modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(auth): cover the transport's own discovery, and only rewrite GETs

Browse source 
Two more review findings, both real.

The shim wrapped `effectiveAuthFetch` only, but the transport is constructed
with the base `this.fetchFn`, and the SDK runs its own discovery from inside
the transport on the 401/refresh leg — so a reconnect with an existing auth
provider could still hit the upstream failure. It now wraps the base fetch,
the same seam `withOAuthEndpointOverrides` uses and the only one that reaches
both paths.

That trades away the previous claim that a captured Network entry shows the
real 404: below the trackers, what they record is the substitution. Rather
than leave that silently misleading, a substituted response now carries
`x-inspector-oauth-metadata-source` naming the URL its body was actually
fetched from — the transport builds its tracker internally, so there is no
seam above it to install into instead. An integration test captures the fetch
the transport is handed and drives it against a real server, since nothing
else proves that wiring.

The wrapper also keyed on URL shape alone, but nothing stops an authorization
or token endpoint from living under `/.well-known/oauth-authorization-server/`;
a POST there returning an ordinary OAuth 4xx would have had its error replaced
by a metadata document. Metadata discovery is a GET, so anything else is now
left alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UL9retfvAXRgvi6EWk4SY4
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-28 01:39:28 -04:00
commit 28c7a9ff8a
1 changed files with 141 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

13
AGENTS.md
View file

@ -135,10 +135,15 @@ v2/main/
│ │ # one is RFC 8414 metadata that is not a
│ │ # valid OIDC document, serves that body as
│ │ # the RFC 8414 response so the SDK picks the
│ │ # right schema. Sits ABOVE the fetch tracker
│ │ # (unlike endpointOverrides, which sits
│ │ # below) so the Network tab records the real
│ │ # 404 and the real probe — #2172;
│ │ # right schema. GET-only, and the well-known
│ │ # match requires a `/` boundary, so a token
│ │ # endpoint living under that prefix keeps its
│ │ # own error. Sits on the BASE fetch like
│ │ # endpointOverrides — the one seam that also
│ │ # covers the discovery the SDK runs inside the
│ │ # transport — so the substituted response
│ │ # carries COMPAT_SOURCE_HEADER naming the URL
│ │ # its body came from — #2172;
│ │ # secret-storage-info.ts browser-safe
│ │ # descriptor of WHERE a typed secret lands
│ │ # — kind/plaintext/durable plus the label,