "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@cspotcode/source-map-support": "^0.8.0",
         "@tsconfig/node10": "^1.0.7",
@@ -12277,6 +12585,7 @@
       "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "~0.27.0",
         "get-tsconfig": "^4.7.5"
@@ -12830,6 +13139,7 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -13038,6 +13348,7 @@
       "integrity": "sha512-ITcnkFeR3+fI8P1wMgItjGrR10170d8auB4EpMLPqmx6uxElH3a/hHGQabSHKdqd4FXWO1nFIp9rRn7JQ34ACQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -13131,6 +13442,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -13550,6 +13862,7 @@
       "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
       "dev": true,
       "license": "ISC",
+      "peer": true,
       "bin": {
         "yaml": "bin.mjs"
       },
@@ -13637,6 +13950,7 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
       "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -13658,7 +13972,9 @@
         "@modelcontextprotocol/sdk": "^1.25.2",
         "cors": "^2.8.5",
         "express": "^5.1.0",
+        "express-rate-limit": "^8.2.1",
         "shell-quote": "^1.8.3",
+        "shx": "^0.3.4",
         "spawn-rx": "^5.1.2",
         "ws": "^8.18.0",
         "zod": "^3.25.76"
@@ -13668,12 +13984,30 @@
       },
       "devDependencies": {
         "@types/cors": "^2.8.19",
-        "@types/express": "^4.17.23",
+        "@types/express": "^5.0.0",
         "@types/shell-quote": "^1.7.5",
         "@types/ws": "^8.5.12",
         "tsx": "^4.19.0",
         "typescript": "^5.6.2"
       }
+    },
+    "server/node_modules/express-rate-limit": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.2.1.tgz",
+      "integrity": "sha512-PCZEIEIxqwhzw4KF0n7QF4QqruVTcF73O5kFKUnGOyjbCCgizBBiFaYpd/fnBLUMPw/BWw9OsiN7GgrNYr7j6g==",
+      "license": "MIT",
+      "dependencies": {
+        "ip-address": "10.0.1"
+      },
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": ">= 4.11"
+      }
     }
   }
 }
diff --git a/server/package.json b/server/package.json
index 622b889d..b11e16d3 100644
--- a/server/package.json
+++ b/server/package.json
@@ -14,14 +14,14 @@
     "build"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && shx cp -R static build",
     "start": "node build/index.js",
     "dev": "tsx watch --clear-screen=false src/index.ts",
     "dev:windows": "tsx watch --clear-screen=false src/index.ts < NUL"
   },
   "devDependencies": {
     "@types/cors": "^2.8.19",
-    "@types/express": "^4.17.23",
+    "@types/express": "^5.0.0",
     "@types/shell-quote": "^1.7.5",
     "@types/ws": "^8.5.12",
     "tsx": "^4.19.0",
@@ -32,8 +32,10 @@
     "cors": "^2.8.5",
     "express": "^5.1.0",
     "shell-quote": "^1.8.3",
+    "shx": "^0.3.4",
     "spawn-rx": "^5.1.2",
     "ws": "^8.18.0",
-    "zod": "^3.25.76"
+    "zod": "^3.25.76",
+    "express-rate-limit": "^8.2.1"
   }
 }
diff --git a/server/src/index.ts b/server/src/index.ts
index 388fdaca..4d1fffa2 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -25,12 +25,21 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import express from "express";
+import rateLimit from "express-rate-limit";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+import { readFileSync } from "fs";
 
 const DEFAULT_MCP_PROXY_LISTEN_PORT = "6277";
 
+const sandboxRateLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100, // limit each IP to 100 /sandbox requests per windowMs
+});
+
 const defaultEnvironment = {
   ...getDefaultEnvironment(),
   ...(process.env.MCP_ENV_VARS ? JSON.parse(process.env.MCP_ENV_VARS) : {}),
@@ -787,6 +796,26 @@ app.get("/config", originValidationMiddleware, authMiddleware, (req, res) => {
   }
 });
 
+app.get(
+  "/sandbox",
+  sandboxRateLimiter as express.RequestHandler,
+  (req, res) => {
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = dirname(__filename);
+    const filePath = join(__dirname, "..", "static", "sandbox_proxy.html");
+    let sandboxHtml;
+
+    try {
+      sandboxHtml = readFileSync(filePath, "utf-8");
+    } catch (e) {
+      sandboxHtml = "MCP Apps sandbox not loaded: " + e;
+    }
+
+    res.set("Cache-Control", "no-cache, no-store, max-age=0");
+    res.send(sandboxHtml);
+  },
+);
+
 const PORT = parseInt(
   process.env.SERVER_PORT || DEFAULT_MCP_PROXY_LISTEN_PORT,
   10,
diff --git a/server/static/sandbox_proxy.html b/server/static/sandbox_proxy.html
new file mode 100644
index 00000000..da77f048
--- /dev/null
+++ b/server/static/sandbox_proxy.html
@@ -0,0 +1,197 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="color-scheme" content="light dark" />
+    <!-- CSP is set via HTTP headers by serve.ts (based on ?csp= query param).
+       The inner iframe inherits this CSP since we use document.write(). -->
+    <title>MCP-UI Proxy</title>
+    <style>
+      html,
+      body {
+        margin: 0;
+        height: 100vh;
+        width: 100vw;
+        /* Transparent background allows parent page to show through */
+        background-color: transparent;
+      }
+      body {
+        display: flex;
+        flex-direction: column;
+      }
+      * {
+        box-sizing: border-box;
+      }
+      iframe {
+        background-color: transparent;
+        border: 0px none transparent;
+        padding: 0px;
+        overflow: hidden;
+        flex-grow: 1;
+        /* Inherit color scheme from parent for consistent transparency */
+        color-scheme: inherit;
+      }
+    </style>
+  </head>
+  <body>
+    <script>
+      function buildAllowAttribute(permissions) {
+        if (!permissions) return "";
+
+        const allowList = [];
+        if (permissions["camera"]) allowList.push("camera");
+        if (permissions["microphone"]) allowList.push("microphone");
+        if (permissions["geolocation"]) allowList.push("geolocation");
+        if (permissions["clipboardWrite"]) allowList.push("clipboard-write");
+
+        return allowList.join("; ");
+      }
+
+      const ALLOWED_REFERRER_PATTERN =
+        /^http:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/;
+
+      if (window.self === window.top) {
+        throw new Error("This file is only to be used in an iframe sandbox.");
+      }
+
+      if (!document.referrer) {
+        throw new Error("No referrer, cannot validate embedding site.");
+      }
+
+      if (!document.referrer.match(ALLOWED_REFERRER_PATTERN)) {
+        throw new Error(
+          `Embedding domain not allowed in referrer ${document.referrer}. (Consider updating the validation logic to allow your domain.)`,
+        );
+      }
+
+      // Extract the expected host origin from the referrer for origin validation.
+      // This is the origin we expect all parent messages to come from.
+      const EXPECTED_HOST_ORIGIN = new URL(document.referrer).origin;
+
+      const OWN_ORIGIN = new URL(window.location.href).origin;
+
+      // Security self-test: verify iframe isolation is working correctly.
+      // This MUST throw a SecurityError -- if `window.top` is accessible, the sandbox
+      // configuration is dangerously broken and untrusted content could escape.
+      try {
+        window.top?.alert(
+          "If you see this, the sandbox is not setup securely.",
+        );
+        throw "FAIL";
+      } catch (e) {
+        if (e === "FAIL") {
+          throw new Error("The sandbox is not setup securely.");
+        }
+
+        // Expected: SecurityError confirms proper sandboxing.
+      }
+
+      // Double-iframe sandbox architecture: THIS file is the outer sandbox proxy
+      // iframe on a separate origin. It creates an inner iframe for untrusted HTML
+      // content. Per the specification, the Host and the Sandbox MUST have different
+      // origins.
+      const inner = document.createElement("iframe");
+      inner.style = "width:100%; height:100%; border:none;";
+      inner.setAttribute(
+        "sandbox",
+        "allow-scripts allow-same-origin allow-forms",
+      );
+      // Note: allow attribute is set later when receiving sandbox-resource-ready notification
+      // based on the permissions requested by the app
+      document.body.appendChild(inner);
+
+      const RESOURCE_READY_NOTIFICATION =
+        "ui/notifications/sandbox-resource-ready";
+      const PROXY_READY_NOTIFICATION = "ui/notifications/sandbox-proxy-ready";
+
+      // Message relay: This Sandbox (outer iframe) acts as a bidirectional bridge,
+      // forwarding messages between:
+      //
+      //   Host (parent window) ↔ Sandbox (outer frame) ↔ View (inner iframe)
+      //
+      // Reason: the parent window and inner iframe have different origins and can't
+      // communicate directly, so the outer iframe forwards messages in both
+      // directions to connect them.
+      //
+      // Special case: The "ui/notifications/sandbox-proxy-ready" message is
+      // intercepted here (not relayed) because the Sandbox uses it to configure and
+      // load the inner iframe with the view HTML content.
+      //
+      // Security: CSP is enforced via HTTP headers on sandbox.html (set by serve.ts
+      // based on ?csp= query param). This is tamper-proof unlike meta tags.
+
+      window.addEventListener("message", async (event) => {
+        if (event.source === window.parent) {
+          // Validate that messages from parent come from the expected host origin.
+          // This prevents malicious pages from sending messages to this sandbox.
+          if (event.origin !== EXPECTED_HOST_ORIGIN) {
+            console.error(
+              "[Sandbox] Rejecting message from unexpected origin:",
+              event.origin,
+              "expected:",
+              EXPECTED_HOST_ORIGIN,
+            );
+            return;
+          }
+
+          if (event.data && event.data.method === RESOURCE_READY_NOTIFICATION) {
+            const { html, sandbox, permissions } = event.data.params;
+            if (typeof sandbox === "string") {
+              inner.setAttribute("sandbox", sandbox);
+            }
+            // Set Permission Policy allow attribute if permissions are requested
+            const allowAttribute = buildAllowAttribute(permissions);
+            if (allowAttribute) {
+              console.log("[Sandbox] Setting allow attribute:", allowAttribute);
+              inner.setAttribute("allow", allowAttribute);
+            }
+            if (typeof html === "string") {
+              // Use document.write instead of srcdoc (which the CesiumJS Map won't work with)
+              const doc =
+                inner.contentDocument || inner.contentWindow?.document;
+              if (doc) {
+                doc.open();
+                doc.write(html);
+                doc.close();
+              } else {
+                // Fallback to srcdoc if document is not accessible
+                console.warn(
+                  "[Sandbox] document.write not available, falling back to srcdoc",
+                );
+                inner.srcdoc = html;
+              }
+            }
+          } else {
+            if (inner && inner.contentWindow) {
+              inner.contentWindow.postMessage(event.data, "*");
+            }
+          }
+        } else if (event.source === inner.contentWindow) {
+          if (event.origin !== OWN_ORIGIN) {
+            console.error(
+              "[Sandbox] Rejecting message from inner iframe with unexpected origin:",
+              event.origin,
+              "expected:",
+              OWN_ORIGIN,
+            );
+            return;
+          }
+          // Relay messages from inner frame to parent window.
+          // Use specific origin instead of "*" to prevent message interception.
+          window.parent.postMessage(event.data, EXPECTED_HOST_ORIGIN);
+        }
+      });
+
+      // Notify the Host that the Sandbox is ready to receive view HTML.
+      // Use specific origin instead of "*" to ensure only the expected host receives this.
+      window.parent.postMessage(
+        {
+          jsonrpc: "2.0",
+          method: PROXY_READY_NOTIFICATION,
+          params: {},
+        },
+        EXPECTED_HOST_ORIGIN,
+      );
+    </script>
+  </body>
+</html>

From a276a7336e04d558d2b3779ed4ba0bf0d60c5ef6 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Fri, 6 Feb 2026 12:35:38 +0000
Subject: [PATCH 16/37] Bump version to 0.20.0

- Updated all package.json files to version 0.20.0
- Updated workspace dependencies in root package.json
- Updated package-lock.json
- Verified version consistency with check-version-consistency script

Co-authored-by: Ola Hungerford <olaservo@users.noreply.github.com>
---
 cli/package.json    |   2 +-
 client/package.json |   2 +-
 package-lock.json   | 125 ++++++++++++++++++++++++++++----------------
 package.json        |   8 +--
 server/package.json |   2 +-
 5 files changed, 88 insertions(+), 51 deletions(-)

diff --git a/cli/package.json b/cli/package.json
index 52f66b6f..94a59d84 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-cli",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "CLI for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
diff --git a/client/package.json b/client/package.json
index 1ac32027..4586168f 100644
--- a/client/package.json
+++ b/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-client",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Client-side application for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
diff --git a/package-lock.json b/package-lock.json
index e1633c5b..6b4dbc29 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@modelcontextprotocol/inspector",
-      "version": "0.19.0",
+      "version": "0.20.0",
       "license": "SEE LICENSE IN LICENSE",
       "workspaces": [
         "client",
@@ -14,9 +14,9 @@
         "cli"
       ],
       "dependencies": {
-        "@modelcontextprotocol/inspector-cli": "^0.19.0",
-        "@modelcontextprotocol/inspector-client": "^0.19.0",
-        "@modelcontextprotocol/inspector-server": "^0.19.0",
+        "@modelcontextprotocol/inspector-cli": "^0.20.0",
+        "@modelcontextprotocol/inspector-client": "^0.20.0",
+        "@modelcontextprotocol/inspector-server": "^0.20.0",
         "@modelcontextprotocol/sdk": "^1.25.2",
         "concurrently": "^9.2.0",
         "node-fetch": "^3.3.2",
@@ -48,7 +48,7 @@
     },
     "cli": {
       "name": "@modelcontextprotocol/inspector-cli",
-      "version": "0.19.0",
+      "version": "0.20.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.25.2",
@@ -76,7 +76,7 @@
     },
     "client": {
       "name": "@modelcontextprotocol/inspector-client",
-      "version": "0.19.0",
+      "version": "0.20.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@mcp-ui/client": "^6.0.0",
@@ -193,6 +193,7 @@
       "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@csstools/css-calc": "^2.1.3",
         "@csstools/css-color-parser": "^3.0.9",
@@ -206,7 +207,8 @@
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
       "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/@babel/code-frame": {
       "version": "7.27.1",
@@ -239,7 +241,6 @@
       "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@babel/generator": "^7.28.5",
@@ -785,6 +786,7 @@
         }
       ],
       "license": "MIT-0",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -805,6 +807,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -829,6 +832,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@csstools/color-helpers": "^5.1.0",
         "@csstools/css-calc": "^2.1.4"
@@ -1850,6 +1854,7 @@
       "integrity": "sha512-kazxw2L9IPuZpQ0mEt9lu9Z98SqR74xcagANmMBU16X0lS23yPc0+S6hGLUz8kVRlomZEs/5S/Zlpqwf5yu6OQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/fake-timers": "30.2.0",
@@ -1878,6 +1883,7 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -1894,6 +1900,7 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -1912,6 +1919,7 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -1925,6 +1933,7 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -1943,7 +1952,8 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@jest/environment-jsdom-abstract/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -1951,6 +1961,7 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -1961,6 +1972,7 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -1973,6 +1985,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -1992,6 +2005,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -2002,6 +2016,7 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -2023,6 +2038,7 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2038,6 +2054,7 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2056,6 +2073,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -2069,6 +2087,7 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -2083,7 +2102,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@jest/expect": {
       "version": "29.7.0",
@@ -2152,6 +2172,7 @@
       "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "jest-regex-util": "30.0.1"
@@ -2166,6 +2187,7 @@
       "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
@@ -2489,7 +2511,6 @@
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.26.0.tgz",
       "integrity": "sha512-Y5RmPncpiDtTXDbLKswIJzTqu2hyBKxTNsgKqKclDbhIgg1wgtf1fRuvxgTnRfcnxtvvgbIEcqUOzZrJ6iSReg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@hono/node-server": "^1.19.9",
         "ajv": "^8.17.1",
@@ -4271,7 +4292,8 @@
       "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
       "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
@@ -4513,7 +4535,6 @@
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.2.tgz",
       "integrity": "sha512-LPM2G3Syo1GLzXLGJAKdqoU35XvrWzGJ21/7sgZTUpbkBaOasTj8tjwn6w+hCkqaa1TfJ/w67rJSwYItlJ2mYw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -4550,7 +4571,6 @@
       "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.27.tgz",
       "integrity": "sha512-cisd7gxkzjBKU2GgdYrTdtQx1SORymWyaAFhaxQPK9bYO9ot3Y5OikQRvY0VYQtvwjeQnizCINJAenh/V7MK2w==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.2.2"
@@ -4562,7 +4582,6 @@
       "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "peerDependencies": {
         "@types/react": "^18.0.0"
       }
@@ -4691,7 +4710,6 @@
       "integrity": "sha512-N9lBGA9o9aqb1hVMc9hzySbhKibHmB+N3IpoShyV6HyQYRGIhlrO5rQgttypi+yEeKsKI4idxC8Jw6gXKD4THA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.49.0",
         "@typescript-eslint/types": "8.49.0",
@@ -5074,7 +5092,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5547,7 +5564,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -6386,7 +6402,8 @@
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
       "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/domexception": {
       "version": "4.0.0",
@@ -6644,7 +6661,6 @@
       "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -6942,7 +6958,6 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -7562,7 +7577,6 @@
       "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.7.tgz",
       "integrity": "sha512-l7qMiNee7t82bH3SeyUCt9UF15EVmaBvsppY2zQtrbIhl/yzBTny+YUxsVjSjQ6gaqaeVtZmGocom8TzBlA4Yw==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=16.9.0"
       }
@@ -8059,7 +8073,6 @@
       "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/core": "^29.7.0",
         "@jest/types": "^29.6.3",
@@ -8400,6 +8413,7 @@
       "integrity": "sha512-zbBTiqr2Vl78pKp/laGBREYzbZx9ZtqPjOK4++lL4BNDhxRnahg51HtoDrk9/VjIy9IthNEWdKVd7H5bqBhiWQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/environment-jsdom-abstract": "30.2.0",
@@ -8425,6 +8439,7 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -8441,6 +8456,7 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -8459,6 +8475,7 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -8472,6 +8489,7 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -8490,7 +8508,8 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/jest-environment-jsdom/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -8498,6 +8517,7 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -8508,6 +8528,7 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -8520,6 +8541,7 @@
       "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 14"
       }
@@ -8530,6 +8552,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -8549,6 +8572,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -8559,6 +8583,7 @@
       "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@asamuzakjp/css-color": "^3.2.0",
         "rrweb-cssom": "^0.8.0"
@@ -8573,6 +8598,7 @@
       "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "whatwg-mimetype": "^4.0.0",
         "whatwg-url": "^14.0.0"
@@ -8587,6 +8613,7 @@
       "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "whatwg-encoding": "^3.1.1"
       },
@@ -8600,6 +8627,7 @@
       "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.0",
         "debug": "^4.3.4"
@@ -8614,6 +8642,7 @@
       "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.2",
         "debug": "4"
@@ -8628,6 +8657,7 @@
       "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
@@ -8641,6 +8671,7 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -8662,6 +8693,7 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8677,6 +8709,7 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8695,6 +8728,7 @@
       "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "cssstyle": "^4.2.1",
         "data-urls": "^5.0.0",
@@ -8735,6 +8769,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -8748,6 +8783,7 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -8762,7 +8798,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/jest-environment-jsdom/node_modules/tough-cookie": {
       "version": "5.1.2",
@@ -8770,6 +8807,7 @@
       "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "tldts": "^6.1.32"
       },
@@ -8783,6 +8821,7 @@
       "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "punycode": "^2.3.1"
       },
@@ -8796,6 +8835,7 @@
       "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "xml-name-validator": "^5.0.0"
       },
@@ -8809,6 +8849,7 @@
       "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "iconv-lite": "0.6.3"
       },
@@ -8822,6 +8863,7 @@
       "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -8832,6 +8874,7 @@
       "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "tr46": "^5.1.0",
         "webidl-conversions": "^7.0.0"
@@ -8846,6 +8889,7 @@
       "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -9440,7 +9484,6 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -9479,7 +9522,6 @@
       "integrity": "sha512-SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "abab": "^2.0.6",
         "acorn": "^8.8.1",
@@ -9818,6 +9860,7 @@
       "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "lz-string": "bin/bin.js"
       }
@@ -10692,7 +10735,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -10868,6 +10910,7 @@
       "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "ansi-regex": "^5.0.1",
         "ansi-styles": "^5.0.0",
@@ -10883,6 +10926,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -11037,7 +11081,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -11050,7 +11093,6 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -11064,7 +11106,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/react-refresh": {
       "version": "0.18.0",
@@ -11482,7 +11525,8 @@
       "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
       "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/run-applescript": {
       "version": "7.1.0",
@@ -12180,7 +12224,6 @@
       "integrity": "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
         "arg": "^5.0.2",
@@ -12319,7 +12362,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -12343,6 +12385,7 @@
       "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "tldts-core": "^6.1.86"
       },
@@ -12355,7 +12398,8 @@
       "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
       "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/tmpl": {
       "version": "1.0.5",
@@ -12528,7 +12572,6 @@
       "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.9.2.tgz",
       "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@cspotcode/source-map-support": "^0.8.0",
         "@tsconfig/node10": "^1.0.7",
@@ -12585,7 +12628,6 @@
       "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "~0.27.0",
         "get-tsconfig": "^4.7.5"
@@ -13139,7 +13181,6 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -13348,7 +13389,6 @@
       "integrity": "sha512-ITcnkFeR3+fI8P1wMgItjGrR10170d8auB4EpMLPqmx6uxElH3a/hHGQabSHKdqd4FXWO1nFIp9rRn7JQ34ACQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -13442,7 +13482,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -13862,7 +13901,6 @@
       "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
       "dev": true,
       "license": "ISC",
-      "peer": true,
       "bin": {
         "yaml": "bin.mjs"
       },
@@ -13950,7 +13988,6 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
       "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -13966,7 +14003,7 @@
     },
     "server": {
       "name": "@modelcontextprotocol/inspector-server",
-      "version": "0.19.0",
+      "version": "0.20.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.25.2",
diff --git a/package.json b/package.json
index a2d52307..948f361e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -47,9 +47,9 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.19.0",
-    "@modelcontextprotocol/inspector-client": "^0.19.0",
-    "@modelcontextprotocol/inspector-server": "^0.19.0",
+    "@modelcontextprotocol/inspector-cli": "^0.20.0",
+    "@modelcontextprotocol/inspector-client": "^0.20.0",
+    "@modelcontextprotocol/inspector-server": "^0.20.0",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
diff --git a/server/package.json b/server/package.json
index b11e16d3..b072c4ce 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-server",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Server-side application for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",

From 96b1b586f95c00c1530eb3cb87134e8917d0ab5e Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Fri, 6 Feb 2026 16:30:23 -0500
Subject: [PATCH 17/37] Manage display of "Run as Task" checkbox on Tools Tab

