modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

refactor(core): apply v1.5-port cleanups deferred from #1306 (#1316)

Browse source 
* refactor(core): apply v1.5-port cleanups deferred from #1306

Addresses issue #1309 — five small, mechanical cleanups deferred from the
v1.5 runtime port:

1. Collapse BrowserOAuthStorage / NodeOAuthStorage / RemoteOAuthStorage
   onto a shared OAuthStorageBase. Three ~130-line duplicates become
   thin adapter wrappers; behavior + public API unchanged.
2. Re-enable erasableSyntaxOnly in tsconfig.app.json by rewriting the
   seven (plus two the issue missed in sampling/elicitation create-
   message) parameter-property constructors as explicit field + assign.
3. Route the lone console.error in inspectorClient.ts through this.logger.
4. Replace `${Date.now()}-${Math.random()}` with crypto.randomUUID() at
   the five local-only ID sites (message tracking + sampling/elicit).
5. Pin the remote-server hono app generic at new Hono<Env>() and drop
   the streamSSE cast. Root cause of the cast was an unresolved hono
   subpath: the tsconfig "hono/*" wildcard didn't honor the exports
   map, so hono/streaming leaked to the root-hoisted hono@4.12.12 while
   hono itself resolved to clients/web/hono@4.12.18. Replaced the
   wildcard with an explicit hono/streaming entry in both tsconfig.app
   and tsconfig.test, removing the package-identity mismatch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(core): address #1316 PR review feedback

- Drop the stranded no-op getServerState() read at the top of
  clearClientInformation in OAuthStorageBase (carried over verbatim
  from the three originals).
- Drop the crypto.randomUUID() guard at the task-ID site so all
  six in-scope sites are consistent; the fallback branch was dead
  code on every supported runtime.
- Remove the residual `c as Context` cast at the streamSSE call site
  in core/mcp/remote/node/server.ts — once both hono imports
  resolve to the same package the route-typed Context flows through
  to streamSSE with no cast at all.
- Move the new `options` / `config` field declarations in
  RemoteClientTransport up with the rest of the field block, matching
  the layout used by the other five rewritten classes in this PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-05-17 19:15:48 -04:00 • committed by GitHub
commit 82269e78cb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
15 changed files with 236 additions and 449 deletions
Download patch file Download diff file Expand all files Collapse all files

10
clients/web/tsconfig.app.json
View file

@ -20,11 +20,7 @@
"strict": true,
"noUnusedLocals": true,
"noUnusedParameters": true,
/* erasableSyntaxOnly disabled: the ported v1.5 core/ subsystem (#1302)
* uses TS parameter properties (`constructor(private foo: T)`) extensively.
* Re-enable once we either rewrite those constructors or move core/ to
* a separate tsconfig with looser rules. */
"erasableSyntaxOnly": false,
"erasableSyntaxOnly": true,
"noFallthroughCasesInSwitch": true,
"noUncheckedSideEffectImports": true,
@ -44,7 +40,9 @@
"zustand": ["./node_modules/zustand"],
"zustand/*": ["./node_modules/zustand/*"],
"hono": ["./node_modules/hono"],
"hono/*": ["./node_modules/hono/*"],
"hono/streaming": [
"./node_modules/hono/dist/types/helper/streaming/index"
],
"@hono/node-server": ["./node_modules/@hono/node-server"],
"atomically": ["./node_modules/atomically"]
}

4
clients/web/tsconfig.test.json
View file

@ -14,7 +14,9 @@
"zustand": ["./node_modules/zustand"],
"zustand/*": ["./node_modules/zustand/*"],
"hono": ["./node_modules/hono"],
"hono/*": ["./node_modules/hono/*"],
"hono/streaming": [
"./node_modules/hono/dist/types/helper/streaming/index"
],
"@hono/node-server": ["./node_modules/@hono/node-server"],
"atomically": ["./node_modules/atomically"],
"express": ["./node_modules/@types/express"],

