diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index 32122205..63b3edef 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -11,6 +11,7 @@ The Inspector ships as one package with three clients (**Web**, **CLI**, **TUI**
 - **Avoid double casts (`as unknown as T`).** They erase all type safety and usually mean the real type is being worked around. Prefer a type guard, a narrower single cast, or fixing the underlying type. If genuinely unavoidable (a documented gap in a third-party type, or bridging structurally-identical shapes TS can't relate), it **must** carry an inline comment justifying why it's safe and why nothing better exists. An unjustified `as unknown as` is not acceptable in review.
 - Prefer inference, type guards, and precise annotations over assertions.
 - An `_` prefix is the intentionally-unused marker (`argsIgnorePattern` / `varsIgnorePattern` / `caughtErrorsIgnorePattern`).
+- **Never float a promise.** `@typescript-eslint/no-floating-promises` is `error` in all five ESLint scopes, so every promise must be awaited, `.catch(…)`-terminated, returned, or explicitly discarded with `void`. Prefer **holding and settling** it — a floated rejection surfaces in an unrelated file as an SDK-internal stack, which is how two un-held `callTool` calls failed the whole `npm run ci` chain (#1947). Reach for `void` only when the callee already owns its failures (it ends in a `catch`) or the caller genuinely cannot await (a sync effect body, an Ink key handler), and say which in a comment. In Storybook play functions, `expect(...)` from `storybook/test` is instrumented and returns a promise — it must be awaited.
 
 ## React and UI (web client)
 
diff --git a/AGENTS.md b/AGENTS.md
index d07e84f4..4ba943ec 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -45,7 +45,13 @@ v2/main/
 │   │                                   #   providers.redirectToAuthorization, the only
 │   │                                   #   seam that sees the SDK-built authorize URL;
 │   │                                   #   authorization request only, never the token
-│   │                                   #   request — #2018)
+│   │                                   #   request — #2018;
+│   │                                   #   endpointOverrides.ts per-server
+│   │                                   #   authorization/token URL overrides — a fetch
+│   │                                   #   wrapper that rewrites the discovered AS
+│   │                                   #   metadata document, the one seam SDK v2 routes
+│   │                                   #   BOTH endpoints through (neither reaches the
+│   │                                   #   OAuthClientProvider) — #1906)
 │   │   ├── browser/                    # Browser-side OAuth (sessionStorage, BrowserNavigation)
 │   │   ├── node/                       # Node-side OAuth (NodeOAuthStorage, OAuthCallbackServer,
 │   │   │                               #   runner-interactive-oauth loopback callback flow)
@@ -719,6 +725,12 @@ The ⚠️ option-deletion hazard, the snapshot rule, and the recovery recipe ab
 - Use type guards and type assertions to handle potential type mismatches and ensure type safety
 - Take advantage of TypeScript's advanced features like generics, type aliases, and conditional types to write more expressive and reusable code
 - Regularly review and refactor TypeScript code to ensure it remains well-structured and adheres to evolving best practices
+- **NEVER leave a promise floating.** `@typescript-eslint/no-floating-promises` is enabled at `error` in **all five** ESLint scopes — `clients/{web,cli,tui,launcher}` and the root `core/` + shared gate (#1959). Every promise must be awaited, returned, terminated with `.catch(…)`, or explicitly discarded with the `void` operator.
+  - **The class it catches is invisible at review time.** A floated call reads like an awaited one minus four characters, and the unhandled rejection it produces surfaces somewhere else entirely — a different test, a different file, a stack pointing at SDK internals. Two un-held `client.callTool(...)` promises made `npm run ci` unpassable in #1947: `disconnect()` rejected them with `Connection closed`, the unhandled rejection failed the whole vitest run, and the chain aborted at `coverage`, silently skipping `verify:build-gate`, `smoke`, and Storybook. Attributing it took a full investigation; the fix was two lines.
+  - **Prefer holding and settling the promise.** `void` is an escape hatch, not a fix — it is visible at review time (strictly better than nothing) but still discards the rejection. Reach for it only when the callee already owns its failures (it ends in a `catch` that surfaces the message) or the caller genuinely cannot await — a synchronous `useEffect` body, an Ink `useInput` key handler, a Hono `stream.onAbort` listener. Say **which** of those it is in a one-line comment; an unexplained `void` is a review finding. Where the callee does *not* own its failures, give it a `catch` rather than voiding the call (see `handleDisconnect` in `clients/tui/src/App.tsx`), or terminate with `.catch(…)` at the call site (see `open(url)` in `clients/web/server/{server,vite-hono-plugin}.ts`).
+  - **In Storybook play functions, `expect(...)` from `storybook/test` returns a promise.** Storybook instruments it so the interactions panel can trace each assertion, so every `expect` in a play function is awaited — as is any shared helper that wraps one (`src/test/scrollAreaStoryAssertions.ts` is `async` for this reason).
+  - **The rule is type-aware, so each scope's ESLint config carries a parser project.** Each client's config must name **every leaf project covering its lint surface**, since the parser needs a program that literally *contains* the file — for cli, tui, and launcher that is the two they already typecheck (`tsconfig.json` + `tsconfig.test.json`, `src` in the first and `__tests__` only in the second), and for **web it is four** (`tsconfig.app.json`, `tsconfig.node.json`, `tsconfig.storybook.json`, `tsconfig.test.json`) — web's `tsconfig.json` is a solution file with `files: []`, so naming it alone would contain nothing. Adding a leaf project to a client means adding it here too. The root config instead points at **`tsconfig.lint.json`**, which exists solely to give the parser a program covering `core/**`, `test-servers/src/**`, and `vitest.shared.mts` — none of which is rooted in a tsconfig of its own. That file emits nothing and gates nothing: type *checking* for those sources stays where it was (`core/` through `clients/web`'s `tsc -b`, `test-servers/src` through `clients/cli`'s test project). It sets `moduleResolution: bundler` deliberately — `core/` uses extensionless relative imports, which NodeNext fails to resolve, degrading every import to `any` so the rule silently stops seeing promises at all. **Its `include` must stay a superset of the root config's type-aware `files` globs** — a file the lint block matches but the project omits fails outright with "was not found in any of the provided project(s)" rather than being checked, so widening one means widening the other (that is why the `include` carries `test-servers/src/**/*.tsx`, which nothing has produced yet). Note also that a tsconfig `include` does **not** expand braces — `core/**/*.{ts,tsx}` matches nothing; list the extensions separately.
+  - Type-aware linting costs real time: `clients/web`'s `eslint .` went from ~8s to ~19s, and `lint` runs inside `validate`, the fast inner-loop check. That is the price of the guarantee; if it needs reducing later, narrowing the projects each scope loads is the lever, not dropping the rule.
 
 ## Web source layout: `src/lib` vs `src/utils`
 
diff --git a/README.md b/README.md
index cb57dd35..e3330d41 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ inspector/
 │   ├── tui/          # TUI client (Ink + React, tsup bundle)
 │   └── launcher/     # Shared launcher — provides the `mcp-inspector` bin, dispatches to web/cli/tui
 ├── core/             # Shared code consumed via the `@inspector/core` alias (no package.json)
-│   ├── auth/         # OAuth: providers, discovery, storage, mid-session recovery (browser/node/remote backends)
+│   ├── auth/         # OAuth: providers, discovery, storage, endpoint overrides, mid-session recovery (browser/node/remote backends)
 │   ├── client/       # Install-level client config (`client.json`): browser-safe parse/validate + Node load/save, remote backend, secrets
 │   ├── json/         # JSON + parameter/argument conversion utilities, and the nullable-union
 │   │                 #   schema collapse shared by the web and TUI form builders
@@ -140,7 +140,7 @@ Each config below is a ready-made server for exercising one feature by hand. Loa
 | ----------------------------------------- | -------------------------------------------------- | ---------------------------------------------------------------------- |
 | `mcp-app-http.json` **(legacy era)**      | An MCP App (UI resource + app tool) in the Apps tab | [#1859](https://github.com/modelcontextprotocol/inspector/issues/1859) |
 | `modern-mrtr-http.json`                   | A single MRTR round-trip                           | —                                                                      |
-| `mrtr-showcase-http.json`                 | Every MRTR preset in one server                    | —                                                                      |
+| `mrtr-showcase-http.json`                 | Every MRTR preset in one server                    | [#1860](https://github.com/modelcontextprotocol/inspector/issues/1860) |
 | `modern-network-http.json`                | Network tab: `Mcp-*` headers + error taxonomy      | [#1628](https://github.com/modelcontextprotocol/inspector/issues/1628) |
 | `xmcpheader-modern-http.json`             | Tools tab: `x-mcp-header` mirroring and exclusions | [#1632](https://github.com/modelcontextprotocol/inspector/issues/1632) |
 | `pagination-http.json`                    | Page-by-page list fetching                         | [#1721](https://github.com/modelcontextprotocol/inspector/issues/1721) |
@@ -175,8 +175,21 @@ The Inspector drives MRTR manually (`inputRequired: { autoFulfill: false }`), so
 | `mrtr_sample`   | Embedded sampling → the Sampling panel                                         |
 | `mrtr_roots`    | Embedded `roots/list`, auto-answered silently from configured roots (no modal) |
 | `mrtr_edge`     | An `inputRequests`-only round, then a `requestState`-only round                |
+| `mrtr_empty`    | Completes with an empty result — no `content`, no `structuredContent`          |
 | `mrtr_loop`     | Never completes → trips the `MRTR_MAX_ROUNDS` bound                            |
 
+Run `mrtr_empty` and answer its single elicitation: the Protocol tab groups the
+exchange as an MRTR conversation ending **COMPLETE**, and the Results panel says
+**"Empty result — The tool call completed successfully and returned no content."**
+On the broken build that same result rendered as **"No results yet"**, the panel's
+pre-run placeholder ([#1860](https://github.com/modelcontextprotocol/inspector/issues/1860)) —
+so a call the user had just watched succeed read as a call that never ran. An
+empty `content` array with no `structuredContent` is a legal `CallToolResult`,
+and the panel only ever mounts once a result exists, so the placeholder wording
+could not be true there. (The neighbouring half of the same gap — a result whose
+payload lives only in `structuredContent` — was closed by
+[#1908](https://github.com/modelcontextprotocol/inspector/issues/1908).)
+
 > The legacy `collect_elicitation` preset calls `server.elicitInput`, which errors on the 2026-07-28 leg — server→client requests aren't allowed there. MRTR is the modern replacement.
 
 #### Network tab — standardized headers and error taxonomy
@@ -307,6 +320,8 @@ Each client self-validates from its own folder; the root scripts chain them. The
 
 Per-client scripts exist too (`validate:web`, `coverage:cli`, `smoke:tui`, …), plus root `validate:core` / `format:core` for the shared `core/` package, `format:scripts` for the root `scripts/` tooling, and `format:shared` / `lint:shared` for the root "shared" surface (`test-servers/src/**`, `vitest.shared.mts`, the root `eslint.config.js`). Run `npm run format` before committing — the root `format` fixes `core/`, the root `scripts/`, the shared surface, and every client; `validate` runs the non-fixing `format:check` and fails CI on any unformatted file.
 
+**Linting is type-aware.** All five ESLint scopes (`clients/{web,cli,tui,launcher}` plus the root `core/` + shared gate) enable `@typescript-eslint/no-floating-promises` at `error`, so a promise that is neither awaited, returned, `.catch(…)`-terminated, nor explicitly discarded with `void` fails `lint` — and therefore `validate` ([#1959](https://github.com/modelcontextprotocol/inspector/issues/1959)). The rule needs type information, so each scope's config names a parser project; the root scope's is **`tsconfig.lint.json`**, a lint-only project covering `core/**`, `test-servers/src/**`, and `vitest.shared.mts`, which have no tsconfig of their own. It emits nothing and changes no typecheck — but a new first-party TS location added to the root lint scope must be added to its `include`. See **TypeScript instructions** in [`AGENTS.md`](./AGENTS.md) for when `void` is acceptable.
+
 For the full testing rules — the ≥90% per-file gate, where test files live, the unit vs. integration vs. storybook projects, and the `v8 ignore` policy — see [`AGENTS.md`](./AGENTS.md).
 
 ## Publishing
diff --git a/clients/cli/__tests__/run-method.test.ts b/clients/cli/__tests__/run-method.test.ts
index 783ba60b..d8599223 100644
--- a/clients/cli/__tests__/run-method.test.ts
+++ b/clients/cli/__tests__/run-method.test.ts
@@ -258,18 +258,29 @@ describe("runMethod", () => {
       );
       expect(stdout.trim().split("\n")).toHaveLength(2);
 
+      // Invoke only the SIGINT handler consumeMethodOutcome registers, rather
+      // than broadcasting `process.emit("SIGINT")` process-wide: `atomically`
+      // (loaded via core's store-io) pulls in `when-exit`, whose module-level
+      // `process.once("SIGINT")` handler re-raises the signal with
+      // `process.kill(process.pid, "SIGINT")` — on Windows an unconditional
+      // TerminateProcess that kills the vitest worker fork mid-run (#1941).
+      const listenersBefore = new Set(process.listeners("SIGINT"));
       const streamPromise = consumeMethodOutcome(
         {
           kind: "stream",
           label: "t",
           start: (write) => {
             write({ hi: true });
-            queueMicrotask(() => process.emit("SIGINT"));
             return () => {};
           },
         },
         {},
       );
+      const added = process
+        .listeners("SIGINT")
+        .filter((listener) => !listenersBefore.has(listener));
+      expect(added).toHaveLength(1);
+      for (const listener of added) listener("SIGINT");
       await streamPromise;
       expect(stdout).toContain('"hi":true');
     } finally {
diff --git a/clients/cli/eslint.config.js b/clients/cli/eslint.config.js
index 9407f997..699b202f 100644
--- a/clients/cli/eslint.config.js
+++ b/clients/cli/eslint.config.js
@@ -16,4 +16,22 @@ export default defineConfig([
       globals: globals.node,
     },
   },
+  {
+    // Type-aware pass for `no-floating-promises` (#1959). The rule needs type
+    // information, which `tseslint.configs.recommended` does not provide, and
+    // the parser needs a project that literally contains the linted file — so
+    // both of this client's tsconfig projects are listed, exactly as
+    // `npm run typecheck` runs them (`src` is in the first, `__tests__` only
+    // in the second).
+    files: ["**/*.ts"],
+    languageOptions: {
+      parserOptions: {
+        project: ["./tsconfig.json", "./tsconfig.test.json"],
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      "@typescript-eslint/no-floating-promises": "error",
+    },
+  },
 ]);
diff --git a/clients/launcher/eslint.config.js b/clients/launcher/eslint.config.js
index 535689a1..b13efaba 100644
--- a/clients/launcher/eslint.config.js
+++ b/clients/launcher/eslint.config.js
@@ -16,4 +16,19 @@ export default defineConfig([
       globals: globals.node,
     },
   },
+  {
+    // Type-aware pass for `no-floating-promises` (#1959) — see the CLI config
+    // for the reasoning. Both tsconfig projects are listed because `src` and
+    // `__tests__` live in different ones.
+    files: ["**/*.{ts,mts}"],
+    languageOptions: {
+      parserOptions: {
+        project: ["./tsconfig.json", "./tsconfig.test.json"],
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      "@typescript-eslint/no-floating-promises": "error",
+    },
+  },
 ]);
diff --git a/clients/tui/__tests__/App.test.tsx b/clients/tui/__tests__/App.test.tsx
index d70b9c27..a66fe603 100644
--- a/clients/tui/__tests__/App.test.tsx
+++ b/clients/tui/__tests__/App.test.tsx
@@ -507,6 +507,9 @@ function renderApp(servers: Record<string, TuiServer>) {
 async function mount(servers: Record<string, TuiServer>) {
   const r = renderApp(servers);
   await tick();
+  // The mount commit's effect flush can still be queued behind this tick, and
+  // this write is the one that absorbs the dropped first keypress.
+  await settleInputHandlers();
   r.stdin.write("x");
   await tick();
   return r;
@@ -532,6 +535,11 @@ const ENTER = "\r";
  */
 async function press(r: RenderResult, keys: string[]) {
   for (const k of keys) {
+    // Same hazard `waitUntil` guards against, at the other end: a caller can
+    // reach here on a turn that still has React's passive-effect flush queued
+    // (e.g. straight after a plain `tick`, or after an earlier key committed a
+    // render), so settle before every write rather than only after a poll.
+    await settleInputHandlers();
     r.stdin.write(k);
     await tick();
     await tick();
@@ -552,9 +560,29 @@ async function press(r: RenderResult, keys: string[]) {
  */
 const POLL_TRIES = 100;
 
+/**
+ * One check-phase turn, queued BEHIND React's already-scheduled passive-effect
+ * flush. A frame observed by a poll predicate is written during React's
+ * COMMIT, but ink re-arms its useInput listeners in the passive-effect flush
+ * React schedules (via setImmediate in Node) during that same commit. Node's
+ * event loop runs the timers phase before the check phase, so a 25ms poll
+ * tick can observe the new frame and let the test write the next keypress
+ * BEFORE that flush has run — the key is then dispatched to the previous
+ * commit's stale useInput closures (where e.g. pendingStepUp is still null)
+ * and silently swallowed (#1942). Yielding one setImmediate turn after the
+ * predicate passes sequences the next stdin write after the flush (FIFO
+ * within the check queue), so "frame visible" once again implies "input
+ * handlers armed".
+ */
+const settleInputHandlers = () =>
+  new Promise((resolve) => setImmediate(resolve));
+
 async function waitUntil(predicate: () => boolean, tries = POLL_TRIES) {
   for (let i = 0; i < tries; i++) {
-    if (predicate()) return;
+    if (predicate()) {
+      await settleInputHandlers();
+      return;
+    }
     await tick();
   }
 }
@@ -626,6 +654,23 @@ afterEach(() => {
   while (mounted.length) mounted.pop()?.unmount();
 });
 
+// Pins the synchronization contract the OAuth step-up assertions depend on
+// (#1942). The `setImmediate` sentinel below stands in for React's pending
+// passive-effect flush — the turn where ink re-arms `useInput`. If `waitUntil`
+// ever returns without yielding a check-phase turn, the sentinel has not run
+// and this fails, instead of the regression resurfacing as a differently-named
+// flaky OAuth test under coverage instrumentation.
+describe("test helpers", () => {
+  it("waitUntil settles input handlers before resolving", async () => {
+    let flushed = false;
+    setImmediate(() => {
+      flushed = true;
+    });
+    await waitUntil(() => true);
+    expect(flushed).toBe(true);
+  });
+});
+
 describe("App (foundation)", () => {
   it("renders the server list with the MCP Servers header", async () => {
     const r = renderApp(stdioServer());
@@ -661,6 +706,91 @@ describe("App (foundation)", () => {
     expect(h.disconnect).toHaveBeenCalled();
   });
 
+  it("surfaces a disconnect failure instead of floating the rejection", async () => {
+    // 'd' is a key handler, so it cannot await handleDisconnect — the handler
+    // has to own the failure itself or it escapes as an unhandled rejection
+    // and fails the whole run from somewhere else (#1959).
+    // The banner is deliberately independent of connection status: a rejected
+    // disconnect leaves the status "connected", so anything gated on
+    // `status === "error"` would never be seen.
+    h.ctrl.status = "connected";
+    h.disconnect.mockRejectedValue(new Error("discfail"));
+    const r = await mount(oneStdio());
+    r.stdin.write("d");
+    await expectFrame(r, "Disconnect failed: discfail");
+  });
+
+  it("owns a non-Error disconnect rejection too", async () => {
+    // The catch stringifies a non-Error rejection rather than reading
+    // `.message` off it; a throw here would escape the same way.
+    h.ctrl.status = "connected";
+    h.disconnect.mockRejectedValue("plainstring");
+    const r = await mount(oneStdio());
+    r.stdin.write("d");
+    await expectFrame(r, "Disconnect failed: plainstring");
+  });
+
+  it("clears a disconnect failure once a retry succeeds", async () => {
+    // A stale banner would keep reporting a failure the user has since fixed.
+    h.ctrl.status = "connected";
+    h.disconnect.mockRejectedValueOnce(new Error("discfail"));
+    const r = await mount(oneStdio());
+    r.stdin.write("d");
+    await expectFrame(r, "Disconnect failed: discfail");
+    r.stdin.write("d");
+    await waitUntil(() => !(r.lastFrame() ?? "").includes("Disconnect failed"));
+    expect(r.lastFrame() ?? "").not.toContain("Disconnect failed");
+  });
+
+  it("drops a disconnect rejection that lands after the user switched servers", async () => {
+    // The stale attempt is the one that usually rejects, so without an
+    // attempt token server alpha's failure would surface in beta's header.
+    h.ctrl.status = "connected";
+    let rejectDisconnect: (err: Error) => void = () => {};
+    h.disconnect.mockImplementationOnce(
+      () =>
+        new Promise<void>((_resolve, reject) => {
+          rejectDisconnect = reject;
+        }),
+    );
+    const r = await mount(stdioServer());
+    r.stdin.write("d"); // alpha's disconnect starts, and hangs
+    await tick();
+    await press(r, [DOWN]); // switch to beta
+    await expectFrame(r, "beta");
+    rejectDisconnect(new Error("stale-alpha-failure"));
+    // Give the rejection every chance to be published before asserting it
+    // wasn't — a bare tick would pass even with the guard removed.
+    await waitUntil(() =>
+      (r.lastFrame() ?? "").includes("stale-alpha-failure"),
+    );
+    expect(r.lastFrame() ?? "").not.toContain("stale-alpha-failure");
+  });
+
+  it("drops a stale disconnect rejection across an A → B → A round trip", async () => {
+    // The server-name check alone passes here: by the time the rejection
+    // lands, alpha is selected again. Only retiring the attempt token on
+    // every switch catches it.
+    h.ctrl.status = "connected";
+    let rejectDisconnect: (err: Error) => void = () => {};
+    h.disconnect.mockImplementationOnce(
+      () =>
+        new Promise<void>((_resolve, reject) => {
+          rejectDisconnect = reject;
+        }),
+    );
+    const r = await mount(stdioServer());
+    r.stdin.write("d"); // alpha's disconnect starts, and hangs
+    await tick();
+    await press(r, [DOWN]); // alpha -> beta
+    await expectFrame(r, "b.js");
+    await press(r, [UP]); // beta -> alpha again
+    await expectFrame(r, "s.js");
+    rejectDisconnect(new Error("round-trip-failure"));
+    await waitUntil(() => (r.lastFrame() ?? "").includes("round-trip-failure"));
+    expect(r.lastFrame() ?? "").not.toContain("round-trip-failure");
+  });
+
   it("switches tabs via accelerator keys", async () => {
     const r = await mount(stdioServer());
     await press(r, ["t"]); // tools tab (server is auto-selected)
diff --git a/clients/tui/__tests__/tsupConfig.test.ts b/clients/tui/__tests__/tsupConfig.test.ts
index a9bfc35f..8c61e9e9 100644
--- a/clients/tui/__tests__/tsupConfig.test.ts
+++ b/clients/tui/__tests__/tsupConfig.test.ts
@@ -207,7 +207,9 @@ describe("tui tsup config", () => {
     // the double cast is bridging a real structural gap, not hiding a mismatch.
     // A hook the patch called but the stub lacks fails as undefined here rather
     // than passing silently.
-    inkFormLabelPatch.setup(
+    // esbuild types `setup` as `void | Promise<void>`; await it so the
+    // assertions below can't run before an async setup has registered.
+    await inkFormLabelPatch.setup(
       build as unknown as Parameters<typeof inkFormLabelPatch.setup>[0],
     );
 