* In ToolsTab.tsx
  - define ExtendedTool interface for augmenting with execution, meta, icons
  - in hasMeta function,
    - cast tool as ExtendedTool
  - add getTaskSupport function
    - returns forbidden if input is not a tool
    - returns the setting of execution.taskSupport if set and valid
    - returns optional otherwise
    - in useEffect map callback
      - set runAsTask to true if getTaskSupport returns "required", else false
    - in IconDisplay instances cast tool as ExtendedTool instead of as WithIcons
    - hide "Run as Task" checkbox if getTaskSupport returns "forbidden" for the selected tool
    - disable the "Run as Task" checkbox if getTaskSupport returns "required"
* In ToolsTab.test.tsx
  - added unit test
    - "should show/hide/disable run-as-task checkbox based on taskSupport"
      - tests checkbox checked and disabled states for "forbidden", "required", and "optional" states
---
 client/src/components/ToolsTab.tsx            | 75 +++++++++++++------
 .../components/__tests__/ToolsTab.test.tsx    | 55 ++++++++++++++
 2 files changed, 109 insertions(+), 21 deletions(-)

diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index 9e1b5d56..69bcdd35 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -50,11 +50,40 @@ import {
   hasValidMetaName,
   hasValidMetaPrefix,
   isReservedMetaKey,
-} from "@/utils/metaUtils";
+} from "../utils/metaUtils";
+
+/**
+ * Extended Tool type that includes optional fields used by the inspector.
+ */
+interface ExtendedTool extends Tool, WithIcons {
+  _meta?: Record<string, unknown>;
+  execution?: {
+    taskSupport?: "forbidden" | "required" | "optional";
+  };
+}
 
 // Type guard to safely detect the optional _meta field without using `any`
-const hasMeta = (tool: Tool): tool is Tool & { _meta: unknown } =>
-  typeof (tool as { _meta?: unknown })._meta !== "undefined";
+const hasMeta = (
+  tool: Tool,
+): tool is ExtendedTool & { _meta: Record<string, unknown> } =>
+  typeof (tool as ExtendedTool)._meta !== "undefined";
+
+// Type guard to detect execution.taskSupport
+const getTaskSupport = (
+  tool: Tool | null,
+): "forbidden" | "required" | "optional" => {
+  if (!tool) return "forbidden";
+  const extendedTool = tool as ExtendedTool;
+  const taskSupport = extendedTool.execution?.taskSupport;
+  if (
+    taskSupport === "forbidden" ||
+    taskSupport === "required" ||
+    taskSupport === "optional"
+  ) {
+    return taskSupport;
+  }
+  return "optional";
+};
 
 const ToolsTab = ({
   tools,
@@ -131,7 +160,8 @@ const ToolsTab = ({
       ];
     });
     setParams(Object.fromEntries(params));
-    setRunAsTask(false);
+    const taskSupport = getTaskSupport(selectedTool);
+    setRunAsTask(taskSupport === "required");
 
     // Reset validation errors when switching tools
     setHasValidationErrors(false);
@@ -170,7 +200,7 @@ const ToolsTab = ({
           renderItem={(tool) => (
             <div className="flex items-start w-full gap-2">
               <div className="flex-shrink-0 mt-1">
-                <IconDisplay icons={(tool as WithIcons).icons} size="sm" />
+                <IconDisplay icons={(tool as ExtendedTool).icons} size="sm" />
               </div>
               <div className="flex flex-col flex-1 min-w-0">
                 <span className="truncate">{tool.name}</span>
@@ -191,7 +221,7 @@ const ToolsTab = ({
             <div className="flex items-center gap-2">
               {selectedTool && (
                 <IconDisplay
-                  icons={(selectedTool as WithIcons).icons}
+                  icons={(selectedTool as ExtendedTool).icons}
                   size="md"
                 />
               )}
@@ -659,21 +689,24 @@ const ToolsTab = ({
                       </div>
                     </div>
                   )}
-                <div className="flex items-center space-x-2">
-                  <Checkbox
-                    id="run-as-task"
-                    checked={runAsTask}
-                    onCheckedChange={(checked: boolean) =>
-                      setRunAsTask(checked)
-                    }
-                  />
-                  <Label
-                    htmlFor="run-as-task"
-                    className="text-sm font-medium text-gray-700 dark:text-gray-300 cursor-pointer"
-                  >
-                    Run as task
-                  </Label>
-                </div>
+                {getTaskSupport(selectedTool) !== "forbidden" && (
+                  <div className="flex items-center space-x-2">
+                    <Checkbox
+                      id="run-as-task"
+                      checked={runAsTask}
+                      onCheckedChange={(checked: boolean) =>
+                        setRunAsTask(checked)
+                      }
+                      disabled={getTaskSupport(selectedTool) === "required"}
+                    />
+                    <Label
+                      htmlFor="run-as-task"
+                      className="text-sm font-medium text-gray-700 dark:text-gray-300 cursor-pointer"
+                    >
+                      Run as task
+                    </Label>
+                  </div>
+                )}
                 <Button
                   onClick={async () => {
                     // Validate JSON inputs before calling tool
diff --git a/client/src/components/__tests__/ToolsTab.test.tsx b/client/src/components/__tests__/ToolsTab.test.tsx
index cb9ebf4e..d2e5499a 100644
--- a/client/src/components/__tests__/ToolsTab.test.tsx
+++ b/client/src/components/__tests__/ToolsTab.test.tsx
@@ -12,6 +12,13 @@ import {
   RESERVED_NAMESPACE_MESSAGE,
 } from "../../utils/metaUtils";
 
+interface ExtendedTool extends Tool {
+  _meta?: Record<string, unknown>;
+  execution?: {
+    taskSupport?: "forbidden" | "required" | "optional";
+  };
+}
+
 describe("ToolsTab", () => {
   beforeEach(() => {
     // Clear the output schema cache before each test
@@ -107,6 +114,54 @@ describe("ToolsTab", () => {
     expect(newInput.value).toBe("");
   });
 
+  it("should show/hide/disable run-as-task checkbox based on taskSupport", async () => {
+    const forbiddenTool: ExtendedTool = {
+      ...mockTools[0],
+      name: "forbiddenTool",
+      execution: { taskSupport: "forbidden" },
+    };
+    const requiredTool: ExtendedTool = {
+      ...mockTools[0],
+      name: "requiredTool",
+      execution: { taskSupport: "required" },
+    };
+    const optionalTool: ExtendedTool = {
+      ...mockTools[0],
+      name: "optionalTool",
+      execution: { taskSupport: "optional" },
+    };
+
+    const { rerender } = renderToolsTab({
+      selectedTool: forbiddenTool,
+    });
+
+    expect(screen.queryByLabelText(/run as task/i)).not.toBeInTheDocument();
+
+    rerender(
+      <Tabs defaultValue="tools">
+        <ToolsTab {...defaultProps} selectedTool={optionalTool} />
+      </Tabs>,
+    );
+    const optionalCheckbox = screen.getByLabelText(
+      /run as task/i,
+    ) as HTMLInputElement;
+    expect(optionalCheckbox).toBeInTheDocument();
+    expect(optionalCheckbox.getAttribute("aria-checked")).toBe("false");
+    expect(optionalCheckbox).not.toBeDisabled();
+
+    rerender(
+      <Tabs defaultValue="tools">
+        <ToolsTab {...defaultProps} selectedTool={requiredTool} />
+      </Tabs>,
+    );
+    const requiredCheckbox = screen.getByLabelText(
+      /run as task/i,
+    ) as HTMLInputElement;
+    expect(requiredCheckbox).toBeInTheDocument();
+    expect(requiredCheckbox.getAttribute("aria-checked")).toBe("true");
+    expect(requiredCheckbox).toBeDisabled();
+  });
+
   it("should handle integer type inputs", async () => {
     renderToolsTab({
       selectedTool: mockTools[1], // Use the tool with integer type

From 43426f3c8eb75565ed039591daaa5186b5586c8f Mon Sep 17 00:00:00 2001
From: olaservo <olahungerford@gmail.com>
Date: Sat, 7 Feb 2026 10:36:20 -0700
Subject: [PATCH 18/37] feat(client): use consistent slate styling for
 annotation badges

Replace value-based green/gray badge coloring with uniform slate
colors, relying on checkmark/cross icons and opacity to convey state.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 client/src/components/ToolsTab.tsx | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index 2128d599..a805de0d 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -123,11 +123,9 @@ const AnnotationBadges = ({
           title={`${description}\n\nValue: ${value ? "Yes" : "No"} (${implied ? "implied default" : "explicitly set"})`}
           className={cn(
             "inline-flex items-center px-2 py-0.5 rounded text-xs font-medium border",
+            "bg-slate-100 text-slate-700 border-slate-300 dark:bg-slate-800 dark:text-slate-300 dark:border-slate-600",
             implied && "border-dashed opacity-60",
             !implied && "border-solid",
-            value
-              ? "bg-green-100 text-green-800 dark:bg-green-900 dark:text-green-200 border-green-300 dark:border-green-700"
-              : "bg-gray-100 text-gray-500 dark:bg-gray-800 dark:text-gray-400 border-gray-300 dark:border-gray-600",
           )}
         >
           {value ? "✓" : "✗"} {label}

From 00791446a8088996139162b64aa19582ed9a840a Mon Sep 17 00:00:00 2001
From: Ruben Casas <ruben@infoxication.net>
Date: Sun, 8 Feb 2026 00:16:35 +0000
Subject: [PATCH 19/37] fix: add missing tool result to AppsRenderer

---
 client/src/components/AppRenderer.tsx         |  68 +++-
 .../components/__tests__/AppRenderer.test.tsx | 303 ++++++++++++++++--
 2 files changed, 340 insertions(+), 31 deletions(-)

diff --git a/client/src/components/AppRenderer.tsx b/client/src/components/AppRenderer.tsx
index e0c25980..7ac56a16 100644
--- a/client/src/components/AppRenderer.tsx
+++ b/client/src/components/AppRenderer.tsx
@@ -1,8 +1,10 @@
-import { useMemo, useState } from "react";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import {
   Tool,
   ContentBlock,
+  CallToolResult,
+  CallToolResultSchema,
   ServerNotification,
   LoggingMessageNotificationParams,
 } from "@modelcontextprotocol/sdk/types.js";
@@ -35,6 +37,8 @@ const AppRenderer = ({
   onNotification,
 }: AppRendererProps) => {
   const [error, setError] = useState<string | null>(null);
+  const [toolResult, setToolResult] = useState<CallToolResult | undefined>();
+  const latestRunIdRef = useRef(0);
   const { toast } = useToast();
 
   const hostContext: McpUiHostContext = useMemo(
@@ -85,6 +89,67 @@ const AppRenderer = ({
     }
   };
 
+  useEffect(() => {
+    if (!mcpClient) {
+      setToolResult(undefined);
+      return;
+    }
+
+    const runId = ++latestRunIdRef.current;
+    const abortController = new AbortController();
+    setToolResult(undefined);
+
+    const runTool = async () => {
+      try {
+        const result = await mcpClient.request(
+          {
+            method: "tools/call",
+            params: {
+              name: tool.name,
+              arguments: toolInput ?? {},
+            },
+          },
+          CallToolResultSchema,
+          { signal: abortController.signal },
+        );
+
+        if (
+          abortController.signal.aborted ||
+          runId !== latestRunIdRef.current
+        ) {
+          return;
+        }
+
+        setToolResult(result);
+      } catch (runError) {
+        if (
+          abortController.signal.aborted ||
+          runId !== latestRunIdRef.current
+        ) {
+          return;
+        }
+
+        const message =
+          runError instanceof Error ? runError.message : String(runError);
+        setToolResult({
+          content: [
+            {
+              type: "text",
+              text: message,
+            },
+          ],
+          isError: true,
+        });
+      }
+    };
+
+    void runTool();
+
+    return () => {
+      abortController.abort();
+    };
+  }, [mcpClient, tool.name, toolInput]);
+
   if (!mcpClient) {
     return (
       <Alert>
@@ -115,6 +180,7 @@ const AppRenderer = ({
           toolName={tool.name}
           hostContext={hostContext}
           toolInput={toolInput}
+          toolResult={toolResult}
           sandbox={{
             url: new URL(sandboxPath, window.location.origin),
           }}
diff --git a/client/src/components/__tests__/AppRenderer.test.tsx b/client/src/components/__tests__/AppRenderer.test.tsx
index beb57e1a..723e4f98 100644
--- a/client/src/components/__tests__/AppRenderer.test.tsx
+++ b/client/src/components/__tests__/AppRenderer.test.tsx
@@ -1,12 +1,30 @@
-import { render, screen, fireEvent } from "@testing-library/react";
+import { render, screen, fireEvent, waitFor } from "@testing-library/react";
 import "@testing-library/jest-dom";
 import { describe, it, jest, beforeEach } from "@jest/globals";
 import AppRenderer from "../AppRenderer";
-import { Tool } from "@modelcontextprotocol/sdk/types.js";
+import { Tool, CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { RequestHandlerExtra } from "@mcp-ui/client";
 import { McpUiMessageResult } from "@modelcontextprotocol/ext-apps";
 
+type BridgeEvent = {
+  type: "sendToolInput" | "sendToolResult";
+  toolName: string;
+  payload: unknown;
+};
+
+type MockMcpUiRendererProps = {
+  toolName: string;
+  toolInput?: Record<string, unknown>;
+  toolResult?: CallToolResult;
+  onMessage?: (
+    params: { role: "user"; content: { type: "text"; text: string }[] },
+    extra: RequestHandlerExtra,
+  ) => Promise<McpUiMessageResult>;
+};
+
+const mockBridgeEvents: BridgeEvent[] = [];
+
 // Mock the ext-apps module
 jest.mock("@modelcontextprotocol/ext-apps/app-bridge", () => ({
   getToolUiResourceUri: (tool: Tool) => {
@@ -24,34 +42,84 @@ jest.mock("@/lib/hooks/useToast", () => ({
   }),
 }));
 
-// Mock @mcp-ui/client
-jest.mock("@mcp-ui/client", () => ({
-  AppRenderer: ({
-    toolName,
-    onMessage,
-  }: {
-    toolName: string;
-    onMessage?: (
-      params: { role: "user"; content: { type: "text"; text: string }[] },
-      extra: RequestHandlerExtra,
-    ) => Promise<McpUiMessageResult>;
-  }) => (
-    <div data-testid="mcp-ui-app-renderer">
-      <div data-testid="tool-name">{toolName}</div>
-      <button
-        data-testid="trigger-message"
-        onClick={() =>
-          onMessage?.(
-            { role: "user", content: [{ type: "text", text: "Test message" }] },
-            {} as RequestHandlerExtra,
-          )
+// Mock @mcp-ui/client to simulate bridge delivery only after app initialization
+jest.mock("@mcp-ui/client", () => {
+  const React = jest.requireActual("react") as typeof import("react");
+
+  return {
+    AppRenderer: ({
+      toolName,
+      toolInput,
+      toolResult,
+      onMessage,
+    }: MockMcpUiRendererProps) => {
+      const [isInitialized, setIsInitialized] = React.useState(false);
+
+      React.useEffect(() => {
+        setIsInitialized(false);
+      }, [toolName]);
+
+      React.useEffect(() => {
+        if (isInitialized && toolInput) {
+          mockBridgeEvents.push({
+            type: "sendToolInput",
+            toolName,
+            payload: toolInput,
+          });
         }
-      >
-        Trigger Message
-      </button>
-    </div>
-  ),
-}));
+      }, [isInitialized, toolInput, toolName]);
+
+      React.useEffect(() => {
+        if (isInitialized && toolResult) {
+          mockBridgeEvents.push({
+            type: "sendToolResult",
+            toolName,
+            payload: toolResult,
+          });
+        }
+      }, [isInitialized, toolResult, toolName]);
+
+      return (
+        <div data-testid="mcp-ui-app-renderer">
+          <div data-testid="tool-name">{toolName}</div>
+          <div data-testid="tool-result">
+            {JSON.stringify(toolResult ?? null)}
+          </div>
+          <button
+            data-testid="initialize-app"
+            onClick={() => setIsInitialized(true)}
+          >
+            Initialize App
+          </button>
+          <button
+            data-testid="trigger-message"
+            onClick={() =>
+              onMessage?.(
+                {
+                  role: "user",
+                  content: [{ type: "text", text: "Test message" }],
+                },
+                {} as RequestHandlerExtra,
+              )
+            }
+          >
+            Trigger Message
+          </button>
+        </div>
+      );
+    },
+  };
+});
+
+const createDeferred = <T,>() => {
+  let resolve!: (value: T) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+};
 
 describe("AppRenderer", () => {
   const mockTool: Tool = {
@@ -69,7 +137,12 @@ describe("AppRenderer", () => {
   } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
 
   const mockMcpClient = {
-    request: jest.fn(),
+    request: jest.fn(
+      () =>
+        new Promise<CallToolResult>(() => {
+          // Intentionally unresolved for baseline rendering tests.
+        }),
+    ),
     getServerCapabilities: jest.fn().mockReturnValue({}),
     setNotificationHandler: jest.fn(),
   } as unknown as Client;
@@ -82,6 +155,7 @@ describe("AppRenderer", () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    mockBridgeEvents.length = 0;
   });
 
   it("should display waiting state when mcpClient is null", () => {
@@ -112,4 +186,173 @@ describe("AppRenderer", () => {
       description: "Test message",
     });
   });
+
+  it("should call tools/call and send tool input/result after app initialization", async () => {
+    const mockResult: CallToolResult = {
+      content: [{ type: "text", text: "Budget initialized" }],
+    };
+    const requestMock = jest.fn().mockResolvedValue(mockResult);
+    const mcpClient = {
+      ...mockMcpClient,
+      request: requestMock,
+    } as unknown as Client;
+
+    render(
+      <AppRenderer
+        {...defaultProps}
+        mcpClient={mcpClient}
+        toolInput={{ monthlyBudget: 2500 }}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(requestMock).toHaveBeenCalledWith(
+        {
+          method: "tools/call",
+          params: {
+            name: "testApp",
+            arguments: { monthlyBudget: 2500 },
+          },
+        },
+        expect.any(Object),
+        expect.objectContaining({ signal: expect.any(AbortSignal) }),
+      );
+    });
+
+    expect(mockBridgeEvents).toHaveLength(0);
+
+    fireEvent.click(screen.getByTestId("initialize-app"));
+
+    await waitFor(() => {
+      const toolEvents = mockBridgeEvents.filter(
+        (event) => event.toolName === "testApp",
+      );
+      expect(toolEvents.map((event) => event.type)).toEqual([
+        "sendToolInput",
+        "sendToolResult",
+      ]);
+    });
+
+    const resultEvent = mockBridgeEvents.find(
+      (event) =>
+        event.toolName === "testApp" && event.type === "sendToolResult",
+    );
+    expect(resultEvent?.payload).toEqual(mockResult);
+  });
+
+  it("should send an app-consumable error result when tools/call fails", async () => {
+    const requestMock = jest
+      .fn()
+      .mockRejectedValue(new Error("tool execution failed"));
+    const mcpClient = {
+      ...mockMcpClient,
+      request: requestMock,
+    } as unknown as Client;
+
+    render(
+      <AppRenderer {...defaultProps} mcpClient={mcpClient} toolInput={{}} />,
+    );
+
+    await waitFor(() => {
+      expect(requestMock).toHaveBeenCalledTimes(1);
+    });
+
+    fireEvent.click(screen.getByTestId("initialize-app"));
+
+    await waitFor(() => {
+      const resultEvent = mockBridgeEvents.find(
+        (event) =>
+          event.toolName === "testApp" && event.type === "sendToolResult",
+      );
+
+      expect(resultEvent?.payload).toEqual({
+        content: [{ type: "text", text: "tool execution failed" }],
+        isError: true,
+      });
+    });
+  });
+
+  it("should ignore stale tool results after switching app tools", async () => {
+    const firstResult: CallToolResult = {
+      content: [{ type: "text", text: "stale result" }],
+    };
+    const secondResult: CallToolResult = {
+      content: [{ type: "text", text: "fresh result" }],
+    };
+
+    const firstRequest = createDeferred<CallToolResult>();
+    const secondRequest = createDeferred<CallToolResult>();
+    const requestMock = jest
+      .fn()
+      .mockReturnValueOnce(firstRequest.promise)
+      .mockReturnValueOnce(secondRequest.promise);
+
+    const mcpClient = {
+      ...mockMcpClient,
+      request: requestMock,
+    } as unknown as Client;
+
+    const { rerender } = render(
+      <AppRenderer
+        {...defaultProps}
+        mcpClient={mcpClient}
+        toolInput={{ month: "january" }}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(requestMock).toHaveBeenCalledTimes(1);
+    });
+
+    const secondTool = {
+      ...mockTool,
+      name: "budgetAllocatorApp",
+    };
+
+    rerender(
+      <AppRenderer
+        {...defaultProps}
+        mcpClient={mcpClient}
+        tool={secondTool}
+        toolInput={{ month: "february" }}
+      />,
+    );
+
+    await waitFor(() => {
+      expect(requestMock).toHaveBeenCalledTimes(2);
+    });
+
+    secondRequest.resolve(secondResult);
+    await waitFor(() => {
+      expect(screen.getByTestId("tool-result")).toHaveTextContent(
+        "fresh result",
+      );
+    });
+
+    fireEvent.click(screen.getByTestId("initialize-app"));
+
+    await waitFor(() => {
+      const freshEvents = mockBridgeEvents.filter(
+        (event) =>
+          event.toolName === "budgetAllocatorApp" &&
+          event.type === "sendToolResult",
+      );
+      expect(freshEvents).toHaveLength(1);
+      expect(freshEvents[0].payload).toEqual(secondResult);
+    });
+
+    firstRequest.resolve(firstResult);
+    await Promise.resolve();
+    await Promise.resolve();
+
+    const secondToolResultEvents = mockBridgeEvents.filter(
+      (event) =>
+        event.toolName === "budgetAllocatorApp" &&
+        event.type === "sendToolResult",
+    );
+
+    expect(secondToolResultEvents).toHaveLength(1);
+    expect(secondToolResultEvents[0].payload).toEqual(secondResult);
+    expect(screen.getByTestId("tool-result")).toHaveTextContent("fresh result");
+  });
 });

From 39c2c9f8ce41957018e391cace9b794bec05071f Mon Sep 17 00:00:00 2001
From: David Soria Parra <davidsp@anthropic.com>
Date: Mon, 9 Feb 2026 18:27:16 +0000
Subject: [PATCH 20/37] Remove environment constraint from release workflow
 jobs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/main.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 96262fda..60262085 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -42,7 +42,6 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
-    environment: release
     needs: build
 
     permissions:
@@ -69,7 +68,6 @@ jobs:
   publish-github-container-registry:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
-    environment: release
     needs: build
     permissions:
       contents: read

From 1f424f252546b8611e275a158d1756fd30517d87 Mon Sep 17 00:00:00 2001
From: David Soria Parra <davidsp@anthropic.com>
Date: Mon, 9 Feb 2026 18:30:00 +0000
Subject: [PATCH 21/37] Revert "Remove environment constraint from release
 workflow jobs"

This reverts commit 39c2c9f8ce41957018e391cace9b794bec05071f.
---
 .github/workflows/main.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 60262085..96262fda 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -42,6 +42,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
+    environment: release
     needs: build
 
     permissions:
@@ -68,6 +69,7 @@ jobs:
   publish-github-container-registry:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
+    environment: release
     needs: build
     permissions:
       contents: read

From 1f9d922475b8cd0598bea0d3306f24935cda9cbf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 9 Feb 2026 23:27:21 +0000
Subject: [PATCH 22/37] Bump actions/checkout from 4 to 6

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/claude.yml    | 4 ++--
 .github/workflows/cli_tests.yml | 2 +-
 .github/workflows/e2e_tests.yml | 2 +-
 .github/workflows/main.yml      | 6 +++---
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 52ca5ce4..9fdebc23 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -54,7 +54,7 @@ jobs:
 
       - name: Checkout PR branch
         if: steps.pr.outcome == 'success'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{ steps.pr.outputs.sha }}
           repository: ${{ steps.pr.outputs.repo }}
@@ -62,7 +62,7 @@ jobs:
 
       - name: Checkout repository
         if: steps.pr.outcome != 'success'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/cli_tests.yml b/.github/workflows/cli_tests.yml
index 3b46b431..106d98f1 100644
--- a/.github/workflows/cli_tests.yml
+++ b/.github/workflows/cli_tests.yml
@@ -15,7 +15,7 @@ jobs:
       run:
         working-directory: ./cli
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
diff --git a/.github/workflows/e2e_tests.yml b/.github/workflows/e2e_tests.yml
index 4d0c4cec..4013a905 100644
--- a/.github/workflows/e2e_tests.yml
+++ b/.github/workflows/e2e_tests.yml
@@ -18,7 +18,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libwoff1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-node@v6
         id: setup_node
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 96262fda..2cc4537b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Check formatting
         run: npx prettier --check .
@@ -50,7 +50,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
           node-version-file: package.json
@@ -77,7 +77,7 @@ jobs:
       attestations: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Log in to the Container registry
         uses: docker/login-action@v3

From 41e0e83fac4db8b2baeee19b8542e8f07f145570 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 14 Feb 2026 12:55:44 +0000
Subject: [PATCH 23/37] Bump qs in the npm_and_yarn group across 1 directory

Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).