138
core/auth/browser/storage.ts
View file

@ -1,145 +1,15 @@
import { createJSONStorage } from "zustand/middleware";
import type { OAuthStorage } from "../storage.js";
import type {
OAuthClientInformation,
OAuthTokens,
OAuthMetadata,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import {
OAuthClientInformationSchema,
OAuthTokensSchema,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import { createOAuthStore, type ServerOAuthState } from "../store.js";
import { OAuthStorageBase } from "../oauth-storage.js";
import { createOAuthStore } from "../store.js";
/**
* Browser storage implementation using Zustand with sessionStorage.
* For web client (can be used by InspectorClient in browser).
*/
export class BrowserOAuthStorage implements OAuthStorage {
private store: ReturnType<typeof createOAuthStore>;
export class BrowserOAuthStorage extends OAuthStorageBase {
constructor() {
// Use Zustand's built-in sessionStorage adapter
// The `name` option in persist() ("mcp-inspector-oauth") becomes the sessionStorage key
const storage = createJSONStorage(() => sessionStorage);
this.store = createOAuthStore(storage);
}
async getClientInformation(
serverUrl: string,
isPreregistered?: boolean,
): Promise<OAuthClientInformation | undefined> {
const state = this.store.getState().getServerState(serverUrl);
const clientInfo = isPreregistered
? state.preregisteredClientInformation
: state.clientInformation;
if (!clientInfo) {
return undefined;
}
return await OAuthClientInformationSchema.parseAsync(clientInfo);
}
async saveClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
clientInformation,
});
}
async savePreregisteredClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
preregisteredClientInformation: clientInformation,
});
}
clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
this.store.getState().getServerState(serverUrl);
const updates: Partial<ServerOAuthState> = {};
if (isPreregistered) {
updates.preregisteredClientInformation = undefined;
} else {
updates.clientInformation = undefined;
}
this.store.getState().setServerState(serverUrl, updates);
}
async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
const state = this.store.getState().getServerState(serverUrl);
if (!state.tokens) {
return undefined;
}
return await OAuthTokensSchema.parseAsync(state.tokens);
}
async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
this.store.getState().setServerState(serverUrl, { tokens });
}
clearTokens(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { tokens: undefined });
}
getCodeVerifier(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.codeVerifier;
}
async saveCodeVerifier(
serverUrl: string,
codeVerifier: string,
): Promise<void> {
this.store.getState().setServerState(serverUrl, { codeVerifier });
}
clearCodeVerifier(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { codeVerifier: undefined });
}
getScope(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.scope;
}
async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
this.store.getState().setServerState(serverUrl, { scope });
}
clearScope(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { scope: undefined });
}
getServerMetadata(serverUrl: string): OAuthMetadata | null {
const state = this.store.getState().getServerState(serverUrl);
return state.serverMetadata || null;
}
async saveServerMetadata(
serverUrl: string,
metadata: OAuthMetadata,
): Promise<void> {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: metadata });
}
clearServerMetadata(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: undefined });
}
clear(serverUrl: string): void {
this.store.getState().clearServerState(serverUrl);
super(createOAuthStore(createJSONStorage(() => sessionStorage)));
}
}

142
core/auth/node/storage-node.ts
View file

@ -1,14 +1,5 @@
import type { OAuthStorage } from "../storage.js";
import type {
OAuthClientInformation,
OAuthTokens,
OAuthMetadata,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import {
OAuthClientInformationSchema,
OAuthTokensSchema,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import { createOAuthStore, type ServerOAuthState } from "../store.js";
import { OAuthStorageBase } from "../oauth-storage.js";
import { createOAuthStore } from "../store.js";
import { createFileStorageAdapter } from "../../storage/adapters/file-storage.js";
import {
getDefaultStorageDir,
@ -59,135 +50,14 @@ export function clearAllOAuthClientState(): void {
}
/**
* Node.js storage implementation using Zustand with file-based persistence
* For InspectorClient, CLI, and TUI
* Node.js storage implementation using Zustand with file-based persistence.
* For InspectorClient, CLI, and TUI.
*/
export class NodeOAuthStorage implements OAuthStorage {
private store: ReturnType<typeof getOAuthStore>;
export class NodeOAuthStorage extends OAuthStorageBase {
/**
* @param storagePath - Optional path to state file. Default: ~/.mcp-inspector/oauth/state.json
*/
constructor(storagePath?: string) {
this.store = getOAuthStore(storagePath);
}
async getClientInformation(
serverUrl: string,
isPreregistered?: boolean,
): Promise<OAuthClientInformation | undefined> {
const state = this.store.getState().getServerState(serverUrl);
const clientInfo = isPreregistered
? state.preregisteredClientInformation
: state.clientInformation;
if (!clientInfo) {
return undefined;
}
return await OAuthClientInformationSchema.parseAsync(clientInfo);
}
async saveClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
clientInformation,
});
}
async savePreregisteredClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
preregisteredClientInformation: clientInformation,
});
}
clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
this.store.getState().getServerState(serverUrl);
const updates: Partial<ServerOAuthState> = {};
if (isPreregistered) {
updates.preregisteredClientInformation = undefined;
} else {
updates.clientInformation = undefined;
}
this.store.getState().setServerState(serverUrl, updates);
}
async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
const state = this.store.getState().getServerState(serverUrl);
if (!state.tokens) {
return undefined;
}
return await OAuthTokensSchema.parseAsync(state.tokens);
}
async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
this.store.getState().setServerState(serverUrl, { tokens });
}
clearTokens(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { tokens: undefined });
}
getCodeVerifier(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.codeVerifier;
}
async saveCodeVerifier(
serverUrl: string,
codeVerifier: string,
): Promise<void> {
this.store.getState().setServerState(serverUrl, { codeVerifier });
}
clearCodeVerifier(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { codeVerifier: undefined });
}
getScope(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.scope;
}
async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
this.store.getState().setServerState(serverUrl, { scope });
}
clearScope(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { scope: undefined });
}
getServerMetadata(serverUrl: string): OAuthMetadata | null {
const state = this.store.getState().getServerState(serverUrl);
return state.serverMetadata || null;
}
async saveServerMetadata(
serverUrl: string,
metadata: OAuthMetadata,
): Promise<void> {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: metadata });
}
clearServerMetadata(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: undefined });
}
clear(serverUrl: string): void {
this.store.getState().clearServerState(serverUrl);
super(getOAuthStore(storagePath));
}
}