diff --git a/clients/tui/eslint.config.js b/clients/tui/eslint.config.js
index b4f8a251..d37c6b7d 100644
--- a/clients/tui/eslint.config.js
+++ b/clients/tui/eslint.config.js
@@ -30,4 +30,19 @@ export default defineConfig([
       "react-hooks/exhaustive-deps": "warn",
     },
   },
+  {
+    // Type-aware pass for `no-floating-promises` (#1959) — see the CLI config
+    // for the reasoning. Both tsconfig projects are listed because `src` and
+    // `__tests__` live in different ones.
+    files: ["**/*.{ts,tsx}"],
+    languageOptions: {
+      parserOptions: {
+        project: ["./tsconfig.json", "./tsconfig.test.json"],
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      "@typescript-eslint/no-floating-promises": "error",
+    },
+  },
 ]);
diff --git a/clients/tui/src/App.tsx b/clients/tui/src/App.tsx
index 62c9e743..240bbd82 100644
--- a/clients/tui/src/App.tsx
+++ b/clients/tui/src/App.tsx
@@ -170,6 +170,17 @@ function App({
     pendingStepUpRef.current = pendingStepUp;
   }, [pendingStepUp]);
   const [connectError, setConnectError] = useState<string | null>(null);
+  // Monotonic token for in-flight disconnects — see handleDisconnect.
+  const disconnectAttemptRef = useRef(0);
+  // A failed disconnect is deliberately NOT folded into `connectError`. That
+  // one is only rendered by InfoTab when the status is "error", which a
+  // rejected disconnect leaves untouched (the status stays "connected"), so
+  // the message would never be seen — and it feeds
+  // `connectError ?? inspectorLastError`, where a stale value would go on
+  // masking a later, real connection error. This renders in the header
+  // regardless of status and is cleared on the next connect/disconnect
+  // attempt and on a server switch.
+  const [disconnectError, setDisconnectError] = useState<string | null>(null);
   const oauthInProgressRef = useRef(false);
   const callbackServerRef = useRef<OAuthCallbackServer | null>(null);
   const selectedServerRef = useRef<string | null>(null);
@@ -434,6 +445,13 @@ function App({
   useEffect(() => {
     setOauthStatus("idle");
     setOauthMessage(null);
+    // The header banner is server-scoped, so a failure from the server we just
+    // left must not be read as this one's. Clearing is not enough: a switch
+    // away and back (A → B → A) would leave both the attempt token and the
+    // server name matching again, so the stale rejection would land on the
+    // re-selected A. Retiring the token on every switch is what closes that.
+    disconnectAttemptRef.current++;
+    setDisconnectError(null);
     const stepUp = pendingStepUpRef.current;
     if (stepUp && selectedServer && stepUp.serverName !== selectedServer) {
       setPendingStepUp(null);
@@ -757,6 +775,10 @@ function App({
     if (!selectedServer || !selectedInspectorClient || !selectedServerConfig) {
       return;
     }
+    // A connect attempt supersedes whatever the last disconnect reported —
+    // including one still in flight, which is what the counter bump retires.
+    disconnectAttemptRef.current++;
+    setDisconnectError(null);
 
     const finishConnect = async () => {
       await connectInspector();
@@ -887,8 +909,31 @@ function App({
   // Disconnect handler
   const handleDisconnect = useCallback(async () => {
     if (!selectedServer) return;
-    await disconnectInspector();
-    // InspectorClient will update status automatically, and data is preserved
+    // Claim this attempt before awaiting. A disconnect can still be in flight
+    // when the user switches servers or presses 'd' again, and it is the
+    // *stale* one that usually rejects — so the catch below must be able to
+    // tell "my failure" from "one that has since been superseded", or server
+    // A's error lands in server B's header. `handleConnect` bumps the same
+    // counter for the same reason.
+    const attempt = ++disconnectAttemptRef.current;
+    const attemptServer = selectedServer;
+    // Clear first, so a retry that succeeds leaves no stale message behind.
+    setDisconnectError(null);
+    try {
+      await disconnectInspector();
+      // InspectorClient will update status automatically, and data is preserved
+    } catch (err) {
+      // Nothing above this catches: the only caller is the key handler, which
+      // cannot await, so without this the rejection escapes unhandled. A
+      // superseded one is still owned here — just not published.
+      if (
+        disconnectAttemptRef.current !== attempt ||
+        selectedServerRef.current !== attemptServer
+      ) {
+        return;
+      }
+      setDisconnectError(err instanceof Error ? err.message : String(err));
+    }
   }, [selectedServer, disconnectInspector]);
 
   const handleClearOAuth = useCallback(async () => {
@@ -1428,12 +1473,15 @@ function App({
         input.toLowerCase() === "c" &&
         (inspectorStatus === "disconnected" || inspectorStatus === "error")
       ) {
-        handleConnect();
+        // Both handlers own their failures internally (each ends in a catch
+        // that surfaces the message), so there is nothing left for a key
+        // handler — which cannot await — to do with the promise.
+        void handleConnect();
       } else if (
         input.toLowerCase() === "d" &&
         (inspectorStatus === "connected" || inspectorStatus === "connecting")
       ) {
-        handleDisconnect();
+        void handleDisconnect();
       }
     }
   });
@@ -1617,6 +1665,11 @@ function App({
                   <Text color="red">OAuth: {oauthMessage}</Text>
                 </Box>
               )}
+              {disconnectError && (
+                <Box marginTop={1}>
+                  <Text color="red">Disconnect failed: {disconnectError}</Text>
+                </Box>
+              )}
             </Box>
           </Box>
 
diff --git a/clients/tui/src/components/PromptsTab.tsx b/clients/tui/src/components/PromptsTab.tsx
index 4f90c1a7..46db93b5 100644
--- a/clients/tui/src/components/PromptsTab.tsx
+++ b/clients/tui/src/components/PromptsTab.tsx
@@ -53,8 +53,10 @@ export function PromptsTab({
         if (selectedPrompt.arguments && selectedPrompt.arguments.length > 0) {
           onFetchPrompt(selectedPrompt);
         } else {
-          // No arguments, fetch directly
-          (async () => {
+          // No arguments, fetch directly. The IIFE catches everything it can
+          // throw, so there is no rejection for this key handler — which
+          // cannot await — to own.
+          void (async () => {
             try {
               const invocation = await inspectorClient.getPrompt(
                 selectedPrompt.name,
diff --git a/clients/tui/src/components/ResourcesTab.tsx b/clients/tui/src/components/ResourcesTab.tsx
index 86ba91ac..4d0fa05d 100644
--- a/clients/tui/src/components/ResourcesTab.tsx
+++ b/clients/tui/src/components/ResourcesTab.tsx
@@ -186,7 +186,9 @@ export function ResourcesTab({
       }
     };
 
-    fetchContent();
+    // An effect body is synchronous, and fetchContent already catches
+    // everything it can throw, so there is no rejection left to own.
+    void fetchContent();
   }, [shouldFetchResource, inspectorClient, onAuthRecoveryRequired]);
 
   const listWidth = Math.floor(width * 0.4);
diff --git a/clients/web/eslint.config.js b/clients/web/eslint.config.js
index 86602ed3..21726da5 100644
--- a/clients/web/eslint.config.js
+++ b/clients/web/eslint.config.js
@@ -31,5 +31,32 @@ export default defineConfig([
       "react-refresh/only-export-components": "off",
     },
   },
+  {
+    // Type-aware pass for `no-floating-promises` (#1959). The rule needs type
+    // information, which `tseslint.configs.recommended` does not provide, and
+    // the parser needs a project that literally contains the linted file — so
+    // all four leaf projects are listed (`tsconfig.json` itself is a
+    // solution file with `files: []`, so it contains nothing).
+    //
+    // `.d.ts` is excluded: `vitest.shims.d.ts` is pulled in through a `types`
+    // reference rather than an `include`, so no project owns it, and a
+    // declaration file cannot float a promise anyway.
+    files: ["**/*.{ts,tsx}"],
+    ignores: ["**/*.d.ts"],
+    languageOptions: {
+      parserOptions: {
+        project: [
+          "./tsconfig.app.json",
+          "./tsconfig.node.json",
+          "./tsconfig.storybook.json",
+          "./tsconfig.test.json",
+        ],
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+    rules: {
+      "@typescript-eslint/no-floating-promises": "error",
+    },
+  },
   ...storybook.configs["flat/recommended"],
 ]);
diff --git a/clients/web/server/server.ts b/clients/web/server/server.ts
index 9f6ff134..fe465530 100644
--- a/clients/web/server/server.ts
+++ b/clients/web/server/server.ts
@@ -9,7 +9,6 @@ import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
-import open from "open";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
@@ -22,6 +21,7 @@ import type { WebServerConfig } from "./web-server-config.js";
 import {
   webServerConfigToInitialPayload,
   printServerBanner,
+  openBrowser,
 } from "./web-server-config.js";
 import type { WebServerHandle } from "./types.js";
 
@@ -125,7 +125,9 @@ export async function startHonoServer(
         sandboxUrl ?? undefined,
       );
       if (config.autoOpen) {
-        open(url);
+        // Never a bare `open(url)`: this callback is synchronous, so a
+        // rejection would escape it. See openBrowser.
+        openBrowser(url);
       }
     },
   );
diff --git a/clients/web/server/vite-hono-plugin.ts b/clients/web/server/vite-hono-plugin.ts
index 1331930c..880913e6 100644
--- a/clients/web/server/vite-hono-plugin.ts
+++ b/clients/web/server/vite-hono-plugin.ts
@@ -9,7 +9,6 @@
 
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Plugin } from "vite";
-import open from "open";
 // Direct leaf import — the `core/mcp/remote/node/index.ts` barrel re-exports
 // from `../constants.js`, which would otherwise drag the broader
 // `core/mcp/remote/index.ts` barrel (including `createRemoteLogger`, with its
@@ -22,6 +21,7 @@ import type { WebServerConfig } from "./web-server-config.js";
 import {
   webServerConfigToInitialPayload,
   printServerBanner,
+  openBrowser,
 } from "./web-server-config.js";
 
 export function honoMiddlewarePlugin(config: WebServerConfig): Plugin {
@@ -114,7 +114,9 @@ export function honoMiddlewarePlugin(config: WebServerConfig): Plugin {
         );
 
         if (config.autoOpen) {
-          open(url);
+          // Never a bare `open(url)`: `logBanner` is synchronous, so a
+          // rejection would escape it. See openBrowser.
+          openBrowser(url);
         }
       };
 
diff --git a/clients/web/server/web-server-config.ts b/clients/web/server/web-server-config.ts
index 6e77bd28..6bb13be2 100644
--- a/clients/web/server/web-server-config.ts
+++ b/clients/web/server/web-server-config.ts
@@ -2,6 +2,7 @@
  * Config object for the web server (dev and prod). Passed in-process; no env handoff.
  */
 
+import open from "open";
 import pino from "pino";
 import type { Logger } from "pino";
 import type { MCPConfig, MCPServerConfig } from "../../../core/mcp/types.ts";
@@ -203,6 +204,24 @@ export function printServerBanner(
   return url;
 }
 
+/**
+ * Launch the user's browser at `url`, reporting a failure rather than throwing.
+ *
+ * Both callers — the prod Hono server's `serve()` listen callback and the dev
+ * plugin's `logBanner` — are synchronous, so a rejection has nowhere to go and
+ * escapes as an unhandled rejection (#1959). On a headless or otherwise
+ * browser-less host that rejection is the ordinary outcome, not an edge case,
+ * and by the time it happens the server is already listening and
+ * `printServerBanner` has printed a perfectly usable URL. So warn and carry
+ * on. Shared between the two servers deliberately: two copies of a one-line
+ * `.catch` is two chances for one of them to drift back to a bare `open(url)`.
+ */
+export function openBrowser(url: string): void {
+  open(url).catch((err: unknown) => {
+    console.warn("Could not open a browser automatically:", err);
+  });
+}
+
 export interface BuildWebServerConfigOptions {
   initialMcpConfig?: MCPServerConfig | null;
   /** Catalog/session file the backend should serve; see {@link WebServerConfig.mcpConfigPath}. */
diff --git a/clients/web/src/App.tsx b/clients/web/src/App.tsx
index 72d8bd1f..5837f27f 100644
--- a/clients/web/src/App.tsx
+++ b/clients/web/src/App.tsx
@@ -64,6 +64,7 @@ import { ResourceSubscriptionsState } from "@inspector/core/mcp/state/resourceSu
 import {
   cleanRoots,
   oauthAuthorizationParamsFromSettings,
+  oauthEndpointOverridesFromSettings,
   serializeMcpConfig,
 } from "@inspector/core/mcp/serverList.js";
 import type { ClientConfig } from "@inspector/core/client/types.js";
@@ -2315,12 +2316,16 @@ function App() {
       const serverAuthorizationParams = savedSettings
         ? oauthAuthorizationParamsFromSettings(savedSettings)
         : undefined;
+      const serverEndpointOverrides = savedSettings
+        ? oauthEndpointOverridesFromSettings(savedSettings)
+        : undefined;
       const oauthFromServer =
         savedSettings &&
         (savedSettings.oauthClientId ||
           savedSettings.oauthClientSecret ||
           savedSettings.oauthScopes ||
           serverAuthorizationParams ||
+          serverEndpointOverrides ||
           savedSettings.enterpriseManaged)
           ? {
               ...(savedSettings.oauthClientId && {
@@ -2335,6 +2340,7 @@ function App() {
               ...(serverAuthorizationParams && {
                 authorizationParams: serverAuthorizationParams,
               }),
+              ...serverEndpointOverrides,
               ...(savedSettings.enterpriseManaged && {
                 enterpriseManaged: true,
               }),
diff --git a/clients/web/src/components/elements/CategoryBadge/CategoryBadge.stories.tsx b/clients/web/src/components/elements/CategoryBadge/CategoryBadge.stories.tsx
index f9118c49..efbeab28 100644
--- a/clients/web/src/components/elements/CategoryBadge/CategoryBadge.stories.tsx
+++ b/clients/web/src/components/elements/CategoryBadge/CategoryBadge.stories.tsx
@@ -14,7 +14,7 @@ export const Transport: Story = {
   args: { category: "transport" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("transport")).toBeInTheDocument();
+    await expect(canvas.getByText("transport")).toBeInTheDocument();
   },
 };
 
@@ -22,6 +22,6 @@ export const Auth: Story = {
   args: { category: "auth" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("auth")).toBeInTheDocument();
+    await expect(canvas.getByText("auth")).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/elements/EmbeddableScrollArea/EmbeddableScrollArea.stories.tsx b/clients/web/src/components/elements/EmbeddableScrollArea/EmbeddableScrollArea.stories.tsx
index e85f9b65..87da3cdb 100644
--- a/clients/web/src/components/elements/EmbeddableScrollArea/EmbeddableScrollArea.stories.tsx
+++ b/clients/web/src/components/elements/EmbeddableScrollArea/EmbeddableScrollArea.stories.tsx
@@ -24,7 +24,7 @@ export const FullSize: Story = {
   ),
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("Row 1")).toBeInTheDocument();
+    await expect(canvas.getByText("Row 1")).toBeInTheDocument();
   },
 };
 
@@ -38,6 +38,6 @@ export const Embedded: Story = {
   ),
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("Row 1")).toBeInTheDocument();
+    await expect(canvas.getByText("Row 1")).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/elements/ExpandToggle/ExpandToggle.stories.tsx b/clients/web/src/components/elements/ExpandToggle/ExpandToggle.stories.tsx
index df4054c8..90369ab1 100644
--- a/clients/web/src/components/elements/ExpandToggle/ExpandToggle.stories.tsx
+++ b/clients/web/src/components/elements/ExpandToggle/ExpandToggle.stories.tsx
@@ -15,7 +15,9 @@ export const Collapsed: Story = {
   args: { expanded: false },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByRole("button", { name: "Expand" })).toBeInTheDocument();
+    await expect(
+      canvas.getByRole("button", { name: "Expand" }),
+    ).toBeInTheDocument();
   },
 };
 
@@ -23,7 +25,7 @@ export const Expanded: Story = {
   args: { expanded: true },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(
+    await expect(
       canvas.getByRole("button", { name: "Collapse" }),
     ).toBeInTheDocument();
   },
diff --git a/clients/web/src/components/elements/McpErrorBadge/McpErrorBadge.stories.tsx b/clients/web/src/components/elements/McpErrorBadge/McpErrorBadge.stories.tsx
index 4616b4fa..c189d654 100644
--- a/clients/web/src/components/elements/McpErrorBadge/McpErrorBadge.stories.tsx
+++ b/clients/web/src/components/elements/McpErrorBadge/McpErrorBadge.stories.tsx
@@ -14,7 +14,7 @@ export const HeaderMismatch: Story = {
   args: { code: -32020, name: "HeaderMismatch" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("-32020 HeaderMismatch")).toBeInTheDocument();
+    await expect(canvas.getByText("-32020 HeaderMismatch")).toBeInTheDocument();
   },
 };
 
@@ -22,7 +22,7 @@ export const MissingCapability: Story = {
   args: { code: -32021, name: "MissingRequiredClientCapability" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(
+    await expect(
       canvas.getByText("-32021 MissingRequiredClientCapability"),
     ).toBeInTheDocument();
   },
@@ -32,7 +32,7 @@ export const UnsupportedVersion: Story = {
   args: { code: -32022, name: "UnsupportedProtocolVersion" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(
+    await expect(
       canvas.getByText("-32022 UnsupportedProtocolVersion"),
     ).toBeInTheDocument();
   },
@@ -47,6 +47,6 @@ export const MethodNotFound: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("-32601 MethodNotFound")).toBeInTheDocument();
+    await expect(canvas.getByText("-32601 MethodNotFound")).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/elements/MessageDirectionBadge/MessageDirectionBadge.stories.tsx b/clients/web/src/components/elements/MessageDirectionBadge/MessageDirectionBadge.stories.tsx
index a4aa55e0..c99b8a12 100644
--- a/clients/web/src/components/elements/MessageDirectionBadge/MessageDirectionBadge.stories.tsx
+++ b/clients/web/src/components/elements/MessageDirectionBadge/MessageDirectionBadge.stories.tsx
@@ -14,7 +14,7 @@ export const Outgoing: Story = {
   args: { direction: "outgoing" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("client → server")).toBeInTheDocument();
+    await expect(canvas.getByText("client → server")).toBeInTheDocument();
   },
 };
 
@@ -22,6 +22,6 @@ export const Incoming: Story = {
   args: { direction: "incoming" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("server → client")).toBeInTheDocument();
+    await expect(canvas.getByText("server → client")).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/elements/MethodBadge/MethodBadge.stories.tsx b/clients/web/src/components/elements/MethodBadge/MethodBadge.stories.tsx
index 91e3abb5..312d249a 100644
--- a/clients/web/src/components/elements/MethodBadge/MethodBadge.stories.tsx
+++ b/clients/web/src/components/elements/MethodBadge/MethodBadge.stories.tsx
@@ -14,7 +14,7 @@ export const ToolsList: Story = {
   args: { method: "tools/list" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("tools/list")).toBeInTheDocument();
+    await expect(canvas.getByText("tools/list")).toBeInTheDocument();
   },
 };
 
@@ -22,6 +22,6 @@ export const TasksList: Story = {
   args: { method: "tasks/list" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("tasks/list")).toBeInTheDocument();
+    await expect(canvas.getByText("tasks/list")).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/elements/MonitoringToggle/MonitoringToggle.stories.tsx b/clients/web/src/components/elements/MonitoringToggle/MonitoringToggle.stories.tsx
index 9541812e..109a47d8 100644
--- a/clients/web/src/components/elements/MonitoringToggle/MonitoringToggle.stories.tsx
+++ b/clients/web/src/components/elements/MonitoringToggle/MonitoringToggle.stories.tsx
@@ -15,7 +15,7 @@ export const Closed: Story = {
   args: { open: false },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(
+    await expect(
       canvas.getByRole("button", { name: "Open monitoring sidebar" }),
     ).toBeInTheDocument();
   },
@@ -25,7 +25,7 @@ export const Open: Story = {
   args: { open: true },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(
+    await expect(
       canvas.getByRole("button", { name: "Close monitoring sidebar" }),
     ).toBeInTheDocument();
   },
diff --git a/clients/web/src/components/elements/PinToggle/PinToggle.stories.tsx b/clients/web/src/components/elements/PinToggle/PinToggle.stories.tsx
index d259eb84..a15900d4 100644
--- a/clients/web/src/components/elements/PinToggle/PinToggle.stories.tsx
+++ b/clients/web/src/components/elements/PinToggle/PinToggle.stories.tsx
@@ -15,7 +15,9 @@ export const Unpinned: Story = {
   args: { pinned: false },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByRole("button", { name: "Pin" })).toBeInTheDocument();
+    await expect(
+      canvas.getByRole("button", { name: "Pin" }),
+    ).toBeInTheDocument();
   },
 };
 
@@ -23,6 +25,8 @@ export const Pinned: Story = {
   args: { pinned: true },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByRole("button", { name: "Unpin" })).toBeInTheDocument();
+    await expect(
+      canvas.getByRole("button", { name: "Unpin" }),
+    ).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/elements/ReplayButton/ReplayButton.stories.tsx b/clients/web/src/components/elements/ReplayButton/ReplayButton.stories.tsx
index 6391f2b4..a7bd9b17 100644
--- a/clients/web/src/components/elements/ReplayButton/ReplayButton.stories.tsx
+++ b/clients/web/src/components/elements/ReplayButton/ReplayButton.stories.tsx
@@ -14,6 +14,8 @@ type Story = StoryObj<typeof ReplayButton>;
 export const Default: Story = {
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByRole("button", { name: "Replay" })).toBeInTheDocument();
+    await expect(
+      canvas.getByRole("button", { name: "Replay" }),
+    ).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/elements/ResizeHandle/ResizeHandle.stories.tsx b/clients/web/src/components/elements/ResizeHandle/ResizeHandle.stories.tsx
index 4fb1c122..7b8072dc 100644
--- a/clients/web/src/components/elements/ResizeHandle/ResizeHandle.stories.tsx
+++ b/clients/web/src/components/elements/ResizeHandle/ResizeHandle.stories.tsx
@@ -44,7 +44,7 @@ export const Default: Story = {
   render: () => <ResizeDemo />,
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(
+    await expect(
       canvas.getByRole("separator", { name: "Resize demo panel" }),
     ).toBeInTheDocument();
   },
diff --git a/clients/web/src/components/elements/ScreenStage/ScreenStage.stories.tsx b/clients/web/src/components/elements/ScreenStage/ScreenStage.stories.tsx
index ab215303..c7af29bc 100644
--- a/clients/web/src/components/elements/ScreenStage/ScreenStage.stories.tsx
+++ b/clients/web/src/components/elements/ScreenStage/ScreenStage.stories.tsx
@@ -48,7 +48,7 @@ export const FillsHostWidth: Story = {
     // sharper discriminator: a row flex leaves the layer full-width while
     // collapsing the child to the single "x").
     const layer = child.parentElement as HTMLElement;
-    expect(child.getBoundingClientRect().width).toBeCloseTo(
+    await expect(child.getBoundingClientRect().width).toBeCloseTo(
       layer.getBoundingClientRect().width,
       0,
     );
@@ -77,11 +77,11 @@ export const FillVariant: Story = {
     // Width still stretches onto the child (relative to the layer, as above);
     // the `fill` height comes from `bottom: 0` making the layer span the host.
     const layer = child.parentElement as HTMLElement;
-    expect(child.getBoundingClientRect().width).toBeCloseTo(
+    await expect(child.getBoundingClientRect().width).toBeCloseTo(
       layer.getBoundingClientRect().width,
       0,
     );
-    expect(layer.getBoundingClientRect().height).toBeGreaterThan(160 - 4);
+    await expect(layer.getBoundingClientRect().height).toBeGreaterThan(160 - 4);
   },
 };
 
@@ -97,6 +97,6 @@ export const Inactive: Story = {
   ),
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.queryByTestId("stage-child")).not.toBeInTheDocument();
+    await expect(canvas.queryByTestId("stage-child")).not.toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.stories.tsx b/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.stories.tsx
index c6f1e598..50549076 100644
--- a/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.stories.tsx
+++ b/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.stories.tsx
@@ -77,6 +77,14 @@ export const ModernEra: Story = {
       },
     },
   },
+  // SEP-2663 moved task support to the extension map, so the Tasks capability
+  // row must read it there on a modern connection — otherwise a tasks-capable
+  // server shows ✗ while listing the extension below (#1887).
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    const tasksRow = canvas.getByText("Tasks");
+    await expect(tasksRow.previousElementSibling).toHaveTextContent("✓");
+  },
 };
 