Updates `qs` from 6.14.1 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.14.1...v6.14.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 24 +++---------------------
 1 file changed, 3 insertions(+), 21 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 6b4dbc29..da310ffb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11010,9 +11010,9 @@
       "license": "MIT"
     },
     "node_modules/qs": {
-      "version": "6.14.1",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.1.tgz",
-      "integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
+      "version": "6.14.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.2.tgz",
+      "integrity": "sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.1.0"
@@ -14027,24 +14027,6 @@
         "tsx": "^4.19.0",
         "typescript": "^5.6.2"
       }
-    },
-    "server/node_modules/express-rate-limit": {
-      "version": "8.2.1",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.2.1.tgz",
-      "integrity": "sha512-PCZEIEIxqwhzw4KF0n7QF4QqruVTcF73O5kFKUnGOyjbCCgizBBiFaYpd/fnBLUMPw/BWw9OsiN7GgrNYr7j6g==",
-      "license": "MIT",
-      "dependencies": {
-        "ip-address": "10.0.1"
-      },
-      "engines": {
-        "node": ">= 16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/express-rate-limit"
-      },
-      "peerDependencies": {
-        "express": ">= 4.11"
-      }
     }
   }
 }

From a31ae3e767bb6d1adaab8edb169700171f1b1f5a Mon Sep 17 00:00:00 2001
From: Ruben Casas <ruben@infoxication.net>
Date: Mon, 16 Feb 2026 16:44:33 +0000
Subject: [PATCH 24/37] feat call tool result from tools tab

---
 client/src/App.tsx                            |  99 ++++-
 .../__tests__/App.toolsAppsPrefill.test.tsx   | 288 ++++++++++++++
 client/src/components/AppRenderer.tsx         |  90 ++---
 client/src/components/AppsTab.tsx             | 219 +++++++++--
 client/src/components/ToolsTab.tsx            |   2 +-
 .../components/__tests__/AppRenderer.test.tsx | 188 +++------
 .../src/components/__tests__/AppsTab.test.tsx | 361 ++++++++++++++++--
 patches/@mcp-ui+client+6.0.0.patch            | 226 +++++++++++
 8 files changed, 1181 insertions(+), 292 deletions(-)
 create mode 100644 client/src/__tests__/App.toolsAppsPrefill.test.tsx
 create mode 100644 patches/@mcp-ui+client+6.0.0.patch

diff --git a/client/src/App.tsx b/client/src/App.tsx
index 5a69495b..184f04d9 100644
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -30,6 +30,7 @@ import {
   hasValidMetaPrefix,
   isReservedMetaKey,
 } from "@/utils/metaUtils";
+import { getToolUiResourceUri } from "@modelcontextprotocol/ext-apps/app-bridge";
 import { AuthDebuggerState, EMPTY_DEBUGGER_STATE } from "./lib/auth-types";
 import { OAuthStateMachine } from "./lib/oauth-state-machine";
 import { cacheToolOutputSchemas } from "./utils/schemaUtils";
@@ -101,6 +102,27 @@ import MetadataTab from "./components/MetadataTab";
 
 const CONFIG_LOCAL_STORAGE_KEY = "inspectorConfig_v1";
 
+type PrefilledAppsToolCall = {
+  id: number;
+  toolName: string;
+  params: Record<string, unknown>;
+  result: CompatibilityCallToolResult;
+};
+
+const hasAppResourceUri = (tool: Tool): boolean => {
+  return Boolean(getToolUiResourceUri(tool));
+};
+
+const cloneToolParams = (
+  source: Record<string, unknown>,
+): Record<string, unknown> => {
+  try {
+    return structuredClone(source);
+  } catch {
+    return { ...source };
+  }
+};
+
 const filterReservedMetadata = (
   metadata: Record<string, string>,
 ): Record<string, string> => {
@@ -137,6 +159,8 @@ const App = () => {
   const [tasks, setTasks] = useState<Task[]>([]);
   const [toolResult, setToolResult] =
     useState<CompatibilityCallToolResult | null>(null);
+  const [prefilledAppsToolCall, setPrefilledAppsToolCall] =
+    useState<PrefilledAppsToolCall | null>(null);
   const [errors, setErrors] = useState<Record<string, string | null>>({
     resources: null,
     prompts: null,
@@ -291,6 +315,7 @@ const App = () => {
   const [nextToolCursor, setNextToolCursor] = useState<string | undefined>();
   const [nextTaskCursor, setNextTaskCursor] = useState<string | undefined>();
   const progressTokenRef = useRef(0);
+  const prefilledAppsToolCallIdRef = useRef(0);
 
   const [activeTab, setActiveTab] = useState<string>(() => {
     const hash = window.location.hash.slice(1);
@@ -977,7 +1002,7 @@ const App = () => {
     params: Record<string, unknown>,
     toolMetadata?: Record<string, unknown>,
     runAsTask?: boolean,
-  ) => {
+  ): Promise<CompatibilityCallToolResult> => {
     lastToolCallOriginTabRef.current = currentTabRef.current;
 
     try {
@@ -1045,7 +1070,7 @@ const App = () => {
           "_meta" in (response as Record<string, unknown>)
             ? ((response as { _meta?: Record<string, unknown> })._meta ?? {})
             : undefined;
-        setToolResult({
+        let latestToolResult: CompatibilityCallToolResult = {
           content: [
             {
               type: "text",
@@ -1056,7 +1081,8 @@ const App = () => {
             ...(initialResponseMeta || {}),
             "io.modelcontextprotocol/related-task": { taskId },
           },
-        } as CompatibilityCallToolResult);
+        };
+        setToolResult(latestToolResult);
 
         // Polling loop
         let taskCompleted = false;
@@ -1093,12 +1119,13 @@ const App = () => {
                   CompatibilityCallToolResultSchema,
                 );
                 console.log(`Result received for task ${taskId}:`, result);
-                setToolResult(result as CompatibilityCallToolResult);
+                latestToolResult = result as CompatibilityCallToolResult;
+                setToolResult(latestToolResult);
 
                 // Refresh tasks list to show completed state
                 void listTasks();
               } else {
-                setToolResult({
+                latestToolResult = {
                   content: [
                     {
                       type: "text",
@@ -1106,7 +1133,8 @@ const App = () => {
                     },
                   ],
                   isError: true,
-                });
+                };
+                setToolResult(latestToolResult);
                 // Refresh tasks list to show failed/cancelled state
                 void listTasks();
               }
@@ -1120,7 +1148,7 @@ const App = () => {
                   ? ((response as { _meta?: Record<string, unknown> })._meta ??
                     {})
                   : undefined;
-              setToolResult({
+              latestToolResult = {
                 content: [
                   {
                     type: "text",
@@ -1131,13 +1159,14 @@ const App = () => {
                   ...(pollingResponseMeta || {}),
                   "io.modelcontextprotocol/related-task": { taskId },
                 },
-              } as CompatibilityCallToolResult);
+              };
+              setToolResult(latestToolResult);
               // Refresh tasks list to show progress
               void listTasks();
             }
           } catch (pollingError) {
             console.error("Error polling task status:", pollingError);
-            setToolResult({
+            latestToolResult = {
               content: [
                 {
                   type: "text",
@@ -1145,16 +1174,22 @@ const App = () => {
                 },
               ],
               isError: true,
-            });
+            };
+            setToolResult(latestToolResult);
             taskCompleted = true;
           }
         }
         setIsPollingTask(false);
+        // Clear any validation errors since tool execution completed
+        setErrors((prev) => ({ ...prev, tools: null }));
+        return latestToolResult;
       } else {
-        setToolResult(response as CompatibilityCallToolResult);
+        const directResult = response as CompatibilityCallToolResult;
+        setToolResult(directResult);
+        // Clear any validation errors since tool execution completed
+        setErrors((prev) => ({ ...prev, tools: null }));
+        return directResult;
       }
-      // Clear any validation errors since tool execution completed
-      setErrors((prev) => ({ ...prev, tools: null }));
     } catch (e) {
       const toolResult: CompatibilityCallToolResult = {
         content: [
@@ -1168,6 +1203,7 @@ const App = () => {
       setToolResult(toolResult);
       // Clear validation errors - tool execution errors are shown in ToolResults
       setErrors((prev) => ({ ...prev, tools: null }));
+      return toolResult;
     }
   };
 
@@ -1508,7 +1544,26 @@ const App = () => {
                       ) => {
                         clearError("tools");
                         setToolResult(null);
-                        await callTool(name, params, metadata, runAsTask);
+                        const result = await callTool(
+                          name,
+                          params,
+                          metadata,
+                          runAsTask,
+                        );
+                        const calledTool = tools.find(
+                          (tool) => tool.name === name,
+                        );
+                        if (calledTool && hasAppResourceUri(calledTool)) {
+                          setPrefilledAppsToolCall({
+                            id: ++prefilledAppsToolCallIdRef.current,
+                            toolName: name,
+                            params: cloneToolParams(params),
+                            result,
+                          });
+                        } else {
+                          setPrefilledAppsToolCall(null);
+                        }
+                        return result;
                       }}
                       selectedTool={selectedTool}
                       setSelectedTool={(tool) => {
@@ -1552,6 +1607,22 @@ const App = () => {
                         clearError("tools");
                         listTools();
                       }}
+                      callTool={async (
+                        name: string,
+                        params: Record<string, unknown>,
+                        metadata?: Record<string, unknown>,
+                        runAsTask?: boolean,
+                      ) => {
+                        clearError("tools");
+                        setToolResult(null);
+                        return callTool(name, params, metadata, runAsTask);
+                      }}
+                      prefilledToolCall={prefilledAppsToolCall}
+                      onPrefilledToolCallConsumed={(callId) => {
+                        setPrefilledAppsToolCall((prev) =>
+                          prev?.id === callId ? null : prev,
+                        );
+                      }}
                       error={errors.tools}
                       mcpClient={mcpClient}
                       onNotification={(notification) => {
diff --git a/client/src/__tests__/App.toolsAppsPrefill.test.tsx b/client/src/__tests__/App.toolsAppsPrefill.test.tsx
new file mode 100644
index 00000000..4931800c
--- /dev/null
+++ b/client/src/__tests__/App.toolsAppsPrefill.test.tsx
@@ -0,0 +1,288 @@
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import "@testing-library/jest-dom";
+import App from "../App";
+import { useConnection } from "../lib/hooks/useConnection";
+import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
+
+type ToolListEntry = {
+  name: string;
+  inputSchema: {
+    type: "object";
+    properties: Record<string, unknown>;
+  };
+  _meta: Record<string, unknown>;
+};
+
+let latestAppsTabProps:
+  | {
+      tools: ToolListEntry[];
+      prefilledToolCall?: {
+        id: number;
+        toolName: string;
+        params: Record<string, unknown>;
+        result: {
+          content: Array<{ type: string; text: string }>;
+        };
+      } | null;
+      onPrefilledToolCallConsumed?: (callId: number) => void;
+    }
+  | undefined;
+
+// Mock auth dependencies first
+jest.mock("@modelcontextprotocol/sdk/client/auth.js", () => ({
+  auth: jest.fn(),
+}));
+
+jest.mock("../lib/oauth-state-machine", () => ({
+  OAuthStateMachine: jest.fn(),
+}));
+
+jest.mock("../lib/auth", () => ({
+  InspectorOAuthClientProvider: jest.fn().mockImplementation(() => ({
+    tokens: jest.fn().mockResolvedValue(null),
+    clear: jest.fn(),
+  })),
+  DebugInspectorOAuthClientProvider: jest.fn(),
+}));
+
+jest.mock("../utils/configUtils", () => ({
+  ...jest.requireActual("../utils/configUtils"),
+  getMCPProxyAddress: jest.fn(() => "http://localhost:6277"),
+  getMCPProxyAuthToken: jest.fn(() => ({
+    token: "",
+    header: "X-MCP-Proxy-Auth",
+  })),
+  getInitialTransportType: jest.fn(() => "stdio"),
+  getInitialSseUrl: jest.fn(() => "http://localhost:3001/sse"),
+  getInitialCommand: jest.fn(() => "mcp-server-everything"),
+  getInitialArgs: jest.fn(() => ""),
+  initializeInspectorConfig: jest.fn(() => ({})),
+  saveInspectorConfig: jest.fn(),
+}));
+
+jest.mock("../lib/hooks/useDraggablePane", () => ({
+  useDraggablePane: () => ({
+    height: 300,
+    handleDragStart: jest.fn(),
+  }),
+  useDraggableSidebar: () => ({
+    width: 320,
+    isDragging: false,
+    handleDragStart: jest.fn(),
+  }),
+}));
+
+jest.mock("../components/Sidebar", () => ({
+  __esModule: true,
+  default: () => <div>Sidebar</div>,
+}));
+
+jest.mock("../components/ResourcesTab", () => ({
+  __esModule: true,
+  default: () => <div>ResourcesTab</div>,
+}));
+
+jest.mock("../components/PromptsTab", () => ({
+  __esModule: true,
+  default: () => <div>PromptsTab</div>,
+}));
+
+jest.mock("../components/TasksTab", () => ({
+  __esModule: true,
+  default: () => <div>TasksTab</div>,
+}));
+
+jest.mock("../components/ConsoleTab", () => ({
+  __esModule: true,
+  default: () => <div>ConsoleTab</div>,
+}));
+
+jest.mock("../components/PingTab", () => ({
+  __esModule: true,
+  default: () => <div>PingTab</div>,
+}));
+
+jest.mock("../components/SamplingTab", () => ({
+  __esModule: true,
+  default: () => <div>SamplingTab</div>,
+}));
+
+jest.mock("../components/RootsTab", () => ({
+  __esModule: true,
+  default: () => <div>RootsTab</div>,
+}));
+
+jest.mock("../components/ElicitationTab", () => ({
+  __esModule: true,
+  default: () => <div>ElicitationTab</div>,
+}));
+
+jest.mock("../components/MetadataTab", () => ({
+  __esModule: true,
+  default: () => <div>MetadataTab</div>,
+}));
+
+jest.mock("../components/AuthDebugger", () => ({
+  __esModule: true,
+  default: () => <div>AuthDebugger</div>,
+}));
+
+jest.mock("../components/HistoryAndNotifications", () => ({
+  __esModule: true,
+  default: () => <div>HistoryAndNotifications</div>,
+}));
+
+jest.mock("../components/ToolsTab", () => ({
+  __esModule: true,
+  default: ({
+    listTools,
+    callTool,
+  }: {
+    listTools: () => void;
+    callTool: (
+      name: string,
+      params: Record<string, unknown>,
+      metadata?: Record<string, unknown>,
+      runAsTask?: boolean,
+    ) => Promise<unknown>;
+  }) => (
+    <div data-testid="tools-tab">
+      <button type="button" onClick={listTools}>
+        mock list tools
+      </button>
+      <button
+        type="button"
+        onClick={() => {
+          void callTool("weatherApp", { city: "Lisbon" });
+        }}
+      >
+        mock run app tool
+      </button>
+    </div>
+  ),
+}));
+
+jest.mock("../components/AppsTab", () => ({
+  __esModule: true,
+  default: (props: typeof latestAppsTabProps) => {
+    latestAppsTabProps = props;
+    const prefilled =
+      props && "prefilledToolCall" in props ? props.prefilledToolCall : null;
+    const tools = props && "tools" in props ? props.tools : [];
+
+    return (
+      <div data-testid="apps-tab">
+        <div data-testid="apps-tools">{JSON.stringify(tools)}</div>
+        <div data-testid="apps-prefilled">
+          {JSON.stringify(prefilled ?? null)}
+        </div>
+        {prefilled && (
+          <button
+            type="button"
+            onClick={() => props?.onPrefilledToolCallConsumed?.(prefilled.id)}
+          >
+            consume prefilled
+          </button>
+        )}
+      </div>
+    );
+  },
+}));
+
+global.fetch = jest.fn().mockResolvedValue({ json: () => Promise.resolve({}) });
+
+jest.mock("../lib/hooks/useConnection", () => ({
+  useConnection: jest.fn(),
+}));
+
+describe("App - Tools to Apps prefilled handoff", () => {
+  const mockUseConnection = jest.mocked(useConnection);
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    latestAppsTabProps = undefined;
+    window.location.hash = "#tools";
+  });
+
+  it("passes prefilled call data to AppsTab for tools using _meta['ui/resourceUri']", async () => {
+    const makeRequest = jest.fn(async (request: { method: string }) => {
+      if (request.method === "tools/list") {
+        return {
+          tools: [
+            {
+              name: "weatherApp",
+              inputSchema: {
+                type: "object",
+                properties: {
+                  city: { type: "string" },
+                },
+              },
+              _meta: {
+                "ui/resourceUri": "ui://weather-app",
+              },
+            },
+          ],
+          nextCursor: undefined,
+        };
+      }
+
+      if (request.method === "tools/call") {
+        return {
+          content: [{ type: "text", text: "weather result" }],
+        };
+      }
+
+      throw new Error(`Unexpected method: ${request.method}`);
+    });
+
+    mockUseConnection.mockReturnValue({
+      connectionStatus: "connected",
+      serverCapabilities: { tools: { listChanged: true } },
+      serverImplementation: null,
+      mcpClient: {
+        request: jest.fn(),
+        notification: jest.fn(),
+        close: jest.fn(),
+      } as unknown as Client,
+      requestHistory: [],
+      clearRequestHistory: jest.fn(),
+      makeRequest,
+      cancelTask: jest.fn(),
+      listTasks: jest.fn(),
+      sendNotification: jest.fn(),
+      handleCompletion: jest.fn(),
+      completionsSupported: false,
+      connect: jest.fn(),
+      disconnect: jest.fn(),
+    } as ReturnType<typeof useConnection>);
+
+    render(<App />);
+
+    fireEvent.click(screen.getByRole("button", { name: /mock list tools/i }));
+
+    await waitFor(() => {
+      const tools = JSON.parse(
+        screen.getByTestId("apps-tools").textContent || "[]",
+      );
+      expect(tools).toHaveLength(1);
+      expect(tools[0].name).toBe("weatherApp");
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: /mock run app tool/i }));
+
+    await waitFor(() => {
+      const prefilled = JSON.parse(
+        screen.getByTestId("apps-prefilled").textContent || "null",
+      );
+      expect(prefilled.toolName).toBe("weatherApp");
+      expect(prefilled.params).toEqual({ city: "Lisbon" });
+      expect(prefilled.result.content[0].text).toBe("weather result");
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: /consume prefilled/i }));
+
+    await waitFor(() => {
+      expect(screen.getByTestId("apps-prefilled")).toHaveTextContent("null");
+    });
+  });
+});
diff --git a/client/src/components/AppRenderer.tsx b/client/src/components/AppRenderer.tsx
index 7ac56a16..e25f35c9 100644
--- a/client/src/components/AppRenderer.tsx
+++ b/client/src/components/AppRenderer.tsx
@@ -1,8 +1,9 @@
-import { useEffect, useMemo, useRef, useState } from "react";
+import { useMemo, useState } from "react";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import {
   Tool,
   ContentBlock,
+  CompatibilityCallToolResult,
   CallToolResult,
   CallToolResultSchema,
   ServerNotification,
@@ -26,6 +27,7 @@ interface AppRendererProps {
   tool: Tool;
   mcpClient: Client | null;
   toolInput?: Record<string, unknown>;
+  toolResult?: CompatibilityCallToolResult | null;
   onNotification?: (notification: ServerNotification) => void;
 }
 
@@ -34,13 +36,32 @@ const AppRenderer = ({
   tool,
   mcpClient,
   toolInput,
+  toolResult,
   onNotification,
 }: AppRendererProps) => {
   const [error, setError] = useState<string | null>(null);
-  const [toolResult, setToolResult] = useState<CallToolResult | undefined>();
-  const latestRunIdRef = useRef(0);
   const { toast } = useToast();
 
+  const normalizedToolResult = useMemo<CallToolResult | undefined>(() => {
+    if (!toolResult) {
+      return undefined;
+    }
+
+    if ("content" in toolResult) {
+      const parsedResult = CallToolResultSchema.safeParse(toolResult);
+      return parsedResult.success ? parsedResult.data : undefined;
+    }
+
+    if ("toolResult" in toolResult) {
+      const parsedResult = CallToolResultSchema.safeParse(
+        toolResult.toolResult,
+      );
+      return parsedResult.success ? parsedResult.data : undefined;
+    }
+
+    return undefined;
+  }, [toolResult]);
+
   const hostContext: McpUiHostContext = useMemo(
     () => ({
       theme: document.documentElement.classList.contains("dark")
@@ -89,67 +110,6 @@ const AppRenderer = ({
     }
   };
 
-  useEffect(() => {
-    if (!mcpClient) {
-      setToolResult(undefined);
-      return;
-    }
-
-    const runId = ++latestRunIdRef.current;
-    const abortController = new AbortController();
-    setToolResult(undefined);
-
-    const runTool = async () => {
-      try {
-        const result = await mcpClient.request(
-          {
-            method: "tools/call",
-            params: {
-              name: tool.name,
-              arguments: toolInput ?? {},
-            },
-          },
-          CallToolResultSchema,
-          { signal: abortController.signal },
-        );
-
-        if (
-          abortController.signal.aborted ||
-          runId !== latestRunIdRef.current
-        ) {
-          return;
-        }
-
-        setToolResult(result);
-      } catch (runError) {
-        if (
-          abortController.signal.aborted ||
-          runId !== latestRunIdRef.current
-        ) {
-          return;
-        }
-
-        const message =
-          runError instanceof Error ? runError.message : String(runError);
-        setToolResult({
-          content: [
-            {
-              type: "text",
-              text: message,
-            },
-          ],
-          isError: true,
-        });
-      }
-    };
-
-    void runTool();
-
-    return () => {
-      abortController.abort();
-    };
-  }, [mcpClient, tool.name, toolInput]);
-
   if (!mcpClient) {
     return (
       <Alert>
@@ -180,7 +140,7 @@ const AppRenderer = ({
           toolName={tool.name}
           hostContext={hostContext}
           toolInput={toolInput}
-          toolResult={toolResult}
+          toolResult={normalizedToolResult}
           sandbox={{
             url: new URL(sandboxPath, window.location.origin),
           }}
diff --git a/client/src/components/AppsTab.tsx b/client/src/components/AppsTab.tsx
index 1943c439..2b6d7535 100644
--- a/client/src/components/AppsTab.tsx
+++ b/client/src/components/AppsTab.tsx
@@ -6,11 +6,16 @@ import {
   AlertCircle,
   X,
   Play,
+  Loader2,
   ChevronRight,
   Maximize2,
   Minimize2,
 } from "lucide-react";
-import { Tool, ServerNotification } from "@modelcontextprotocol/sdk/types.js";
+import {
+  Tool,
+  ServerNotification,
+  CompatibilityCallToolResult,
+} from "@modelcontextprotocol/sdk/types.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { getToolUiResourceUri } from "@modelcontextprotocol/ext-apps/app-bridge";
 import AppRenderer from "./AppRenderer";
@@ -40,6 +45,19 @@ interface AppsTabProps {
   sandboxPath: string;
   tools: Tool[];
   listTools: () => void;
+  callTool: (
+    name: string,
+    params: Record<string, unknown>,
+    metadata?: Record<string, unknown>,
+    runAsTask?: boolean,
+  ) => Promise<CompatibilityCallToolResult>;
+  prefilledToolCall?: {
+    id: number;
+    toolName: string;
+    params: Record<string, unknown>;
+    result: CompatibilityCallToolResult;
+  } | null;
+  onPrefilledToolCallConsumed?: (callId: number) => void;
   error: string | null;
   mcpClient: Client | null;
   onNotification?: (notification: ServerNotification) => void;
@@ -50,10 +68,23 @@ const hasUIMetadata = (tool: Tool): boolean => {
   return !!getToolUiResourceUri(tool);
 };
 