142
core/auth/oauth-storage.ts Normal file
View file

@ -0,0 +1,142 @@
import type {
OAuthClientInformation,
OAuthTokens,
OAuthMetadata,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import {
OAuthClientInformationSchema,
OAuthTokensSchema,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import type { OAuthStorage } from "./storage.js";
import { type createOAuthStore, type ServerOAuthState } from "./store.js";
/**
* Concrete OAuthStorage implementation parameterized on a Zustand store.
* The store carries the storage adapter (sessionStorage, file, remote HTTP, …),
* so the same body works for browser, Node, and remote environments.
*/
export class OAuthStorageBase implements OAuthStorage {
private readonly store: ReturnType<typeof createOAuthStore>;
constructor(store: ReturnType<typeof createOAuthStore>) {
this.store = store;
}
async getClientInformation(
serverUrl: string,
isPreregistered?: boolean,
): Promise<OAuthClientInformation | undefined> {
const state = this.store.getState().getServerState(serverUrl);
const clientInfo = isPreregistered
? state.preregisteredClientInformation
: state.clientInformation;
if (!clientInfo) {
return undefined;
}
return await OAuthClientInformationSchema.parseAsync(clientInfo);
}
async saveClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
clientInformation,
});
}
async savePreregisteredClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
preregisteredClientInformation: clientInformation,
});
}
clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
const updates: Partial<ServerOAuthState> = {};
if (isPreregistered) {
updates.preregisteredClientInformation = undefined;
} else {
updates.clientInformation = undefined;
}
this.store.getState().setServerState(serverUrl, updates);
}
async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
const state = this.store.getState().getServerState(serverUrl);
if (!state.tokens) {
return undefined;
}
return await OAuthTokensSchema.parseAsync(state.tokens);
}
async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
this.store.getState().setServerState(serverUrl, { tokens });
}
clearTokens(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { tokens: undefined });
}
getCodeVerifier(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.codeVerifier;
}
async saveCodeVerifier(
serverUrl: string,
codeVerifier: string,
): Promise<void> {
this.store.getState().setServerState(serverUrl, { codeVerifier });
}
clearCodeVerifier(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { codeVerifier: undefined });
}
getScope(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.scope;
}
async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
this.store.getState().setServerState(serverUrl, { scope });
}
clearScope(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { scope: undefined });
}
getServerMetadata(serverUrl: string): OAuthMetadata | null {
const state = this.store.getState().getServerState(serverUrl);
return state.serverMetadata || null;
}
async saveServerMetadata(
serverUrl: string,
metadata: OAuthMetadata,
): Promise<void> {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: metadata });
}
clearServerMetadata(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: undefined });
}
clear(serverUrl: string): void {
this.store.getState().clearServerState(serverUrl);
}
}