 // A modern server that omitted the optional `_meta` serverInfo stamp (#1772).
@@ -106,8 +114,10 @@ export const ServerInfoNotReported: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.queryByText("my-catalog-name")).not.toBeInTheDocument();
-    expect(canvas.getAllByText(SERVER_INFO_NOT_REPORTED_LABEL)).toHaveLength(2);
+    await expect(canvas.queryByText("my-catalog-name")).not.toBeInTheDocument();
+    await expect(
+      canvas.getAllByText(SERVER_INFO_NOT_REPORTED_LABEL),
+    ).toHaveLength(2);
   },
 };
 
@@ -187,11 +197,11 @@ export const WithOAuthIdToken: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("ID Token")).toBeInTheDocument();
+    await expect(canvas.getByText("ID Token")).toBeInTheDocument();
     // Only the ID token is a JWT here, so exactly one decode toggle is offered.
     await userEvent.click(
       canvas.getByRole("button", { name: "Decode JWT for ID Token" }),
     );
-    expect(canvas.getByText(/"sub": "user-42"/)).toBeInTheDocument();
+    await expect(canvas.getByText(/"sub": "user-42"/)).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.test.tsx b/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.test.tsx
index f9f3d2fa..0ebb740f 100644
--- a/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.test.tsx
+++ b/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.test.tsx
@@ -31,6 +31,21 @@ const fullClientCaps: ClientCapabilities = {
   experimental: {},
 };
 
+// The glyphs `CapabilityItem` renders beside each capability label.
+const SUPPORTED_MARK = "✓";
+const UNSUPPORTED_MARK = "✗";
+
+/**
+ * Read the ✓/✗ a capability row is showing. The mark is the label's preceding
+ * sibling inside the row `Group`, so asserting on it — rather than on the
+ * label's mere presence — is what distinguishes "supported" from "listed".
+ */
+function capabilityMark(label: string): string | undefined {
+  return (
+    screen.getByText(label).previousElementSibling?.textContent ?? undefined
+  );
+}
+
 describe("ConnectionInfoContent", () => {
   it("renders server implementation fields under the heading", () => {
     renderWithMantine(
@@ -181,6 +196,96 @@ describe("ConnectionInfoContent", () => {
     expect(screen.getByText("Sampling")).toBeInTheDocument();
   });
 
+  it("marks Tasks supported on a modern connection that advertises the tasks extension (#1887)", () => {
+    renderWithMantine(
+      <ConnectionInfoContent
+        initializeResult={{
+          ...fullResult,
+          capabilities: {
+            ...fullResult.capabilities,
+            // SEP-2663: no top-level `tasks` key — support is the extension.
+            extensions: { "io.modelcontextprotocol/tasks": {} },
+          },
+        }}
+        clientCapabilities={fullClientCaps}
+        transport="streamable-http"
+        protocolEra="modern"
+      />,
+    );
+    expect(capabilityMark("Tasks")).toBe(SUPPORTED_MARK);
+  });
+
+  it("still marks Tasks unsupported on a modern connection without the extension (#1887)", () => {
+    renderWithMantine(
+      <ConnectionInfoContent
+        initializeResult={fullResult}
+        clientCapabilities={fullClientCaps}
+        transport="streamable-http"
+        protocolEra="modern"
+      />,
+    );
+    expect(capabilityMark("Tasks")).toBe(UNSUPPORTED_MARK);
+  });
+
+  it("does not read the tasks extension on a legacy connection (#1887)", () => {
+    renderWithMantine(
+      <ConnectionInfoContent
+        initializeResult={{
+          ...fullResult,
+          capabilities: {
+            ...fullResult.capabilities,
+            extensions: { "io.modelcontextprotocol/tasks": {} },
+          },
+        }}
+        clientCapabilities={fullClientCaps}
+        transport="streamable-http"
+        protocolEra="legacy"
+      />,
+    );
+    // Legacy tasks support is `capabilities.tasks`, which this server omits —
+    // an extension key alone must not turn the row green.
+    expect(capabilityMark("Tasks")).toBe(UNSUPPORTED_MARK);
+  });
+
+  it("marks Tasks supported on a legacy connection from capabilities.tasks", () => {
+    renderWithMantine(
+      <ConnectionInfoContent
+        initializeResult={{
+          ...fullResult,
+          capabilities: {
+            ...fullResult.capabilities,
+            // `ServerTasksCapability`'s sub-capabilities are objects, not
+            // booleans — `{}` is the "supported, no sub-options" shape.
+            tasks: { list: {}, cancel: {} },
+          },
+        }}
+        clientCapabilities={fullClientCaps}
+        transport="streamable-http"
+        protocolEra="legacy"
+      />,
+    );
+    expect(capabilityMark("Tasks")).toBe(SUPPORTED_MARK);
+  });
+
+  it("does not extension-promote a capability other than tasks (#1887)", () => {
+    renderWithMantine(
+      <ConnectionInfoContent
+        initializeResult={{
+          ...fullResult,
+          capabilities: {
+            tools: { listChanged: true },
+            extensions: { "io.modelcontextprotocol/ui": {} },
+          },
+        }}
+        clientCapabilities={fullClientCaps}
+        transport="streamable-http"
+        protocolEra="modern"
+      />,
+    );
+    expect(capabilityMark("Prompts")).toBe(UNSUPPORTED_MARK);
+    expect(capabilityMark("Tasks")).toBe(UNSUPPORTED_MARK);
+  });
+
   it("renders instructions when present", () => {
     renderWithMantine(
       <ConnectionInfoContent
diff --git a/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.tsx b/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.tsx
index dde264b6..9ee75b8a 100644
--- a/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.tsx
+++ b/clients/web/src/components/groups/ConnectionInfoContent/ConnectionInfoContent.tsx
@@ -14,8 +14,10 @@ import type {
   DiscoverResult,
   InitializeResult,
   ProtocolEra,
+  ServerCapabilities,
 } from "@modelcontextprotocol/client";
 import type { ServerType } from "@inspector/core/mcp/types.js";
+import { TASKS_EXTENSION_KEY } from "@inspector/core/mcp/modernTaskSchemas.js";
 import type { OAuthClientRegistrationKind } from "@inspector/core/auth/types.js";
 import {
   CapabilityItem,
@@ -189,16 +191,62 @@ const CLIENT_CAPABILITY_KEYS: CapabilityKey[] = [
 export const CLEAR_OAUTH_STATE_AND_DISCONNECT_LABEL =
   "Clear OAuth state and disconnect";
 
+/**
+ * Server capabilities the modern (2026-07-28) era expresses as a negotiated
+ * *extension* rather than a top-level `capabilities` key. `tasks` is the only
+ * one today: SEP-2663 moved task support to
+ * `capabilities.extensions["io.modelcontextprotocol/tasks"]`, so a modern
+ * tasks-capable server left the Tasks row showing a red ✗ while the very same
+ * extension id was listed under "Server Extensions" two sections below
+ * (#1887). Keyed the same way `InspectorClient.isTasksExtensionNegotiated()`
+ * gates the Tasks tab, so the checkmark and the tab agree.
+ */
+const MODERN_EXTENSION_BACKED_CAPABILITIES: Partial<
+  Record<CapabilityKey, string>
+> = {
+  tasks: TASKS_EXTENSION_KEY,
+};
+
+function isCapabilityPresent(
+  capabilities: Record<string, unknown>,
+  key: CapabilityKey,
+): boolean {
+  return key in capabilities && capabilities[key] != null;
+}
+
 function getCapabilityEntries(
   capabilities: Record<string, unknown>,
   knownKeys: CapabilityKey[],
 ): { capability: CapabilityKey; supported: boolean }[] {
   return knownKeys.map((key) => ({
     capability: key,
-    supported: key in capabilities && capabilities[key] != null,
+    supported: isCapabilityPresent(capabilities, key),
   }));
 }
 
+/**
+ * Server-side capability entries. Same presence rule as the client column,
+ * plus the modern extension fallback above — gated on the negotiated era so a
+ * legacy connection is still judged purely on its `initialize` capabilities.
+ */
+function getServerCapabilityEntries(
+  capabilities: ServerCapabilities,
+  era: ProtocolEra | undefined,
+): { capability: CapabilityKey; supported: boolean }[] {
+  const modern = isModernEra(era);
+  return SERVER_CAPABILITY_KEYS.map((key) => {
+    const extensionKey = MODERN_EXTENSION_BACKED_CAPABILITIES[key];
+    const viaExtension =
+      modern &&
+      extensionKey !== undefined &&
+      capabilities.extensions?.[extensionKey] != null;
+    return {
+      capability: key,
+      supported: isCapabilityPresent(capabilities, key) || viaExtension,
+    };
+  });
+}
+
 export function ConnectionInfoContent({
   initializeResult,
   serverInfoReported = true,
@@ -229,7 +277,7 @@ export function ConnectionInfoContent({
     ? serverInfo.version?.trim() || "—"
     : SERVER_INFO_NOT_REPORTED_LABEL;
 
-  const serverCaps = getCapabilityEntries(capabilities, SERVER_CAPABILITY_KEYS);
+  const serverCaps = getServerCapabilityEntries(capabilities, protocolEra);
   const clientCaps = getCapabilityEntries(
     clientCapabilities,
     CLIENT_CAPABILITY_KEYS,
diff --git a/clients/web/src/components/groups/LogStreamPanel/LogStreamPanel.stories.tsx b/clients/web/src/components/groups/LogStreamPanel/LogStreamPanel.stories.tsx
index 111f54e6..a7545dc3 100644
--- a/clients/web/src/components/groups/LogStreamPanel/LogStreamPanel.stories.tsx
+++ b/clients/web/src/components/groups/LogStreamPanel/LogStreamPanel.stories.tsx
@@ -77,6 +77,6 @@ export const WithEntries: Story = {
   },
   // List scrollbar reserves a gutter and stays hidden when idle (#1474).
   play: async ({ canvasElement }) => {
-    expectScrollbarGutterIdleHidden(canvasElement);
+    await expectScrollbarGutterIdleHidden(canvasElement);
   },
 };
diff --git a/clients/web/src/components/groups/MessageDirectionFilter/MessageDirectionFilter.stories.tsx b/clients/web/src/components/groups/MessageDirectionFilter/MessageDirectionFilter.stories.tsx
index 362b30bd..8296dd63 100644
--- a/clients/web/src/components/groups/MessageDirectionFilter/MessageDirectionFilter.stories.tsx
+++ b/clients/web/src/components/groups/MessageDirectionFilter/MessageDirectionFilter.stories.tsx
@@ -31,10 +31,10 @@ export const AllVisible: Story = {
   args: { visibleDirections: { client: true, server: true } },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(
+    await expect(
       canvas.getByRole("button", { name: "client → server" }),
     ).toBeInTheDocument();
-    expect(
+    await expect(
       canvas.getByRole("button", { name: "Deselect All" }),
     ).toBeInTheDocument();
   },
diff --git a/clients/web/src/components/groups/MonitoringControls/MonitoringControls.stories.tsx b/clients/web/src/components/groups/MonitoringControls/MonitoringControls.stories.tsx
index 3a3eb7ff..eca1065a 100644
--- a/clients/web/src/components/groups/MonitoringControls/MonitoringControls.stories.tsx
+++ b/clients/web/src/components/groups/MonitoringControls/MonitoringControls.stories.tsx
@@ -20,7 +20,7 @@ type Story = StoryObj<typeof MonitoringControls>;
 export const AllTabs: Story = {
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByRole("radio", { name: "Logs" })).toBeChecked();
+    await expect(canvas.getByRole("radio", { name: "Logs" })).toBeChecked();
   },
 };
 
@@ -28,6 +28,6 @@ export const StdioServer: Story = {
   args: { tabs: ["Logs", "Protocol"], value: "Protocol" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.queryByRole("radio", { name: "Network" })).toBeNull();
+    await expect(canvas.queryByRole("radio", { name: "Network" })).toBeNull();
   },
 };
diff --git a/clients/web/src/components/groups/MonitoringScreen/MonitoringScreen.stories.tsx b/clients/web/src/components/groups/MonitoringScreen/MonitoringScreen.stories.tsx
index 56c1cca2..b91d5d3b 100644
--- a/clients/web/src/components/groups/MonitoringScreen/MonitoringScreen.stories.tsx
+++ b/clients/web/src/components/groups/MonitoringScreen/MonitoringScreen.stories.tsx
@@ -47,7 +47,7 @@ type Story = StoryObj<typeof MonitoringScreen>;
 export const Logs: Story = {
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("Log stream")).toBeInTheDocument();
+    await expect(canvas.getByText("Log stream")).toBeInTheDocument();
   },
 };
 
@@ -55,6 +55,6 @@ export const Protocol: Story = {
   args: { value: "Protocol" },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("Request history")).toBeInTheDocument();
+    await expect(canvas.getByText("Request history")).toBeInTheDocument();
   },
 };
diff --git a/clients/web/src/components/groups/NetworkStreamPanel/NetworkStreamPanel.stories.tsx b/clients/web/src/components/groups/NetworkStreamPanel/NetworkStreamPanel.stories.tsx
index a4248d1e..e006e261 100644
--- a/clients/web/src/components/groups/NetworkStreamPanel/NetworkStreamPanel.stories.tsx
+++ b/clients/web/src/components/groups/NetworkStreamPanel/NetworkStreamPanel.stories.tsx
@@ -50,7 +50,7 @@ export const WithEntries: Story = {
   args: { entries: sample },
   // List scrollbar reserves a gutter and stays hidden when idle (#1474).
   play: async ({ canvasElement }) => {
-    expectScrollbarGutterIdleHidden(canvasElement);
+    await expectScrollbarGutterIdleHidden(canvasElement);
   },
 };
 
diff --git a/clients/web/src/components/groups/OutputValidationModal/OutputValidationModal.stories.tsx b/clients/web/src/components/groups/OutputValidationModal/OutputValidationModal.stories.tsx
index 0942c7dd..40544352 100644
--- a/clients/web/src/components/groups/OutputValidationModal/OutputValidationModal.stories.tsx
+++ b/clients/web/src/components/groups/OutputValidationModal/OutputValidationModal.stories.tsx
@@ -45,14 +45,14 @@ export const Default: Story = {
     // Mantine renders the modal in a portal at document.body.
     const body = within(canvasElement.ownerDocument.body);
     await body.findByText("Output schema validation");
-    expect(body.getByText(/open_pattern_editor/)).toBeInTheDocument();
+    await expect(body.getByText(/open_pattern_editor/)).toBeInTheDocument();
     const details = body.getByLabelText(
       "Validation details",
     ) as HTMLTextAreaElement;
-    expect(details.value).toContain(
+    await expect(details.value).toContain(
       "data/samples/0 must NOT have additional properties",
     );
-    expect(details.readOnly).toBe(true);
+    await expect(details.readOnly).toBe(true);
   },
 };
 
diff --git a/clients/web/src/components/groups/PendingClientRequestModal/PendingClientRequestModal.stories.tsx b/clients/web/src/components/groups/PendingClientRequestModal/PendingClientRequestModal.stories.tsx
index 5130e98c..ee81a687 100644
--- a/clients/web/src/components/groups/PendingClientRequestModal/PendingClientRequestModal.stories.tsx
+++ b/clients/web/src/components/groups/PendingClientRequestModal/PendingClientRequestModal.stories.tsx
@@ -122,11 +122,11 @@ export const Sampling: Story = {
   play: async ({ canvasElement, args }) => {
     const body = within(canvasElement.ownerDocument.body);
     await body.findByText("Sampling Request");
-    expect(
+    await expect(
       body.getByText("The server is requesting an LLM completion."),
     ).toBeInTheDocument();
     await userEvent.click(body.getByRole("button", { name: "Send Response" }));
-    expect(args.onSamplingRespond).toHaveBeenCalled();
+    await expect(args.onSamplingRespond).toHaveBeenCalled();
   },
 };
 
@@ -144,8 +144,8 @@ export const SamplingInputRequired: Story = {
   play: async ({ canvasElement }) => {
     const body = within(canvasElement.ownerDocument.body);
     await body.findByText("Sampling Request");
-    expect(body.getByText("input_required")).toBeInTheDocument();
-    expect(body.getByText(/sent back as a retry/i)).toBeInTheDocument();
+    await expect(body.getByText("input_required")).toBeInTheDocument();
+    await expect(body.getByText(/sent back as a retry/i)).toBeInTheDocument();
   },
 };
 
@@ -172,11 +172,11 @@ export const ElicitationForm: Story = {
   play: async ({ canvasElement, args }) => {
     const body = within(canvasElement.ownerDocument.body);
     await body.findByText("Elicitation Request");
-    expect(
+    await expect(
       body.getByText(/Please provide your database connection details/),
     ).toBeInTheDocument();
     await userEvent.click(body.getByRole("button", { name: "Submit" }));
-    expect(args.onElicitationRespond).toHaveBeenCalledWith({
+    await expect(args.onElicitationRespond).toHaveBeenCalledWith({
       action: "accept",
       content: {},
     });
@@ -207,7 +207,7 @@ export const ElicitationUrl: Story = {
   play: async ({ canvasElement }) => {
     const body = within(canvasElement.ownerDocument.body);
     await body.findByText("Elicitation Request");
-    expect(
+    await expect(
       body.getByText("https://example.com/authorize?token=abc123"),
     ).toBeInTheDocument();
   },
diff --git a/clients/web/src/components/groups/ProtocolListPanel/ProtocolListPanel.stories.tsx b/clients/web/src/components/groups/ProtocolListPanel/ProtocolListPanel.stories.tsx
index 2e1dfe8d..861f23c2 100644
--- a/clients/web/src/components/groups/ProtocolListPanel/ProtocolListPanel.stories.tsx
+++ b/clients/web/src/components/groups/ProtocolListPanel/ProtocolListPanel.stories.tsx
@@ -107,7 +107,7 @@ export const WithEntries: Story = {
   // bar never overlays the cards, and uses type="scroll" so it stays hidden
   // when idle rather than appearing on hover (#1474).
   play: async ({ canvasElement }) => {
-    expectScrollbarGutterIdleHidden(canvasElement);
+    await expectScrollbarGutterIdleHidden(canvasElement);
   },
 };
 
diff --git a/clients/web/src/components/groups/ResourceControls/ResourceControls.stories.tsx b/clients/web/src/components/groups/ResourceControls/ResourceControls.stories.tsx
index 958ec6aa..e7cd4f90 100644
--- a/clients/web/src/components/groups/ResourceControls/ResourceControls.stories.tsx
+++ b/clients/web/src/components/groups/ResourceControls/ResourceControls.stories.tsx
@@ -86,8 +86,8 @@ export const Default: Story = {
   // chevron points down.
   play: async ({ canvasElement }) => {
     const transforms = chevronTransforms(canvasElement);
-    expect(transforms).toHaveLength(3);
-    for (const t of transforms) expect(t).toBe(ROTATED_DOWN);
+    await expect(transforms).toHaveLength(3);
+    for (const t of transforms) await expect(t).toBe(ROTATED_DOWN);
   },
 };
 
@@ -122,9 +122,9 @@ export const Collapsed: Story = {
   },
   play: async ({ canvasElement }) => {
     const transforms = chevronTransforms(canvasElement);
-    expect(transforms).toHaveLength(3);
+    await expect(transforms).toHaveLength(3);
     // Identity matrix = the right-pointing arrow's natural 0° (not rotated).
-    for (const t of transforms) expect(t).toBe(NOT_ROTATED);
+    for (const t of transforms) await expect(t).toBe(NOT_ROTATED);
   },
 };
 
@@ -140,10 +140,10 @@ export const EmptySectionCollapsed: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText("Subscriptions (0)")).toBeInTheDocument();
+    await expect(canvas.getByText("Subscriptions (0)")).toBeInTheDocument();
     const transforms = chevronTransforms(canvasElement);
     const downCount = transforms.filter((t) => t === ROTATED_DOWN).length;
-    expect(downCount).toBe(2); // URIs + Templates down, Subscriptions right
+    await expect(downCount).toBe(2); // URIs + Templates down, Subscriptions right
   },
 };
 
@@ -158,11 +158,11 @@ export const SubscriptionsUnsupported: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.queryByText(/Subscriptions/)).not.toBeInTheDocument();
+    await expect(canvas.queryByText(/Subscriptions/)).not.toBeInTheDocument();
     // Only the two remaining sections render, both open → both chevrons down.
     const transforms = chevronTransforms(canvasElement);
-    expect(transforms).toHaveLength(2);
-    for (const t of transforms) expect(t).toBe(ROTATED_DOWN);
+    await expect(transforms).toHaveLength(2);
+    for (const t of transforms) await expect(t).toBe(ROTATED_DOWN);
   },
 };
 
diff --git a/clients/web/src/components/groups/ResourceLink/ResourceLink.stories.tsx b/clients/web/src/components/groups/ResourceLink/ResourceLink.stories.tsx
index 655a5e7a..ac6b6ca2 100644
--- a/clients/web/src/components/groups/ResourceLink/ResourceLink.stories.tsx
+++ b/clients/web/src/components/groups/ResourceLink/ResourceLink.stories.tsx
@@ -45,10 +45,12 @@ export const Static: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByText(URI)).toBeInTheDocument();
+    await expect(canvas.getByText(URI)).toBeInTheDocument();
     // Copy button is present; there's no expand control in the static card.
-    expect(canvas.getByRole("button", { name: "Copy" })).toBeInTheDocument();
-    expect(
+    await expect(
+      canvas.getByRole("button", { name: "Copy" }),
+    ).toBeInTheDocument();
+    await expect(
       canvas.queryByRole("button", { name: /^Expand resource/ }),
     ).not.toBeInTheDocument();
   },
diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
index d313c00a..7ea0e396 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx
@@ -714,6 +714,8 @@ describe("ServerSettingsForm", () => {
       clientSecret: "",
       scopes: "",
       authorizationParams: [],
+      authorizationUrl: "",
+      tokenUrl: "",
       enterpriseManaged: false,
     });
   });
@@ -979,6 +981,104 @@ describe("ServerSettingsForm", () => {
     expect(screen.getByText(/state, scope are set/)).toBeInTheDocument();
   });
 
+  // #1906 — the endpoint overrides ride the same `onOAuthChange` callback as
+  // the rest of the Authorization section.
+  it("invokes onOAuthChange when an endpoint override is typed", async () => {
+    const user = userEvent.setup();
+    const onOAuthChange = vi.fn();
+    renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        onOAuthChange={onOAuthChange}
+        settings={emptySettings}
+        expandedSections={["oauth"]}
+      />,
+    );
+    await user.type(
+      screen.getByRole("textbox", { name: /Authorization URL override/i }),
+      "h",
+    );
+    expect(onOAuthChange).toHaveBeenCalledWith(
+      expect.objectContaining({ authorizationUrl: "h" }),
+    );
+
+    onOAuthChange.mockClear();
+    await user.type(
+      screen.getByRole("textbox", { name: /Token URL override/i }),
+      "h",
+    );
+    expect(onOAuthChange).toHaveBeenCalledWith(
+      expect.objectContaining({ tokenUrl: "h" }),
+    );
+  });
+
+  it("says the endpoint overrides are unused under enterprise-managed auth", () => {
+    const { rerender } = renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        settings={{ ...emptySettings, enterpriseManaged: true }}
+        expandedSections={["oauth"]}
+      />,
+    );
+    expect(
+      screen.getAllByText(
+        /Not applied while Enterprise-managed authorization is on/,
+      ),
+    ).toHaveLength(2);
+
+    rerender(
+      <ServerSettingsForm
+        {...baseHandlers}
+        settings={{ ...emptySettings, enterpriseManaged: false }}
+        expandedSections={["oauth"]}
+      />,
+    );
+    expect(
+      screen.queryByText(
+        /Not applied while Enterprise-managed authorization is on/,
+      ),
+    ).not.toBeInTheDocument();
+  });
+
+  it("flags an endpoint override that is not an absolute http(s) URL", () => {
+    renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        settings={{
+          ...emptySettings,
+          oauthAuthorizationUrl: "/authorize",
+          oauthTokenUrl: "https://staging.test/token",
+        }}
+        expandedSections={["oauth"]}
+      />,
+    );
+    expect(
+      screen.getByText('"/authorize" is not an absolute URL.'),
+    ).toBeInTheDocument();
+    expect(screen.queryByText(/is not an http\(s\) URL/)).toBeNull();
+  });
+
+  it("clears an endpoint override through its clear button", async () => {
+    const user = userEvent.setup();
+    const onOAuthChange = vi.fn();
+    renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        onOAuthChange={onOAuthChange}
+        settings={{
+          ...emptySettings,
+          oauthTokenUrl: "https://staging.test/token",
+        }}
+        expandedSections={["oauth"]}
+      />,
+    );
+    const clearButtons = screen.getAllByRole("button", { name: /clear/i });
+    await user.click(clearButtons[clearButtons.length - 1]);
+    expect(onOAuthChange).toHaveBeenCalledWith(
+      expect.objectContaining({ tokenUrl: "" }),
+    );
+  });
+
   it("invokes onOAuthChange with the chosen insufficient-scope policy (SEP-2350)", async () => {
     const user = userEvent.setup();
     const onOAuthChange = vi.fn();
@@ -1020,6 +1120,8 @@ describe("ServerSettingsForm", () => {
       clientSecret: "",
       scopes: "",
       authorizationParams: [],
+      authorizationUrl: "",
+      tokenUrl: "",
       enterpriseManaged: true,
     });
   });
@@ -1125,6 +1227,8 @@ describe("ServerSettingsForm", () => {
       clientSecret: "z",
       scopes: "",
       authorizationParams: [],
+      authorizationUrl: "",
+      tokenUrl: "",
       enterpriseManaged: false,
     });
   });
diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
index 48e67c05..18f0c522 100644
--- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
+++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx
@@ -32,6 +32,7 @@ import {
   authorizationParamKeyError,
   isReservedAuthorizationParam,
 } from "@inspector/core/auth/authorizationParams.js";
+import { oauthEndpointUrlError } from "@inspector/core/auth/endpointOverrides.js";
 import { ADVERTISABLE_EXTENSIONS } from "@inspector/core/mcp/extensions.js";
 import type { Root } from "@modelcontextprotocol/client";
 