+const cloneToolParams = (
+  source: Record<string, unknown>,
+): Record<string, unknown> => {
+  try {
+    return structuredClone(source);
+  } catch {
+    return { ...source };
+  }
+};
+
 const AppsTab = ({
   sandboxPath,
   tools,
   listTools,
+  callTool,
+  prefilledToolCall,
+  onPrefilledToolCallConsumed,
   error,
   mcpClient,
   onNotification,
@@ -62,9 +93,38 @@ const AppsTab = ({
   const [selectedTool, setSelectedTool] = useState<Tool | null>(null);
   const [params, setParams] = useState<Record<string, unknown>>({});
   const [isAppOpen, setIsAppOpen] = useState(false);
+  const [isOpeningApp, setIsOpeningApp] = useState(false);
   const [isMaximized, setIsMaximized] = useState(false);
   const [hasValidationErrors, setHasValidationErrors] = useState(false);
+  const [submittedParams, setSubmittedParams] = useState<
+    Record<string, unknown> | undefined
+  >(undefined);
+  const [submittedToolResult, setSubmittedToolResult] =
+    useState<CompatibilityCallToolResult | null>(null);
   const formRefs = useRef<Record<string, DynamicJsonFormRef | null>>({});
+  const openAppRunIdRef = useRef(0);
+  const prefillingParamsRef = useRef<Record<string, unknown> | null>(null);
+  const consumedPrefilledCallIdRef = useRef<number | null>(null);
+
+  const buildInitialParams = useCallback((tool: Tool) => {
+    const initialParams = Object.entries(tool.inputSchema.properties ?? []).map(
+      ([key, value]) => {
+        const resolvedValue = resolveRef(
+          value as JsonSchemaType,
+          tool.inputSchema as JsonSchemaType,
+        );
+        return [
+          key,
+          generateDefaultValue(
+            resolvedValue,
+            key,
+            tool.inputSchema as JsonSchemaType,
+          ),
+        ];
+      },
+    );
+    return Object.fromEntries(initialParams);
+  }, []);
 
   // Function to check if any form has validation errors
   const checkValidationErrors = useCallback(() => {
@@ -89,63 +149,145 @@ const AppsTab = ({
     if (selectedTool && !filtered.find((t) => t.name === selectedTool.name)) {
       setSelectedTool(null);
       setIsAppOpen(false);
+      setSubmittedParams(undefined);
+      setSubmittedToolResult(null);
     }
   }, [tools, selectedTool]);
 
   useEffect(() => {
     if (selectedTool) {
-      const initialParams = Object.entries(
-        selectedTool.inputSchema.properties ?? [],
-      ).map(([key, value]) => {
-        // First resolve any $ref references
-        const resolvedValue = resolveRef(
-          value as JsonSchemaType,
-          selectedTool.inputSchema as JsonSchemaType,
-        );
-        return [
-          key,
-          generateDefaultValue(
-            resolvedValue,
-            key,
-            selectedTool.inputSchema as JsonSchemaType,
-          ),
-        ];
-      });
-      setParams(Object.fromEntries(initialParams));
+      const prefillingParams = prefillingParamsRef.current;
+      if (prefillingParams) {
+        setParams(prefillingParams);
+        prefillingParamsRef.current = null;
+      } else {
+        setParams(buildInitialParams(selectedTool));
+      }
       setHasValidationErrors(false);
       formRefs.current = {};
     } else {
       setParams({});
       setIsAppOpen(false);
+      setSubmittedParams(undefined);
+      setSubmittedToolResult(null);
     }
-  }, [selectedTool]);
+  }, [buildInitialParams, selectedTool]);
+
+  useEffect(() => {
+    if (!prefilledToolCall) {
+      return;
+    }
+
+    if (consumedPrefilledCallIdRef.current === prefilledToolCall.id) {
+      return;
+    }
+
+    const matchingTool = appTools.find(
+      (tool) => tool.name === prefilledToolCall.toolName,
+    );
+    if (!matchingTool) {
+      return;
+    }
+
+    const hydratedParams = cloneToolParams(prefilledToolCall.params);
+
+    openAppRunIdRef.current += 1;
+    setIsOpeningApp(false);
+    prefillingParamsRef.current = hydratedParams;
+    setSelectedTool(matchingTool);
+    setSubmittedParams(hydratedParams);
+    setSubmittedToolResult(prefilledToolCall.result);
+    setIsAppOpen(true);
+    setIsMaximized(false);
+    consumedPrefilledCallIdRef.current = prefilledToolCall.id;
+    onPrefilledToolCallConsumed?.(prefilledToolCall.id);
+  }, [appTools, onPrefilledToolCallConsumed, prefilledToolCall]);
 
   const handleRefresh = useCallback(() => {
     listTools();
   }, [listTools]);
 
+  const executeToolAndOpenApp = useCallback(
+    async (tool: Tool, toolParams: Record<string, unknown>) => {
+      const runId = ++openAppRunIdRef.current;
+      const runParams = cloneToolParams(toolParams);
+      prefillingParamsRef.current = null;
+      setIsOpeningApp(true);
+      setSubmittedParams(runParams);
+      setSubmittedToolResult(null);
+      try {
+        const result = await callTool(tool.name, runParams);
+
+        if (runId !== openAppRunIdRef.current) {
+          return;
+        }
+
+        setSubmittedParams(runParams);
+        setSubmittedToolResult(result);
+        setIsAppOpen(true);
+      } catch {
+        if (runId !== openAppRunIdRef.current) {
+          return;
+        }
+
+        setSubmittedToolResult(null);
+        setIsAppOpen(false);
+      } finally {
+        if (runId === openAppRunIdRef.current) {
+          setIsOpeningApp(false);
+        }
+      }
+    },
+    [callTool],
+  );
+
   const handleCloseApp = useCallback(() => {
+    openAppRunIdRef.current += 1;
+    setIsOpeningApp(false);
     setIsAppOpen(false);
+    setSubmittedToolResult(null);
   }, []);
 
-  const handleOpenApp = useCallback(() => {
-    if (!checkValidationErrors()) {
-      setIsAppOpen(true);
+  const handleOpenApp = useCallback(async () => {
+    if (!selectedTool || checkValidationErrors()) {
+      return;
     }
-  }, [checkValidationErrors]);
 
-  const handleSelectTool = useCallback((tool: Tool) => {
-    setSelectedTool(tool);
-    const hasFields =
-      tool.inputSchema.properties &&
-      Object.keys(tool.inputSchema.properties).length > 0;
-    setIsAppOpen(!hasFields);
-  }, []);
+    await executeToolAndOpenApp(selectedTool, params);
+  }, [checkValidationErrors, executeToolAndOpenApp, params, selectedTool]);
+
+  const handleSelectTool = useCallback(
+    (tool: Tool) => {
+      openAppRunIdRef.current += 1;
+      setIsOpeningApp(false);
+      prefillingParamsRef.current = null;
+      setSelectedTool(tool);
+      setSubmittedParams(undefined);
+      setSubmittedToolResult(null);
+      const hasFields =
+        tool.inputSchema.properties &&
+        Object.keys(tool.inputSchema.properties).length > 0;
+
+      if (hasFields) {
+        setIsAppOpen(false);
+        return;
+      }
+
+      const initialParams = buildInitialParams(tool);
+      void executeToolAndOpenApp(tool, initialParams);
+    },
+    [buildInitialParams, executeToolAndOpenApp],
+  );
 
   const handleDeselectTool = useCallback(() => {
+    openAppRunIdRef.current += 1;
+    setIsOpeningApp(false);
+    prefillingParamsRef.current = null;
     setSelectedTool(null);
     setIsAppOpen(false);
     setIsMaximized(false);
+    setSubmittedParams(undefined);
+    setSubmittedToolResult(null);
   }, []);
 
   return (
@@ -470,12 +612,16 @@ const AppsTab = ({
                           })}
 
                           <Button
-                            onClick={handleOpenApp}
+                            onClick={() => void handleOpenApp()}
                             className="w-full"
-                            disabled={hasValidationErrors}
+                            disabled={hasValidationErrors || isOpeningApp}
                           >
-                            <Play className="w-4 h-4 mr-2" />
-                            Open App
+                            {isOpeningApp ? (
+                              <Loader2 className="w-4 h-4 mr-2 animate-spin" />
+                            ) : (
+                              <Play className="w-4 h-4 mr-2" />
+                            )}
+                            {isOpeningApp ? "Opening App..." : "Open App"}
                           </Button>
                         </div>
                       </div>
@@ -497,7 +643,8 @@ const AppsTab = ({
                             sandboxPath={sandboxPath}
                             tool={selectedTool}
                             mcpClient={mcpClient}
-                            toolInput={params}
+                            toolInput={submittedParams}
+                            toolResult={submittedToolResult}
                             onNotification={onNotification}
                           />
                         </div>
diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index c581e98a..f50c0abb 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -78,7 +78,7 @@ const ToolsTab = ({
     params: Record<string, unknown>,
     metadata?: Record<string, unknown>,
     runAsTask?: boolean,
-  ) => Promise<void>;
+  ) => Promise<CompatibilityCallToolResult>;
   selectedTool: Tool | null;
   setSelectedTool: (tool: Tool | null) => void;
   toolResult: CompatibilityCallToolResult | null;
diff --git a/client/src/components/__tests__/AppRenderer.test.tsx b/client/src/components/__tests__/AppRenderer.test.tsx
index 723e4f98..7d9ae060 100644
--- a/client/src/components/__tests__/AppRenderer.test.tsx
+++ b/client/src/components/__tests__/AppRenderer.test.tsx
@@ -2,7 +2,10 @@ import { render, screen, fireEvent, waitFor } from "@testing-library/react";
 import "@testing-library/jest-dom";
 import { describe, it, jest, beforeEach } from "@jest/globals";
 import AppRenderer from "../AppRenderer";
-import { Tool, CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+import {
+  Tool,
+  CompatibilityCallToolResult,
+} from "@modelcontextprotocol/sdk/types.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { RequestHandlerExtra } from "@mcp-ui/client";
 import { McpUiMessageResult } from "@modelcontextprotocol/ext-apps";
@@ -16,7 +19,7 @@ type BridgeEvent = {
 type MockMcpUiRendererProps = {
   toolName: string;
   toolInput?: Record<string, unknown>;
-  toolResult?: CallToolResult;
+  toolResult?: CompatibilityCallToolResult;
   onMessage?: (
     params: { role: "user"; content: { type: "text"; text: string }[] },
     extra: RequestHandlerExtra,
@@ -111,16 +114,6 @@ jest.mock("@mcp-ui/client", () => {
   };
 });
 
-const createDeferred = <T,>() => {
-  let resolve!: (value: T) => void;
-  let reject!: (reason?: unknown) => void;
-  const promise = new Promise<T>((res, rej) => {
-    resolve = res;
-    reject = rej;
-  });
-  return { promise, resolve, reject };
-};
-
 describe("AppRenderer", () => {
   const mockTool: Tool = {
     name: "testApp",
@@ -137,12 +130,6 @@ describe("AppRenderer", () => {
   } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
 
   const mockMcpClient = {
-    request: jest.fn(
-      () =>
-        new Promise<CallToolResult>(() => {
-          // Intentionally unresolved for baseline rendering tests.
-        }),
-    ),
     getServerCapabilities: jest.fn().mockReturnValue({}),
     setNotificationHandler: jest.fn(),
   } as unknown as Client;
@@ -151,6 +138,7 @@ describe("AppRenderer", () => {
     sandboxPath: "/sandbox",
     tool: mockTool,
     mcpClient: mockMcpClient,
+    toolResult: null,
   };
 
   beforeEach(() => {
@@ -187,38 +175,19 @@ describe("AppRenderer", () => {
     });
   });
 
-  it("should call tools/call and send tool input/result after app initialization", async () => {
-    const mockResult: CallToolResult = {
+  it("should send provided tool input and tool result after app initialization", async () => {
+    const result: CompatibilityCallToolResult = {
       content: [{ type: "text", text: "Budget initialized" }],
     };
-    const requestMock = jest.fn().mockResolvedValue(mockResult);
-    const mcpClient = {
-      ...mockMcpClient,
-      request: requestMock,
-    } as unknown as Client;
 
     render(
       <AppRenderer
         {...defaultProps}
-        mcpClient={mcpClient}
         toolInput={{ monthlyBudget: 2500 }}
+        toolResult={result}
       />,
     );
 
-    await waitFor(() => {
-      expect(requestMock).toHaveBeenCalledWith(
-        {
-          method: "tools/call",
-          params: {
-            name: "testApp",
-            arguments: { monthlyBudget: 2500 },
-          },
-        },
-        expect.any(Object),
-        expect.objectContaining({ signal: expect.any(AbortSignal) }),
-      );
-    });
-
     expect(mockBridgeEvents).toHaveLength(0);
 
     fireEvent.click(screen.getByTestId("initialize-app"));
@@ -237,26 +206,50 @@ describe("AppRenderer", () => {
       (event) =>
         event.toolName === "testApp" && event.type === "sendToolResult",
     );
-    expect(resultEvent?.payload).toEqual(mockResult);
+    expect(resultEvent?.payload).toEqual(result);
   });
 
-  it("should send an app-consumable error result when tools/call fails", async () => {
-    const requestMock = jest
-      .fn()
-      .mockRejectedValue(new Error("tool execution failed"));
-    const mcpClient = {
-      ...mockMcpClient,
-      request: requestMock,
-    } as unknown as Client;
-
+  it("should not send tool result event when toolResult is null", async () => {
     render(
-      <AppRenderer {...defaultProps} mcpClient={mcpClient} toolInput={{}} />,
+      <AppRenderer
+        {...defaultProps}
+        toolInput={{ monthlyBudget: 2500 }}
+        toolResult={null}
+      />,
     );
 
+    fireEvent.click(screen.getByTestId("initialize-app"));
+
     await waitFor(() => {
-      expect(requestMock).toHaveBeenCalledTimes(1);
+      const inputEvents = mockBridgeEvents.filter(
+        (event) =>
+          event.toolName === "testApp" && event.type === "sendToolInput",
+      );
+      expect(inputEvents).toHaveLength(1);
     });
 
+    const resultEvents = mockBridgeEvents.filter(
+      (event) =>
+        event.toolName === "testApp" && event.type === "sendToolResult",
+    );
+    expect(resultEvents).toHaveLength(0);
+  });
+
+  it("should normalize compatibility wrapper tool results before sending", async () => {
+    const wrappedResult = {
+      toolResult: {
+        content: [{ type: "text", text: "Wrapped result payload" }],
+      },
+    } as CompatibilityCallToolResult;
+
+    render(
+      <AppRenderer
+        {...defaultProps}
+        toolInput={{ monthlyBudget: 2500 }}
+        toolResult={wrappedResult}
+      />,
+    );
+
     fireEvent.click(screen.getByTestId("initialize-app"));
 
     await waitFor(() => {
@@ -264,95 +257,8 @@ describe("AppRenderer", () => {
         (event) =>
           event.toolName === "testApp" && event.type === "sendToolResult",
       );
-
-      expect(resultEvent?.payload).toEqual({
-        content: [{ type: "text", text: "tool execution failed" }],
-        isError: true,
-      });
+      expect(resultEvent).toBeTruthy();
+      expect(resultEvent?.payload).toEqual(wrappedResult.toolResult);
     });
   });
-
-  it("should ignore stale tool results after switching app tools", async () => {
-    const firstResult: CallToolResult = {
-      content: [{ type: "text", text: "stale result" }],
-    };
-    const secondResult: CallToolResult = {
-      content: [{ type: "text", text: "fresh result" }],
-    };
-
-    const firstRequest = createDeferred<CallToolResult>();
-    const secondRequest = createDeferred<CallToolResult>();
-    const requestMock = jest
-      .fn()
-      .mockReturnValueOnce(firstRequest.promise)
-      .mockReturnValueOnce(secondRequest.promise);
-
-    const mcpClient = {
-      ...mockMcpClient,
-      request: requestMock,
-    } as unknown as Client;
-
-    const { rerender } = render(
-      <AppRenderer
-        {...defaultProps}
-        mcpClient={mcpClient}
-        toolInput={{ month: "january" }}
-      />,
-    );
-
-    await waitFor(() => {
-      expect(requestMock).toHaveBeenCalledTimes(1);
-    });
-
-    const secondTool = {
-      ...mockTool,
-      name: "budgetAllocatorApp",
-    };
-
-    rerender(
-      <AppRenderer
-        {...defaultProps}
-        mcpClient={mcpClient}
-        tool={secondTool}
-        toolInput={{ month: "february" }}
-      />,
-    );
-
-    await waitFor(() => {
-      expect(requestMock).toHaveBeenCalledTimes(2);
-    });
-
-    secondRequest.resolve(secondResult);
-    await waitFor(() => {
-      expect(screen.getByTestId("tool-result")).toHaveTextContent(
-        "fresh result",
-      );
-    });
-
-    fireEvent.click(screen.getByTestId("initialize-app"));
-
-    await waitFor(() => {
-      const freshEvents = mockBridgeEvents.filter(
-        (event) =>
-          event.toolName === "budgetAllocatorApp" &&
-          event.type === "sendToolResult",
-      );
-      expect(freshEvents).toHaveLength(1);
-      expect(freshEvents[0].payload).toEqual(secondResult);
-    });
-
-    firstRequest.resolve(firstResult);
-    await Promise.resolve();
-    await Promise.resolve();
-
-    const secondToolResultEvents = mockBridgeEvents.filter(
-      (event) =>
-        event.toolName === "budgetAllocatorApp" &&
-        event.type === "sendToolResult",
-    );
-
-    expect(secondToolResultEvents).toHaveLength(1);
-    expect(secondToolResultEvents[0].payload).toEqual(secondResult);
-    expect(screen.getByTestId("tool-result")).toHaveTextContent("fresh result");
-  });
 });
diff --git a/client/src/components/__tests__/AppsTab.test.tsx b/client/src/components/__tests__/AppsTab.test.tsx
index 27868fca..315a95cc 100644
--- a/client/src/components/__tests__/AppsTab.test.tsx
+++ b/client/src/components/__tests__/AppsTab.test.tsx
@@ -1,8 +1,17 @@
-import { render, screen, fireEvent } from "@testing-library/react";
+import {
+  render,
+  screen,
+  fireEvent,
+  waitFor,
+  act,
+} from "@testing-library/react";
 import "@testing-library/jest-dom";
 import { describe, it, jest, beforeEach } from "@jest/globals";
 import AppsTab from "../AppsTab";
-import { Tool } from "@modelcontextprotocol/sdk/types.js";
+import {
+  Tool,
+  CompatibilityCallToolResult,
+} from "@modelcontextprotocol/sdk/types.js";
 import { Tabs } from "../ui/tabs";
 
 // Mock AppRenderer component
@@ -10,14 +19,19 @@ jest.mock("../AppRenderer", () => {
   return function MockAppRenderer({
     tool,
     toolInput,
+    toolResult,
   }: {
     tool: Tool;
     toolInput?: Record<string, unknown>;
+    toolResult?: unknown;
   }) {
     return (
       <div data-testid="app-renderer">
         <div>Tool: {tool.name}</div>
         <div data-testid="tool-input">{JSON.stringify(toolInput)}</div>
+        <div data-testid="tool-result">
+          {JSON.stringify(toolResult ?? null)}
+        </div>
       </div>
     );
   };
@@ -50,6 +64,12 @@ describe("AppsTab", () => {
   const defaultProps = {
     tools: [],
     listTools: jest.fn(),
+    callTool: jest.fn(
+      async () =>
+        ({
+          content: [],
+        }) as CompatibilityCallToolResult,
+    ),
     error: null,
     mcpClient: null,
   };
@@ -131,7 +151,7 @@ describe("AppsTab", () => {
     expect(screen.getByText(errorMessage)).toBeInTheDocument();
   });
 
-  it("should open app renderer when an app card is clicked and Open App button is clicked if fields exist", () => {
+  it("should open app renderer when an app card is clicked and Open App button is clicked if fields exist", async () => {
     const toolWithFields: Tool = {
       name: "fieldsApp",
       inputSchema: {
@@ -142,9 +162,16 @@ describe("AppsTab", () => {
       },
       _meta: { ui: { resourceUri: "ui://fields" } },
     } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+    const mockCallTool = jest.fn(
+      async () =>
+        ({
+          content: [],
+        }) as CompatibilityCallToolResult,
+    );
 
     renderAppsTab({
       tools: [toolWithFields],
+      callTool: mockCallTool,
     });
 
     const appCard = screen.getByText("fieldsApp").closest("div");
@@ -159,12 +186,19 @@ describe("AppsTab", () => {
     const openAppButton = screen.getByRole("button", { name: /open app/i });
     fireEvent.click(openAppButton);
 
-    // AppRenderer should be rendered
-    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    await waitFor(() => {
+      expect(mockCallTool).toHaveBeenCalledWith("fieldsApp", {
+        field1: undefined,
+      });
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
     expect(screen.getByText("Tool: fieldsApp")).toBeInTheDocument();
   });
 
-  it("should close app renderer when close button is clicked", () => {
+  it("should close app renderer when close button is clicked", async () => {
     renderAppsTab({
       tools: [mockAppTool],
     });
@@ -172,8 +206,9 @@ describe("AppsTab", () => {
     // Open the app
     const appCard = screen.getByText("weatherApp").closest("div");
     fireEvent.click(appCard!);
-    // weatherApp has no properties in mockAppTool, so it should be open immediately
-    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
 
     // Close the app (Deselect tool)
     const closeButton = screen.getByRole("button", { name: /close app/i });
@@ -204,7 +239,7 @@ describe("AppsTab", () => {
     expect(screen.getByText("noDescriptionApp")).toBeInTheDocument();
   });
 
-  it("should reset selected tool when tools list changes and selected tool is removed", () => {
+  it("should reset selected tool when tools list changes and selected tool is removed", async () => {
     const { rerender } = renderAppsTab({
       tools: [mockAppTool],
     });
@@ -212,8 +247,9 @@ describe("AppsTab", () => {
     // Select the app
     const appCard = screen.getByText("weatherApp").closest("div");
     fireEvent.click(appCard!);
-    // weatherApp has no properties in mockAppTool, so it should be open immediately
-    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
 
     // Update tools list to remove the selected tool
     rerender(
@@ -226,7 +262,7 @@ describe("AppsTab", () => {
     expect(screen.queryByTestId("app-renderer")).not.toBeInTheDocument();
   });
 