9
core/auth/providers.ts
View file

@ -51,8 +51,11 @@ export type OAuthNavigationCallback = (
*/
export class CallbackNavigation implements OAuthNavigation {
private authorizationUrl: URL | null = null;
private callback: OAuthNavigationCallback;
constructor(private callback: OAuthNavigationCallback) {}
constructor(callback: OAuthNavigationCallback) {
this.callback = callback;
}
navigateToAuthorization(authorizationUrl: URL): void {
this.authorizationUrl = authorizationUrl;
@ -100,6 +103,7 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
private capturedAuthUrl: URL | null = null;
private eventTarget: EventTarget | null = null;
protected serverUrl: string;
protected storage: OAuthStorage;
protected redirectUrlProvider: RedirectUrlProvider;
protected navigation: OAuthNavigation;
@ -107,10 +111,11 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
protected mode: "normal" | "guided";
constructor(
protected serverUrl: string,
serverUrl: string,
oauthConfig: OAuthProviderConfig,
mode: "normal" | "guided" = "normal",
) {
this.serverUrl = serverUrl;
this.storage = oauthConfig.storage;
this.redirectUrlProvider = oauthConfig.redirectUrlProvider;
this.navigation = oauthConfig.navigation;

153
core/auth/remote/storage-remote.ts
View file

@ -4,17 +4,8 @@
* For web clients that need to share state with Node apps.
*/
import type { OAuthStorage } from "../storage.js";
import type {
OAuthClientInformation,
OAuthTokens,
OAuthMetadata,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import {
OAuthClientInformationSchema,
OAuthTokensSchema,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import { createOAuthStore, type ServerOAuthState } from "../store.js";
import { OAuthStorageBase } from "../oauth-storage.js";
import { createOAuthStore } from "../store.js";
import { createRemoteStorageAdapter } from "../../storage/adapters/remote-storage.js";
export interface RemoteOAuthStorageOptions {
@ -33,135 +24,17 @@ export interface RemoteOAuthStorageOptions {
* Stores OAuth state via HTTP API (GET/POST/DELETE /api/storage/:storeId).
* For web clients that need to share state with Node apps (TUI, CLI).
*/
export class RemoteOAuthStorage implements OAuthStorage {
private store: ReturnType<typeof createOAuthStore>;
export class RemoteOAuthStorage extends OAuthStorageBase {
constructor(options: RemoteOAuthStorageOptions) {
const storage = createRemoteStorageAdapter({
baseUrl: options.baseUrl,
storeId: options.storeId ?? "oauth",
authToken: options.authToken,
fetchFn: options.fetchFn,
});
this.store = createOAuthStore(storage);
}
async getClientInformation(
serverUrl: string,
isPreregistered?: boolean,
): Promise<OAuthClientInformation | undefined> {
const state = this.store.getState().getServerState(serverUrl);
const clientInfo = isPreregistered
? state.preregisteredClientInformation
: state.clientInformation;
if (!clientInfo) {
return undefined;
}
return await OAuthClientInformationSchema.parseAsync(clientInfo);
}
async saveClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
clientInformation,
});
}
async savePreregisteredClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
preregisteredClientInformation: clientInformation,
});
}
clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
this.store.getState().getServerState(serverUrl);
const updates: Partial<ServerOAuthState> = {};
if (isPreregistered) {
updates.preregisteredClientInformation = undefined;
} else {
updates.clientInformation = undefined;
}
this.store.getState().setServerState(serverUrl, updates);
}
async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
const state = this.store.getState().getServerState(serverUrl);
if (!state.tokens) {
return undefined;
}
return await OAuthTokensSchema.parseAsync(state.tokens);
}
async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
this.store.getState().setServerState(serverUrl, { tokens });
}
clearTokens(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { tokens: undefined });
}
getCodeVerifier(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.codeVerifier;
}
async saveCodeVerifier(
serverUrl: string,
codeVerifier: string,
): Promise<void> {
this.store.getState().setServerState(serverUrl, { codeVerifier });
}
clearCodeVerifier(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { codeVerifier: undefined });
}
getScope(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.scope;
}
async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
this.store.getState().setServerState(serverUrl, { scope });
}
clearScope(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { scope: undefined });
}
getServerMetadata(serverUrl: string): OAuthMetadata | null {
const state = this.store.getState().getServerState(serverUrl);
return state.serverMetadata || null;
}
async saveServerMetadata(
serverUrl: string,
metadata: OAuthMetadata,
): Promise<void> {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: metadata });
}
clearServerMetadata(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: undefined });
}
clear(serverUrl: string): void {
this.store.getState().clearServerState(serverUrl);
super(
createOAuthStore(
createRemoteStorageAdapter({
baseUrl: options.baseUrl,
storeId: options.storeId ?? "oauth",
authToken: options.authToken,
fetchFn: options.fetchFn,
}),
),
);
}
}