@@ -509,11 +510,20 @@ export function ServerSettingsForm({
       clientSecret: settings.oauthClientSecret ?? "",
       scopes: settings.oauthScopes ?? "",
       authorizationParams,
+      authorizationUrl: settings.oauthAuthorizationUrl ?? "",
+      tokenUrl: settings.oauthTokenUrl ?? "",
       enterpriseManaged: settings.enterpriseManaged ?? false,
       onInsufficientScope: settings.oauthOnInsufficientScope,
     };
   }
 
+  // #1906 — the overrides are suppressed under EMA for the same reason the
+  // custom authorization parameters are: that leg authorizes against the
+  // enterprise IdP, a different authorization server.
+  const endpointOverrideEmaNote = settings.enterpriseManaged
+    ? " Not applied while Enterprise-managed authorization is on: that flow authorizes against the enterprise IdP, a different authorization server."
+    : "";
+
   const rejectedParamKeys = authorizationParams
     .map((p) => p.key.trim())
     .filter((key) => isReservedAuthorizationParam(key));
@@ -899,6 +909,55 @@ export function ServerSettingsForm({
                   + Add Parameter
                 </AddButton>
               </Stack>
+              <ClearableTextInput
+                label="Authorization URL override"
+                description={`Leave blank to use the authorization_endpoint the authorization server's metadata advertises. Set it to point this server at a development or staging authorization server instead. Endpoints only — the discovered issuer is unchanged, so an authorization server advertising a different issuer is rejected on callback (RFC 9207).${endpointOverrideEmaNote}`}
+                placeholder="https://staging.auth.example.com/authorize"
+                value={settings.oauthAuthorizationUrl ?? ""}
+                error={oauthEndpointUrlError(
+                  settings.oauthAuthorizationUrl ?? "",
+                )}
+                onChange={(e) =>
+                  onOAuthChange({
+                    ...currentOAuth(),
+                    authorizationUrl: e.currentTarget.value,
+                  })
+                }
+                rightSection={
+                  settings.oauthAuthorizationUrl ? (
+                    <ClearButton
+                      onClick={() =>
+                        onOAuthChange({
+                          ...currentOAuth(),
+                          authorizationUrl: "",
+                        })
+                      }
+                    />
+                  ) : null
+                }
+              />
+              <ClearableTextInput
+                label="Token URL override"
+                description={`Leave blank to use the token_endpoint the authorization server's metadata advertises. Independent of the authorization URL — either can be overridden alone.${endpointOverrideEmaNote}`}
+                placeholder="https://staging.auth.example.com/token"
+                value={settings.oauthTokenUrl ?? ""}
+                error={oauthEndpointUrlError(settings.oauthTokenUrl ?? "")}
+                onChange={(e) =>
+                  onOAuthChange({
+                    ...currentOAuth(),
+                    tokenUrl: e.currentTarget.value,
+                  })
+                }
+                rightSection={
+                  settings.oauthTokenUrl ? (
+                    <ClearButton
+                      onClick={() =>
+                        onOAuthChange({ ...currentOAuth(), tokenUrl: "" })
+                      }
+                    />
+                  ) : null
+                }
+              />
               <Select
                 label="Insufficient-scope response"
                 description="On a 403 insufficient_scope challenge (SEP-2350): re-authorize with the accumulated scope union, or surface the error to you."
diff --git a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
index a5dbcb0d..e627beb7 100644
--- a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
+++ b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.test.tsx
@@ -451,6 +451,52 @@ describe("ServerSettingsModal", () => {
     });
   });
 
+  // #1906 — a typed endpoint override lands on the settings; clearing it
+  // persists `undefined` rather than an empty string, so "cleared" and "never
+  // set" are the same state on disk.
+  it("persists a typed endpoint override, and clears it back to undefined", async () => {
+    const user = userEvent.setup();
+    const onSettingsChange = vi.fn();
+    const { rerender } = renderWithMantine(
+      <ServerSettingsModal
+        opened
+        settings={emptySettings}
+        serverType="streamable-http"
+        isStdio={false}
+        onClose={vi.fn()}
+        onSettingsChange={onSettingsChange}
+      />,
+    );
+    await user.click(screen.getByRole("button", { name: "OAuth Settings" }));
+    await user.type(
+      screen.getByRole("textbox", { name: /Token URL override/i }),
+      "h",
+    );
+    expect(onSettingsChange).toHaveBeenCalledWith(
+      expect.objectContaining({ oauthTokenUrl: "h" }),
+    );
+
+    onSettingsChange.mockClear();
+    rerender(
+      <ServerSettingsModal
+        opened
+        settings={{
+          ...emptySettings,
+          oauthTokenUrl: "https://staging.test/token",
+        }}
+        serverType="streamable-http"
+        isStdio={false}
+        onClose={vi.fn()}
+        onSettingsChange={onSettingsChange}
+      />,
+    );
+    const clearButtons = screen.getAllByRole("button", { name: /clear/i });
+    await user.click(clearButtons[clearButtons.length - 1]);
+    expect(onSettingsChange).toHaveBeenCalledWith(
+      expect.objectContaining({ oauthTokenUrl: undefined }),
+    );
+  });
+
   // #2018 — the authorization-parameter rows ride the same onOAuthChange
   // callback, so the modal folds them onto the settings object.
   it("persists an added authorization-parameter row onto the settings", async () => {
diff --git a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
index 869291b1..35c1fb12 100644
--- a/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
+++ b/clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.tsx
@@ -183,6 +183,11 @@ export function ServerSettingsModal({
       // survives a re-render; the drop-blank/omit-empty filtering happens on the
       // way to disk. An emptied list persists as `[]`, which writes nothing.
       oauthAuthorizationParams: oauth.authorizationParams,
+      // #1906: an emptied field persists as undefined rather than `""` — the
+      // read side treats a blank override as "not configured", and keeping the
+      // two in step means clearing the input really clears the setting.
+      oauthAuthorizationUrl: oauth.authorizationUrl || undefined,
+      oauthTokenUrl: oauth.tokenUrl || undefined,
       enterpriseManaged: oauth.enterpriseManaged ? true : undefined,
       // SEP-2350: persist only the non-default ('throw') so unset servers keep
       // the SDK's `reauthorize` behavior without writing a spurious field.
diff --git a/clients/web/src/components/groups/StructuredOutputPanel/StructuredOutputPanel.stories.tsx b/clients/web/src/components/groups/StructuredOutputPanel/StructuredOutputPanel.stories.tsx
index c66760f0..78f1ea8d 100644
--- a/clients/web/src/components/groups/StructuredOutputPanel/StructuredOutputPanel.stories.tsx
+++ b/clients/web/src/components/groups/StructuredOutputPanel/StructuredOutputPanel.stories.tsx
@@ -41,7 +41,7 @@ export const Nested: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(
+    await expect(
       canvas.getByRole("heading", { name: "Structured Output" }),
     ).toBeInTheDocument();
     // The section starts expanded, so the payload is visible without a click.
@@ -78,9 +78,9 @@ export const Large: Story = {
     }
     // Capped: the visible height stays at the section's `mah`, well under the
     // payload's natural height…
-    expect(viewport.clientHeight).toBeLessThanOrEqual(400);
+    await expect(viewport.clientHeight).toBeLessThanOrEqual(400);
     // …and the overflow is reachable by scrolling rather than clipped away.
-    expect(viewport.scrollHeight).toBeGreaterThan(viewport.clientHeight);
+    await expect(viewport.scrollHeight).toBeGreaterThan(viewport.clientHeight);
   },
 };
 
@@ -95,7 +95,7 @@ export const Collapsed: Story = {
     const toggle = canvas.getByRole("button", {
       name: "Expand structured output",
     });
-    expect(toggle).toHaveAttribute("aria-expanded", "false");
+    await expect(toggle).toHaveAttribute("aria-expanded", "false");
     await userEvent.click(toggle);
     await waitFor(() =>
       expect(
diff --git a/clients/web/src/components/groups/ToolResultPanel/ToolResultPanel.test.tsx b/clients/web/src/components/groups/ToolResultPanel/ToolResultPanel.test.tsx
index 1be9f2c3..0820e01b 100644
--- a/clients/web/src/components/groups/ToolResultPanel/ToolResultPanel.test.tsx
+++ b/clients/web/src/components/groups/ToolResultPanel/ToolResultPanel.test.tsx
@@ -35,11 +35,20 @@ describe("ToolResultPanel", () => {
     expect(screen.getByText("boom")).toBeInTheDocument();
   });
 
-  it("renders the empty state when content is empty", () => {
+  // #1860: this panel only mounts once a result exists, so an empty result must
+  // read as "the call completed and returned nothing" — never as the pre-run
+  // "No results yet" placeholder, which denies a call the user watched succeed.
+  it("names the outcome when a completed result has no content", () => {
     renderWithMantine(
       <ToolResultPanel result={emptyResult} onClear={() => {}} />,
     );
-    expect(screen.getByText("No results yet")).toBeInTheDocument();
+    expect(screen.getByText("Empty result")).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        "The tool call completed successfully and returned no content.",
+      ),
+    ).toBeInTheDocument();
+    expect(screen.queryByText("No results yet")).not.toBeInTheDocument();
   });
 
   it("groups resource_link blocks in a scrollable Resource Links box", async () => {
@@ -141,7 +150,7 @@ describe("ToolResultPanel", () => {
           onClear={() => {}}
         />,
       );
-      expect(screen.queryByText("No results yet")).not.toBeInTheDocument();
+      expect(screen.queryByText("Empty result")).not.toBeInTheDocument();
       expect(
         screen.getByRole("heading", { name: "Structured Output" }),
       ).toBeInTheDocument();
diff --git a/clients/web/src/components/groups/ToolResultPanel/ToolResultPanel.tsx b/clients/web/src/components/groups/ToolResultPanel/ToolResultPanel.tsx
index 33ca7761..772965dc 100644
--- a/clients/web/src/components/groups/ToolResultPanel/ToolResultPanel.tsx
+++ b/clients/web/src/components/groups/ToolResultPanel/ToolResultPanel.tsx
@@ -5,7 +5,6 @@ import {
   Paper,
   ScrollArea,
   Stack,
-  Text,
   Title,
 } from "@mantine/core";
 import type {
@@ -176,6 +175,16 @@ const ErrorAlert = Alert.withProps({
   title: "Tool Error",
 });
 
+// A completed call whose result renders nothing. `content: []` with no
+// `structuredContent` is a legal CallToolResult, and this panel is only mounted
+// once a result exists — so saying "no results yet" here would deny a call the
+// user just watched succeed (#1860). Name the outcome instead.
+const EmptyResultAlert = Alert.withProps({
+  color: "gray",
+  variant: "light",
+  title: "Empty result",
+});
+
 function ResourceLinksGroup({
   links,
   onReadResource,
@@ -277,7 +286,9 @@ export function ToolResultPanel({
         </ResultScroll>
       ) : result.content.length === 0 && !structuredNode ? (
         <ResultScroll>
-          <Text c="dimmed">No results yet</Text>
+          <EmptyResultAlert>
+            The tool call completed successfully and returned no content.
+          </EmptyResultAlert>
         </ResultScroll>
       ) : hasLinks ? (
         <FillStack>
diff --git a/clients/web/src/components/groups/UrlElicitationErrorModal/UrlElicitationErrorModal.stories.tsx b/clients/web/src/components/groups/UrlElicitationErrorModal/UrlElicitationErrorModal.stories.tsx
index 4a6c64e8..bba498b3 100644
--- a/clients/web/src/components/groups/UrlElicitationErrorModal/UrlElicitationErrorModal.stories.tsx
+++ b/clients/web/src/components/groups/UrlElicitationErrorModal/UrlElicitationErrorModal.stories.tsx
@@ -47,10 +47,10 @@ export const Default: Story = {
     // Mantine renders the modal in a portal at document.body.
     const body = within(canvasElement.ownerDocument.body);
     await body.findByText("URL elicitation required");
-    expect(body.getByText(/trigger-url-elicitation/)).toBeInTheDocument();
+    await expect(body.getByText(/trigger-url-elicitation/)).toBeInTheDocument();
     const details = body.getByLabelText("Error details") as HTMLTextAreaElement;
-    expect(details.value).toContain("-32042");
-    expect(details.readOnly).toBe(true);
+    await expect(details.value).toContain("-32042");
+    await expect(details.readOnly).toBe(true);
   },
 };
 
diff --git a/clients/web/src/components/screens/ResourcesScreen/ResourcesScreen.stories.tsx b/clients/web/src/components/screens/ResourcesScreen/ResourcesScreen.stories.tsx
index b1de0328..ebcdeb05 100644
--- a/clients/web/src/components/screens/ResourcesScreen/ResourcesScreen.stories.tsx
+++ b/clients/web/src/components/screens/ResourcesScreen/ResourcesScreen.stories.tsx
@@ -235,7 +235,7 @@ export const SubscriptionsUnsupported: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(canvas.queryByText(/Subscriptions/)).not.toBeInTheDocument();
+    await expect(canvas.queryByText(/Subscriptions/)).not.toBeInTheDocument();
   },
 };
 
@@ -256,7 +256,7 @@ export const ModernSubscriptionStream: Story = {
   },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    expect(await canvas.findByText("Listening")).toBeInTheDocument();
+    await expect(await canvas.findByText("Listening")).toBeInTheDocument();
   },
 };
 
@@ -281,18 +281,22 @@ export const ManyResources: Story = {
     const sidebar = sidebarCard.getBoundingClientRect();
     const detail = detailCard.getBoundingClientRect();
     // The sidebar matches the detail panel's height (same bottom baseline).
-    expect(Math.abs(sidebar.bottom - detail.bottom)).toBeLessThanOrEqual(1);
-    expect(Math.abs(sidebar.height - detail.height)).toBeLessThanOrEqual(1);
+    await expect(Math.abs(sidebar.bottom - detail.bottom)).toBeLessThanOrEqual(
+      1,
+    );
+    await expect(Math.abs(sidebar.height - detail.height)).toBeLessThanOrEqual(
+      1,
+    );
 
     // The section headers stay pinned (visible, in document order), so the
     // whole accordion doesn't scroll as one block.
     const controls = canvasElement.querySelectorAll(
       ".disclosure-sections .mantine-Accordion-control",
     );
-    expect(controls).toHaveLength(3);
+    await expect(controls).toHaveLength(3);
     const tops = [...controls].map((c) => c.getBoundingClientRect().top);
-    expect(tops[0]).toBeLessThan(tops[1]);
-    expect(tops[1]).toBeLessThan(tops[2]);
+    await expect(tops[0]).toBeLessThan(tops[1]);
+    await expect(tops[1]).toBeLessThan(tops[2]);
 
     // The long URIs section scrolls within its own panel, with a thin styled
     // scrollbar matching the Mantine ScrollArea look (#1466).
@@ -302,13 +306,15 @@ export const ManyResources: Story = {
     if (!(urisPanel instanceof HTMLElement)) {
       throw new Error("URIs panel not found");
     }
-    expect(urisPanel.scrollHeight).toBeGreaterThan(urisPanel.clientHeight);
+    await expect(urisPanel.scrollHeight).toBeGreaterThan(
+      urisPanel.clientHeight,
+    );
     const panelStyle = getComputedStyle(urisPanel);
-    expect(panelStyle.scrollbarWidth).toBe("thin");
+    await expect(panelStyle.scrollbarWidth).toBe("thin");
     // The themed translucent thumb resolves (the `--inspector-scrollbar-thumb`
     // token, an rgba value, vs. a transparent track). WebKit pseudo-element
     // styles aren't queryable, so `scrollbar-color` is the assertable proxy.
-    expect(panelStyle.scrollbarColor).toContain("rgba");
+    await expect(panelStyle.scrollbarColor).toContain("rgba");
   },
 };
 
diff --git a/clients/web/src/components/screens/ServerListScreen/ServerListScreen.stories.tsx b/clients/web/src/components/screens/ServerListScreen/ServerListScreen.stories.tsx
index 89e1e691..3eca532b 100644
--- a/clients/web/src/components/screens/ServerListScreen/ServerListScreen.stories.tsx
+++ b/clients/web/src/components/screens/ServerListScreen/ServerListScreen.stories.tsx
@@ -83,7 +83,7 @@ export const MultipleServers: Story = {
   // The server grid scroll region reserves a scrollbar gutter and hides the
   // bar when idle, matching the Protocol/Network/Logging list panels (#1474).
   play: async ({ canvasElement }) => {
-    expectScrollbarGutterIdleHidden(canvasElement);
+    await expectScrollbarGutterIdleHidden(canvasElement);
   },
 };
 
@@ -148,7 +148,7 @@ export const KeyboardReorder: Story = {
 
     await waitFor(() => expect(args.onReorder).toHaveBeenCalled());
     // The first card swapped places with the second; the third is unmoved.
-    expect(args.onReorder).toHaveBeenCalledWith([
+    await expect(args.onReorder).toHaveBeenCalledWith([
       disconnectedStdioServer.id,
       connectedStdioServer.id,
       failedHttpServer.id,
diff --git a/clients/web/src/components/views/InspectorView/InspectorView.stories.tsx b/clients/web/src/components/views/InspectorView/InspectorView.stories.tsx
index 5b218726..fd7f25ac 100644
--- a/clients/web/src/components/views/InspectorView/InspectorView.stories.tsx
+++ b/clients/web/src/components/views/InspectorView/InspectorView.stories.tsx
@@ -452,10 +452,10 @@ export const Default: Story = {
     if (!(main instanceof HTMLElement)) {
       throw new Error("AppShell main not found");
     }
-    expect(getComputedStyle(main).overflowY).toBe("hidden");
+    await expect(getComputedStyle(main).overflowY).toBe("hidden");
     // Clamped to the viewport (within a pixel of rounding), so the shell can't
     // grow past it and push the page into scrolling.
-    expect(main.getBoundingClientRect().height).toBeLessThanOrEqual(
+    await expect(main.getBoundingClientRect().height).toBeLessThanOrEqual(
       window.innerHeight + 1,
     );
   },
@@ -489,8 +489,8 @@ export const ManyServers: Story = {
     if (!(main instanceof HTMLElement)) {
       throw new Error("AppShell main not found");
     }
-    expect(getComputedStyle(main).overflowY).toBe("hidden");
-    expect(main.getBoundingClientRect().bottom).toBeLessThanOrEqual(
+    await expect(getComputedStyle(main).overflowY).toBe("hidden");
+    await expect(main.getBoundingClientRect().bottom).toBeLessThanOrEqual(
       window.innerHeight + 1,
     );
     // The overflow lives in the inner server-grid ScrollArea, which is actually
@@ -499,7 +499,7 @@ export const ManyServers: Story = {
     if (!(viewport instanceof HTMLElement)) {
       throw new Error("server-grid scroll viewport not found");
     }
-    expect(viewport.scrollHeight).toBeGreaterThan(viewport.clientHeight);
+    await expect(viewport.scrollHeight).toBeGreaterThan(viewport.clientHeight);
   },
 };
 
diff --git a/clients/web/src/test/PreviewAnnotations.stories.tsx b/clients/web/src/test/PreviewAnnotations.stories.tsx
index bca4fb48..c05b0ae4 100644
--- a/clients/web/src/test/PreviewAnnotations.stories.tsx
+++ b/clients/web/src/test/PreviewAnnotations.stories.tsx
@@ -69,25 +69,27 @@ type Story = StoryObj<typeof Button>;
 export const ProjectAnnotationsApplied: Story = {
   play: async ({ canvasElement, parameters }) => {
     const canvas = within(canvasElement);
-    expect(canvas.getByRole("button", { name: "Themed" })).toBeInTheDocument();
+    await expect(
+      canvas.getByRole("button", { name: "Themed" }),
+    ).toBeInTheDocument();
 
     const root = getComputedStyle(document.documentElement);
 
     // `MantineProvider` (the `./preview` decorator) injects the theme's CSS
     // variables onto `:root`. No provider, no variables.
-    expect(root.getPropertyValue("--mantine-primary-color-filled").trim()).toBe(
-      expectedPrimaryColor(),
-    );
+    await expect(
+      root.getPropertyValue("--mantine-primary-color-filled").trim(),
+    ).toBe(expectedPrimaryColor());
 
     // `--inspector-brand-primary` is defined in `App.css`, which only reaches
     // the story through `./preview`'s stylesheet import — and it resolves
     // *through* the Mantine variable above, so this covers both layers.
-    expect(root.getPropertyValue("--inspector-brand-primary").trim()).toBe(
-      expectedPrimaryColor(),
-    );
+    await expect(
+      root.getPropertyValue("--inspector-brand-primary").trim(),
+    ).toBe(expectedPrimaryColor());
 
     // The preview `parameters` merged into the story context — the same channel
     // that carries `a11y: { test: "error" }` to the a11y addon.
-    expect(parameters.a11y).toMatchObject({ test: "error" });
+    await expect(parameters.a11y).toMatchObject({ test: "error" });
   },
 };
diff --git a/clients/web/src/test/core/auth/ema/transportProvider.test.ts b/clients/web/src/test/core/auth/ema/transportProvider.test.ts
index b6a3b32a..ff66653e 100644
--- a/clients/web/src/test/core/auth/ema/transportProvider.test.ts
+++ b/clients/web/src/test/core/auth/ema/transportProvider.test.ts
@@ -117,12 +117,12 @@ describe("EmaTransportOAuthProvider", () => {
     expect(await provider.clientInformation()).toEqual({ client_id: "abc" });
     expect(await provider.codeVerifier()).toBe("verifier-xyz");
 
-    provider.saveClientInformation({ client_id: "new" } as never);
+    await provider.saveClientInformation({ client_id: "new" } as never);
     expect(inner.saveClientInformation).toHaveBeenCalledWith({
       client_id: "new",
     });
 