-  it("should maintain selected tool when tools list updates but includes the same tool", () => {
+  it("should maintain selected tool when tools list updates but includes the same tool", async () => {
     const { rerender } = renderAppsTab({
       tools: [mockAppTool],
     });
@@ -234,8 +270,9 @@ describe("AppsTab", () => {
     // Select the app
     const appCard = screen.getByText("weatherApp").closest("div");
     fireEvent.click(appCard!);
-    // weatherApp has no properties in mockAppTool, so it should be open immediately
-    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
 
     // Update tools list with the same tool
     rerender(
@@ -248,7 +285,7 @@ describe("AppsTab", () => {
     expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
   });
 
-  it("should maximize and minimize the app window", () => {
+  it("should maximize and minimize the app window", async () => {
     renderAppsTab({
       tools: [mockAppTool],
     });
@@ -256,12 +293,12 @@ describe("AppsTab", () => {
     // Select the app
     const appCard = screen.getByText("weatherApp").closest("div");
     fireEvent.click(appCard!);
-    // weatherApp has no properties in mockAppTool, so it should be open immediately
 
-    // Now Maximize button should be visible
-    expect(
-      screen.getByRole("button", { name: /maximize/i }),
-    ).toBeInTheDocument();
+    await waitFor(() => {
+      expect(
+        screen.getByRole("button", { name: /maximize/i }),
+      ).toBeInTheDocument();
+    });
 
     // Initially, ListPane should be visible
     expect(screen.getByText("MCP Apps")).toBeInTheDocument();
@@ -281,7 +318,7 @@ describe("AppsTab", () => {
     expect(screen.getByText("MCP Apps")).toBeInTheDocument();
   });
 
-  it("should reset maximized state when app is closed", () => {
+  it("should reset maximized state when app is closed", async () => {
     renderAppsTab({
       tools: [mockAppTool],
     });
@@ -289,7 +326,12 @@ describe("AppsTab", () => {
     // Select the app
     const appCard = screen.getByText("weatherApp").closest("div");
     fireEvent.click(appCard!);
-    // weatherApp has no properties in mockAppTool, so it should be open immediately
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole("button", { name: /maximize/i }),
+      ).toBeInTheDocument();
+    });
 
     // Maximize
     fireEvent.click(screen.getByRole("button", { name: /maximize/i }));
@@ -311,7 +353,7 @@ describe("AppsTab", () => {
     expect(appItem).toBeTruthy();
   });
 
-  it("should handle empty resourceContentMap", () => {
+  it("should handle empty resourceContentMap", async () => {
     renderAppsTab({
       tools: [mockAppTool],
     });
@@ -319,13 +361,13 @@ describe("AppsTab", () => {
     // Open the app
     const appCard = screen.getByText("weatherApp").closest("div");
     fireEvent.click(appCard!);
-    // weatherApp has no properties in mockAppTool, so it should be open immediately
 
-    // AppRenderer should still be rendered
-    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
   });
 
-  it("should handle various input types and pass them to AppRenderer", () => {
+  it("should handle various input types and pass them to AppRenderer", async () => {
     const toolWithComplexSchema: Tool = {
       name: "complexApp",
       inputSchema: {
@@ -359,6 +401,10 @@ describe("AppsTab", () => {
 
     fireEvent.click(screen.getByRole("button", { name: /open app/i }));
 
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
+
     const toolInput = JSON.parse(
       screen.getByTestId("tool-input").textContent || "{}",
     );
@@ -367,7 +413,7 @@ describe("AppsTab", () => {
     expect(toolInput.number).toBe(42);
   });
 
-  it("should handle nullable fields", () => {
+  it("should handle nullable fields", async () => {
     const toolWithNullable: Tool = {
       name: "nullableApp",
       inputSchema: {
@@ -391,13 +437,17 @@ describe("AppsTab", () => {
 
     fireEvent.click(screen.getByRole("button", { name: /open app/i }));
 
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
+
     const toolInput = JSON.parse(
       screen.getByTestId("tool-input").textContent || "{}",
     );
     expect(toolInput.nullableField).toBe(null);
   });
 
-  it("should allow going back to input form from app renderer", () => {
+  it("should allow going back to input form from app renderer", async () => {
     const toolWithFields: Tool = {
       name: "fieldsApp",
       inputSchema: {
@@ -416,13 +466,15 @@ describe("AppsTab", () => {
     fireEvent.click(screen.getByText("fieldsApp"));
     fireEvent.click(screen.getByRole("button", { name: /open app/i }));
 
-    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
 
     const backButton = screen.queryByRole("button", { name: /back to input/i });
     expect(backButton).toBeInTheDocument();
   });
 
-  it("should skip input form if tool has no input fields", () => {
+  it("should skip input form if tool has no input fields", async () => {
     const toolNoFields: Tool = {
       name: "noFieldsApp",
       inputSchema: {
@@ -431,15 +483,27 @@ describe("AppsTab", () => {
       },
       _meta: { ui: { resourceUri: "ui://no-fields" } },
     } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+    const mockCallTool = jest.fn(
+      async () =>
+        ({
+          content: [],
+        }) as CompatibilityCallToolResult,
+    );
 
     renderAppsTab({
       tools: [toolNoFields],
+      callTool: mockCallTool,
     });
 
     fireEvent.click(screen.getByText("noFieldsApp"));
 
-    // Should see the renderer immediately
-    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    await waitFor(() => {
+      expect(mockCallTool).toHaveBeenCalledWith("noFieldsApp", {});
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
     expect(screen.getByText("Tool: noFieldsApp")).toBeInTheDocument();
 
     // Should NOT see the back button
@@ -448,7 +512,7 @@ describe("AppsTab", () => {
     ).not.toBeInTheDocument();
   });
 
-  it("should allow going back to input form from app renderer if fields exist", () => {
+  it("should allow going back to input form from app renderer if fields exist", async () => {
     const toolWithFields: Tool = {
       name: "fieldsApp",
       inputSchema: {
@@ -470,7 +534,9 @@ describe("AppsTab", () => {
     expect(screen.getByText("App Input")).toBeInTheDocument();
     fireEvent.click(screen.getByRole("button", { name: /open app/i }));
 
-    expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
 
     const backButton = screen.getByRole("button", { name: /back to input/i });
     fireEvent.click(backButton);
@@ -478,4 +544,229 @@ describe("AppsTab", () => {
     expect(screen.queryByTestId("app-renderer")).not.toBeInTheDocument();
     expect(screen.getByText("App Input")).toBeInTheDocument();
   });
+
+  it("should auto-render app from prefilled tools tab call without manual click", async () => {
+    const toolWithFields: Tool = {
+      name: "prefilledApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          city: { type: "string" },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://prefilled" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+    const onPrefilledToolCallConsumed = jest.fn();
+    const prefilledResult: CompatibilityCallToolResult = {
+      content: [{ type: "text", text: "weather result" }],
+    };
+
+    renderAppsTab({
+      tools: [toolWithFields],
+      prefilledToolCall: {
+        id: 42,
+        toolName: "prefilledApp",
+        params: { city: "Lisbon" },
+        result: prefilledResult,
+      },
+      onPrefilledToolCallConsumed,
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+      expect(screen.getByText("Tool: prefilledApp")).toBeInTheDocument();
+    });
+
+    const toolInput = JSON.parse(
+      screen.getByTestId("tool-input").textContent || "{}",
+    );
+    expect(toolInput).toEqual({ city: "Lisbon" });
+    expect(screen.getByTestId("tool-result")).toHaveTextContent(
+      "weather result",
+    );
+    expect(onPrefilledToolCallConsumed).toHaveBeenCalledWith(42);
+  });
+
+  it("should not auto-render app when no prefilled tool call is provided", () => {
+    const toolWithFields: Tool = {
+      name: "manualApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          city: { type: "string" },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://manual" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    renderAppsTab({
+      tools: [toolWithFields],
+    });
+
+    expect(screen.queryByTestId("app-renderer")).not.toBeInTheDocument();
+    expect(
+      screen.getByText("Select an app from the list to get started"),
+    ).toBeInTheDocument();
+  });
+
+  it("should preserve submitted params while opening app", async () => {
+    const toolWithFields: Tool = {
+      name: "paramsApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          query: { type: "string" },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://params" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    let resolveCall: ((result: CompatibilityCallToolResult) => void) | null =
+      null;
+    const mockCallTool = jest.fn(
+      () =>
+        new Promise<CompatibilityCallToolResult>((resolve) => {
+          resolveCall = resolve;
+        }),
+    );
+
+    renderAppsTab({
+      tools: [toolWithFields],
+      callTool: mockCallTool,
+    });
+
+    fireEvent.click(screen.getByText("paramsApp"));
+    fireEvent.change(screen.getByLabelText("query"), {
+      target: { value: "first value" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: /open app/i }));
+
+    fireEvent.change(screen.getByLabelText("query"), {
+      target: { value: "second value" },
+    });
+
+    expect(resolveCall).toBeTruthy();
+    await act(async () => {
+      resolveCall?.({
+        content: [{ type: "text", text: "done" }],
+      });
+    });
+
+    await waitFor(() => {
+      expect(screen.getByTestId("app-renderer")).toBeInTheDocument();
+    });
+
+    const toolInput = JSON.parse(
+      screen.getByTestId("tool-input").textContent || "{}",
+    );
+    expect(toolInput.query).toBe("first value");
+  });
+
+  it("should keep input view when opening fails and recover button state", async () => {
+    const toolWithFields: Tool = {
+      name: "failingApp",
+      inputSchema: {
+        type: "object",
+        properties: {
+          query: { type: "string" },
+        },
+      },
+      _meta: { ui: { resourceUri: "ui://failing" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    const mockCallTool = jest.fn(
+      async () =>
+        await Promise.reject<CompatibilityCallToolResult>(
+          new Error("tool failed"),
+        ),
+    );
+
+    renderAppsTab({
+      tools: [toolWithFields],
+      callTool: mockCallTool,
+    });
+
+    fireEvent.click(screen.getByText("failingApp"));
+    fireEvent.click(screen.getByRole("button", { name: /open app/i }));
+
+    await waitFor(() => {
+      expect(mockCallTool).toHaveBeenCalledWith("failingApp", {
+        query: undefined,
+      });
+    });
+
+    await waitFor(() => {
+      const openAppButton = screen.getByRole("button", { name: /open app/i });
+      expect(openAppButton).toBeEnabled();
+    });
+
+    expect(screen.getByText("App Input")).toBeInTheDocument();
+    expect(screen.queryByTestId("app-renderer")).not.toBeInTheDocument();
+  });
+
+  it("should ignore stale results from older app launches", async () => {
+    const appA: Tool = {
+      name: "appA",
+      inputSchema: {
+        type: "object",
+        properties: {},
+      },
+      _meta: { ui: { resourceUri: "ui://app-a" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+    const appB: Tool = {
+      name: "appB",
+      inputSchema: {
+        type: "object",
+        properties: {},
+      },
+      _meta: { ui: { resourceUri: "ui://app-b" } },
+    } as Tool & { _meta?: { ui?: { resourceUri?: string } } };
+
+    const pendingCalls: {
+      name: string;
+      resolve: (result: CompatibilityCallToolResult) => void;
+    }[] = [];
+    const mockCallTool = jest.fn(
+      (name: string) =>
+        new Promise<CompatibilityCallToolResult>((resolve) => {
+          pendingCalls.push({ name, resolve });
+        }),
+    );
+
+    renderAppsTab({
+      tools: [appA, appB],
+      callTool: mockCallTool,
+    });
+
+    fireEvent.click(screen.getByText("appA"));
+    fireEvent.click(screen.getByText("appB"));
+
+    const appBCall = pendingCalls.find((call) => call.name === "appB");
+    const appACall = pendingCalls.find((call) => call.name === "appA");
+    expect(appBCall).toBeTruthy();
+    expect(appACall).toBeTruthy();
+
+    await act(async () => {
+      appBCall?.resolve({
+        content: [{ type: "text", text: "result from appB" }],
+      });
+    });
+
+    await waitFor(() => {
+      expect(screen.getByText("Tool: appB")).toBeInTheDocument();
+      expect(screen.getByTestId("tool-result")).toHaveTextContent("appB");
+    });
+
+    await act(async () => {
+      appACall?.resolve({
+        content: [{ type: "text", text: "result from appA" }],
+      });
+    });
+
+    await waitFor(() => {
+      expect(screen.getByText("Tool: appB")).toBeInTheDocument();
+      expect(screen.getByTestId("tool-result")).toHaveTextContent("appB");
+      expect(screen.getByTestId("tool-result")).not.toHaveTextContent("appA");
+    });
+  });
 });
diff --git a/patches/@mcp-ui+client+6.0.0.patch b/patches/@mcp-ui+client+6.0.0.patch
new file mode 100644
index 00000000..f0354e8c
--- /dev/null
+++ b/patches/@mcp-ui+client+6.0.0.patch
@@ -0,0 +1,226 @@
+diff --git a/node_modules/@mcp-ui/client/dist/index.mjs b/node_modules/@mcp-ui/client/dist/index.mjs
+index 38fbac3..fa81be4 100644
+--- a/node_modules/@mcp-ui/client/dist/index.mjs
++++ b/node_modules/@mcp-ui/client/dist/index.mjs
+@@ -8417,23 +8417,40 @@ const $h = "io.modelcontextprotocol/ui", Ih = {
+ }, jh = {
+   [$h]: Ih
+ }, kh = 1e4;
+-async function wh(e) {
+-  const i = document.createElement("iframe");
+-  i.style.width = "100%", i.style.height = "600px", i.style.border = "none", i.style.backgroundColor = "transparent", i.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
+-  const r = new Promise((a, t) => {
+-    let n = !1;
+-    const o = () => {
+-      window.removeEventListener("message", u), i.removeEventListener("error", l);
+-    }, s = setTimeout(() => {
+-      n || (n = !0, o(), t(new Error("Timed out waiting for sandbox proxy iframe to be ready")));
+-    }, kh), u = (d) => {
+-      d.source === i.contentWindow && d.data && d.data.method === $f && (n || (n = !0, clearTimeout(s), o(), a()));
++function Fh(e) {
++  if (!e || typeof e != "object")
++    return "";
++  const i = [];
++  return e.camera && i.push("camera"), e.microphone && i.push("microphone"), e.geolocation && i.push("geolocation"), e.clipboardWrite && i.push("clipboard-write"), i.join("; ");
++}
++function Jh(e) {
++  if (!e || typeof e != "object")
++    return {};
++  const i = "_meta" in e && e._meta && typeof e._meta == "object" ? e._meta : "meta" in e && e.meta && typeof e.meta == "object" ? e.meta : void 0, r = i && typeof i.ui == "object" && i.ui ? i.ui : void 0;
++  return {
++    csp: r && typeof r.csp == "object" ? r.csp : void 0,
++    permissions: r && typeof r.permissions == "object" ? r.permissions : void 0
++  };
++}
++async function wh(e, i) {
++  const r = document.createElement("iframe");
++  r.style.width = "100%", r.style.height = "600px", r.style.border = "none", r.style.backgroundColor = "transparent", r.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
++  const a = Fh(i);
++  a && r.setAttribute("allow", a);
++  const t = new Promise((n, o) => {
++    let s = !1;
++    const u = () => {
++      window.removeEventListener("message", d), r.removeEventListener("error", l);
++    }, c = setTimeout(() => {
++      s || (s = !0, u(), o(new Error("Timed out waiting for sandbox proxy iframe to be ready")));
++    }, kh), d = (v) => {
++      v.source === r.contentWindow && v.data && v.data.method === $f && (s || (s = !0, clearTimeout(c), u(), n()));
+     }, l = () => {
+-      n || (n = !0, clearTimeout(s), o(), t(new Error("Failed to load sandbox proxy iframe")));
++      s || (s = !0, clearTimeout(c), u(), o(new Error("Failed to load sandbox proxy iframe")));
+     };
+-    window.addEventListener("message", u), i.addEventListener("error", l);
++    window.addEventListener("message", d), r.addEventListener("error", l);
+   });
+-  return i.src = e.href, { iframe: i, onReady: r };
++  return r.src = e.href, { iframe: r, onReady: t };
+ }
+ async function Sh(e, i) {
+   let r, a;
+@@ -8467,7 +8484,12 @@ async function xh(e, i) {
+     t = atob(a.blob);
+   else
+     throw new Error("Unsupported UI resource content format: " + JSON.stringify(a));
+-  return t;
++  const o = Jh(a);
++  return {
++    html: t,
++    csp: o.csp,
++    permissions: o.permissions
++  };
+ }
+ function Eh(e, i) {
+   const r = new URL(e.href);
+@@ -8496,7 +8518,7 @@ const zh = (e) => {
+       var ne, Q;
+       try {
+         $.current && ((ne = b.current) != null && ne.contains($.current)) && (b.current.removeChild($.current), $.current = null, I.current = null, N.current = null);
+-        const { iframe: H, onReady: ge } = await wh(k);
++        const { iframe: H, onReady: ge } = await wh(k, r.permissions);
+         if (!R || ($.current = H, I.current = V, N.current = a, b.current && b.current.appendChild(H), await ge, !R) || (a.onsizechange = async (ae) => {
+           var st;
+           (st = J.current) == null || st.call(J, ae), $.current && (ae.width !== void 0 && ($.current.style.width = `${ae.width}px`), ae.height !== void 0 && ($.current.style.height = `${ae.height}px`));
+@@ -8518,21 +8540,22 @@ const zh = (e) => {
+     })(), () => {
+       R = !1;
+     };
+-  }, [r.url, r.csp, a]), q(() => {
++  }, [r.url, r.csp, r.permissions, a]), q(() => {
+     if (!c || !i || N.current !== a) return;
+     (async () => {
+       var V;
+       try {
+         console.log("[AppFrame] Sending HTML to sandbox"), await a.sendSandboxResourceReady({
+           html: i,
+-          csp: r.csp
++          csp: r.csp,
++          permissions: r.permissions
+         });
+       } catch (R) {
+         const ve = R instanceof Error ? R : new Error(String(R));
+         g(ve), (V = O.current) == null || V.call(O, ve);
+       }
+     })();
+-  }, [c, i, a, r.csp]), q(() => {
++  }, [c, i, a, r.csp, r.permissions]), q(() => {
+     c && l && o && N.current === a && (console.log("[AppFrame] Sending tool input:", o), a.sendToolInput({ arguments: o }));
+   }, [a, c, l, o]), q(() => {
+     c && l && s && N.current === a && (console.log("[AppFrame] Sending tool result:", s), a.sendToolResult(s));
+@@ -8574,9 +8597,9 @@ const zh = (e) => {
+     onListResourceTemplates: J,
+     onReadResource: U,
+     onListPrompts: O
+-  } = e, [k, V] = Se(null), [R, ve] = Se(o ?? null), [ne, Q] = Se(null), H = F(f), ge = F(v), ae = F(g), st = F(b), Ue = F($), er = F(I), tr = F(N), ir = F(J), We = F(U), rr = F(O);
++  } = e, [k, V] = Se(null), [R, ve] = Se(o ?? null), [ne, Q] = Se(null), [H, ge] = Se({ csp: void 0, permissions: void 0 }), ae = F(f), st = F(v), Ue = F(g), er = F(b), tr = F($), ir = F(I), We = F(N), rr = F(J), He = F(U), qe = F(O);
+   q(() => {
+-    H.current = f, ge.current = v, ae.current = g, st.current = b, Ue.current = $, er.current = I, tr.current = N, ir.current = J, We.current = U, rr.current = O;
++    ae.current = f, st.current = v, Ue.current = g, er.current = b, tr.current = $, ir.current = I, We.current = N, rr.current = J, He.current = U, qe.current = O;
+   }), Qa(
+     i,
+     () => ({
+@@ -8604,31 +8627,31 @@ const zh = (e) => {
+           }
+         );
+         if (K.onmessage = async (G, A) => {
+-          if (H.current)
+-            return H.current(G, A);
++          if (ae.current)
++            return ae.current(G, A);
+           throw new ba(ya.MethodNotFound, "Method not found");
+         }, K.onopenlink = async (G, A) => {
+-          if (ge.current)
+-            return ge.current(G, A);
++          if (st.current)
++            return st.current(G, A);
+           throw new ba(ya.MethodNotFound, "Method not found");
+         }, K.onloggingmessage = (G) => {
+-          ae.current && ae.current(G);
+-        }, er.current && (K.oncalltool = (G, A) => er.current(G, A)), tr.current && (K.onlistresources = (G, A) => tr.current(G, A)), ir.current && (K.onlistresourcetemplates = (G, A) => ir.current(G, A)), We.current && (K.onreadresource = (G, A) => We.current(G, A)), rr.current && (K.onlistprompts = (G, A) => rr.current(G, A)), !ut) return;
++          Ue.current && Ue.current(G);
++        }, ir.current && (K.oncalltool = (G, A) => ir.current(G, A)), We.current && (K.onlistresources = (G, A) => We.current(G, A)), rr.current && (K.onlistresourcetemplates = (G, A) => rr.current(G, A)), He.current && (K.onreadresource = (G, A) => He.current(G, A)), qe.current && (K.onlistprompts = (G, A) => qe.current(G, A)), !ut) return;
+         V(K);
+       } catch (oe) {
+         if (console.error("[AppRenderer] Error creating bridge:", oe), !ut) return;
+         const K = oe instanceof Error ? oe : new Error(String(oe));
+-        Q(K), (Oe = Ue.current) == null || Oe.call(Ue, K);
++        Q(K), (Oe = tr.current) == null || Oe.call(tr, K);
+       }
+     })(), () => {
+       ut = !1;
+     };
+   }, [r]), q(() => {
+     if (o) {
+-      ve(o);
++      ve(o), ge({ csp: void 0, permissions: void 0 });
+       return;
+     }
+-    const ut = !!r, ga = !!n && !!We.current;
++    const ut = !!r, ga = !!n && !!He.current;
+     if (!ut && !ga) {
+       Q(
+         new Error(
+@@ -8637,6 +8660,7 @@ const zh = (e) => {
+       );
+       return;
+     }
++    ge({ csp: void 0, permissions: void 0 });
+     let Oe = !0;
+     return (async () => {
+       var K, G;
+@@ -8657,10 +8681,12 @@ const zh = (e) => {
+         if (!Oe) return;
+         console.log(`[AppRenderer] Reading resource HTML from: ${A}`);
+         let Ne;
+-        if (r)
+-          Ne = await xh(r, { uri: A });
+-        else if (We.current) {
+-          const Re = await We.current({ uri: A }, {});
++        if (r) {
++          const Re = await xh(r, { uri: A });
++          if (!Oe) return;
++          Ne = Re.html, ge({ csp: Re.csp, permissions: Re.permissions });
++        } else if (He.current) {
++          const Re = await He.current({ uri: A }, {});
+           if (!Re.contents || Re.contents.length !== 1)
+             throw new Error("Unsupported UI resource content length: " + ((K = Re.contents) == null ? void 0 : K.length));
+           const _e = Re.contents[0], ha = (dm) => dm === va;
+@@ -8670,6 +8696,8 @@ const zh = (e) => {
+             Ne = atob(_e.blob);
+           else
+             throw new Error("Unsupported UI resource content format: " + JSON.stringify(_e));
++          const mt = Jh(_e);
++          ge({ csp: mt.csp, permissions: mt.permissions });
+         } else
+           throw new Error("No way to read resource HTML");
+         if (!Oe) return;
+@@ -8677,7 +8705,7 @@ const zh = (e) => {
+       } catch (A) {
+         if (!Oe) return;
+         const Ne = A instanceof Error ? A : new Error(String(A));
+-        Q(Ne), (G = Ue.current) == null || G.call(Ue, Ne);
++        Q(Ne), (G = tr.current) == null || G.call(tr, Ne);
+       }
+     })(), () => {
+       Oe = !1;
+@@ -8689,7 +8717,11 @@ const zh = (e) => {
+   }, [k, l]), q(() => {
+     k && d && k.sendToolCancelled({});
+   }, [k, d]);
+-  const lm = st.current;
++  const lm = er.current, dm = {
++    ...t,
++    csp: H.csp ?? t.csp,
++    permissions: H.permissions ?? t.permissions
++  };
+   return ne ? /* @__PURE__ */ bt("div", { style: { color: "red", padding: "1rem" }, children: [
+     "Error: ",
+     ne.message
+@@ -8697,7 +8729,7 @@ const zh = (e) => {
+     zh,
+     {
+       html: R,
+-      sandbox: t,
++      sandbox: dm,
+       appBridge: k,
+       toolInput: s,
+       toolResult: u,