-    provider.saveCodeVerifier("cv");
+    await provider.saveCodeVerifier("cv");
     expect(inner.saveCodeVerifier).toHaveBeenCalledWith("cv");
   });
 
diff --git a/clients/web/src/test/core/auth/endpointOverrides.test.ts b/clients/web/src/test/core/auth/endpointOverrides.test.ts
new file mode 100644
index 00000000..19fbe266
--- /dev/null
+++ b/clients/web/src/test/core/auth/endpointOverrides.test.ts
@@ -0,0 +1,394 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import {
+  applyOAuthEndpointOverrides,
+  isAuthorizationServerMetadata,
+  normalizeOAuthEndpointOverrides,
+  oauthEndpointUrlError,
+  withOAuthEndpointOverrides,
+} from "@inspector/core/auth/endpointOverrides.js";
+
+const METADATA = {
+  issuer: "https://as.example.com",
+  authorization_endpoint: "https://as.example.com/authorize",
+  token_endpoint: "https://as.example.com/token",
+  response_types_supported: ["code"],
+};
+
+const AS_METADATA_URL =
+  "https://as.example.com/.well-known/oauth-authorization-server";
+const STAGING_AUTHORIZE = "https://staging.example.com/authorize";
+const STAGING_TOKEN = "https://staging.example.com/token";
+
+function jsonResponse(body: unknown, init?: ResponseInit): Response {
+  return new Response(typeof body === "string" ? body : JSON.stringify(body), {
+    headers: { "content-type": "application/json" },
+    ...init,
+  });
+}
+
+/** A `fetch` that always resolves to the same prepared response. */
+function passThrough(response: Response): typeof fetch {
+  return async () => response;
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("oauthEndpointUrlError", () => {
+  it("accepts a blank value as 'no override'", () => {
+    expect(oauthEndpointUrlError("")).toBeUndefined();
+    expect(oauthEndpointUrlError("   ")).toBeUndefined();
+  });
+
+  it("accepts absolute http and https URLs", () => {
+    expect(oauthEndpointUrlError(STAGING_AUTHORIZE)).toBeUndefined();
+    expect(
+      oauthEndpointUrlError("http://localhost:9000/token"),
+    ).toBeUndefined();
+  });
+
+  it("rejects a relative path", () => {
+    expect(oauthEndpointUrlError("/authorize")).toMatch(/not an absolute URL/);
+  });
+
+  it("rejects a non-http(s) scheme", () => {
+    expect(oauthEndpointUrlError("ftp://example.com/authorize")).toMatch(
+      /not an http\(s\) URL/,
+    );
+  });
+
+  // `new URL` accepts these, but Fetch rejects a request URL carrying them —
+  // so without this check the value passes validation and fails mid-flow.
+  it("rejects embedded credentials", () => {
+    expect(
+      oauthEndpointUrlError("https://user:pass@as.example.com/token"),
+    ).toMatch(/username or password/);
+    expect(oauthEndpointUrlError("https://user@as.example.com/token")).toMatch(
+      /username or password/,
+    );
+  });
+});
+
+describe("normalizeOAuthEndpointOverrides", () => {
+  it("returns undefined when nothing is configured", () => {
+    expect(normalizeOAuthEndpointOverrides(undefined)).toBeUndefined();
+    expect(normalizeOAuthEndpointOverrides({})).toBeUndefined();
+    expect(
+      normalizeOAuthEndpointOverrides({ authorizationUrl: "  " }),
+    ).toBeUndefined();
+  });
+
+  it("trims and keeps each configured endpoint independently", () => {
+    expect(
+      normalizeOAuthEndpointOverrides({
+        authorizationUrl: `  ${STAGING_AUTHORIZE} `,
+      }),
+    ).toEqual({ authorizationUrl: STAGING_AUTHORIZE });
+    expect(
+      normalizeOAuthEndpointOverrides({ tokenUrl: STAGING_TOKEN }),
+    ).toEqual({ tokenUrl: STAGING_TOKEN });
+  });
+
+  it("drops a malformed value with a warning, keeping the valid sibling", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    expect(
+      normalizeOAuthEndpointOverrides({
+        authorizationUrl: "not a url",
+        tokenUrl: STAGING_TOKEN,
+      }),
+    ).toEqual({ tokenUrl: STAGING_TOKEN });
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("Ignoring `authorizationUrl`"),
+    );
+  });
+
+  it("drops a URL with embedded credentials", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    expect(
+      normalizeOAuthEndpointOverrides({
+        tokenUrl: "https://user:pass@as.example.com/token",
+      }),
+    ).toBeUndefined();
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("username or password"),
+    );
+  });
+
+  it("returns undefined when every configured value is malformed", () => {
+    vi.spyOn(console, "warn").mockImplementation(() => {});
+    expect(
+      normalizeOAuthEndpointOverrides({
+        authorizationUrl: "ftp://example.com/a",
+        tokenUrl: "also not a url",
+      }),
+    ).toBeUndefined();
+  });
+});
+
+describe("isAuthorizationServerMetadata", () => {
+  it("accepts a document with an issuer and at least one endpoint", () => {
+    expect(isAuthorizationServerMetadata(METADATA)).toBe(true);
+    expect(
+      isAuthorizationServerMetadata({
+        issuer: "https://as.example.com",
+        token_endpoint: "https://as.example.com/token",
+      }),
+    ).toBe(true);
+  });
+
+  it("rejects a non-object body", () => {
+    expect(isAuthorizationServerMetadata(null)).toBe(false);
+    expect(isAuthorizationServerMetadata("nope")).toBe(false);
+    expect(isAuthorizationServerMetadata([METADATA])).toBe(false);
+  });
+
+  it("rejects protected-resource metadata, which has no issuer", () => {
+    expect(
+      isAuthorizationServerMetadata({
+        resource: "https://mcp.example.com",
+        authorization_servers: ["https://as.example.com"],
+      }),
+    ).toBe(false);
+  });
+
+  it("rejects a document with an issuer but neither endpoint", () => {
+    expect(
+      isAuthorizationServerMetadata({ issuer: "https://as.example.com" }),
+    ).toBe(false);
+  });
+});
+
+describe("applyOAuthEndpointOverrides", () => {
+  it("replaces only the configured endpoints and copies the rest", () => {
+    const patched = applyOAuthEndpointOverrides(METADATA, {
+      tokenUrl: STAGING_TOKEN,
+    });
+    expect(patched).toEqual({
+      ...METADATA,
+      token_endpoint: STAGING_TOKEN,
+    });
+    expect(METADATA.token_endpoint).toBe("https://as.example.com/token");
+  });
+
+  it("supplies an endpoint the document never advertised", () => {
+    const patched = applyOAuthEndpointOverrides(
+      { issuer: "https://as.example.com" },
+      { authorizationUrl: STAGING_AUTHORIZE, tokenUrl: STAGING_TOKEN },
+    );
+    expect(patched).toEqual({
+      issuer: "https://as.example.com",
+      authorization_endpoint: STAGING_AUTHORIZE,
+      token_endpoint: STAGING_TOKEN,
+    });
+  });
+});
+
+describe("withOAuthEndpointOverrides", () => {
+  it("rewrites the endpoints of a metadata response", async () => {
+    const base: typeof fetch = async () => jsonResponse(METADATA);
+    const wrapped = withOAuthEndpointOverrides(base, () => ({
+      authorizationUrl: STAGING_AUTHORIZE,
+      tokenUrl: STAGING_TOKEN,
+    }));
+
+    const response = await wrapped(AS_METADATA_URL);
+    await expect(response.json()).resolves.toEqual({
+      ...METADATA,
+      authorization_endpoint: STAGING_AUTHORIZE,
+      token_endpoint: STAGING_TOKEN,
+    });
+    expect(response.status).toBe(200);
+  });
+
+  it("re-reads the overrides on every call, so a settings edit takes effect", async () => {
+    const base: typeof fetch = async () => jsonResponse(METADATA);
+    // Held in a box rather than a `let`: the resolver closes over it before the
+    // first assignment, which is what the lazy read exists to support.
+    const config: { overrides?: { tokenUrl?: string } } = {};
+    const wrapped = withOAuthEndpointOverrides(base, () => config.overrides);
+
+    const before = await wrapped(AS_METADATA_URL);
+    await expect(before.json()).resolves.toMatchObject({
+      token_endpoint: METADATA.token_endpoint,
+    });
+
+    config.overrides = { tokenUrl: STAGING_TOKEN };
+    const after = await wrapped(AS_METADATA_URL);
+    await expect(after.json()).resolves.toMatchObject({
+      token_endpoint: STAGING_TOKEN,
+    });
+  });
+
+  // The gate that keeps this wrapper off the hot path: an ordinary JSON-RPC
+  // response is not even cloned, let alone parsed. Regression test for PR #2037.
+  it("ignores a response to a request that is not metadata discovery", async () => {
+    const original = jsonResponse(METADATA);
+    const clone = vi.spyOn(original, "clone");
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+
+    await expect(wrapped("https://mcp.example.com/mcp")).resolves.toBe(
+      original,
+    );
+    expect(clone).not.toHaveBeenCalled();
+  });
+
+  it("recognizes discovery through every request-input form", async () => {
+    const wrapped = withOAuthEndpointOverrides(
+      // A fresh response per call: each patched one consumes its own clone.
+      async () => jsonResponse(METADATA),
+      () => ({ tokenUrl: STAGING_TOKEN }),
+    );
+    const oidcUrl = "https://as.example.com/.well-known/openid-configuration";
+    for (const input of [
+      AS_METADATA_URL,
+      new URL(oidcUrl),
+      new Request(`${AS_METADATA_URL}/tenant-a`),
+    ]) {
+      const response = await wrapped(input);
+      await expect(response.json()).resolves.toMatchObject({
+        token_endpoint: STAGING_TOKEN,
+      });
+    }
+  });
+
+  it("warns once about a malformed override, not on every request", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const base: typeof fetch = async () => jsonResponse(METADATA);
+    const wrapped = withOAuthEndpointOverrides(base, () => ({
+      tokenUrl: "not a url",
+    }));
+
+    await wrapped(AS_METADATA_URL);
+    await wrapped(AS_METADATA_URL);
+    await wrapped(AS_METADATA_URL);
+
+    expect(warn).toHaveBeenCalledTimes(1);
+  });
+
+  it("passes the response through untouched when nothing is configured", async () => {
+    const original = jsonResponse(METADATA);
+    const wrapped = withOAuthEndpointOverrides(
+      passThrough(original),
+      () => undefined,
+    );
+    await expect(wrapped(AS_METADATA_URL)).resolves.toBe(original);
+  });
+
+  it("leaves an error response alone", async () => {
+    const original = jsonResponse(METADATA, { status: 404 });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    await expect(wrapped(AS_METADATA_URL)).resolves.toBe(original);
+  });
+
+  it("leaves a non-JSON response alone", async () => {
+    const original = new Response("<html></html>", {
+      headers: { "content-type": "text/html" },
+    });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    await expect(wrapped(AS_METADATA_URL)).resolves.toBe(original);
+  });
+
+  // Everything that is not a metadata document comes back as the caller's own
+  // Response — identity, not an equivalent copy — so native properties a
+  // synthesized Response cannot carry (`url`, `redirected`, `type`) survive.
+  it("returns the original response for a JSON body that is not metadata", async () => {
+    const original = jsonResponse({ access_token: "abc" });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    const response = await wrapped(AS_METADATA_URL);
+    expect(response).toBe(original);
+    await expect(response.json()).resolves.toEqual({ access_token: "abc" });
+  });
+
+  it("returns the original response when the body is not valid JSON", async () => {
+    const original = jsonResponse("not json at all");
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    const response = await wrapped(AS_METADATA_URL);
+    expect(response).toBe(original);
+    await expect(response.text()).resolves.toBe("not json at all");
+  });
+
+  // `application/x-ndjson` satisfies a naive `includes("json")` test, and the
+  // streamable-HTTP transport serves its long-lived server-push channel that way
+  // (see `isLongLivedStreamResponse`). Awaiting `.json()` on a clone of an
+  // unbounded stream never resolves, so the MCP connection would hang for as
+  // long as an override was configured. Regression test for PR #2037 review.
+  it("does not read an unbounded NDJSON stream", async () => {
+    // A body that never closes: if the wrapper reads it, this test times out.
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode('{"jsonrpc":"2.0"}\n'));
+        // Deliberately never closed.
+      },
+    });
+    const original = new Response(stream, {
+      headers: { "content-type": "application/x-ndjson" },
+    });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    await expect(wrapped("https://mcp.example.com/mcp")).resolves.toBe(
+      original,
+    );
+    await original.body?.cancel();
+  });
+
+  it("ignores content-type parameters when deciding a body is JSON", async () => {
+    const wrapped = withOAuthEndpointOverrides(
+      passThrough(
+        new Response(JSON.stringify(METADATA), {
+          headers: { "content-type": "application/json; charset=utf-8" },
+        }),
+      ),
+      () => ({ tokenUrl: STAGING_TOKEN }),
+    );
+    const response = await wrapped(AS_METADATA_URL);
+    await expect(response.json()).resolves.toMatchObject({
+      token_endpoint: STAGING_TOKEN,
+    });
+  });
+
+  // Fetch forbids a body on 204/205, so rebuilding one would throw. A JSON
+  // content-type on an empty response is unusual but legal, and it must not
+  // take down an unrelated transport request.
+  it("passes a body-less 204 through untouched", async () => {
+    const original = new Response(null, {
+      status: 204,
+      headers: { "content-type": "application/json" },
+    });
+    const wrapped = withOAuthEndpointOverrides(passThrough(original), () => ({
+      tokenUrl: STAGING_TOKEN,
+    }));
+    await expect(wrapped(AS_METADATA_URL)).resolves.toBe(original);
+  });
+
+  it("drops the stale content-length and content-encoding of a rewritten body", async () => {
+    const body = JSON.stringify(METADATA);
+    const wrapped = withOAuthEndpointOverrides(
+      passThrough(
+        new Response(body, {
+          headers: {
+            "content-type": "application/json",
+            "content-length": String(body.length),
+            "content-encoding": "gzip",
+          },
+        }),
+      ),
+      () => ({ tokenUrl: STAGING_TOKEN }),
+    );
+    const response = await wrapped(AS_METADATA_URL);
+    expect(response.headers.get("content-length")).toBeNull();
+    expect(response.headers.get("content-encoding")).toBeNull();
+    expect(response.headers.get("content-type")).toBe("application/json");
+  });
+});
diff --git a/clients/web/src/test/core/client/runner.test.ts b/clients/web/src/test/core/client/runner.test.ts
index 3936d6c2..06dd0e1b 100644
--- a/clients/web/src/test/core/client/runner.test.ts
+++ b/clients/web/src/test/core/client/runner.test.ts
@@ -124,6 +124,46 @@ describe("runner client auth options", () => {
     expect(buildRunnerClientAuthOptions({}, settings)).toEqual({});
   });
 
+  // #1906 — the CLI/TUI leg reads the endpoint overrides from the same
+  // per-server settings the web leg does.
+  it("buildRunnerClientAuthOptions forwards the endpoint overrides", () => {
+    const settings: InspectorServerSettings = {
+      oauthAuthorizationUrl: "https://staging.example.com/authorize",
+      oauthTokenUrl: "https://staging.example.com/token",
+      requestTimeout: 0,
+      connectionTimeout: 0,
+      taskTtl: 60000,
+      maxFetchRequests: 10,
+      autoRefreshOnListChanged: false,
+      metadata: [],
+      headers: [],
+      env: [],
+      roots: [],
+    };
+    const opts = buildRunnerClientAuthOptions({}, settings);
+    expect(opts.oauth?.authorizationUrl).toBe(
+      "https://staging.example.com/authorize",
+    );
+    expect(opts.oauth?.tokenUrl).toBe("https://staging.example.com/token");
+  });
+
+  it("buildRunnerClientAuthOptions ignores blank endpoint overrides", () => {
+    const settings: InspectorServerSettings = {
+      oauthAuthorizationUrl: "   ",
+      oauthTokenUrl: "",
+      requestTimeout: 0,
+      connectionTimeout: 0,
+      taskTtl: 60000,
+      maxFetchRequests: 10,
+      autoRefreshOnListChanged: false,
+      metadata: [],
+      headers: [],
+      env: [],
+      roots: [],
+    };
+    expect(buildRunnerClientAuthOptions({}, settings)).toEqual({});
+  });
+
   it("buildRunnerClientAuthOptions returns no oauth when nothing supplies it", () => {
     expect(buildRunnerClientAuthOptions({})).toEqual({});
   });
diff --git a/clients/web/src/test/core/mcp/inspectorClient-oauth-endpoint-overrides.test.ts b/clients/web/src/test/core/mcp/inspectorClient-oauth-endpoint-overrides.test.ts
new file mode 100644
index 00000000..c8dd11a8
--- /dev/null
+++ b/clients/web/src/test/core/mcp/inspectorClient-oauth-endpoint-overrides.test.ts
@@ -0,0 +1,143 @@
+import { describe, it, expect } from "vitest";
+import { InspectorClient } from "@inspector/core/mcp/inspectorClient.js";
+import type { CreateTransportOptions } from "@inspector/core/mcp/types.js";
+import { BrowserOAuthStorage } from "@inspector/core/auth/browser/storage.js";
+import type { JSONRPCMessage, Transport } from "@modelcontextprotocol/client";
+
+/**
+ * #1906 — the per-server authorization/token endpoint overrides are applied by
+ * wrapping the client's base fetch, so the authorization-server metadata
+ * document carries the overridden endpoints wherever the SDK discovers it —
+ * including the discovery the transport runs on its own (the 401/refresh path),
+ * which is handed this same fetch.
+ *
+ * The assertion goes through the fetch the client actually hands the transport,
+ * rather than through a private field, so it fails if the wiring is removed.
+ */
+
+class InertTransport implements Transport {
+  onclose?: () => void;
+  onerror?: (error: Error) => void;
+  onmessage?: (message: JSONRPCMessage) => void;
+
+  async start(): Promise<void> {}
+
+  async send(): Promise<void> {
+    throw new Error("not connected");
+  }
+
+  async close(): Promise<void> {
+    this.onclose?.();
+  }
+}
+
+/**
+ * The real browser storage plus inert navigation/redirect stubs — enough for the
+ * OAuth manager to exist (which is what installs the override wrapper) without
+ * any stored tokens, so `connect()` still builds a transport with no auth
+ * provider attached.
+ */
+function oauthEnvironment() {
+  return {
+    storage: new BrowserOAuthStorage(),
+    navigation: { navigateToAuthorization: () => {} },
+    redirectUrlProvider: { getRedirectUrl: () => "http://localhost/callback" },
+  };
+}
+
+const METADATA = {
+  issuer: "https://as.example.com",
+  authorization_endpoint: "https://as.example.com/authorize",
+  token_endpoint: "https://as.example.com/token",
+};
+
+/**
+ * Build a client, drive `connect()` far enough to create the transport, and
+ * return the `fetchFn` the transport was given.
+ */
+async function transportFetchFor(
+  oauth: Record<string, string> | undefined,
+): Promise<typeof fetch | undefined> {
+  let captured: CreateTransportOptions | undefined;
+  const baseFetch: typeof fetch = async () =>
+    new Response(JSON.stringify(METADATA), {
+      headers: { "content-type": "application/json" },
+    });
+
+  const client = new InspectorClient(
+    { type: "streamable-http", url: "https://mcp.example/mcp" },
+    {
+      environment: {
+        fetch: baseFetch,
+        oauth: oauthEnvironment(),
+        transport: (_config, options) => {
+          captured = options;
+          return { transport: new InertTransport() };
+        },
+      },
+      ...(oauth && { oauth }),
+    },
+  );
+
+  await client.connect().catch(() => undefined);
+  return captured?.fetchFn;
+}
+
+describe("InspectorClient OAuth endpoint overrides (#1906)", () => {
+  it("rewrites the discovered metadata endpoints for the transport's fetch", async () => {
+    const fetchFn = await transportFetchFor({
+      authorizationUrl: "https://staging.example.com/authorize",
+      tokenUrl: "https://staging.example.com/token",
+    });
+    expect(fetchFn).toBeDefined();
+
+    const response = await fetchFn!(
+      "https://as.example.com/.well-known/oauth-authorization-server",
+    );
+    await expect(response.json()).resolves.toEqual({
+      issuer: "https://as.example.com",
+      authorization_endpoint: "https://staging.example.com/authorize",
+      token_endpoint: "https://staging.example.com/token",
+    });
+  });
+
+  it("leaves the metadata untouched when no override is configured", async () => {
+    const fetchFn = await transportFetchFor(undefined);
+    expect(fetchFn).toBeDefined();
+
+    const response = await fetchFn!(
+      "https://as.example.com/.well-known/oauth-authorization-server",
+    );
+    await expect(response.json()).resolves.toEqual(METADATA);
+  });
+
+  it("picks up an override applied after construction via setOAuthConfig", async () => {
+    let captured: CreateTransportOptions | undefined;
+    const client = new InspectorClient(
+      { type: "streamable-http", url: "https://mcp.example/mcp" },
+      {
+        environment: {
+          fetch: async () =>
+            new Response(JSON.stringify(METADATA), {
+              headers: { "content-type": "application/json" },
+            }),
+          oauth: oauthEnvironment(),
+          transport: (_config, options) => {
+            captured = options;
+            return { transport: new InertTransport() };
+          },
+        },
+        oauth: { clientId: "cid" },
+      },
+    );
+    await client.connect().catch(() => undefined);
+
+    client.setOAuthConfig({ tokenUrl: "https://staging.example.com/token" });
+    const response = await captured!.fetchFn!(
+      "https://as.example.com/.well-known/oauth-authorization-server",
+    );
+    await expect(response.json()).resolves.toMatchObject({
+      token_endpoint: "https://staging.example.com/token",
+    });
+  });
+});
diff --git a/clients/web/src/test/core/mcp/oauthManager.test.ts b/clients/web/src/test/core/mcp/oauthManager.test.ts
index 99af81bf..1fbdf8e9 100644
--- a/clients/web/src/test/core/mcp/oauthManager.test.ts
+++ b/clients/web/src/test/core/mcp/oauthManager.test.ts
@@ -115,6 +115,53 @@ describe("OAuthManager", () => {
     });
   });
 
+  // #1906 — the endpoint overrides are read live from the config so a settings
+  // edit reaches the already-built fetch wrapper.
+  describe("getEndpointOverrides", () => {
+    it("returns undefined when neither endpoint is configured", () => {
+      const manager = new OAuthManager(createMockParams());
+      expect(manager.getEndpointOverrides()).toBeUndefined();
+    });
+
+    it("reflects each endpoint set through setOAuthConfig", () => {
+      const manager = new OAuthManager(createMockParams());
+      manager.setOAuthConfig({
+        authorizationUrl: "https://staging.test/authorize",
+      });
+      expect(manager.getEndpointOverrides()).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+      });
+      manager.setOAuthConfig({ tokenUrl: "https://staging.test/token" });
+      expect(manager.getEndpointOverrides()).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+    });
+
+    // The EMA leg authorizes against the enterprise IdP — a different
+    // authorization server, whose OIDC discovery runs through the same fetch the
+    // override wrapper is installed on. Applying a resource-AS override there
+    // would redirect the IdP login (or the IdP code exchange) to the resource
+    // AS. Regression test for the review finding on PR #2037.
+    it("suppresses the overrides under enterprise-managed authorization", () => {
+      const manager = new OAuthManager(createMockParams());
+      manager.setOAuthConfig({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+      expect(manager.getEndpointOverrides()).toBeDefined();
+
+      manager.setOAuthConfig({ enterpriseManaged: true });
+      expect(manager.getEndpointOverrides()).toBeUndefined();
+
+      manager.setOAuthConfig({ enterpriseManaged: false });
+      expect(manager.getEndpointOverrides()).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+    });
+  });
+
   describe("getServerUrl propagation", () => {
     it("createOAuthProviderForTransport throws when getServerUrl throws", async () => {
       const params = createMockParams({
@@ -1588,7 +1635,7 @@ describe("OAuthManager", () => {
       });
 
       const provider = await manager.createOAuthProviderForTransport();
-      provider.redirectToAuthorization(
+      await provider.redirectToAuthorization(
         new URL("https://as.example.com/authorize?client_id=abc&state=xyz"),
       );
 
@@ -1610,7 +1657,7 @@ describe("OAuthManager", () => {
       });
 
       const provider = await manager.createOAuthProviderForTransport();
-      provider.redirectToAuthorization(
+      await provider.redirectToAuthorization(
         new URL("https://as.example.com/authorize?client_id=abc&state=xyz"),
       );
 
diff --git a/clients/web/src/test/core/mcp/serverList.test.ts b/clients/web/src/test/core/mcp/serverList.test.ts
index 6641e55b..0492622d 100644
--- a/clients/web/src/test/core/mcp/serverList.test.ts
+++ b/clients/web/src/test/core/mcp/serverList.test.ts
@@ -12,6 +12,7 @@ import {
   mergeSecretsIntoStored,
   normalizeServerType,
   oauthAuthorizationParamsFromSettings,
+  oauthEndpointOverridesFromSettings,
   serverEntriesToMcpConfig,
   serializeMcpConfig,
   storedFieldsToInspectorSettings,
@@ -1288,6 +1289,89 @@ describe("oauthOnInsufficientScope (SEP-2350)", () => {
     ).toBeUndefined();
     expect(oauthAuthorizationParamsFromSettings({})).toBeUndefined();
   });
+
+  // #1906 — authorization/token endpoint overrides.
+  it("lifts oauth endpoint overrides into settings fields", () => {
+    const settings = storedFieldsToInspectorSettings({
+      oauth: {
+        authorizationUrl: "https://staging.example.com/authorize",
+        tokenUrl: "https://staging.example.com/token",
+      },
+    });
+    expect(settings?.oauthAuthorizationUrl).toBe(
+      "https://staging.example.com/authorize",
+    );
+    expect(settings?.oauthTokenUrl).toBe("https://staging.example.com/token");
+  });
+
+  // Hand-edited `mcp.json` reaches the CLI/TUI unvalidated, and
+  // `oauthEndpointOverridesFromSettings` calls `.trim()` on these — so a
+  // non-string would crash the server load rather than being ignored.
+  it("drops a non-string endpoint override from disk", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const settings = storedFieldsToInspectorSettings({
+      oauth: {
+        clientId: "cid",
+        // Types the field as a string; disk does not honor that.
+        authorizationUrl: 42 as unknown as string,
+        tokenUrl: "https://staging.example.com/token",
+      },
+    });
+    expect(settings?.oauthAuthorizationUrl).toBeUndefined();
+    expect(settings?.oauthTokenUrl).toBe("https://staging.example.com/token");
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("oauth.authorizationUrl"),
+    );
+    // Restored here rather than left to a global teardown: a later describe
+    // spies on `console.warn` again and would inherit this spy's recorded call.
+    warn.mockRestore();
+  });
+
+  it("reads a blank endpoint override back as unset", () => {
+    const settings = storedFieldsToInspectorSettings({
+      oauth: { clientId: "cid", authorizationUrl: "", tokenUrl: "" },
+    });
+    expect(settings?.oauthAuthorizationUrl).toBeUndefined();
+    expect(settings?.oauthTokenUrl).toBeUndefined();
+  });
+
+  it("persists endpoint overrides under oauth, trimming whitespace", () => {
+    const stored = inspectorSettingsToStoredFields({
+      ...baseSettings,
+      oauthAuthorizationUrl: "  https://staging.example.com/authorize  ",
+      oauthTokenUrl: "https://staging.example.com/token",
+    });
+    expect(stored.oauth).toEqual({
+      authorizationUrl: "https://staging.example.com/authorize",
+      tokenUrl: "https://staging.example.com/token",
+    });
+  });
+
+  it("omits the oauth block when the endpoint overrides are blank", () => {
+    const stored = inspectorSettingsToStoredFields({
+      ...baseSettings,
+      oauthAuthorizationUrl: "   ",
+      oauthTokenUrl: "",
+    });
+    expect(stored).not.toHaveProperty("oauth");
+  });
+
+  it("derives the endpoint-override client option, or undefined when blank", () => {
+    expect(
+      oauthEndpointOverridesFromSettings({
+        oauthAuthorizationUrl: " https://staging.example.com/authorize ",
+      }),
+    ).toEqual({ authorizationUrl: "https://staging.example.com/authorize" });
+    expect(
+      oauthEndpointOverridesFromSettings({
+        oauthTokenUrl: "https://staging.example.com/token",
+      }),
+    ).toEqual({ tokenUrl: "https://staging.example.com/token" });
+    expect(
+      oauthEndpointOverridesFromSettings({ oauthAuthorizationUrl: "  " }),
+    ).toBeUndefined();
+    expect(oauthEndpointOverridesFromSettings({})).toBeUndefined();
+  });
 });
 
 describe("envRecordToPairs / envPairsToRecord", () => {
diff --git a/clients/web/src/test/core/react/useServers.test.tsx b/clients/web/src/test/core/react/useServers.test.tsx
index bb95402d..c0d5260c 100644
--- a/clients/web/src/test/core/react/useServers.test.tsx
+++ b/clients/web/src/test/core/react/useServers.test.tsx
@@ -969,6 +969,146 @@ describe("useServers", () => {
     );
   });
 
+  it("parses CRLF-delimited SSE frames as change notifications (#2006)", async () => {
+    // SSE permits CRLF line endings, and this hook is a hand-rolled parser
+    // (EventSource can't send `x-mcp-remote-auth`). Matching only `\n\n` left
+    // a CRLF frame buffered forever, so an external mcp.json edit never
+    // reached the list.
+    writeFileSync(
+      h.configPath,
+      JSON.stringify({
+        mcpServers: { seed: { type: "stdio", command: "s" } },
+      }),
+    );
+
+    // The frame is held back until the test has mutated the file, so the
+    // resulting list can only come from a refresh this frame triggered.
+    let releaseFrame: (() => void) | undefined;
+    const framed = new Promise<void>((r) => {
+      releaseFrame = r;
+    });
+    const encoder = new TextEncoder();
+    // Referentially stable: an inline arrow re-subscribes on every render, and
+    // the re-subscription's own mount refresh would pick the edit up on its
+    // own — passing whether or not the frame was ever parsed.
+    const fetchFn: typeof fetch = async (input, init) => {
+      const url = input instanceof Request ? input.url : String(input);
+      if (url.endsWith("/api/servers/events")) {
+        // A real ReadableStream in a real Response — `pull` is only invoked
+        // when the hook's reader asks for a chunk, so awaiting inside it
+        // gates delivery exactly the way a hand-rolled reader double would,
+        // while keeping the mock type-checked against the Response API.
+        const stream = new ReadableStream<Uint8Array>({
+          async pull(controller) {
+            await framed;
+            controller.enqueue(encoder.encode("event: change\r\n\r\n"));
+            controller.close();
+          },
+        });
+        return new Response(stream, { status: 200 });
+      }
+      return h.fetchFn(url, init);
+    };
+    const { result } = renderHook(() =>
+      useServers({ baseUrl: "http://test.local", fetchFn }),
+    );
+    await waitFor(() => expect(result.current.loading).toBe(false));
+    expect(result.current.servers.map((s) => s.id)).toEqual(["seed"]);
+
+    writeFileSync(
+      h.configPath,
+      JSON.stringify({
+        mcpServers: { aftercrlf: { type: "stdio", command: "x" } },
+      }),
+    );
+    releaseFrame?.();
+
+    await waitFor(
+      () => {
+        expect(result.current.servers.map((s) => s.id)).toEqual(["aftercrlf"]);
+      },
+      { timeout: 3000 },
+    );
+  });
+
+  it("does not split a CRLF frame separator straddling two chunks (#2006)", async () => {
+    // The bare-CR terminator is deliberately not accepted: a chunk ending in
+    // `…\r\n\r` would otherwise read as a completed frame, and the `\n`
+    // arriving next would start a bogus one. Deliver exactly that split and
+    // assert the frame is recognized once — only after both halves land.
+    writeFileSync(
+      h.configPath,
+      JSON.stringify({
+        mcpServers: { seed: { type: "stdio", command: "s" } },
+      }),
+    );
+
+    let releaseFirstHalf: (() => void) | undefined;
+    const firstHalf = new Promise<void>((r) => {
+      releaseFirstHalf = r;
+    });
+    let releaseSecondHalf: (() => void) | undefined;
+    const secondHalf = new Promise<void>((r) => {
+      releaseSecondHalf = r;
+    });
+    let listGets = 0;
+    let chunks = 0;
+    const encoder = new TextEncoder();
+    const fetchFn: typeof fetch = async (input, init) => {
+      const url = input instanceof Request ? input.url : String(input);
+      if (url.endsWith("/api/servers/events")) {
+        // `pull` runs once per chunk the hook's reader consumes, so `chunks`
+        // reaching 2 proves the half-separator chunk was read and parsed.
+        const stream = new ReadableStream<Uint8Array>({
+          async pull(controller) {
+            chunks += 1;
+            if (chunks === 1) {
+              await firstHalf;
+              controller.enqueue(encoder.encode("event: change\r\n\r"));
+              return;
+            }
+            if (chunks === 2) {
+              await secondHalf;
+              controller.enqueue(encoder.encode("\n"));
+              return;
+            }
+            controller.close();
+          },
+        });
+        return new Response(stream, { status: 200 });
+      }
+      if (url.endsWith("/api/servers")) listGets += 1;
+      return h.fetchFn(url, init);
+    };
+    const { result } = renderHook(() =>
+      useServers({ baseUrl: "http://test.local", fetchFn }),
+    );
+    await waitFor(() => expect(result.current.loading).toBe(false));
+    expect(listGets).toBe(1);
+
+    // Half a separator is not a frame: no refresh yet.
+    releaseFirstHalf?.();
+    await waitFor(() => expect(chunks).toBeGreaterThanOrEqual(2));
+    await new Promise((r) => setTimeout(r, 100));
+    expect(listGets).toBe(1);
+
+    writeFileSync(
+      h.configPath,
+      JSON.stringify({
+        mcpServers: { aftersplit: { type: "stdio", command: "x" } },
+      }),
+    );
+    releaseSecondHalf?.();
+
+    await waitFor(
+      () => {
+        expect(result.current.servers.map((s) => s.id)).toEqual(["aftersplit"]);
+      },
+      { timeout: 3000 },
+    );
+    expect(listGets).toBe(2);
+  });
+
   it("ignores the backend's inert priming comment frame (#1858)", async () => {
     // The backend opens every SSE stream with a `:` comment so a streaming
     // fetch() resolves on Firefox at all. That frame carries no event/data
diff --git a/clients/web/src/test/integration/mcp/inspectorClient-modern-era.test.ts b/clients/web/src/test/integration/mcp/inspectorClient-modern-era.test.ts
index 6251340d..cb346ec0 100644
--- a/clients/web/src/test/integration/mcp/inspectorClient-modern-era.test.ts
+++ b/clients/web/src/test/integration/mcp/inspectorClient-modern-era.test.ts
@@ -18,6 +18,8 @@ import {
   createMrtrSamplingTool,
   createMrtrLoopTool,
   createMrtrEdgeCaseTool,
+  loadConfig,
+  resolveConfig,
 } from "@modelcontextprotocol/inspector-test-server";
 import type { ServerConfig } from "@modelcontextprotocol/inspector-test-server";
 import type {
@@ -26,6 +28,13 @@ import type {
 } from "@modelcontextprotocol/client";
 import { LOG_LEVEL_META_KEY } from "@modelcontextprotocol/client";
 import type { MessageEntry } from "@inspector/core/mcp/types.js";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// clients/web/src/test/integration/mcp → repo root is six levels up. Derived
+// from the module URL rather than `process.cwd()` so the showcase config
+// resolves the same however vitest is invoked.
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "../".repeat(6));
 
 /**
  * Live coverage of the modern (2026-07-28) connection path (#1700). The bundled
@@ -389,6 +398,45 @@ describe("modern-era negotiation (2026-07-28)", () => {
     expect(Object.keys(retry2.inputResponses ?? {})).toHaveLength(0);
   });
 
+  // #1860. Drives the reproduction the README documents, through the SAME
+  // artifacts a human would use — the showcase config file, resolved through the
+  // preset registry — so the config entry, the `mrtr_empty` registry branch, and
+  // the handler are all covered rather than just the fixture factory. The
+  // assertion is that a completed MRTR call really does hand back an empty
+  // `CallToolResult`: that is the input the Tools panel has to render as
+  // "completed, returned nothing" instead of its pre-run placeholder.
+  it("completes an MRTR sequence with an empty result (mrtr_empty, via the showcase config)", async () => {
+    const config = loadConfig(
+      join(repoRoot, "test-servers/configs/mrtr-showcase-http.json"),
+    );
+    expect(config.tools).toContainEqual({ preset: "mrtr_empty" });
+
+    const started = createTestServerHttp(resolveConfig(config));
+    await started.start();
+    server = started;
+    const connected = await connectWithEra(started.url, "modern");
+
+    let pausedAtPendingUi = false;
+    connected.addEventListener("newPendingElicitation", (event) => {
+      pausedAtPendingUi = true;
+      void event.detail.respond({
+        action: "accept",
+        content: { ack: true },
+      });
+    });
+
+    const { tools } = await connected.listTools();
+    const tool = tools.find((t) => t.name === "mrtr_empty");
+    expect(tool).toBeDefined();
+
+    const result = await connected.callTool(tool!, {});
+    expect(result.success).toBe(true);
+    expect(pausedAtPendingUi).toBe(true);
+    expect(result.result!.content).toEqual([]);
+    expect(result.result!.structuredContent).toBeUndefined();
+    expect(result.result!.isError).toBeFalsy();
+  });
+
   it("cancels an in-flight MRTR call while its embedded request is pending", async () => {
     const started = await startMrtrServer(createMrtrTool());
     const connected = await connectWithEra(started.url, "modern");
diff --git a/clients/web/src/test/integration/mcp/remote/server-extra-coverage.test.ts b/clients/web/src/test/integration/mcp/remote/server-extra-coverage.test.ts
index 9a44f07c..427800a6 100644
--- a/clients/web/src/test/integration/mcp/remote/server-extra-coverage.test.ts
+++ b/clients/web/src/test/integration/mcp/remote/server-extra-coverage.test.ts
@@ -20,6 +20,7 @@ import { serve } from "@hono/node-server";
 import type { ServerType } from "@hono/node-server";
 import type pinoType from "pino";
 import {
+  closeAbortedStream,
   createRemoteApp,
   requestIdForSendWait,
   mcpParamHeadersOnly,
@@ -1107,4 +1108,37 @@ describe("server.ts supplemental coverage", () => {
       }
     });
   });
+  describe("closeAbortedStream", () => {
+    it("owns a rejected close instead of letting it go unhandled", async () => {
+      // The whole reason the helper exists. Both SSE `onAbort` listeners run
+      // after the peer is already gone, so `close()` can lose the race and
+      // reject — and Hono invokes abort subscribers with a bare
+      // `subscriber()`, so nothing upstream would catch it. A regression here
+      // does not fail at the call site; it fails the whole vitest run from
+      // wherever the rejection happens to surface.
+      const rejected = Promise.reject(new Error("peer already gone"));
+      const unhandled: unknown[] = [];
+      const onUnhandled = (err: unknown) => unhandled.push(err);
+      process.on("unhandledRejection", onUnhandled);
+      try {
+        expect(closeAbortedStream({ close: () => rejected })).toBeUndefined();
+        // An unhandledRejection fires on a later macrotask, not this one.
+        await new Promise((resolve) => setTimeout(resolve, 20));
+      } finally {
+        process.off("unhandledRejection", onUnhandled);
+      }
+      expect(unhandled).toEqual([]);
+    });
+
+    it("returns without waiting on a close that resolves", async () => {
+      let closed = false;
+      closeAbortedStream({
+        close: async () => {
+          closed = true;
+        },
+      });
+      await Promise.resolve();
+      expect(closed).toBe(true);
+    });
+  });
 });
diff --git a/clients/web/src/test/integration/mcp/remote/servers-route.test.ts b/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
index 18803b5a..0a286253 100644
--- a/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
+++ b/clients/web/src/test/integration/mcp/remote/servers-route.test.ts
@@ -496,6 +496,75 @@ describe("/api/servers routes", () => {
       expect(res.status).toBe(400);
     });
 