From 2a84ce32540144d82c74b9378232d26809816a4a Mon Sep 17 00:00:00 2001
From: Ruben Casas <ruben@infoxication.net>
Date: Mon, 16 Feb 2026 16:53:28 +0000
Subject: [PATCH 25/37] chore: remove accidentally committed mcp-ui patch

---
 patches/@mcp-ui+client+6.0.0.patch | 226 -----------------------------
 1 file changed, 226 deletions(-)
 delete mode 100644 patches/@mcp-ui+client+6.0.0.patch

diff --git a/patches/@mcp-ui+client+6.0.0.patch b/patches/@mcp-ui+client+6.0.0.patch
deleted file mode 100644
index f0354e8c..00000000
--- a/patches/@mcp-ui+client+6.0.0.patch
+++ /dev/null
@@ -1,226 +0,0 @@
-diff --git a/node_modules/@mcp-ui/client/dist/index.mjs b/node_modules/@mcp-ui/client/dist/index.mjs
-index 38fbac3..fa81be4 100644
---- a/node_modules/@mcp-ui/client/dist/index.mjs
-+++ b/node_modules/@mcp-ui/client/dist/index.mjs
-@@ -8417,23 +8417,40 @@ const $h = "io.modelcontextprotocol/ui", Ih = {
- }, jh = {
-   [$h]: Ih
- }, kh = 1e4;
--async function wh(e) {
--  const i = document.createElement("iframe");
--  i.style.width = "100%", i.style.height = "600px", i.style.border = "none", i.style.backgroundColor = "transparent", i.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
--  const r = new Promise((a, t) => {
--    let n = !1;
--    const o = () => {
--      window.removeEventListener("message", u), i.removeEventListener("error", l);
--    }, s = setTimeout(() => {
--      n || (n = !0, o(), t(new Error("Timed out waiting for sandbox proxy iframe to be ready")));
--    }, kh), u = (d) => {
--      d.source === i.contentWindow && d.data && d.data.method === $f && (n || (n = !0, clearTimeout(s), o(), a()));
-+function Fh(e) {
-+  if (!e || typeof e != "object")
-+    return "";
-+  const i = [];
-+  return e.camera && i.push("camera"), e.microphone && i.push("microphone"), e.geolocation && i.push("geolocation"), e.clipboardWrite && i.push("clipboard-write"), i.join("; ");
-+}
-+function Jh(e) {
-+  if (!e || typeof e != "object")
-+    return {};
-+  const i = "_meta" in e && e._meta && typeof e._meta == "object" ? e._meta : "meta" in e && e.meta && typeof e.meta == "object" ? e.meta : void 0, r = i && typeof i.ui == "object" && i.ui ? i.ui : void 0;
-+  return {
-+    csp: r && typeof r.csp == "object" ? r.csp : void 0,
-+    permissions: r && typeof r.permissions == "object" ? r.permissions : void 0
-+  };
-+}
-+async function wh(e, i) {
-+  const r = document.createElement("iframe");
-+  r.style.width = "100%", r.style.height = "600px", r.style.border = "none", r.style.backgroundColor = "transparent", r.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
-+  const a = Fh(i);
-+  a && r.setAttribute("allow", a);
-+  const t = new Promise((n, o) => {
-+    let s = !1;
-+    const u = () => {
-+      window.removeEventListener("message", d), r.removeEventListener("error", l);
-+    }, c = setTimeout(() => {
-+      s || (s = !0, u(), o(new Error("Timed out waiting for sandbox proxy iframe to be ready")));
-+    }, kh), d = (v) => {
-+      v.source === r.contentWindow && v.data && v.data.method === $f && (s || (s = !0, clearTimeout(c), u(), n()));
-     }, l = () => {
--      n || (n = !0, clearTimeout(s), o(), t(new Error("Failed to load sandbox proxy iframe")));
-+      s || (s = !0, clearTimeout(c), u(), o(new Error("Failed to load sandbox proxy iframe")));
-     };
--    window.addEventListener("message", u), i.addEventListener("error", l);
-+    window.addEventListener("message", d), r.addEventListener("error", l);
-   });
--  return i.src = e.href, { iframe: i, onReady: r };
-+  return r.src = e.href, { iframe: r, onReady: t };
- }
- async function Sh(e, i) {
-   let r, a;
-@@ -8467,7 +8484,12 @@ async function xh(e, i) {
-     t = atob(a.blob);
-   else
-     throw new Error("Unsupported UI resource content format: " + JSON.stringify(a));
--  return t;
-+  const o = Jh(a);
-+  return {
-+    html: t,
-+    csp: o.csp,
-+    permissions: o.permissions
-+  };
- }
- function Eh(e, i) {
-   const r = new URL(e.href);
-@@ -8496,7 +8518,7 @@ const zh = (e) => {
-       var ne, Q;
-       try {
-         $.current && ((ne = b.current) != null && ne.contains($.current)) && (b.current.removeChild($.current), $.current = null, I.current = null, N.current = null);
--        const { iframe: H, onReady: ge } = await wh(k);
-+        const { iframe: H, onReady: ge } = await wh(k, r.permissions);
-         if (!R || ($.current = H, I.current = V, N.current = a, b.current && b.current.appendChild(H), await ge, !R) || (a.onsizechange = async (ae) => {
-           var st;
-           (st = J.current) == null || st.call(J, ae), $.current && (ae.width !== void 0 && ($.current.style.width = `${ae.width}px`), ae.height !== void 0 && ($.current.style.height = `${ae.height}px`));
-@@ -8518,21 +8540,22 @@ const zh = (e) => {
-     })(), () => {
-       R = !1;
-     };
--  }, [r.url, r.csp, a]), q(() => {
-+  }, [r.url, r.csp, r.permissions, a]), q(() => {
-     if (!c || !i || N.current !== a) return;
-     (async () => {
-       var V;
-       try {
-         console.log("[AppFrame] Sending HTML to sandbox"), await a.sendSandboxResourceReady({
-           html: i,
--          csp: r.csp
-+          csp: r.csp,
-+          permissions: r.permissions
-         });
-       } catch (R) {
-         const ve = R instanceof Error ? R : new Error(String(R));
-         g(ve), (V = O.current) == null || V.call(O, ve);
-       }
-     })();
--  }, [c, i, a, r.csp]), q(() => {
-+  }, [c, i, a, r.csp, r.permissions]), q(() => {
-     c && l && o && N.current === a && (console.log("[AppFrame] Sending tool input:", o), a.sendToolInput({ arguments: o }));
-   }, [a, c, l, o]), q(() => {
-     c && l && s && N.current === a && (console.log("[AppFrame] Sending tool result:", s), a.sendToolResult(s));
-@@ -8574,9 +8597,9 @@ const zh = (e) => {
-     onListResourceTemplates: J,
-     onReadResource: U,
-     onListPrompts: O
--  } = e, [k, V] = Se(null), [R, ve] = Se(o ?? null), [ne, Q] = Se(null), H = F(f), ge = F(v), ae = F(g), st = F(b), Ue = F($), er = F(I), tr = F(N), ir = F(J), We = F(U), rr = F(O);
-+  } = e, [k, V] = Se(null), [R, ve] = Se(o ?? null), [ne, Q] = Se(null), [H, ge] = Se({ csp: void 0, permissions: void 0 }), ae = F(f), st = F(v), Ue = F(g), er = F(b), tr = F($), ir = F(I), We = F(N), rr = F(J), He = F(U), qe = F(O);
-   q(() => {
--    H.current = f, ge.current = v, ae.current = g, st.current = b, Ue.current = $, er.current = I, tr.current = N, ir.current = J, We.current = U, rr.current = O;
-+    ae.current = f, st.current = v, Ue.current = g, er.current = b, tr.current = $, ir.current = I, We.current = N, rr.current = J, He.current = U, qe.current = O;
-   }), Qa(
-     i,
-     () => ({
-@@ -8604,31 +8627,31 @@ const zh = (e) => {
-           }
-         );
-         if (K.onmessage = async (G, A) => {
--          if (H.current)
--            return H.current(G, A);
-+          if (ae.current)
-+            return ae.current(G, A);
-           throw new ba(ya.MethodNotFound, "Method not found");
-         }, K.onopenlink = async (G, A) => {
--          if (ge.current)
--            return ge.current(G, A);
-+          if (st.current)
-+            return st.current(G, A);
-           throw new ba(ya.MethodNotFound, "Method not found");
-         }, K.onloggingmessage = (G) => {
--          ae.current && ae.current(G);
--        }, er.current && (K.oncalltool = (G, A) => er.current(G, A)), tr.current && (K.onlistresources = (G, A) => tr.current(G, A)), ir.current && (K.onlistresourcetemplates = (G, A) => ir.current(G, A)), We.current && (K.onreadresource = (G, A) => We.current(G, A)), rr.current && (K.onlistprompts = (G, A) => rr.current(G, A)), !ut) return;
-+          Ue.current && Ue.current(G);
-+        }, ir.current && (K.oncalltool = (G, A) => ir.current(G, A)), We.current && (K.onlistresources = (G, A) => We.current(G, A)), rr.current && (K.onlistresourcetemplates = (G, A) => rr.current(G, A)), He.current && (K.onreadresource = (G, A) => He.current(G, A)), qe.current && (K.onlistprompts = (G, A) => qe.current(G, A)), !ut) return;
-         V(K);
-       } catch (oe) {
-         if (console.error("[AppRenderer] Error creating bridge:", oe), !ut) return;
-         const K = oe instanceof Error ? oe : new Error(String(oe));
--        Q(K), (Oe = Ue.current) == null || Oe.call(Ue, K);
-+        Q(K), (Oe = tr.current) == null || Oe.call(tr, K);
-       }
-     })(), () => {
-       ut = !1;
-     };
-   }, [r]), q(() => {
-     if (o) {
--      ve(o);
-+      ve(o), ge({ csp: void 0, permissions: void 0 });
-       return;
-     }
--    const ut = !!r, ga = !!n && !!We.current;
-+    const ut = !!r, ga = !!n && !!He.current;
-     if (!ut && !ga) {
-       Q(
-         new Error(
-@@ -8637,6 +8660,7 @@ const zh = (e) => {
-       );
-       return;
-     }
-+    ge({ csp: void 0, permissions: void 0 });
-     let Oe = !0;
-     return (async () => {
-       var K, G;
-@@ -8657,10 +8681,12 @@ const zh = (e) => {
-         if (!Oe) return;
-         console.log(`[AppRenderer] Reading resource HTML from: ${A}`);
-         let Ne;
--        if (r)
--          Ne = await xh(r, { uri: A });
--        else if (We.current) {
--          const Re = await We.current({ uri: A }, {});
-+        if (r) {
-+          const Re = await xh(r, { uri: A });
-+          if (!Oe) return;
-+          Ne = Re.html, ge({ csp: Re.csp, permissions: Re.permissions });
-+        } else if (He.current) {
-+          const Re = await He.current({ uri: A }, {});
-           if (!Re.contents || Re.contents.length !== 1)
-             throw new Error("Unsupported UI resource content length: " + ((K = Re.contents) == null ? void 0 : K.length));
-           const _e = Re.contents[0], ha = (dm) => dm === va;
-@@ -8670,6 +8696,8 @@ const zh = (e) => {
-             Ne = atob(_e.blob);
-           else
-             throw new Error("Unsupported UI resource content format: " + JSON.stringify(_e));
-+          const mt = Jh(_e);
-+          ge({ csp: mt.csp, permissions: mt.permissions });
-         } else
-           throw new Error("No way to read resource HTML");
-         if (!Oe) return;
-@@ -8677,7 +8705,7 @@ const zh = (e) => {
-       } catch (A) {
-         if (!Oe) return;
-         const Ne = A instanceof Error ? A : new Error(String(A));
--        Q(Ne), (G = Ue.current) == null || G.call(Ue, Ne);
-+        Q(Ne), (G = tr.current) == null || G.call(tr, Ne);
-       }
-     })(), () => {
-       Oe = !1;
-@@ -8689,7 +8717,11 @@ const zh = (e) => {
-   }, [k, l]), q(() => {
-     k && d && k.sendToolCancelled({});
-   }, [k, d]);
--  const lm = st.current;
-+  const lm = er.current, dm = {
-+    ...t,
-+    csp: H.csp ?? t.csp,
-+    permissions: H.permissions ?? t.permissions
-+  };
-   return ne ? /* @__PURE__ */ bt("div", { style: { color: "red", padding: "1rem" }, children: [
-     "Error: ",
-     ne.message
-@@ -8697,7 +8729,7 @@ const zh = (e) => {
-     zh,
-     {
-       html: R,
--      sandbox: t,
-+      sandbox: dm,
-       appBridge: k,
-       toolInput: s,
-       toolResult: u,

From 87bb2425a3780bef3fce1bb8145c4c7c69eb59be Mon Sep 17 00:00:00 2001
From: Ruben Casas <ruben@infoxication.net>
Date: Mon, 16 Feb 2026 22:20:06 +0000
Subject: [PATCH 26/37] fix linting error

---
 .../__tests__/App.toolsAppsPrefill.test.tsx   | 30 ++++++++-----------
 1 file changed, 13 insertions(+), 17 deletions(-)

diff --git a/client/src/__tests__/App.toolsAppsPrefill.test.tsx b/client/src/__tests__/App.toolsAppsPrefill.test.tsx
index 4931800c..9239f29d 100644
--- a/client/src/__tests__/App.toolsAppsPrefill.test.tsx
+++ b/client/src/__tests__/App.toolsAppsPrefill.test.tsx
@@ -13,20 +13,18 @@ type ToolListEntry = {
   _meta: Record<string, unknown>;
 };
 
-let latestAppsTabProps:
-  | {
-      tools: ToolListEntry[];
-      prefilledToolCall?: {
-        id: number;
-        toolName: string;
-        params: Record<string, unknown>;
-        result: {
-          content: Array<{ type: string; text: string }>;
-        };
-      } | null;
-      onPrefilledToolCallConsumed?: (callId: number) => void;
-    }
-  | undefined;
+type AppsTabProps = {
+  tools: ToolListEntry[];
+  prefilledToolCall?: {
+    id: number;
+    toolName: string;
+    params: Record<string, unknown>;
+    result: {
+      content: Array<{ type: string; text: string }>;
+    };
+  } | null;
+  onPrefilledToolCallConsumed?: (callId: number) => void;
+};
 
 // Mock auth dependencies first
 jest.mock("@modelcontextprotocol/sdk/client/auth.js", () => ({
@@ -164,8 +162,7 @@ jest.mock("../components/ToolsTab", () => ({
 
 jest.mock("../components/AppsTab", () => ({
   __esModule: true,
-  default: (props: typeof latestAppsTabProps) => {
-    latestAppsTabProps = props;
+  default: (props: AppsTabProps) => {
     const prefilled =
       props && "prefilledToolCall" in props ? props.prefilledToolCall : null;
     const tools = props && "tools" in props ? props.tools : [];
@@ -200,7 +197,6 @@ describe("App - Tools to Apps prefilled handoff", () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
-    latestAppsTabProps = undefined;
     window.location.hash = "#tools";
   });
 

From f2ed4ef3b9434810509958017175e26d9d9068f8 Mon Sep 17 00:00:00 2001
From: Den Delimarsky <53200638+localden@users.noreply.github.com>
Date: Wed, 18 Feb 2026 18:57:45 -0800
Subject: [PATCH 27/37] Update SECURITY.md to use GitHub Security Advisories
 (#1097)

---
 SECURITY.md | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 21f8e598..50292420 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,14 +1,21 @@
 # Security Policy
-Thank you for helping us keep the inspector secure.
+
+Thank you for helping keep the Model Context Protocol and its ecosystem secure.
 
 ## Reporting Security Issues
 
-This project is maintained by [Anthropic](https://www.anthropic.com/) as part of the Model Context Protocol project.
+If you discover a security vulnerability in this repository, please report it through
+the [GitHub Security Advisory process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
+for this repository.
 
-The security of our systems and user data is Anthropic’s top priority. We appreciate the work of security researchers acting in good faith in identifying and reporting potential vulnerabilities.
+Please **do not** report security vulnerabilities through public GitHub issues, discussions,
+or pull requests.
 
-Our security program is managed on HackerOne and we ask that any validated vulnerability in this functionality be reported through their [submission form](https://hackerone.com/anthropic-vdp/reports/new?type=team&report_type=vulnerability).
+## What to Include
 
-## Vulnerability Disclosure Program
+To help us triage and respond quickly, please include:
 
-Our Vulnerability Program Guidelines are defined on our [HackerOne program page](https://hackerone.com/anthropic-vdp).
+- A description of the vulnerability
+- Steps to reproduce the issue
+- The potential impact
+- Any suggested fixes (optional)

From 841c42e4688ee4af8a3bf180971d856167fda11c Mon Sep 17 00:00:00 2001
From: olaservo <olahungerford@gmail.com>
Date: Wed, 18 Feb 2026 21:06:44 -0700
Subject: [PATCH 28/37] Remove misleading structured content compatibility
 warning

The MCP spec allows `content` to be a human-readable summary rather
than a JSON-stringified copy of `structuredContent`. Remove the yellow
warning that was shown when no text block JSON-matched structuredContent,
keeping only the positive blue indicator when a match does exist.

Fixes #1089

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 client/src/components/ToolResults.tsx | 27 +++++++--------------------
 1 file changed, 7 insertions(+), 20 deletions(-)

diff --git a/client/src/components/ToolResults.tsx b/client/src/components/ToolResults.tsx
index 38d1d038..d036298b 100644
--- a/client/src/components/ToolResults.tsx
+++ b/client/src/components/ToolResults.tsx
@@ -22,17 +22,14 @@ const checkContentCompatibility = (
     text?: string;
     [key: string]: unknown;
   }>,
-): { isCompatible: boolean; message: string } => {
+): { hasMatch: boolean; message: string } | null => {
   // Look for at least one text content block that matches the structured content
   const textBlocks = unstructuredContent.filter(
     (block) => block.type === "text",
   );
 
   if (textBlocks.length === 0) {
-    return {
-      isCompatible: false,
-      message: "No text blocks to match structured content",
-    };
+    return null;
   }
 
   // Check if any text block contains JSON that matches the structured content
@@ -49,7 +46,7 @@ const checkContentCompatibility = (
 
       if (isEqual) {
         return {
-          isCompatible: true,
+          hasMatch: true,
           message: `Structured content matches text block${textBlocks.length > 1 ? " (multiple blocks)" : ""}${unstructuredContent.length > textBlocks.length ? " + other content" : ""}`,
         };
       }
@@ -59,10 +56,7 @@ const checkContentCompatibility = (
     }
   }
 
-  return {
-    isCompatible: false,
-    message: "No text block matches structured content",
-  };
+  return null;
 };
 
 const ToolResults = ({
@@ -195,16 +189,9 @@ const ToolResults = ({
                 <h5 className="font-semibold mb-2 text-sm">
                   Unstructured Content:
                 </h5>
-                {compatibilityResult && (
-                  <div
-                    className={`mb-2 p-2 rounded text-sm ${
-                      compatibilityResult.isCompatible
-                        ? "bg-blue-100 dark:bg-blue-900 text-blue-800 dark:text-blue-200"
-                        : "bg-yellow-100 dark:bg-yellow-900 text-yellow-800 dark:text-yellow-200"
-                    }`}
-                  >
-                    {compatibilityResult.isCompatible ? "✓" : "⚠"}{" "}
-                    {compatibilityResult.message}
+                {compatibilityResult?.hasMatch && (
+                  <div className="mb-2 p-2 rounded text-sm bg-blue-100 dark:bg-blue-900 text-blue-800 dark:text-blue-200">
+                    ✓ {compatibilityResult.message}
                   </div>
                 )}
               </>

From 695972a4041f655e01d0de95ce8c99d47b38d25c Mon Sep 17 00:00:00 2001
From: John Howard <john.howard@solo.io>
Date: Thu, 19 Feb 2026 05:00:33 -0800
Subject: [PATCH 29/37] oauth: add tenant suffix to oauth flow (#1096)

---
 client/src/components/OAuthFlowProgress.tsx   | 16 ++++++-----
 .../__tests__/AuthDebugger.test.tsx           | 10 +++++--
 client/src/utils/__tests__/oauthUtils.test.ts | 27 ++++++++++++++++++
 client/src/utils/oauthUtils.ts                | 28 +++++++++++++++++++
 4 files changed, 72 insertions(+), 9 deletions(-)

diff --git a/client/src/components/OAuthFlowProgress.tsx b/client/src/components/OAuthFlowProgress.tsx
index 6e0fd695..58d4e99f 100644
--- a/client/src/components/OAuthFlowProgress.tsx
+++ b/client/src/components/OAuthFlowProgress.tsx
@@ -6,6 +6,7 @@ import { useEffect, useMemo, useState } from "react";
 import { OAuthClientInformation } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { validateRedirectUrl } from "@/utils/urlValidation";
 import { useToast } from "@/lib/hooks/useToast";
+import { getAuthorizationServerMetadataDiscoveryUrl } from "@/utils/oauthUtils";
 
 interface OAuthStepProps {
   label: string;
@@ -81,6 +82,13 @@ export const OAuthFlowProgress = ({
   const [clientInfo, setClientInfo] = useState<OAuthClientInformation | null>(
     null,
   );
+  const authorizationServerMetadataDiscoveryUrl = useMemo(() => {
+    if (!authState.authServerUrl) {
+      return null;
+    }
+
+    return getAuthorizationServerMetadataDiscoveryUrl(authState.authServerUrl);
+  }, [authState.authServerUrl]);
 
   const currentStepIdx = steps.findIndex((s) => s === authState.oauthStep);
 