+    // #1906 — the endpoint overrides travel as plain strings and land under
+    // `oauth` on disk beside the credentials.
+    it("persists the oauth endpoint overrides on POST", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "endpointoverrides",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthAuthorizationUrl: "https://staging.test/authorize",
+            oauthTokenUrl: "https://staging.test/token",
+          },
+        }),
+      });
+      expect(res.status).toBe(200);
+      const stored = readConfig(h.configPath).mcpServers.endpointoverrides;
+      expect(stored?.oauth).toEqual({
+        authorizationUrl: "https://staging.test/authorize",
+        tokenUrl: "https://staging.test/token",
+      });
+    });
+
+    it("drops an empty oauth endpoint override rather than writing it", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "blankoverrides",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthAuthorizationUrl: "",
+            oauthTokenUrl: "",
+          },
+        }),
+      });
+      expect(res.status).toBe(200);
+      expect(
+        readConfig(h.configPath).mcpServers.blankoverrides,
+      ).not.toHaveProperty("oauth");
+    });
+
+    it("rejects a non-string oauthTokenUrl payload", async () => {
+      const res = await fetch(`${h.baseUrl}/api/servers`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          id: "badtokenurl",
+          config: { type: "streamable-http", url: "https://x.test/mcp" },
+          settings: {
+            headers: [],
+            metadata: [],
+            connectionTimeout: 0,
+            requestTimeout: 0,
+            oauthTokenUrl: 42,
+          },
+        }),
+      });
+      expect(res.status).toBe(400);
+    });
+
     it("updates Inspector-extension fields at the top level on PUT", async () => {
       writeFileSync(
         h.configPath,
diff --git a/clients/web/src/test/integration/server/server-auto-open.test.ts b/clients/web/src/test/integration/server/server-auto-open.test.ts
new file mode 100644
index 00000000..527f8b56
--- /dev/null
+++ b/clients/web/src/test/integration/server/server-auto-open.test.ts
@@ -0,0 +1,149 @@
+/**
+ * `autoOpen` browser launch (#1959).
+ *
+ * Both servers call `openBrowser` from a synchronous callback — the prod
+ * server from `serve()`'s listen callback, the dev plugin from `logBanner` —
+ * so a rejection there has nowhere to go. On a headless or otherwise
+ * browser-less host that rejection is the *ordinary* outcome, not an edge
+ * case, and before #1959 it escaped as an unhandled rejection from a server
+ * that had already started listening and printed a perfectly usable URL.
+ *
+ * The helper is shared precisely so this behavior has one implementation to
+ * pin. The unit tests below cover it directly; the end-to-end test then
+ * proves the prod server routes through it and survives the failure. The dev
+ * plugin is not booted here — it returns early under `VITEST` by design (see
+ * `vite-hono-plugin.ts`) — but it calls the same tested helper.
+ */
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { createServer } from "node:net";
+import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { WebServerConfig } from "../../../../server/web-server-config.js";
+import type { WebServerHandle } from "../../../../server/types.js";
+
+const openMock = vi.hoisted(() => vi.fn());
+vi.mock("open", () => ({ default: openMock }));
+
+// Imported after the mock is registered so both bind to the double.
+const { openBrowser } = await import("../../../../server/web-server-config.js");
+const { startHonoServer } = await import("../../../../server/server.js");
+
+const WARNING = "Could not open a browser automatically:";
+
+async function findFreePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const srv = createServer();
+    srv.unref();
+    srv.on("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      if (addr && typeof addr === "object") {
+        const { port } = addr;
+        srv.close(() => resolve(port));
+      } else {
+        srv.close(() => reject(new Error("Could not resolve a free port")));
+      }
+    });
+  });
+}
+
+/** An unhandledRejection fires on a later macrotask than the rejection. */
+async function settle() {
+  await new Promise((resolve) => setTimeout(resolve, 50));
+}
+
+const INDEX_HTML =
+  "<!doctype html><html><body><div id=root></div></body></html>";
+
+let handle: WebServerHandle | undefined;
+let staticRoot: string | undefined;
+
+afterEach(async () => {
+  await handle?.close();
+  handle = undefined;
+  if (staticRoot) await rm(staticRoot, { recursive: true, force: true });
+  staticRoot = undefined;
+  openMock.mockReset();
+  vi.restoreAllMocks();
+});
+
+describe("openBrowser", () => {
+  it("owns a rejection and warns instead of letting it go unhandled", async () => {
+    // Suppress the expected warning rather than letting it pollute the run,
+    // but assert on it — the warning IS the user-visible half of the fix.
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const unhandled: unknown[] = [];
+    const onUnhandled = (err: unknown) => unhandled.push(err);
+    process.on("unhandledRejection", onUnhandled);
+    try {
+      openMock.mockRejectedValue(new Error("no browser on this host"));
+      expect(openBrowser("http://127.0.0.1:6274")).toBeUndefined();
+      await settle();
+    } finally {
+      process.off("unhandledRejection", onUnhandled);
+    }
+    expect(unhandled).toEqual([]);
+    expect(warn).toHaveBeenCalledWith(WARNING, expect.any(Error));
+  });
+
+  it("stays quiet when the browser opens", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    openMock.mockResolvedValue(undefined);
+    openBrowser("http://127.0.0.1:6274");
+    await settle();
+    expect(openMock).toHaveBeenCalledWith("http://127.0.0.1:6274");
+    expect(warn).not.toHaveBeenCalledWith(WARNING, expect.anything());
+  });
+});
+
+describe("startHonoServer autoOpen", () => {
+  it("keeps serving when the browser cannot be opened", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const unhandled: unknown[] = [];
+    const onUnhandled = (err: unknown) => unhandled.push(err);
+    process.on("unhandledRejection", onUnhandled);
+
+    try {
+      openMock.mockRejectedValue(new Error("no browser on this host"));
+
+      staticRoot = await mkdtemp(join(tmpdir(), "inspector-autoopen-"));
+      await writeFile(join(staticRoot, "index.html"), INDEX_HTML, "utf-8");
+      const port = await findFreePort();
+      const baseUrl = `http://127.0.0.1:${port}`;
+      const config: WebServerConfig = {
+        port,
+        hostname: "127.0.0.1",
+        authToken: "auto-open-token",
+        dangerouslyOmitAuth: false,
+        initialMcpConfig: null,
+        mcpConfigPath: undefined,
+        writable: true,
+        initialServers: null,
+        storageDir: undefined,
+        allowedOrigins: [baseUrl],
+        sandboxPort: 0,
+        sandboxHost: "127.0.0.1",
+        logger: undefined,
+        autoOpen: true,
+        staticRoot,
+      };
+      handle = await startHonoServer(config);
+
+      // `serve()`'s listen callback fires after startHonoServer resolves.
+      for (let i = 0; i < 100 && openMock.mock.calls.length === 0; i++) {
+        await new Promise((resolve) => setTimeout(resolve, 10));
+      }
+      await settle();
+
+      expect(openMock).toHaveBeenCalledWith(expect.stringContaining(baseUrl));
+      expect(unhandled).toEqual([]);
+      expect(warn).toHaveBeenCalledWith(WARNING, expect.any(Error));
+      // The point of warning rather than throwing: the server is still up.
+      const res = await fetch(`${baseUrl}/`);
+      expect(res.status).toBe(200);
+    } finally {
+      process.off("unhandledRejection", onUnhandled);
+    }
+  });
+});
diff --git a/clients/web/src/test/scrollAreaStoryAssertions.ts b/clients/web/src/test/scrollAreaStoryAssertions.ts
index cd3fe28e..b3de5bbf 100644
--- a/clients/web/src/test/scrollAreaStoryAssertions.ts
+++ b/clients/web/src/test/scrollAreaStoryAssertions.ts
@@ -6,22 +6,24 @@ import { expect } from "storybook/test";
  * hidden when idle (`type="scroll"`, so it shows only while scrolling rather
  * than on hover). Shared by the Protocol/Network/Logging panel stories (#1474).
  */
-export function expectScrollbarGutterIdleHidden(canvasElement: HTMLElement) {
+export async function expectScrollbarGutterIdleHidden(
+  canvasElement: HTMLElement,
+) {
   const viewport = canvasElement.querySelector(".mantine-ScrollArea-viewport");
   if (!(viewport instanceof HTMLElement)) {
     throw new Error("scroll viewport not found");
   }
   // offsetScrollbars reserves a non-zero inline-end gutter for the scrollbar.
   const pad = parseFloat(getComputedStyle(viewport).paddingInlineEnd);
-  expect(pad).toBeGreaterThan(0);
+  await expect(pad).toBeGreaterThan(0);
   // type="scroll" → scrollbars are mounted but hidden until the user scrolls.
   // Assert at least one exists first so the loop isn't trivially-true if a
   // future change stops rendering the scrollbar element.
   const scrollbars = canvasElement.querySelectorAll(
     ".mantine-ScrollArea-scrollbar",
   );
-  expect(scrollbars.length).toBeGreaterThan(0);
+  await expect(scrollbars.length).toBeGreaterThan(0);
   for (const bar of scrollbars) {
-    expect(bar.getAttribute("data-state")).toBe("hidden");
+    await expect(bar.getAttribute("data-state")).toBe("hidden");
   }
 }
diff --git a/core/auth/endpointOverrides.ts b/core/auth/endpointOverrides.ts
new file mode 100644
index 00000000..c2438b30
--- /dev/null
+++ b/core/auth/endpointOverrides.ts
@@ -0,0 +1,342 @@
+/**
+ * Per-server authorization/token endpoint overrides (#1906).
+ *
+ * The Inspector deliberately has no fields for the authorization and token URLs
+ * — they are resolved by authorization-server metadata discovery (RFC 8414 /
+ * OpenID Connect Discovery), exactly as a real MCP host resolves them. But a
+ * server under development often advertises its *production* authorization
+ * server while the person debugging it wants the staging one, and discovery
+ * gives them no way to say so.
+ *
+ * These overrides are that affordance: when set, they replace whatever the
+ * authorization server's metadata document returned.
+ *
+ * ## Why this is a fetch wrapper and not a provider hook
+ *
+ * Both endpoints reach the flow through exactly one path in SDK v2: `auth()`
+ * discovers the metadata document and then reads `metadata.authorization_endpoint`
+ * (in `startAuthorization`) and `metadata.token_endpoint` (in `fetchToken`).
+ * Neither is routed through `OAuthClientProvider`, and `AuthOptions` has no
+ * `metadata` field — so the provider seam that carries the custom authorization
+ * parameters (#2018) cannot reach the token endpoint at all. The one seam that
+ * sees both is the `fetchFn` the SDK uses for discovery, so the override is
+ * applied to the metadata document in flight.
+ *
+ * Four consequences worth knowing:
+ *
+ * - **A metadata document is required.** When discovery returns nothing, the SDK
+ *   falls back to `/authorize` and `/token` on the authorization server's origin
+ *   and there is no document to patch. That matches the feature as asked for —
+ *   overriding "whatever urls the authorization server returns" — and a server
+ *   publishing no metadata is already on a path where the endpoints are not
+ *   being advertised in the first place.
+ * - **They do not apply to the enterprise-managed (EMA) leg.** That flow
+ *   authorizes against the enterprise IdP — a different authorization server —
+ *   and its OIDC discovery runs through this same fetch, so `OAuthManager`
+ *   suppresses the overrides when the server is enterprise-managed. This mirrors
+ *   `redirectToExternalAuthorization` skipping the custom authorization
+ *   parameters (#2018).
+ * - **They redirect endpoints, they do not re-point the issuer.** `issuer` is
+ *   left exactly as discovery returned it, deliberately: it is the authorization
+ *   server's *identity*, and it is what RFC 9207 / SEP-2352 check the callback's
+ *   `iss` against to defend against an authorization-server mix-up. So these
+ *   overrides fit alternate endpoints of the same logical issuer (a staging
+ *   deployment fronting the same issuer, a local proxy). Aim one at an
+ *   authorization server that advertises a *different* issuer and the callback
+ *   is rejected as an issuer mismatch before the code is redeemed — which is the
+ *   mix-up defense working. Suppressing that check to make the override "work"
+ *   would trade a real security property for a debugging convenience, so the
+ *   limit is documented rather than removed.
+ * - **The Network tab shows the patched document.** The wrapper is applied to the
+ *   base fetch, inside the request tracker, so what the tab renders is the
+ *   metadata as the flow consumed it. That is the useful reading: it explains why
+ *   the subsequent authorize/token requests went where they did.
+ */
+
+/**
+ * Per-server overrides for the two endpoints an authorization server publishes.
+ * Both are optional and independent — overriding only the token URL is a valid
+ * configuration.
+ */
+export interface OAuthEndpointOverrides {
+  /** Replaces `authorization_endpoint` in the discovered metadata. */
+  authorizationUrl?: string;
+  /** Replaces `token_endpoint` in the discovered metadata. */
+  tokenUrl?: string;
+}
+
+/** Field name on the metadata document each override replaces. */
+const OVERRIDE_FIELDS = {
+  authorizationUrl: "authorization_endpoint",
+  tokenUrl: "token_endpoint",
+} as const;
+
+/**
+ * Validation message for one configured endpoint URL, or `undefined` when the
+ * value is acceptable. A blank value is not an error — it means "no override".
+ *
+ * Only absolute `http:`/`https:` URLs are accepted: the value is written
+ * straight into the metadata document, where the SDK passes it to `new URL(...)`
+ * with no base — so a relative path would throw deep inside the flow, far from
+ * the setting that caused it. `http:` is allowed because the whole point is
+ * reaching a local or staging authorization server.
+ *
+ * The settings form renders this message against the field, so the form and the
+ * runtime cannot disagree about which values are usable.
+ */
+export function oauthEndpointUrlError(value: string): string | undefined {
+  const trimmed = value.trim();
+  if (trimmed === "") return undefined;
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return `"${trimmed}" is not an absolute URL.`;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return `"${trimmed}" is not an http(s) URL.`;
+  }
+  // `new URL` accepts embedded credentials but Fetch rejects an HTTP(S) request
+  // URL that carries them, so without this the value would pass both the form
+  // and the runtime and then fail deep in the OAuth exchange — the failure mode
+  // this validation exists to prevent. (Sending credentials to an endpoint the
+  // flow discovered is not something to support quietly, either.)
+  if (parsed.username || parsed.password) {
+    return "URL must not contain a username or password.";
+  }
+  return undefined;
+}
+
+/**
+ * The trimmed value, or `undefined` when it is blank or unusable. A rejected
+ * value warns and is dropped rather than throwing, so one bad field cannot make
+ * an otherwise-working server unconnectable.
+ */
+function normalizeEndpointUrl(
+  value: string | undefined,
+  field: keyof OAuthEndpointOverrides,
+): string | undefined {
+  if (value === undefined) return undefined;
+  const trimmed = value.trim();
+  if (trimmed === "") return undefined;
+  const error = oauthEndpointUrlError(trimmed);
+  if (error) {
+    console.warn(`[oauth] Ignoring \`${field}\`: ${error}`);
+    return undefined;
+  }
+  return trimmed;
+}
+
+/**
+ * Normalize the configured overrides, dropping blank and malformed values.
+ * Returns `undefined` when nothing usable remains, which is the signal callers
+ * use to skip wrapping their fetch at all.
+ */
+export function normalizeOAuthEndpointOverrides(
+  overrides: OAuthEndpointOverrides | undefined,
+): OAuthEndpointOverrides | undefined {
+  if (!overrides) return undefined;
+  const authorizationUrl = normalizeEndpointUrl(
+    overrides.authorizationUrl,
+    "authorizationUrl",
+  );
+  const tokenUrl = normalizeEndpointUrl(overrides.tokenUrl, "tokenUrl");
+  if (!authorizationUrl && !tokenUrl) return undefined;
+  return {
+    ...(authorizationUrl && { authorizationUrl }),
+    ...(tokenUrl && { tokenUrl }),
+  };
+}
+
+/**
+ * Whether a parsed JSON body is an authorization-server metadata document.
+ *
+ * The wrapper sees every JSON response on the connection, so this has to be
+ * narrow enough not to rewrite an unrelated body that happens to carry a
+ * similarly-named field. RFC 8414 §2 makes `issuer` REQUIRED and it appears in
+ * no other document the flow fetches (protected-resource metadata has
+ * `authorization_servers`, not `issuer`), so requiring `issuer` alongside at
+ * least one of the two endpoints is a precise test.
+ */
+export function isAuthorizationServerMetadata(
+  value: unknown,
+): value is Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const doc = value as Record<string, unknown>;
+  if (typeof doc.issuer !== "string") return false;
+  return (
+    typeof doc.authorization_endpoint === "string" ||
+    typeof doc.token_endpoint === "string"
+  );
+}
+
+/**
+ * Return a copy of an authorization-server metadata document with the
+ * configured endpoints replaced.
+ *
+ * An override is written even when the document does not advertise that
+ * endpoint: a metadata document missing `authorization_endpoint` already fails
+ * the flow (`new URL(undefined)` throws), so supplying the missing value is
+ * strictly better than leaving the hole.
+ */
+export function applyOAuthEndpointOverrides(
+  metadata: Record<string, unknown>,
+  overrides: OAuthEndpointOverrides,
+): Record<string, unknown> {
+  const patched = { ...metadata };
+  for (const [key, field] of Object.entries(OVERRIDE_FIELDS) as [
+    keyof OAuthEndpointOverrides,
+    (typeof OVERRIDE_FIELDS)[keyof OAuthEndpointOverrides],
+  ][]) {
+    const override = overrides[key];
+    if (override) patched[field] = override;
+  }
+  return patched;
+}
+
+/**
+ * The well-known paths authorization-server metadata is discovered at: RFC 8414
+ * (§3.1, including the path-suffixed and path-prefixed variants the SDK's
+ * `buildDiscoveryUrls` emits) and OpenID Connect Discovery. Matched as a
+ * substring of the pathname so every variant is covered by two literals.
+ */
+const AS_METADATA_WELL_KNOWN_PATHS = [
+  "/.well-known/oauth-authorization-server",
+  "/.well-known/openid-configuration",
+] as const;
+
+/** The request URL a `fetch` call was made with, in any of its three forms. */
+function requestUrlOf(input: RequestInfo | URL): string {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.href;
+  return input.url;
+}
+
+/**
+ * Whether a request is an authorization-server metadata discovery request.
+ *
+ * This is what keeps the wrapper off the hot path. Without it, every successful
+ * `application/json` response on the connection — every `tools/call` result, and
+ * every resource payload on the direct CLI/TUI transports — would be buffered
+ * and parsed a second time before the SDK could consume it, purely to discover
+ * that it is not a metadata document. Gating on the discovery URL first means
+ * ordinary traffic is untouched: one string test and the response is returned.
+ *
+ * A URL that will not parse falls back to testing the raw string, which is the
+ * conservative direction — worst case a request is *considered*, and the
+ * metadata predicate then rejects it.
+ */
+function isAuthorizationServerMetadataRequest(
+  input: RequestInfo | URL,
+): boolean {
+  const raw = requestUrlOf(input);
+  let pathname: string;
+  try {
+    pathname = new URL(raw).pathname;
+  } catch {
+    pathname = raw;
+  }
+  return AS_METADATA_WELL_KNOWN_PATHS.some((path) => pathname.includes(path));
+}
+
+/**
+ * Whether a `content-type` names a **whole JSON document** — something that can
+ * be read to completion.
+ *
+ * This must be an exact media-type match, not a substring test for "json". The
+ * streamable-HTTP transport's long-lived server-push channel can be served as
+ * `application/x-ndjson` (see `isLongLivedStreamResponse` in
+ * `core/mcp/fetchTracking.ts`), which is an unbounded stream: awaiting `.json()`
+ * on a clone of it would never resolve, and since this wrapper awaits before
+ * returning, the MCP connection would hang for as long as an override is
+ * configured. Metadata documents are plain `application/json`, so the narrow
+ * test loses nothing. The `+json` structured suffix is accepted for the same
+ * reason it exists — it names a concrete document, not a stream.
+ */
+function isJsonDocumentResponse(contentType: string | null): boolean {
+  if (!contentType) return false;
+  // Strip parameters (`; charset=utf-8`) and compare the media type itself.
+  const mediaType = contentType.split(";")[0].trim().toLowerCase();
+  return mediaType === "application/json" || mediaType.endsWith("+json");
+}
+
+/** Rebuild a response around a replacement body, preserving status/headers. */
+function responseWithBody(response: Response, body: string): Response {
+  const headers = new Headers(response.headers);
+  // The body length changes when an override is applied, and a stale
+  // `content-length` on a synthesized `Response` is worse than none — consumers
+  // read the body we hand them, not the header.
+  headers.delete("content-length");
+  // `fetch` already decoded the body, so the replacement is plain text and an
+  // inherited `content-encoding` would describe an encoding it no longer has.
+  headers.delete("content-encoding");
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
+/**
+ * Wrap a `fetch` so authorization-server metadata responses carry the
+ * configured endpoint overrides.
+ *
+ * `getOverrides` is called per request rather than captured once: the OAuth
+ * config is mutable (a settings edit can change it without rebuilding the
+ * client), and reading it lazily means a wrapped fetch never serves a stale
+ * override. When it returns nothing the response is passed through untouched,
+ * so the wrapper is inert for the overwhelmingly common unconfigured case.
+ */
+export function withOAuthEndpointOverrides(
+  fetchFn: typeof fetch,
+  getOverrides: () => OAuthEndpointOverrides | undefined,
+): typeof fetch {
+  // Normalization is memoized on the raw pair rather than run per request: it
+  // warns about a malformed value, and every request on the connection passes
+  // through here — so without this a single typo would log on every call.
+  let lastKey: string | undefined;
+  let lastNormalized: OAuthEndpointOverrides | undefined;
+
+  const resolveOverrides = (): OAuthEndpointOverrides | undefined => {
+    const raw = getOverrides();
+    const key = JSON.stringify([raw?.authorizationUrl, raw?.tokenUrl]);
+    if (key !== lastKey) {
+      lastKey = key;
+      lastNormalized = normalizeOAuthEndpointOverrides(raw);
+    }
+    return lastNormalized;
+  };
+
+  return async (input, init) => {
+    const response = await fetchFn(input, init);
+    const overrides = resolveOverrides();
+    if (!overrides) return response;
+    // Cheapest tests first: only a discovery request can carry the document
+    // this wrapper rewrites, so ordinary traffic never reaches the clone below.
+    if (!isAuthorizationServerMetadataRequest(input)) return response;
+    if (!response.ok) return response;
+    if (!isJsonDocumentResponse(response.headers.get("content-type")))
+      return response;
+
+    // Read through a clone so every path that does NOT patch can return the
+    // caller's own `Response`, untouched. Rebuilding unconditionally would drop
+    // native properties a synthesized `Response` cannot carry (`url`,
+    // `redirected`, `type`) from responses this wrapper has no business
+    // altering — and would throw outright on a body-less 204/205, whose status
+    // Fetch forbids a body on. A clone also makes a non-JSON body a plain
+    // parse failure with nothing consumed.
+    let parsed: unknown;
+    try {
+      parsed = await response.clone().json();
+    } catch {
+      return response;
+    }
+    if (!isAuthorizationServerMetadata(parsed)) return response;
+    return responseWithBody(
+      response,
+      JSON.stringify(applyOAuthEndpointOverrides(parsed, overrides)),
+    );
+  };
+}
diff --git a/core/auth/index.ts b/core/auth/index.ts
index 53615f8c..f38fcbe0 100644
--- a/core/auth/index.ts
+++ b/core/auth/index.ts
@@ -36,6 +36,16 @@ export {
 } from "./authorizationParams.js";
 export type { ReservedAuthorizationParam } from "./authorizationParams.js";
 
+// Authorization/token endpoint overrides (#1906)
+export {
+  oauthEndpointUrlError,
+  normalizeOAuthEndpointOverrides,
+  isAuthorizationServerMetadata,
+  applyOAuthEndpointOverrides,
+  withOAuthEndpointOverrides,
+} from "./endpointOverrides.js";
+export type { OAuthEndpointOverrides } from "./endpointOverrides.js";
+
 // Storage
 export type {
   OAuthStorage,
diff --git a/core/client/runner.ts b/core/client/runner.ts
index 25cd83f3..5192b674 100644
--- a/core/client/runner.ts
+++ b/core/client/runner.ts
@@ -11,7 +11,10 @@ import type {
   InspectorClientOptions,
   InspectorServerSettings,
 } from "../mcp/types.js";
-import { oauthAuthorizationParamsFromSettings } from "../mcp/serverList.js";
+import {
+  oauthAuthorizationParamsFromSettings,
+  oauthEndpointOverridesFromSettings,
+} from "../mcp/serverList.js";
 import { loadClientConfig } from "./config.js";
 import type { ClientConfig } from "./types.js";
 import {
@@ -74,6 +77,9 @@ export function buildRunnerClientAuthOptions(
   const serverAuthorizationParams = savedSettings
     ? oauthAuthorizationParamsFromSettings(savedSettings)
     : undefined;
+  const serverEndpointOverrides = savedSettings
+    ? oauthEndpointOverridesFromSettings(savedSettings)
+    : undefined;
 
   const oauthFromServer =
     savedSettings &&
@@ -81,6 +87,7 @@ export function buildRunnerClientAuthOptions(
       savedSettings.oauthClientSecret ||
       savedSettings.oauthScopes ||
       serverAuthorizationParams ||
+      serverEndpointOverrides ||
       savedSettings.enterpriseManaged)
       ? {
           ...(savedSettings.oauthClientId && {
@@ -95,6 +102,7 @@ export function buildRunnerClientAuthOptions(
           ...(serverAuthorizationParams && {
             authorizationParams: serverAuthorizationParams,
           }),
+          ...serverEndpointOverrides,
           ...(savedSettings.enterpriseManaged && {
             enterpriseManaged: true,
           }),
diff --git a/core/mcp/inspectorClient.ts b/core/mcp/inspectorClient.ts
index a635582d..09f665bd 100644
--- a/core/mcp/inspectorClient.ts
+++ b/core/mcp/inspectorClient.ts
@@ -218,6 +218,7 @@ import {
   type AuthChallengeOutcome,
   type HandleAuthChallengeOptions,
 } from "../auth/challenge.js";
+import { withOAuthEndpointOverrides } from "../auth/endpointOverrides.js";
 import type { OAuthTokens } from "@modelcontextprotocol/client";
 import { silentLogger, type InspectorLogger } from "../logging/logger.js";
 import { createFetchTracker } from "./fetchTracking.js";
@@ -650,6 +651,16 @@ export class InspectorClient extends InspectorClientEventTarget {
     };
 
     // Effective auth fetch: base fetch + tracking with category 'auth'
+    // #1906: apply the per-server authorization/token endpoint overrides to the
+    // authorization-server metadata document in flight. This wraps the *base*
+    // fetch rather than `effectiveAuthFetch` so it also covers the discovery the
+    // SDK runs from inside the transport (the 401/refresh path), which is handed
+    // `this.fetchFn` directly. The overrides are read lazily — `oauthManager` is
+    // created a few lines below, and `setOAuthConfig` can change them later — so
+    // the wrapper is inert until a server actually configures one.
+    this.fetchFn = withOAuthEndpointOverrides(this.fetchFn ?? fetch, () =>
+      this.oauthManager?.getEndpointOverrides(),
+    );
     this.effectiveAuthFetch = this.buildEffectiveAuthFetch();
 
     this.sessionId = options.sessionId;
@@ -5988,6 +5999,9 @@ export class InspectorClient extends InspectorClientEventTarget {
     scope?: string;
     /** Custom authorization-request parameters (#2018). Authorize URL only. */
     authorizationParams?: Record<string, string>;
+    /** Endpoint overrides applied to the discovered AS metadata (#1906). */
+    authorizationUrl?: string;
+    tokenUrl?: string;
   }): void {
     if (!this.oauthManager) {
       throw new Error(
diff --git a/core/mcp/oauthManager.ts b/core/mcp/oauthManager.ts
index f49aff49..59846e2a 100644
--- a/core/mcp/oauthManager.ts
+++ b/core/mcp/oauthManager.ts
@@ -5,6 +5,7 @@
  */
 
 import { BaseOAuthClientProvider } from "../auth/providers.js";
+import type { OAuthEndpointOverrides } from "../auth/endpointOverrides.js";
 import type { OAuthFlowState, OAuthStep } from "../auth/types.js";
 import { EMPTY_OAUTH_FLOW_STATE } from "../auth/types.js";
 import type { OAuthTokens } from "@modelcontextprotocol/client";
@@ -95,6 +96,8 @@ export class OAuthManager {
     scope?: string;
     enterpriseManaged?: boolean;
     authorizationParams?: Record<string, string>;
+    authorizationUrl?: string;
+    tokenUrl?: string;
   }): void {
     this.oauthConfig = {
       ...this.oauthConfig,
@@ -106,6 +109,31 @@ export class OAuthManager {
     return this.params.getServerUrl();
   }
 
+  /**
+   * The per-server authorization/token endpoint overrides, read live so a
+   * `setOAuthConfig` between requests takes effect without rebuilding the
+   * client's fetch. `InspectorClient` reads this from inside its fetch wrapper.
+   * (#1906)
+   *
+   * Returns nothing under enterprise-managed authorization, for the same reason
+   * `redirectToExternalAuthorization` skips the custom authorization parameters
+   * (#2018): the EMA leg authorizes against the enterprise IdP, a *different*
+   * authorization server, and its OIDC discovery runs through this same fetch
+   * (`emaFlow` → `idpOidc`). Rewriting that document would point the IdP login —
+   * or the IdP code/refresh-token exchange — at the resource server's
+   * authorization server, which is both wrong and a way to leak an IdP
+   * credential across an authorization-server boundary.
+   */
+  getEndpointOverrides(): OAuthEndpointOverrides | undefined {
+    if (this.isEnterpriseManaged()) return undefined;
+    const { authorizationUrl, tokenUrl } = this.oauthConfig;
+    if (!authorizationUrl && !tokenUrl) return undefined;
+    return {
+      ...(authorizationUrl && { authorizationUrl }),
+      ...(tokenUrl && { tokenUrl }),
+    };
+  }
+
   /**
    * Return the configured OAuth storage, throwing a clear error if it is
    * absent. Used on the EMA re-mint/persist paths, which are only reached for
diff --git a/core/mcp/remote/node/server.ts b/core/mcp/remote/node/server.ts
index d0ee6ea1..93000922 100644
--- a/core/mcp/remote/node/server.ts
+++ b/core/mcp/remote/node/server.ts
@@ -99,6 +99,22 @@ import { ZodError } from "zod";
  */
 const SSE_PRIMING_COMMENT = ":\n\n";
 
+/**
+ * Close an SSE stream from inside an `onAbort` listener, discarding the
+ * rejection.
+ *
+ * `close()` is async and the peer is, by definition, already gone here — a
+ * write that loses the race rejects with nothing left to recover. The listener
+ * itself cannot own the promise either: Hono's `abort()` invokes subscribers
+ * with a bare `subscriber()` (`hono/utils/stream`), so a promise *returned*
+ * from the listener is floated by Hono rather than awaited, turning an
+ * `async` listener into the same unhandled rejection one layer up. Swallowing
+ * it here is the only place the rejection has an owner.
+ */
+export function closeAbortedStream(stream: { close(): Promise<void> }): void {
+  stream.close().catch(() => {});
+}
+
 /**
  * Shape of the initial config returned by GET /api/config (defaults for client).
  */
@@ -854,7 +870,7 @@ export function createRemoteApp(
       stream.onAbort(() => {
         // Client disconnected - clear event consumer
         const shouldCleanup = session.clearEventConsumer();
-        stream.close();
+        closeAbortedStream(stream);
 
         // If transport is dead and no client connected, cleanup session
         if (shouldCleanup || session.isTransportDead()) {
@@ -1131,11 +1147,22 @@ export function createRemoteApp(
     clientSecret?: string;
     scopes?: string;
     authorizationParams?: Record<string, string>;
+    authorizationUrl?: string;
+    tokenUrl?: string;
     enterpriseManaged?: boolean;
   } => {
     if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
     const o = v as Record<string, unknown>;
-    for (const k of ["clientId", "clientSecret", "scopes"] as const) {
+    for (const k of [
+      "clientId",
+      "clientSecret",
+      "scopes",
+      // #1906 — shape only; the values are validated as absolute http(s) URLs
+      // where they're applied (core/auth/endpointOverrides.ts), so a typo drops
+      // one field with a warning instead of dropping the whole `oauth` block.
+      "authorizationUrl",
+      "tokenUrl",
+    ] as const) {
       if (o[k] !== undefined && typeof o[k] !== "string") return false;
     }
     if (
@@ -1255,7 +1282,7 @@ export function createRemoteApp(
       if ("oauth" in valObj && !isOauthObject(valObj.oauth)) {
         logWarn(
           { route: "/api/servers", id, droppedKey: "oauth" },
-          "Dropping malformed `oauth` field — expected `{ clientId?, clientSecret?, scopes?, authorizationParams?, enterpriseManaged?, onInsufficientScope? }`.",
+          "Dropping malformed `oauth` field — expected `{ clientId?, clientSecret?, scopes?, authorizationParams?, authorizationUrl?, tokenUrl?, enterpriseManaged?, onInsufficientScope? }`.",
         );
         delete valObj.oauth;
       }
@@ -1522,6 +1549,10 @@ export function createRemoteApp(
       "oauthClientId",
       "oauthClientSecret",
       "oauthScopes",
+      // #1906 — string-shaped on the wire; URL validity is checked where the
+      // override is applied, not here.
+      "oauthAuthorizationUrl",
+      "oauthTokenUrl",
     ] as const) {
       if (obj[optional] !== undefined && typeof obj[optional] !== "string") {
         return { ok: false, error: `settings.${optional} must be a string` };
@@ -1660,6 +1691,18 @@ export function createRemoteApp(
     if (isKvArray(obj.oauthAuthorizationParams)) {
       value.oauthAuthorizationParams = obj.oauthAuthorizationParams;
     }
+    // Empty-string coerces to absent like the credential fields above: the form
+    // emits `""` when a user clears the input, and an empty override on disk
+    // would read back as a configured-but-blank endpoint. (#1906)
+    if (
+      typeof obj.oauthAuthorizationUrl === "string" &&
+      obj.oauthAuthorizationUrl !== ""
+    ) {
+      value.oauthAuthorizationUrl = obj.oauthAuthorizationUrl;
+    }
+    if (typeof obj.oauthTokenUrl === "string" && obj.oauthTokenUrl !== "") {
+      value.oauthTokenUrl = obj.oauthTokenUrl;
+    }
     if (obj.enterpriseManaged === true) {
       value.enterpriseManaged = true;
     }
@@ -2460,7 +2503,7 @@ export function createRemoteApp(
       stream.onAbort(() => {
         serverEventSubscribers.delete(send);
         void maybeStopWatcher();
-        stream.close();
+        closeAbortedStream(stream);
       });
 
       // Hono closes the stream the moment this callback returns, so hold the
diff --git a/core/mcp/serverList.ts b/core/mcp/serverList.ts
index 1f34cab0..f4be5f4a 100644
--- a/core/mcp/serverList.ts
+++ b/core/mcp/serverList.ts
@@ -248,6 +248,56 @@ export function oauthAuthorizationParamsFromSettings(
   return Object.keys(record).length > 0 ? record : undefined;
 }
 
+/**
+ * Validate one of a server's `oauth` endpoint overrides as it comes off disk,
+ * or `undefined` when there is nothing usable. (#1906)
+ *
+ * Same reasoning as `cleanAuthorizationParams` above: `StoredMCPServer` types
+ * these as `string`, but that is a compile-time promise a hand-edited file does
+ * not keep, and the CLI/TUI read `mcp.json` directly. A non-string reaches
+ * `oauthEndpointOverridesFromSettings`, which calls `.trim()` on it — so without
+ * this the whole server list fails to load. URL *validity* is not checked here;
+ * that happens where the override is applied, so a typo drops one field with a
+ * warning instead of anything louder.
+ */
+export function cleanEndpointOverride(
+  value: string | undefined,
+  field: "authorizationUrl" | "tokenUrl",
+): string | undefined {
+  if (value === undefined) return undefined;
+  // Keep: unreachable per the parameter type, reachable from disk.
+  if (typeof value !== "string") {
+    console.warn(
+      `Ignoring \`oauth.${field}\`: expected a string, got ${typeof value}.`,
+    );
+    return undefined;
+  }
+  return value.trim() || undefined;
+}
+
+/**
+ * Collapse a server's endpoint-override fields into the
+ * `InspectorClientOptions.oauth` sub-shape, or `undefined` when neither is set.
+ * Shared by the web (`App.tsx`) and Node (`buildRunnerClientAuthOptions`) paths
+ * so both derive the option identically. The values are passed through as
+ * typed; validation (absolute http(s) URL) happens once at the point of use, in
+ * `core/auth/endpointOverrides.ts`. (#1906)
+ */
+export function oauthEndpointOverridesFromSettings(
+  settings: Pick<
+    InspectorServerSettings,
+    "oauthAuthorizationUrl" | "oauthTokenUrl"
+  >,
+): { authorizationUrl?: string; tokenUrl?: string } | undefined {
+  const authorizationUrl = settings.oauthAuthorizationUrl?.trim();
+  const tokenUrl = settings.oauthTokenUrl?.trim();
+  if (!authorizationUrl && !tokenUrl) return undefined;
+  return {
+    ...(authorizationUrl && { authorizationUrl }),
+    ...(tokenUrl && { tokenUrl }),
+  };
+}
+
 /**
  * Lift the Inspector-extension fields off a freshly-read `StoredMCPServer`
  * into the pair-array / flat-OAuth `InspectorServerSettings` shape the form
@@ -357,6 +407,21 @@ export function storedFieldsToInspectorSettings(
   if (authorizationParams) {
     settings.oauthAuthorizationParams = envRecordToPairs(authorizationParams);
   }
+  // Truthiness drops empty strings like the credential fields above, so a
+  // cleared field reads back as unset rather than as an empty override. The
+  // `string` type is a compile-time promise a hand-edited `mcp.json` does not
+  // keep, and only the web client's `/api/servers` route checks it — the CLI and
+  // TUI read the file directly and then call `.trim()` on these in
+  // `oauthEndpointOverridesFromSettings`, so a non-string would crash the server
+  // load. Sanitized like `authorizationParams` above rather than trusted.
+  // (#1906)
+  const authorizationUrl = cleanEndpointOverride(
+    stored.oauth?.authorizationUrl,
+    "authorizationUrl",
+  );
+  if (authorizationUrl) settings.oauthAuthorizationUrl = authorizationUrl;
+  const tokenUrl = cleanEndpointOverride(stored.oauth?.tokenUrl, "tokenUrl");
+  if (tokenUrl) settings.oauthTokenUrl = tokenUrl;
   if (stored.oauth?.onInsufficientScope) {
     settings.oauthOnInsufficientScope = stored.oauth.onInsufficientScope;
   }
@@ -474,6 +539,14 @@ export function inspectorSettingsToStoredFields(
       oauthFields.authorizationParams = authParams;
     }
   }
+  // Empty/blank reads back as unset (above), so a cleared field writes nothing
+  // and the file diff stays minimal for servers that never set one. (#1906)
+  if (settings.oauthAuthorizationUrl?.trim()) {
+    oauthFields.authorizationUrl = settings.oauthAuthorizationUrl.trim();
+  }
+  if (settings.oauthTokenUrl?.trim()) {
+    oauthFields.tokenUrl = settings.oauthTokenUrl.trim();
+  }
   if (settings.oauthOnInsufficientScope) {
     oauthFields.onInsufficientScope = settings.oauthOnInsufficientScope;
   }
diff --git a/core/mcp/types.ts b/core/mcp/types.ts
index ece4e1be..3b92eb2c 100644
--- a/core/mcp/types.ts
+++ b/core/mcp/types.ts
@@ -176,6 +176,19 @@ export type StoredMCPServer = MCPServerConfig & {
      * (#2018)
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Overrides the `authorization_endpoint` the authorization server's
+     * metadata document advertises — for pointing a server at a development or
+     * staging authorization server without changing what it publishes.
+     * Inspector-specific. (#1906)
+     */
+    authorizationUrl?: string;
+    /**
+     * Overrides the `token_endpoint` the authorization server's metadata
+     * document advertises. Independent of {@link authorizationUrl}.
+     * Inspector-specific. (#1906)
+     */
+    tokenUrl?: string;
   };
   /**
    * Filesystem/URI roots advertised to the server via the `roots` client
@@ -534,6 +547,13 @@ export interface OAuthSettings {
    * (#2018)
    */
   authorizationParams?: { key: string; value: string }[];
+  /**
+   * Endpoint overrides applied to the discovered authorization-server metadata
+   * (#1906). Optional for the same reason as `authorizationParams` — callers
+   * building an `OAuthSettings` for the other fields need not supply them.
+   */
+  authorizationUrl?: string;
+  tokenUrl?: string;
   enterpriseManaged?: boolean;
   onInsufficientScope?: OnInsufficientScopePolicy;
 }
@@ -699,6 +719,18 @@ export interface InspectorServerSettings {
    * the way there. Applied to the authorization request only. (#2018)
    */
   oauthAuthorizationParams?: { key: string; value: string }[];
+  /**
+   * Overrides the authorization endpoint discovery resolved, so a server can be
+   * pointed at a development or staging authorization server without changing
+   * what it advertises. Empty/absent means "use what discovery returned".
+   * Persisted as `oauth.authorizationUrl`. (#1906)
+   */
+  oauthAuthorizationUrl?: string;
+  /**
+   * Overrides the token endpoint discovery resolved. Independent of
+   * {@link oauthAuthorizationUrl}; persisted as `oauth.tokenUrl`. (#1906)
+   */
+  oauthTokenUrl?: string;
   /**
    * SEP-2350 step-up policy for a `403 insufficient_scope` challenge on this
    * server's HTTP transport. Defaults to `reauthorize` when unset.
@@ -1064,6 +1096,13 @@ export interface InspectorClientOptions {
      * (#2018). Reserved, protocol-critical keys are dropped with a warning.
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Overrides for the endpoints the authorization server's metadata document
+     * advertises (#1906). Applied to the discovered document, so they reach both
+     * the authorization request and the token request.
+     */
+    authorizationUrl?: string;
+    tokenUrl?: string;
   };
 
   /**
diff --git a/core/react/useServers.ts b/core/react/useServers.ts
index 3a2a5002..c9713344 100644
--- a/core/react/useServers.ts
+++ b/core/react/useServers.ts
@@ -90,10 +90,38 @@ async function readErrorMessage(res: Response): Promise<string> {
  */
 function isSseDataFrame(frame: string): boolean {
   return frame
-    .split("\n")
+    .split(SSE_LINE_SEPARATOR)
     .some((line) => line.startsWith("event:") || line.startsWith("data:"));
 }
 
+/**
+ * SSE line terminators. The spec permits CRLF, LF, and a bare CR; we accept
+ * the first two. A bare CR is deliberately excluded because it can't be told
+ * apart from the first half of a CRLF that straddles a chunk boundary — a
+ * buffer ending in `…\r\n\r` would look like a completed frame and the `\n`
+ * arriving in the next chunk would be mis-read as the start of another. No
+ * SSE producer in the wild emits bare-CR frames, so the ambiguity buys
+ * nothing.
+ *
+ * A frame ends at a blank line, i.e. two terminators back to back.
+ */
+const SSE_LINE_SEPARATOR = /\r\n|\n/;
+const SSE_FRAME_SEPARATOR = /(?:\r\n|\n){2}/;
+
+/**
+ * Locates the next frame boundary in `buffer`. Returns the frame's end offset
+ * and the length of the blank-line separator that terminated it (2–4 chars,
+ * depending on which terminators the server used), or `null` when the buffer
+ * holds no complete frame yet.
+ */
+function findSseFrameEnd(
+  buffer: string,
+): { end: number; separatorLength: number } | null {
+  const match = SSE_FRAME_SEPARATOR.exec(buffer);
+  if (!match) return null;
+  return { end: match.index, separatorLength: match[0].length };
+}
+
 export function useServers(opts: UseServersOptions): UseServersResult {
   const { baseUrl, authToken, fetchFn } = opts;
   const doFetch = fetchFn ?? globalThis.fetch;
@@ -163,7 +191,9 @@ export function useServers(opts: UseServersOptions): UseServersResult {
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         let buffer = "";
-        // SSE frames are separated by a blank line (`\n\n`). We don't parse
+        // SSE frames are separated by a blank line — LF- or CRLF-terminated,
+        // both of which the spec permits and `findSseFrameEnd` accepts (#2006).
+        // We don't parse
         // the event type or data — `refreshInternal()` re-fetches the
         // canonical state regardless — so we just count frames and fire a
         // single background refresh per decode chunk. Two `change`
@@ -183,12 +213,12 @@ export function useServers(opts: UseServersOptions): UseServersResult {
           if (done) break;
           buffer += decoder.decode(value, { stream: true });
           let sawFrame = false;
-          let frameEnd = buffer.indexOf("\n\n");
-          while (frameEnd !== -1) {
-            const frame = buffer.slice(0, frameEnd);
-            buffer = buffer.slice(frameEnd + 2);
+          let boundary = findSseFrameEnd(buffer);
+          while (boundary !== null) {
+            const frame = buffer.slice(0, boundary.end);
+            buffer = buffer.slice(boundary.end + boundary.separatorLength);
             if (isSseDataFrame(frame)) sawFrame = true;
-            frameEnd = buffer.indexOf("\n\n");
+            boundary = findSseFrameEnd(buffer);
           }
           if (sawFrame) void refreshInternal(true);
         }
diff --git a/docs/mcp-server-configuration.md b/docs/mcp-server-configuration.md
index 1fa58a7a..ac105f3a 100644
--- a/docs/mcp-server-configuration.md
+++ b/docs/mcp-server-configuration.md
@@ -175,10 +175,18 @@ These have no analog in the broader `mcp.json` ecosystem. Each is **omitted on w
 | `paginatedLists`                       | `false`    | Fetch tools/resources/prompts one page at a time instead of auto-aggregating                        |
 | `advertisedExtensions`                 | —          | Per-extension overrides for what the Inspector declares in `capabilities.extensions`                |
 | `maxFetchRequests`                     | `1000`     | Network-log retention for this server (`DEFAULT_MAX_FETCH_REQUESTS`); `0` means unlimited           |
-| `oauth`                                | —          | `{ clientId, clientSecret, scopes, authorizationParams, enterpriseManaged, onInsufficientScope }`   |
+| `oauth`                                | —          | `{ clientId, clientSecret, scopes, authorizationParams, authorizationUrl, tokenUrl, enterpriseManaged, onInsufficientScope }` |
 
 `oauth.authorizationParams` is a string→string record of extra query parameters merged into the OAuth **authorization request** URL only — never the token request. Use it for provider-specific hints the core specs don't standardize (Keycloak's `kc_idp_hint`, OIDC's `login_hint` / `prompt` / `acr_values`, Auth0's `audience`). The protocol-critical parameters — `client_id`, `code_challenge`, `code_challenge_method`, `redirect_uri`, `resource`, `response_type`, `scope`, `state` — are **reserved**: the web form rejects them inline, and any that reach the merge anyway are dropped with a warning rather than overriding what the flow set (overriding them breaks PKCE, the CSRF state binding, or RFC 8707). Edit them in Server Settings → Authorization ("Additional authorization parameters"), beside Scopes.
 
+`oauth.authorizationUrl` and `oauth.tokenUrl` override the `authorization_endpoint` and `token_endpoint` that authorization-server metadata discovery resolved. The Inspector deliberately has no such fields by default — it resolves both from the AS's metadata document, exactly as a real MCP host does — but a server under development often advertises its *production* authorization server while you want to hit staging. Set either (they are independent) to an absolute `http(s)` URL and it replaces what the metadata returned, for both the authorization request and the token request; leave blank to use discovery. A malformed value is flagged inline in the form and dropped with a warning at connect time rather than failing the connection. Edit them in Server Settings → Authorization ("Authorization URL override" / "Token URL override").
+
+They redirect the **endpoints**, not the authorization server's identity: `issuer` is left exactly as discovery returned it, because that is what RFC 9207 / SEP-2352 validate the callback's `iss` against to defend against an authorization-server mix-up. So they fit alternate endpoints of the *same* logical issuer — a staging deployment fronting the same issuer, a local proxy. Point one at an authorization server advertising a **different** issuer and the callback is rejected as an issuer mismatch before the code is redeemed; that is the mix-up defense working, and it is not disabled to make the override succeed.
+
+They are **not applied under enterprise-managed authorization** (`oauth.enterpriseManaged`), for the same reason `oauth.authorizationParams` isn't: that flow authorizes against the enterprise IdP — a different authorization server, whose OIDC discovery would otherwise be rewritten too, pointing the IdP login (or the IdP code exchange) at the resource server's authorization server.
+
+> Because the override is applied to the *discovered metadata document*, a server whose authorization server publishes no metadata at all is unaffected — there the SDK falls back to `/authorize` and `/token` on the AS origin, and there is nothing to override.
+
 A catalog carrying these fields:
 
 ```json
diff --git a/eslint.config.js b/eslint.config.js
index dfa945d1..b133e612 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -10,6 +10,31 @@ import { defineConfig, globalIgnores } from "eslint/config";
 // isomorphic TypeScript (browser-side OAuth + Node backends + shared runtime);
 // the shared surface is Node-only tooling/tests. Neither has JSX, so no React
 // plugin is needed.
+// Type-aware linting for the two blocks below. `no-floating-promises` needs
+// type information, which `tseslint.configs.recommended` (the non-type-aware
+// set) does not provide — so each block adds a parser project (#1959).
+//
+// `tsconfig.lint.json` exists for this and nothing else: the root has no
+// tsconfig of its own (`core/` is typechecked through `clients/web`'s
+// `tsc -b`, `test-servers/src` through `clients/cli`'s test project), and a
+// parser project must literally *contain* every file it is asked to lint.
+const typeAware = {
+  languageOptions: {
+    parserOptions: {
+      project: ["./tsconfig.lint.json"],
+      tsconfigRootDir: import.meta.dirname,
+    },
+  },
+  rules: {
+    // The class this catches is invisible at review time: the call reads like
+    // an awaited one minus four characters, and the unhandled rejection it
+    // produces surfaces in a different test, in a different file, as a stack
+    // pointing at SDK internals — which is how #1947 came to fail the whole
+    // `npm run ci` chain from two un-held `callTool` promises.
+    "@typescript-eslint/no-floating-promises": "error",
+  },
+};
+
 const sharedRules = {
   // An `_`-prefix is the explicit "intentionally unused" marker —
   // interface-conformance params in fakes, destructuring-rest omissions,
@@ -59,4 +84,15 @@ export default defineConfig([
     },
     rules: sharedRules,
   },
+  {
+    // Type-aware pass over the same surface, minus `eslint.config.js` — it is
+    // JavaScript, so no tsconfig contains it and asking the parser for a
+    // project would fail it outright rather than lint it.
+    files: [
+      "core/**/*.{ts,tsx}",
+      "test-servers/src/**/*.{ts,tsx,mts,cts}",
+      "vitest.shared.mts",
+    ],
+    ...typeAware,
+  },
 ]);
diff --git a/test-servers/configs/mrtr-showcase-http.json b/test-servers/configs/mrtr-showcase-http.json
index 026d43c0..84e309fd 100644
--- a/test-servers/configs/mrtr-showcase-http.json
+++ b/test-servers/configs/mrtr-showcase-http.json
@@ -10,6 +10,7 @@
     { "preset": "mrtr_sample" },
     { "preset": "mrtr_roots" },
     { "preset": "mrtr_edge" },
+    { "preset": "mrtr_empty" },
     { "preset": "mrtr_loop" }
   ],
   "transport": {
diff --git a/test-servers/src/preset-registry.ts b/test-servers/src/preset-registry.ts
index d78998ec..be840183 100644
--- a/test-servers/src/preset-registry.ts
+++ b/test-servers/src/preset-registry.ts
@@ -29,6 +29,7 @@ import {
   createMrtrSamplingTool,
   createMrtrLoopTool,
   createMrtrEdgeCaseTool,
+  createMrtrEmptyResultTool,
   createCollectUrlElicitationTool,
   createUrlElicitationFormTool,
   createSendNotificationTool,
@@ -151,6 +152,8 @@ function resolveToolPreset(
       return createMrtrLoopTool();
     case "mrtr_edge":
       return createMrtrEdgeCaseTool();
+    case "mrtr_empty":
+      return createMrtrEmptyResultTool();
     case "collect_url_elicitation":
       return createCollectUrlElicitationTool();
     case "url_elicitation_form":
diff --git a/test-servers/src/test-server-fixtures.ts b/test-servers/src/test-server-fixtures.ts
index 070b5750..469100ea 100644
--- a/test-servers/src/test-server-fixtures.ts
+++ b/test-servers/src/test-server-fixtures.ts
@@ -755,6 +755,50 @@ export function createMrtrEdgeCaseTool(): ToolDefinition {
   };
 }
 
+/**
+ * An MRTR tool whose FINAL (complete) result carries an empty `content` array
+ * and no `structuredContent` — a legal `CallToolResult` that renders nothing.
+ *
+ * This is the shape behind #1860: the sequence completes (the Protocol tab shows
+ * the conversation COMPLETE), a real result is stored, and the Results panel had
+ * no way to say so — it fell through to the same "No results yet" placeholder it
+ * shows before anything has run, so a successful call read as a call that never
+ * happened. Kept as an MRTR tool rather than a plain one because the multi-round
+ * case is where the ambiguity actually misleads: the user has answered prompts
+ * and watched rounds complete, so "no results yet" is flatly contradicted by
+ * what they just did.
+ */
+export function createMrtrEmptyResultTool(): ToolDefinition {
+  return {
+    name: "mrtr_empty",
+    description:
+      "MRTR tool that completes with an empty result (no content, no structuredContent).",
+    inputSchema: {},
+    handler: async (
+      _params: Record<string, unknown>,
+      _context?: TestServerContext,
+      extra?: HandlerExtra,
+    ) => {
+      if (extra?.inputResponses?.ack === undefined) {
+        return inputRequired({
+          inputRequests: {
+            ack: inputRequired.elicit({
+              message: "Acknowledge to finish (the result will be empty)",
+              requestedSchema: {
+                type: "object",
+                properties: { ack: { type: "boolean", title: "Acknowledge" } },
+                required: ["ack"],
+              },
+            }),
+          },
+          requestState: `mrtr-empty:${++mrtrMintCount}`,
+        });
+      }
+      return { content: [] } satisfies CallToolResult;
+    },
+  };
+}
+
 /**
  * Create a "url_elicitation_form" tool that spins up a simple HTTP server on a dynamic
  * port with a form page, sends that URL via URL elicitation, and on form submit collects
diff --git a/tsconfig.lint.json b/tsconfig.lint.json
new file mode 100644
index 00000000..4fb3447a
--- /dev/null
+++ b/tsconfig.lint.json
@@ -0,0 +1,35 @@
+{
+  // Parser project for the ROOT eslint config's type-aware rules (#1959), and
+  // nothing else — it emits nothing and gates nothing.
+  //
+  // `@typescript-eslint/no-floating-promises` needs a program containing the
+  // file being linted, and the root scope (`core/**`, `test-servers/src/**`,
+  // `vitest.shared.mts`) has no tsconfig of its own: `core/` is typechecked
+  // through `clients/web`'s `tsc -b` and `test-servers/src` through
+  // `clients/cli`'s test project, neither of which is rooted here. Type
+  // *checking* stays where it is; this file only gives the parser a program.
+  //
+  // `moduleResolution: bundler` because `core/` is written for a bundler
+  // (extensionless relative imports) — under NodeNext those fail to resolve,
+  // every import degrades to `any`, and the rule silently stops seeing
+  // promises at all.
+  "extends": "./tsconfig.base.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2023", "DOM", "DOM.Iterable"],
+    "jsx": "react-jsx",
+    "types": ["node"],
+    "typeRoots": ["./clients/web/node_modules/@types", "./node_modules/@types"]
+  },
+  "include": [
+    "core/**/*.ts",
+    "core/**/*.tsx",
+    "test-servers/src/**/*.ts",
+    "test-servers/src/**/*.tsx",
+    "test-servers/src/**/*.mts",
+    "test-servers/src/**/*.cts",
+    "vitest.shared.mts"
+  ]
+}