@@ -197,13 +205,7 @@ export const OAuthFlowProgress = ({
                   <p className="font-medium">Authorization Server Metadata:</p>
                   {authState.authServerUrl && (
                     <p className="text-xs text-muted-foreground">
-                      From{" "}
-                      {
-                        new URL(
-                          "/.well-known/oauth-authorization-server",
-                          authState.authServerUrl,
-                        ).href
-                      }
+                      From {authorizationServerMetadataDiscoveryUrl}
                     </p>
                   )}
                   <pre className="mt-2 p-2 bg-muted rounded-md overflow-auto max-h-[300px]">
diff --git a/client/src/components/__tests__/AuthDebugger.test.tsx b/client/src/components/__tests__/AuthDebugger.test.tsx
index b05a4898..fec87677 100644
--- a/client/src/components/__tests__/AuthDebugger.test.tsx
+++ b/client/src/components/__tests__/AuthDebugger.test.tsx
@@ -681,7 +681,7 @@ describe("AuthDebugger", () => {
       const updateAuthState = jest.fn();
       const mockResourceMetadata = {
         resource: "https://example.com/mcp",
-        authorization_servers: ["https://custom-auth.example.com"],
+        authorization_servers: ["https://custom-auth.example.com/mcp/tenant"],
         bearer_methods_supported: ["header", "body"],
         resource_documentation: "https://example.com/mcp/docs",
         resource_policy_uri: "https://example.com/mcp/policy",
@@ -733,11 +733,17 @@ describe("AuthDebugger", () => {
         expect(updateAuthState).toHaveBeenCalledWith(
           expect.objectContaining({
             resourceMetadata: mockResourceMetadata,
-            authServerUrl: new URL("https://custom-auth.example.com"),
+            authServerUrl: new URL(
+              "https://custom-auth.example.com/mcp/tenant",
+            ),
             oauthStep: "client_registration",
           }),
         );
       });
+
+      expect(mockDiscoverAuthorizationServerMetadata).toHaveBeenCalledWith(
+        new URL("https://custom-auth.example.com/mcp/tenant"),
+      );
     });
 
     it("should handle protected resource metadata fetch failure gracefully", async () => {
diff --git a/client/src/utils/__tests__/oauthUtils.test.ts b/client/src/utils/__tests__/oauthUtils.test.ts
index c42f014e..b885b5ec 100644
--- a/client/src/utils/__tests__/oauthUtils.test.ts
+++ b/client/src/utils/__tests__/oauthUtils.test.ts
@@ -2,6 +2,7 @@ import {
   generateOAuthErrorDescription,
   parseOAuthCallbackParams,
   generateOAuthState,
+  getAuthorizationServerMetadataDiscoveryUrl,
 } from "@/utils/oauthUtils.ts";
 
 describe("parseOAuthCallbackParams", () => {
@@ -84,3 +85,29 @@ describe("generateOAuthErrorDescription", () => {
     });
   });
 });
+
+describe("getAuthorizationServerMetadataDiscoveryUrl", () => {
+  it("uses root discovery URL for root authorization server URL", () => {
+    expect(
+      getAuthorizationServerMetadataDiscoveryUrl("https://example.com"),
+    ).toBe("https://example.com/.well-known/oauth-authorization-server");
+  });
+
+  it("inserts tenant path for non-root authorization server URL", () => {
+    expect(
+      getAuthorizationServerMetadataDiscoveryUrl("https://example.com/tenant1"),
+    ).toBe(
+      "https://example.com/.well-known/oauth-authorization-server/tenant1",
+    );
+  });
+
+  it("strips trailing slash before appending tenant path", () => {
+    expect(
+      getAuthorizationServerMetadataDiscoveryUrl(
+        "https://example.com/tenant1/",
+      ),
+    ).toBe(
+      "https://example.com/.well-known/oauth-authorization-server/tenant1",
+    );
+  });
+});
diff --git a/client/src/utils/oauthUtils.ts b/client/src/utils/oauthUtils.ts
index 9b51179c..cb6faf27 100644
--- a/client/src/utils/oauthUtils.ts
+++ b/client/src/utils/oauthUtils.ts
@@ -87,3 +87,31 @@ export const generateOAuthErrorDescription = (
     .filter(Boolean)
     .join("\n");
 };
+
+/**
+ * Returns the primary OAuth authorization server metadata discovery URL
+ * for a given authorization server URL, including tenant path handling.
+ */
+export const getAuthorizationServerMetadataDiscoveryUrl = (
+  authorizationServerUrl: string | URL,
+): string => {
+  const url =
+    typeof authorizationServerUrl === "string"
+      ? new URL(authorizationServerUrl)
+      : authorizationServerUrl;
+  const hasPath = url.pathname !== "/";
+
+  if (!hasPath) {
+    return new URL("/.well-known/oauth-authorization-server", url.origin).href;
+  }
+
+  // Strip trailing slash to avoid double slashes in tenant-aware discovery URLs.
+  const pathname = url.pathname.endsWith("/")
+    ? url.pathname.slice(0, -1)
+    : url.pathname;
+
+  return new URL(
+    `/.well-known/oauth-authorization-server${pathname}`,
+    url.origin,
+  ).href;
+};

From 6ce441ae70527bb388a65865c71bc6a98bc3932b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 22 Feb 2026 18:04:00 -0700
Subject: [PATCH 30/37] chore(deps): bump the npm_and_yarn group across 1
 directory with 2 updates (#1106)

Bumps the npm_and_yarn group with 2 updates in the / directory: [ajv](https://github.com/ajv-validator/ajv) and [hono](https://github.com/honojs/hono).


Updates `ajv` from 6.12.6 to 6.14.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](https://github.com/ajv-validator/ajv/compare/v6.12.6...v6.14.0)

Updates `hono` from 4.11.7 to 4.12.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.11.7...v4.12.1)

---
updated-dependencies:
- dependency-name: ajv
  dependency-version: 6.14.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index da310ffb..f709c628 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5146,9 +5146,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.14.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
+      "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -7573,9 +7573,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.11.7",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.7.tgz",
-      "integrity": "sha512-l7qMiNee7t82bH3SeyUCt9UF15EVmaBvsppY2zQtrbIhl/yzBTny+YUxsVjSjQ6gaqaeVtZmGocom8TzBlA4Yw==",
+      "version": "4.12.1",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.1.tgz",
+      "integrity": "sha512-hi9afu8g0lfJVLolxElAZGANCTTl6bewIdsRNhaywfP9K8BPf++F2z6OLrYGIinUwpRKzbZHMhPwvc0ZEpAwGw==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

From f64a7ea6e376f7cbc394143f55ab5e1d07410c33 Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Mon, 23 Feb 2026 11:15:53 -0500
Subject: [PATCH 31/37] Fix review issues from Claude's code review

- Default taskSupport fallback to "forbidden" per MCP spec (was "optional")
- Fix import path to use @/ alias consistently
- Fix misleading "type guard" comment on getTaskSupport
- Extract getTaskSupport to a variable to avoid duplicate calls in render
- Export ExtendedTool and import in tests instead of duplicating

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 client/src/components/ToolsTab.tsx                | 14 ++++++++------
 client/src/components/__tests__/ToolsTab.test.tsx |  9 +--------
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index 6f823615..ac898235 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -51,12 +51,12 @@ import {
   hasValidMetaName,
   hasValidMetaPrefix,
   isReservedMetaKey,
-} from "../utils/metaUtils";
+} from "@/utils/metaUtils";
 
 /**
  * Extended Tool type that includes optional fields used by the inspector.
  */
-interface ExtendedTool extends Tool, WithIcons {
+export interface ExtendedTool extends Tool, WithIcons {
   _meta?: Record<string, unknown>;
   execution?: {
     taskSupport?: "forbidden" | "required" | "optional";
@@ -69,7 +69,7 @@ const hasMeta = (
 ): tool is ExtendedTool & { _meta: Record<string, unknown> } =>
   typeof (tool as ExtendedTool)._meta !== "undefined";
 
-// Type guard to detect execution.taskSupport
+// Returns the execution.taskSupport value for a tool, defaulting to "forbidden" per MCP spec
 const getTaskSupport = (
   tool: Tool | null,
 ): "forbidden" | "required" | "optional" => {
@@ -83,7 +83,7 @@ const getTaskSupport = (
   ) {
     return taskSupport;
   }
-  return "optional";
+  return "forbidden";
 };
 
 // Type guard to safely detect the optional annotations field
@@ -264,6 +264,8 @@ const ToolsTab = ({
     return trimmedKey !== "" && !hasValidMetaName(trimmedKey);
   });
 
+  const taskSupport = getTaskSupport(selectedTool);
+
   return (
     <TabsContent value="tools">
       <div className="grid grid-cols-2 gap-4">
@@ -777,7 +779,7 @@ const ToolsTab = ({
                       </div>
                     </div>
                   )}
-                {getTaskSupport(selectedTool) !== "forbidden" && (
+                {taskSupport !== "forbidden" && (
                   <div className="flex items-center space-x-2">
                     <Checkbox
                       id="run-as-task"
@@ -785,7 +787,7 @@ const ToolsTab = ({
                       onCheckedChange={(checked: boolean) =>
                         setRunAsTask(checked)
                       }
-                      disabled={getTaskSupport(selectedTool) === "required"}
+                      disabled={taskSupport === "required"}
                     />
                     <Label
                       htmlFor="run-as-task"
diff --git a/client/src/components/__tests__/ToolsTab.test.tsx b/client/src/components/__tests__/ToolsTab.test.tsx
index d2e5499a..9978aba1 100644
--- a/client/src/components/__tests__/ToolsTab.test.tsx
+++ b/client/src/components/__tests__/ToolsTab.test.tsx
@@ -1,7 +1,7 @@
 import { render, screen, fireEvent, act } from "@testing-library/react";
 import "@testing-library/jest-dom";
 import { describe, it, jest, beforeEach } from "@jest/globals";
-import ToolsTab from "../ToolsTab";
+import ToolsTab, { ExtendedTool } from "../ToolsTab";
 import { Tool } from "@modelcontextprotocol/sdk/types.js";
 import { Tabs } from "../ui/tabs";
 import { cacheToolOutputSchemas } from "../../utils/schemaUtils";
@@ -12,13 +12,6 @@ import {
   RESERVED_NAMESPACE_MESSAGE,
 } from "../../utils/metaUtils";
 
-interface ExtendedTool extends Tool {
-  _meta?: Record<string, unknown>;
-  execution?: {
-    taskSupport?: "forbidden" | "required" | "optional";
-  };
-}
-
 describe("ToolsTab", () => {
   beforeEach(() => {
     // Clear the output schema cache before each test

From 92b6c89354f28ef76cb949af4e5e91e31e867e70 Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Mon, 23 Feb 2026 11:49:44 -0500
Subject: [PATCH 32/37] Formatting

---
 client/src/App.tsx                            |  3 ++
 client/src/components/ToolsTab.tsx            | 14 +++++---
 .../components/__tests__/ToolsTab.test.tsx    | 33 +++++++++++++++++++
 3 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/client/src/App.tsx b/client/src/App.tsx
index 184f04d9..12e9a7bd 100644
--- a/client/src/App.tsx
+++ b/client/src/App.tsx
@@ -1526,6 +1526,9 @@ const App = () => {
                       error={errors.prompts}
                     />
                     <ToolsTab
+                      serverSupportsTaskRequests={
+                        !!serverCapabilities?.tasks?.requests?.tools?.call
+                      }
                       tools={tools}
                       listTools={() => {
                         clearError("tools");
diff --git a/client/src/components/ToolsTab.tsx b/client/src/components/ToolsTab.tsx
index ac898235..febea1d8 100644
--- a/client/src/components/ToolsTab.tsx
+++ b/client/src/components/ToolsTab.tsx
@@ -177,6 +177,7 @@ const ToolsTab = ({
   error,
   resourceContent,
   onReadResource,
+  serverSupportsTaskRequests,
 }: {
   tools: Tool[];
   listTools: () => void;
@@ -195,6 +196,7 @@ const ToolsTab = ({
   error: string | null;
   resourceContent: Record<string, string>;
   onReadResource?: (uri: string) => void;
+  serverSupportsTaskRequests: boolean;
 }) => {
   const [params, setParams] = useState<Record<string, unknown>>({});
   const [runAsTask, setRunAsTask] = useState(false);
@@ -239,15 +241,17 @@ const ToolsTab = ({
       ];
     });
     setParams(Object.fromEntries(params));
-    const taskSupport = getTaskSupport(selectedTool);
-    setRunAsTask(taskSupport === "required");
+    const toolTaskSupport = serverSupportsTaskRequests
+      ? getTaskSupport(selectedTool)
+      : "forbidden";
+    setRunAsTask(toolTaskSupport === "required");
 
     // Reset validation errors when switching tools
     setHasValidationErrors(false);
 
     // Clear form refs for the previous tool
     formRefs.current = {};
-  }, [selectedTool]);
+  }, [selectedTool, serverSupportsTaskRequests]);
 
   const hasReservedMetadataEntry = metadataEntries.some(({ key }) => {
     const trimmedKey = key.trim();
@@ -264,7 +268,9 @@ const ToolsTab = ({
     return trimmedKey !== "" && !hasValidMetaName(trimmedKey);
   });
 
-  const taskSupport = getTaskSupport(selectedTool);
+  const taskSupport = serverSupportsTaskRequests
+    ? getTaskSupport(selectedTool)
+    : "forbidden";
 
   return (
     <TabsContent value="tools">
diff --git a/client/src/components/__tests__/ToolsTab.test.tsx b/client/src/components/__tests__/ToolsTab.test.tsx
index 9978aba1..5678914d 100644
--- a/client/src/components/__tests__/ToolsTab.test.tsx
+++ b/client/src/components/__tests__/ToolsTab.test.tsx
@@ -73,6 +73,7 @@ describe("ToolsTab", () => {
     error: null,
     resourceContent: {},
     onReadResource: jest.fn(),
+    serverSupportsTaskRequests: true,
   };
 
   const renderToolsTab = (props = {}) => {
@@ -155,6 +156,38 @@ describe("ToolsTab", () => {
     expect(requiredCheckbox).toBeDisabled();
   });
 
+  it("should hide run-as-task checkbox when serverSupportsTaskRequests is false even for required/optional tools", async () => {
+    const requiredTool: ExtendedTool = {
+      ...mockTools[0],
+      name: "requiredTool",
+      execution: { taskSupport: "required" },
+    };
+    const optionalTool: ExtendedTool = {
+      ...mockTools[0],
+      name: "optionalTool",
+      execution: { taskSupport: "optional" },
+    };
+
+    const { rerender } = renderToolsTab({
+      selectedTool: requiredTool,
+      serverSupportsTaskRequests: false,
+    });
+
+    expect(screen.queryByLabelText(/run as task/i)).not.toBeInTheDocument();
+
+    rerender(
+      <Tabs defaultValue="tools">
+        <ToolsTab
+          {...defaultProps}
+          selectedTool={optionalTool}
+          serverSupportsTaskRequests={false}
+        />
+      </Tabs>,
+    );
+
+    expect(screen.queryByLabelText(/run as task/i)).not.toBeInTheDocument();
+  });
+
   it("should handle integer type inputs", async () => {
     renderToolsTab({
       selectedTool: mockTools[1], // Use the tool with integer type

From 58478bc88bfdc0f77e1084a26e65de79ea015246 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 24 Feb 2026 15:48:58 +0000
Subject: [PATCH 34/37] chore: bump version to 0.21.0

Co-authored-by: olaservo <16480113+olaservo@users.noreply.github.com>
---
 cli/package.json    |   2 +-
 client/package.json |   2 +-
 package-lock.json   | 125 ++++++++++++++++----------------------------
 package.json        |   8 +--
 server/package.json |   2 +-
 5 files changed, 51 insertions(+), 88 deletions(-)

diff --git a/cli/package.json b/cli/package.json
index ebd5d229..a5f2c703 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-cli",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "CLI for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
diff --git a/client/package.json b/client/package.json
index 30fadb51..a9cb374d 100644
--- a/client/package.json
+++ b/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-client",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Client-side application for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
diff --git a/package-lock.json b/package-lock.json
index f709c628..a52d0c49 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@modelcontextprotocol/inspector",
-      "version": "0.20.0",
+      "version": "0.21.0",
       "license": "SEE LICENSE IN LICENSE",
       "workspaces": [
         "client",
@@ -14,9 +14,9 @@
         "cli"
       ],
       "dependencies": {
-        "@modelcontextprotocol/inspector-cli": "^0.20.0",
-        "@modelcontextprotocol/inspector-client": "^0.20.0",
-        "@modelcontextprotocol/inspector-server": "^0.20.0",
+        "@modelcontextprotocol/inspector-cli": "^0.21.0",
+        "@modelcontextprotocol/inspector-client": "^0.21.0",
+        "@modelcontextprotocol/inspector-server": "^0.21.0",
         "@modelcontextprotocol/sdk": "^1.25.2",
         "concurrently": "^9.2.0",
         "node-fetch": "^3.3.2",
@@ -48,7 +48,7 @@
     },
     "cli": {
       "name": "@modelcontextprotocol/inspector-cli",
-      "version": "0.20.0",
+      "version": "0.21.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.25.2",
@@ -76,7 +76,7 @@
     },
     "client": {
       "name": "@modelcontextprotocol/inspector-client",
-      "version": "0.20.0",
+      "version": "0.21.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@mcp-ui/client": "^6.0.0",
@@ -193,7 +193,6 @@
       "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@csstools/css-calc": "^2.1.3",
         "@csstools/css-color-parser": "^3.0.9",
@@ -207,8 +206,7 @@
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
       "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
-      "license": "ISC",
-      "peer": true
+      "license": "ISC"
     },
     "node_modules/@babel/code-frame": {
       "version": "7.27.1",
@@ -241,6 +239,7 @@
       "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@babel/generator": "^7.28.5",
@@ -786,7 +785,6 @@
         }
       ],
       "license": "MIT-0",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -807,7 +805,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -832,7 +829,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@csstools/color-helpers": "^5.1.0",
         "@csstools/css-calc": "^2.1.4"
@@ -1854,7 +1850,6 @@
       "integrity": "sha512-kazxw2L9IPuZpQ0mEt9lu9Z98SqR74xcagANmMBU16X0lS23yPc0+S6hGLUz8kVRlomZEs/5S/Zlpqwf5yu6OQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/fake-timers": "30.2.0",
@@ -1883,7 +1878,6 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -1900,7 +1894,6 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -1919,7 +1912,6 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -1933,7 +1925,6 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -1952,8 +1943,7 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@jest/environment-jsdom-abstract/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -1961,7 +1951,6 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -1972,7 +1961,6 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -1985,7 +1973,6 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -2005,7 +1992,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -2016,7 +2002,6 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -2038,7 +2023,6 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2054,7 +2038,6 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2073,7 +2056,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -2087,7 +2069,6 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -2102,8 +2083,7 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@jest/expect": {
       "version": "29.7.0",
@@ -2172,7 +2152,6 @@
       "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "jest-regex-util": "30.0.1"
@@ -2187,7 +2166,6 @@
       "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
@@ -2511,6 +2489,7 @@
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.26.0.tgz",
       "integrity": "sha512-Y5RmPncpiDtTXDbLKswIJzTqu2hyBKxTNsgKqKclDbhIgg1wgtf1fRuvxgTnRfcnxtvvgbIEcqUOzZrJ6iSReg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@hono/node-server": "^1.19.9",
         "ajv": "^8.17.1",
@@ -4292,8 +4271,7 @@
       "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
       "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
@@ -4535,6 +4513,7 @@
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.2.tgz",
       "integrity": "sha512-LPM2G3Syo1GLzXLGJAKdqoU35XvrWzGJ21/7sgZTUpbkBaOasTj8tjwn6w+hCkqaa1TfJ/w67rJSwYItlJ2mYw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -4571,6 +4550,7 @@
       "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.27.tgz",
       "integrity": "sha512-cisd7gxkzjBKU2GgdYrTdtQx1SORymWyaAFhaxQPK9bYO9ot3Y5OikQRvY0VYQtvwjeQnizCINJAenh/V7MK2w==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.2.2"
@@ -4582,6 +4562,7 @@
       "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "peerDependencies": {
         "@types/react": "^18.0.0"
       }
@@ -4710,6 +4691,7 @@
       "integrity": "sha512-N9lBGA9o9aqb1hVMc9hzySbhKibHmB+N3IpoShyV6HyQYRGIhlrO5rQgttypi+yEeKsKI4idxC8Jw6gXKD4THA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.49.0",
         "@typescript-eslint/types": "8.49.0",
@@ -5092,6 +5074,7 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5564,6 +5547,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -6402,8 +6386,7 @@
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
       "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/domexception": {
       "version": "4.0.0",
@@ -6661,6 +6644,7 @@
       "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -6958,6 +6942,7 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -7577,6 +7562,7 @@
       "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.1.tgz",
       "integrity": "sha512-hi9afu8g0lfJVLolxElAZGANCTTl6bewIdsRNhaywfP9K8BPf++F2z6OLrYGIinUwpRKzbZHMhPwvc0ZEpAwGw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=16.9.0"
       }
@@ -8073,6 +8059,7 @@
       "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/core": "^29.7.0",
         "@jest/types": "^29.6.3",
@@ -8413,7 +8400,6 @@
       "integrity": "sha512-zbBTiqr2Vl78pKp/laGBREYzbZx9ZtqPjOK4++lL4BNDhxRnahg51HtoDrk9/VjIy9IthNEWdKVd7H5bqBhiWQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/environment-jsdom-abstract": "30.2.0",
@@ -8439,7 +8425,6 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -8456,7 +8441,6 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -8475,7 +8459,6 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -8489,7 +8472,6 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -8508,8 +8490,7 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/jest-environment-jsdom/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -8517,7 +8498,6 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -8528,7 +8508,6 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -8541,7 +8520,6 @@
       "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">= 14"
       }
@@ -8552,7 +8530,6 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -8572,7 +8549,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -8583,7 +8559,6 @@
       "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@asamuzakjp/css-color": "^3.2.0",
         "rrweb-cssom": "^0.8.0"
@@ -8598,7 +8573,6 @@
       "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "whatwg-mimetype": "^4.0.0",
         "whatwg-url": "^14.0.0"
@@ -8613,7 +8587,6 @@
       "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "whatwg-encoding": "^3.1.1"
       },
@@ -8627,7 +8600,6 @@
       "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.0",
         "debug": "^4.3.4"
@@ -8642,7 +8614,6 @@
       "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.2",
         "debug": "4"
@@ -8657,7 +8628,6 @@
       "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
@@ -8671,7 +8641,6 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -8693,7 +8662,6 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8709,7 +8677,6 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8728,7 +8695,6 @@
       "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "cssstyle": "^4.2.1",
         "data-urls": "^5.0.0",
@@ -8769,7 +8735,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -8783,7 +8748,6 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -8798,8 +8762,7 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/jest-environment-jsdom/node_modules/tough-cookie": {
       "version": "5.1.2",
@@ -8807,7 +8770,6 @@
       "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "peer": true,
       "dependencies": {
         "tldts": "^6.1.32"
       },
@@ -8821,7 +8783,6 @@
       "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "punycode": "^2.3.1"
       },
@@ -8835,7 +8796,6 @@
       "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "xml-name-validator": "^5.0.0"
       },
@@ -8849,7 +8809,6 @@
       "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "iconv-lite": "0.6.3"
       },
@@ -8863,7 +8822,6 @@
       "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -8874,7 +8832,6 @@
       "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "tr46": "^5.1.0",
         "webidl-conversions": "^7.0.0"
@@ -8889,7 +8846,6 @@
       "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -9484,6 +9440,7 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -9522,6 +9479,7 @@
       "integrity": "sha512-SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "abab": "^2.0.6",
         "acorn": "^8.8.1",
@@ -9860,7 +9818,6 @@
       "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "lz-string": "bin/bin.js"
       }
@@ -10735,6 +10692,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -10910,7 +10868,6 @@
       "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "ansi-regex": "^5.0.1",
         "ansi-styles": "^5.0.0",
@@ -10926,7 +10883,6 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -11081,6 +11037,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -11093,6 +11050,7 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -11106,8 +11064,7 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/react-refresh": {
       "version": "0.18.0",
@@ -11525,8 +11482,7 @@
       "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
       "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/run-applescript": {
       "version": "7.1.0",
@@ -12224,6 +12180,7 @@
       "integrity": "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
         "arg": "^5.0.2",
@@ -12362,6 +12319,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -12385,7 +12343,6 @@
       "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "tldts-core": "^6.1.86"
       },
@@ -12398,8 +12355,7 @@
       "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
       "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
       "dev": true,
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/tmpl": {
       "version": "1.0.5",
@@ -12572,6 +12528,7 @@
       "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.9.2.tgz",
       "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@cspotcode/source-map-support": "^0.8.0",
         "@tsconfig/node10": "^1.0.7",
@@ -12628,6 +12585,7 @@
       "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "~0.27.0",
         "get-tsconfig": "^4.7.5"
@@ -13181,6 +13139,7 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -13389,6 +13348,7 @@
       "integrity": "sha512-ITcnkFeR3+fI8P1wMgItjGrR10170d8auB4EpMLPqmx6uxElH3a/hHGQabSHKdqd4FXWO1nFIp9rRn7JQ34ACQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -13482,6 +13442,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -13901,6 +13862,7 @@
       "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
       "dev": true,
       "license": "ISC",
+      "peer": true,
       "bin": {
         "yaml": "bin.mjs"
       },
@@ -13988,6 +13950,7 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
       "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -14003,7 +13966,7 @@
     },
     "server": {
       "name": "@modelcontextprotocol/inspector-server",
-      "version": "0.20.0",
+      "version": "0.21.0",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.25.2",
diff --git a/package.json b/package.json
index 948f361e..ab0764a6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -47,9 +47,9 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.20.0",
-    "@modelcontextprotocol/inspector-client": "^0.20.0",
-    "@modelcontextprotocol/inspector-server": "^0.20.0",
+    "@modelcontextprotocol/inspector-cli": "^0.21.0",
+    "@modelcontextprotocol/inspector-client": "^0.21.0",
+    "@modelcontextprotocol/inspector-server": "^0.21.0",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
diff --git a/server/package.json b/server/package.json
index b5805319..216cbe7b 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-server",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Server-side application for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",

From bb791cdeded4a42d7f2c94c6ccb4ee21f64a0e63 Mon Sep 17 00:00:00 2001
From: James Woods <jwwoods01@gmail.com>
Date: Wed, 25 Feb 2026 12:31:41 +0000
Subject: [PATCH 35/37] fix: include server/static in published package files
 (#1113)

The sandbox_proxy.html file was not shipped in the npm package because
the files arrays in both package.json and server/package.json only
included the build directory. The server code resolves the file via
join(__dirname, '..', 'static', 'sandbox_proxy.html') which expects
static/ as a sibling of build/, but it was missing from the package.
---
 package.json        | 1 +
 server/package.json | 1 +
 2 files changed, 2 insertions(+)

diff --git a/package.json b/package.json
index ab0764a6..ed9a6cc3 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,7 @@
     "client/bin",
     "client/dist",
     "server/build",
+    "server/static",
     "cli/build"
   ],
   "workspaces": [
diff --git a/server/package.json b/server/package.json
index 216cbe7b..c3eb80d6 100644
--- a/server/package.json
+++ b/server/package.json
@@ -12,6 +12,7 @@
   },
   "files": [
     "build",
+    "static",
     "LICENSE"
   ],
   "scripts": {

From db0827b24645f61c8b15aaaa4726bb7d21ad8282 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Fri, 27 Feb 2026 11:00:05 -0500
Subject: [PATCH 36/37] chore: bump version to 0.21.1 (#1116)

* Initial plan

* chore: bump version to 0.21.1

Co-authored-by: olaservo <16480113+olaservo@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: olaservo <16480113+olaservo@users.noreply.github.com>
Co-authored-by: Ola Hungerford <olahungerford@gmail.com>
---
 cli/package.json    |   2 +-
 client/package.json |   2 +-
 package-lock.json   | 125 ++++++++++++++++++++++++++++----------------
 package.json        |   8 +--
 server/package.json |   2 +-
 5 files changed, 88 insertions(+), 51 deletions(-)

diff --git a/cli/package.json b/cli/package.json
index a5f2c703..78092335 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-cli",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "CLI for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
diff --git a/client/package.json b/client/package.json
index a9cb374d..66732f39 100644
--- a/client/package.json
+++ b/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-client",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Client-side application for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
diff --git a/package-lock.json b/package-lock.json
index a52d0c49..19b73655 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@modelcontextprotocol/inspector",
-      "version": "0.21.0",
+      "version": "0.21.1",
       "license": "SEE LICENSE IN LICENSE",
       "workspaces": [
         "client",
@@ -14,9 +14,9 @@
         "cli"
       ],
       "dependencies": {
-        "@modelcontextprotocol/inspector-cli": "^0.21.0",
-        "@modelcontextprotocol/inspector-client": "^0.21.0",
-        "@modelcontextprotocol/inspector-server": "^0.21.0",
+        "@modelcontextprotocol/inspector-cli": "^0.21.1",
+        "@modelcontextprotocol/inspector-client": "^0.21.1",
+        "@modelcontextprotocol/inspector-server": "^0.21.1",
         "@modelcontextprotocol/sdk": "^1.25.2",
         "concurrently": "^9.2.0",
         "node-fetch": "^3.3.2",
@@ -48,7 +48,7 @@
     },
     "cli": {
       "name": "@modelcontextprotocol/inspector-cli",
-      "version": "0.21.0",
+      "version": "0.21.1",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.25.2",
@@ -76,7 +76,7 @@
     },
     "client": {
       "name": "@modelcontextprotocol/inspector-client",
-      "version": "0.21.0",
+      "version": "0.21.1",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@mcp-ui/client": "^6.0.0",
@@ -193,6 +193,7 @@
       "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@csstools/css-calc": "^2.1.3",
         "@csstools/css-color-parser": "^3.0.9",
@@ -206,7 +207,8 @@
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
       "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/@babel/code-frame": {
       "version": "7.27.1",
@@ -239,7 +241,6 @@
       "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@babel/generator": "^7.28.5",
@@ -785,6 +786,7 @@
         }
       ],
       "license": "MIT-0",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -805,6 +807,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -829,6 +832,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@csstools/color-helpers": "^5.1.0",
         "@csstools/css-calc": "^2.1.4"
@@ -1850,6 +1854,7 @@
       "integrity": "sha512-kazxw2L9IPuZpQ0mEt9lu9Z98SqR74xcagANmMBU16X0lS23yPc0+S6hGLUz8kVRlomZEs/5S/Zlpqwf5yu6OQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/fake-timers": "30.2.0",
@@ -1878,6 +1883,7 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -1894,6 +1900,7 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -1912,6 +1919,7 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -1925,6 +1933,7 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -1943,7 +1952,8 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@jest/environment-jsdom-abstract/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -1951,6 +1961,7 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -1961,6 +1972,7 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -1973,6 +1985,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -1992,6 +2005,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -2002,6 +2016,7 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -2023,6 +2038,7 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2038,6 +2054,7 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -2056,6 +2073,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -2069,6 +2087,7 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -2083,7 +2102,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@jest/expect": {
       "version": "29.7.0",
@@ -2152,6 +2172,7 @@
       "integrity": "sha512-gWp7NfQW27LaBQz3TITS8L7ZCQ0TLvtmI//4OwlQRx4rnWxcPNIYjxZpDcN4+UlGxgm3jS5QPz8IPTCkb59wZA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "jest-regex-util": "30.0.1"
@@ -2166,6 +2187,7 @@
       "integrity": "sha512-jHEQgBXAgc+Gh4g0p3bCevgRCVRkB4VB70zhoAE48gxeSr1hfUOsM/C2WoJgVL7Eyg//hudYENbm3Ne+/dRVVA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
@@ -2489,7 +2511,6 @@
       "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.26.0.tgz",
       "integrity": "sha512-Y5RmPncpiDtTXDbLKswIJzTqu2hyBKxTNsgKqKclDbhIgg1wgtf1fRuvxgTnRfcnxtvvgbIEcqUOzZrJ6iSReg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@hono/node-server": "^1.19.9",
         "ajv": "^8.17.1",
@@ -4271,7 +4292,8 @@
       "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
       "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
@@ -4513,7 +4535,6 @@
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.2.tgz",
       "integrity": "sha512-LPM2G3Syo1GLzXLGJAKdqoU35XvrWzGJ21/7sgZTUpbkBaOasTj8tjwn6w+hCkqaa1TfJ/w67rJSwYItlJ2mYw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -4550,7 +4571,6 @@
       "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.27.tgz",
       "integrity": "sha512-cisd7gxkzjBKU2GgdYrTdtQx1SORymWyaAFhaxQPK9bYO9ot3Y5OikQRvY0VYQtvwjeQnizCINJAenh/V7MK2w==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@types/prop-types": "*",
         "csstype": "^3.2.2"
@@ -4562,7 +4582,6 @@
       "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "peerDependencies": {
         "@types/react": "^18.0.0"
       }
@@ -4691,7 +4710,6 @@
       "integrity": "sha512-N9lBGA9o9aqb1hVMc9hzySbhKibHmB+N3IpoShyV6HyQYRGIhlrO5rQgttypi+yEeKsKI4idxC8Jw6gXKD4THA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.49.0",
         "@typescript-eslint/types": "8.49.0",
@@ -5074,7 +5092,6 @@
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
       "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -5547,7 +5564,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -6386,7 +6402,8 @@
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
       "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/domexception": {
       "version": "4.0.0",
@@ -6644,7 +6661,6 @@
       "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -6942,7 +6958,6 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -7562,7 +7577,6 @@
       "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.1.tgz",
       "integrity": "sha512-hi9afu8g0lfJVLolxElAZGANCTTl6bewIdsRNhaywfP9K8BPf++F2z6OLrYGIinUwpRKzbZHMhPwvc0ZEpAwGw==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=16.9.0"
       }
@@ -8059,7 +8073,6 @@
       "integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@jest/core": "^29.7.0",
         "@jest/types": "^29.6.3",
@@ -8400,6 +8413,7 @@
       "integrity": "sha512-zbBTiqr2Vl78pKp/laGBREYzbZx9ZtqPjOK4++lL4BNDhxRnahg51HtoDrk9/VjIy9IthNEWdKVd7H5bqBhiWQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/environment": "30.2.0",
         "@jest/environment-jsdom-abstract": "30.2.0",
@@ -8425,6 +8439,7 @@
       "integrity": "sha512-/QPTL7OBJQ5ac09UDRa3EQes4gt1FTEG/8jZ/4v5IVzx+Cv7dLxlVIvfvSVRiiX2drWyXeBjkMSR8hvOWSog5g==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/fake-timers": "30.2.0",
         "@jest/types": "30.2.0",
@@ -8441,6 +8456,7 @@
       "integrity": "sha512-HI3tRLjRxAbBy0VO8dqqm7Hb2mIa8d5bg/NJkyQcOk7V118ObQML8RC5luTF/Zsg4474a+gDvhce7eTnP4GhYw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@sinonjs/fake-timers": "^13.0.0",
@@ -8459,6 +8475,7 @@
       "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@sinclair/typebox": "^0.34.0"
       },
@@ -8472,6 +8489,7 @@
       "integrity": "sha512-H9xg1/sfVvyfU7o3zMfBEjQ1gcsdeTMgqHoYdN79tuLqfTtuu7WckRA1R5whDwOzxaZAeMKTYWqP+WCAi0CHsg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/pattern": "30.0.1",
         "@jest/schemas": "30.0.5",
@@ -8490,7 +8508,8 @@
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.41.tgz",
       "integrity": "sha512-6gS8pZzSXdyRHTIqoqSVknxolr1kzfy4/CeDnrzsVz8TTIWUbOBr6gnzOmTYJ3eXQNh4IYHIGi5aIL7sOZ2G/g==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/jest-environment-jsdom/node_modules/@sinonjs/fake-timers": {
       "version": "13.0.5",
@@ -8498,6 +8517,7 @@
       "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "@sinonjs/commons": "^3.0.1"
       }
@@ -8508,6 +8528,7 @@
       "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/tough-cookie": "*",
@@ -8520,6 +8541,7 @@
       "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 14"
       }
@@ -8530,6 +8552,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -8549,6 +8572,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -8559,6 +8583,7 @@
       "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@asamuzakjp/css-color": "^3.2.0",
         "rrweb-cssom": "^0.8.0"
@@ -8573,6 +8598,7 @@
       "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "whatwg-mimetype": "^4.0.0",
         "whatwg-url": "^14.0.0"
@@ -8587,6 +8613,7 @@
       "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "whatwg-encoding": "^3.1.1"
       },
@@ -8600,6 +8627,7 @@
       "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.0",
         "debug": "^4.3.4"
@@ -8614,6 +8642,7 @@
       "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "agent-base": "^7.1.2",
         "debug": "4"
@@ -8628,6 +8657,7 @@
       "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
@@ -8641,6 +8671,7 @@
       "integrity": "sha512-y4DKFLZ2y6DxTWD4cDe07RglV88ZiNEdlRfGtqahfbIjfsw1nMCPx49Uev4IA/hWn3sDKyAnSPwoYSsAEdcimw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
         "@jest/types": "30.2.0",
@@ -8662,6 +8693,7 @@
       "integrity": "sha512-JNNNl2rj4b5ICpmAcq+WbLH83XswjPbjH4T7yvGzfAGCPh1rw+xVNbtk+FnRslvt9lkCcdn9i1oAoKUuFsOxRw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8677,6 +8709,7 @@
       "integrity": "sha512-QKNsM0o3Xe6ISQU869e+DhG+4CK/48aHYdJZGlFQVTjnbvgpcKyxpzk29fGiO7i/J8VENZ+d2iGnSsvmuHywlA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/types": "30.2.0",
         "@types/node": "*",
@@ -8695,6 +8728,7 @@
       "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "cssstyle": "^4.2.1",
         "data-urls": "^5.0.0",
@@ -8735,6 +8769,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -8748,6 +8783,7 @@
       "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/schemas": "30.0.5",
         "ansi-styles": "^5.2.0",
@@ -8762,7 +8798,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
       "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/jest-environment-jsdom/node_modules/tough-cookie": {
       "version": "5.1.2",
@@ -8770,6 +8807,7 @@
       "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
       "dev": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "tldts": "^6.1.32"
       },
@@ -8783,6 +8821,7 @@
       "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "punycode": "^2.3.1"
       },
@@ -8796,6 +8835,7 @@
       "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "xml-name-validator": "^5.0.0"
       },
@@ -8809,6 +8849,7 @@
       "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "iconv-lite": "0.6.3"
       },
@@ -8822,6 +8863,7 @@
       "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -8832,6 +8874,7 @@
       "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "tr46": "^5.1.0",
         "webidl-conversions": "^7.0.0"
@@ -8846,6 +8889,7 @@
       "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "engines": {
         "node": ">=18"
       }
@@ -9440,7 +9484,6 @@
       "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "jiti": "bin/jiti.js"
       }
@@ -9479,7 +9522,6 @@
       "integrity": "sha512-SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "abab": "^2.0.6",
         "acorn": "^8.8.1",
@@ -9818,6 +9860,7 @@
       "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "lz-string": "bin/bin.js"
       }
@@ -10692,7 +10735,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
@@ -10868,6 +10910,7 @@
       "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "ansi-regex": "^5.0.1",
         "ansi-styles": "^5.0.0",
@@ -10883,6 +10926,7 @@
       "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=10"
       },
@@ -11037,7 +11081,6 @@
       "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
       "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0"
       },
@@ -11050,7 +11093,6 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
       "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "loose-envify": "^1.1.0",
         "scheduler": "^0.23.2"
@@ -11064,7 +11106,8 @@
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
       "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/react-refresh": {
       "version": "0.18.0",
@@ -11482,7 +11525,8 @@
       "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
       "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/run-applescript": {
       "version": "7.1.0",
@@ -12180,7 +12224,6 @@
       "integrity": "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
         "arg": "^5.0.2",
@@ -12319,7 +12362,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -12343,6 +12385,7 @@
       "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "tldts-core": "^6.1.86"
       },
@@ -12355,7 +12398,8 @@
       "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
       "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/tmpl": {
       "version": "1.0.5",
@@ -12528,7 +12572,6 @@
       "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.9.2.tgz",
       "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@cspotcode/source-map-support": "^0.8.0",
         "@tsconfig/node10": "^1.0.7",
@@ -12585,7 +12628,6 @@
       "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "~0.27.0",
         "get-tsconfig": "^4.7.5"
@@ -13139,7 +13181,6 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -13348,7 +13389,6 @@
       "integrity": "sha512-ITcnkFeR3+fI8P1wMgItjGrR10170d8auB4EpMLPqmx6uxElH3a/hHGQabSHKdqd4FXWO1nFIp9rRn7JQ34ACQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.5.0",
@@ -13442,7 +13482,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -13862,7 +13901,6 @@
       "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
       "dev": true,
       "license": "ISC",
-      "peer": true,
       "bin": {
         "yaml": "bin.mjs"
       },
@@ -13950,7 +13988,6 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
       "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -13966,7 +14003,7 @@
     },
     "server": {
       "name": "@modelcontextprotocol/inspector-server",
-      "version": "0.21.0",
+      "version": "0.21.1",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.25.2",
diff --git a/package.json b/package.json
index ed9a6cc3..bd2e0915 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -48,9 +48,9 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.21.0",
-    "@modelcontextprotocol/inspector-client": "^0.21.0",
-    "@modelcontextprotocol/inspector-server": "^0.21.0",
+    "@modelcontextprotocol/inspector-cli": "^0.21.1",
+    "@modelcontextprotocol/inspector-client": "^0.21.1",
+    "@modelcontextprotocol/inspector-server": "^0.21.1",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
diff --git a/server/package.json b/server/package.json
index c3eb80d6..c674018a 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector-server",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Server-side application for the Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",

From fdbf896a04aec63b7c422309bda86f8c5663aeae Mon Sep 17 00:00:00 2001
From: MumuTW <clothl47364@gmail.com>
Date: Fri, 6 Mar 2026 05:45:13 +0000
Subject: [PATCH 37/37] Fix decimal input handling in DynamicJsonForm number
 fields

---
 client/src/components/DynamicJsonForm.tsx     | 66 ++++++++++++++++++-
 .../__tests__/DynamicJsonForm.test.tsx        | 25 ++++++-
 2 files changed, 88 insertions(+), 3 deletions(-)

diff --git a/client/src/components/DynamicJsonForm.tsx b/client/src/components/DynamicJsonForm.tsx
index ecd150f2..90249ab1 100644
--- a/client/src/components/DynamicJsonForm.tsx
+++ b/client/src/components/DynamicJsonForm.tsx
@@ -125,6 +125,9 @@ const DynamicJsonForm = forwardRef<DynamicJsonFormRef, DynamicJsonFormProps>(
     const [rawJsonValue, setRawJsonValue] = useState<string>(
       JSON.stringify(value ?? generateDefaultValue(schema), null, 2),
     );
+    const [numericInputDrafts, setNumericInputDrafts] = useState<
+      Record<string, string>
+    >({});
 
     // Use a ref to manage debouncing timeouts to avoid parsing JSON
     // on every keystroke which would be inefficient and error-prone
@@ -134,6 +137,37 @@ const DynamicJsonForm = forwardRef<DynamicJsonFormRef, DynamicJsonFormProps>(
       return !!jsonError;
     };
 
+    const getPathKey = (path: string[]) =>
+      path.length === 0 ? "$root" : path.join(".");
+
+    const getNumericDisplayValue = (
+      path: string[],
+      currentValue: JsonValue,
+    ): string => {
+      const pathKey = getPathKey(path);
+      if (Object.prototype.hasOwnProperty.call(numericInputDrafts, pathKey)) {
+        return numericInputDrafts[pathKey];
+      }
+      return typeof currentValue === "number" ? currentValue.toString() : "";
+    };
+
+    const updateNumericDraft = (path: string[], draftValue: string) => {
+      const pathKey = getPathKey(path);
+      setNumericInputDrafts((prev) => ({ ...prev, [pathKey]: draftValue }));
+    };
+
+    const clearNumericDraft = (path: string[]) => {
+      const pathKey = getPathKey(path);
+      setNumericInputDrafts((prev) => {
+        if (!Object.prototype.hasOwnProperty.call(prev, pathKey)) {
+          return prev;
+        }
+        const next = { ...prev };
+        delete next[pathKey];
+        return next;
+      });
+    };
+
     // Debounce JSON parsing and parent updates to handle typing gracefully
     const debouncedUpdateParent = useCallback(
       (jsonString: string) => {
@@ -429,9 +463,10 @@ const DynamicJsonForm = forwardRef<DynamicJsonFormRef, DynamicJsonFormProps>(
           return (
             <Input
               type="number"
-              value={(currentValue as number)?.toString() ?? ""}
+              value={getNumericDisplayValue(path, currentValue)}
               onChange={(e) => {
                 const val = e.target.value;
+                updateNumericDraft(path, val);
                 if (!val && !isRequired) {
                   handleFieldChange(path, undefined);
                 } else {
@@ -441,6 +476,19 @@ const DynamicJsonForm = forwardRef<DynamicJsonFormRef, DynamicJsonFormProps>(
                   }
                 }
               }}
+              onBlur={(e) => {
+                const val = e.target.value;
+                if (!val) {
+                  clearNumericDraft(path);
+                  return;
+                }
+
+                const num = Number(val);
+                if (!isNaN(num)) {
+                  handleFieldChange(path, num);
+                }
+                clearNumericDraft(path);
+              }}
               placeholder={propSchema.description}
               required={isRequired}
               min={propSchema.minimum}
@@ -453,9 +501,10 @@ const DynamicJsonForm = forwardRef<DynamicJsonFormRef, DynamicJsonFormProps>(
             <Input
               type="number"
               step="1"
-              value={(currentValue as number)?.toString() ?? ""}
+              value={getNumericDisplayValue(path, currentValue)}
               onChange={(e) => {
                 const val = e.target.value;
+                updateNumericDraft(path, val);
                 if (!val && !isRequired) {
                   handleFieldChange(path, undefined);
                 } else {
@@ -465,6 +514,19 @@ const DynamicJsonForm = forwardRef<DynamicJsonFormRef, DynamicJsonFormProps>(
                   }
                 }
               }}
+              onBlur={(e) => {
+                const val = e.target.value;
+                if (!val) {
+                  clearNumericDraft(path);
+                  return;
+                }
+
+                const num = Number(val);
+                if (!isNaN(num) && Number.isInteger(num)) {
+                  handleFieldChange(path, num);
+                }
+                clearNumericDraft(path);
+              }}
               placeholder={propSchema.description}
               required={isRequired}
               min={propSchema.minimum}
diff --git a/client/src/components/__tests__/DynamicJsonForm.test.tsx b/client/src/components/__tests__/DynamicJsonForm.test.tsx
index a9f17d55..a273f75a 100644
--- a/client/src/components/__tests__/DynamicJsonForm.test.tsx
+++ b/client/src/components/__tests__/DynamicJsonForm.test.tsx
@@ -1,7 +1,7 @@
 import { render, screen, fireEvent, waitFor } from "@testing-library/react";
 import "@testing-library/jest-dom";
 import { describe, it, expect, jest } from "@jest/globals";
-import { useRef } from "react";
+import { useRef, useState } from "react";
 import DynamicJsonForm, { DynamicJsonFormRef } from "../DynamicJsonForm";
 import type { JsonSchemaType } from "@/utils/jsonUtils";
 
@@ -402,6 +402,29 @@ describe("DynamicJsonForm Number Fields", () => {
 
       expect(onChange).toHaveBeenCalledWith(98.6);
     });
+
+    it("should preserve decimal zero while typing", () => {
+      const schema: JsonSchemaType = {
+        type: "number",
+        description: "Coordinate",
+      };
+
+      const WrappedForm = () => {
+        const [value, setValue] = useState<number>(0);
+        return (
+          <DynamicJsonForm schema={schema} value={value} onChange={setValue} />
+        );
+      };
+
+      render(<WrappedForm />);
+      const input = screen.getByRole("spinbutton") as HTMLInputElement;
+
+      fireEvent.change(input, { target: { value: "-74.0" } });
+      expect(input.value).toBe("-74.0");
+
+      fireEvent.change(input, { target: { value: "-74.01" } });
+      expect(input.value).toBe("-74.01");
+    });
   });
 });