20
core/auth/state-machine.ts
View file

@ -256,12 +256,22 @@ export const oauthTransitions: Record<OAuthStep, StateTransition> = {
};
export class OAuthStateMachine {
private serverUrl: string;
private provider: BaseOAuthClientProvider;
private updateState: (updates: Partial<AuthGuidedState>) => void;
private fetchFn?: typeof fetch;
constructor(
private serverUrl: string,
private provider: BaseOAuthClientProvider,
private updateState: (updates: Partial<AuthGuidedState>) => void,
private fetchFn?: typeof fetch,
) {}
serverUrl: string,
provider: BaseOAuthClientProvider,
updateState: (updates: Partial<AuthGuidedState>) => void,
fetchFn?: typeof fetch,
) {
this.serverUrl = serverUrl;
this.provider = provider;
this.updateState = updateState;
this.fetchFn = fetchFn;
}
async executeStep(state: AuthGuidedState): Promise<void> {
const context: StateMachineContext = {

6
core/mcp/elicitationCreateMessage.ts
View file

@ -29,14 +29,16 @@ export class ElicitationCreateMessage {
private resolvePromise?: (result: ElicitResult) => void;
/** Set only for task-augmented elicit; used when user declines so server's tasks/result receives an error */
private rejectCallback?: (error: Error) => void;
private onRemove: (id: string) => void;
constructor(
request: ElicitRequest,
resolve: (result: ElicitResult) => void,
private onRemove: (id: string) => void,
onRemove: (id: string) => void,
reject?: (error: Error) => void,
) {
this.id = `elicitation-${Date.now()}-${Math.random()}`;
this.onRemove = onRemove;
this.id = `elicitation-${crypto.randomUUID()}`;
this.timestamp = new Date();
this.request = request;
// Extract taskId from request params metadata if present

20
core/mcp/inspectorClient.ts
View file

@ -174,12 +174,14 @@ export class InspectorClient extends InspectorClientEventTarget {
private effectiveAuthFetch: typeof fetch;
// Session ID (for OAuth state and saveSession event; persistence is in FetchRequestLogState)
private sessionId?: string;
private transportConfig: MCPServerConfig;
constructor(
private transportConfig: MCPServerConfig,
transportConfig: MCPServerConfig,
options: InspectorClientOptions,
) {
super();
this.transportConfig = transportConfig;
// Extract environment components
this.transportClientFactory = options.environment.transport;
this.fetchFn = options.environment.fetch;
@ -309,7 +311,7 @@ export class InspectorClient extends InspectorClientEventTarget {
return {
trackRequest: (message: JSONRPCRequest) => {
const entry: MessageEntry = {
id: `${Date.now()}-${Math.random()}`,
id: crypto.randomUUID(),
timestamp: new Date(),
direction: "request",
message,
@ -320,7 +322,7 @@ export class InspectorClient extends InspectorClientEventTarget {
message: JSONRPCResultResponse | JSONRPCErrorResponse,
) => {
const entry: MessageEntry = {
id: `${Date.now()}-${Math.random()}`,
id: crypto.randomUUID(),
timestamp: new Date(),
direction: "response",
message,
@ -329,7 +331,7 @@ export class InspectorClient extends InspectorClientEventTarget {
},
trackNotification: (message: JSONRPCNotification) => {
const entry: MessageEntry = {
id: `${Date.now()}-${Math.random()}`,
id: crypto.randomUUID(),
timestamp: new Date(),
direction: "notification",
message,
@ -415,10 +417,7 @@ export class InspectorClient extends InspectorClientEventTarget {
statusMessage?: string;
pollInterval?: number;
}): ReceiverTaskRecord {
const taskId =
typeof crypto !== "undefined" && crypto.randomUUID
? crypto.randomUUID()
: `task-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
const taskId = crypto.randomUUID();
const ttlMs =
opts.ttl ??
(typeof this.receiverTaskTtlMs === "function"
@ -1962,7 +1961,10 @@ export class InspectorClient extends InspectorClientEventTarget {
});
} catch (error) {
// Log but don't throw - roots were updated locally even if notification failed
console.error("Failed to send roots/list_changed notification:", error);
this.logger.error(
{ error },
"Failed to send roots/list_changed notification",
);
}
}

12
core/mcp/messageTrackingTransport.ts
View file

@ -23,10 +23,16 @@ export interface MessageTrackingCallbacks {
// Transport wrapper that intercepts all messages for tracking
export class MessageTrackingTransport implements Transport {
private baseTransport: Transport;
private callbacks: MessageTrackingCallbacks;
constructor(
private baseTransport: Transport,
private callbacks: MessageTrackingCallbacks,
) {}
baseTransport: Transport,
callbacks: MessageTrackingCallbacks,
) {
this.baseTransport = baseTransport;
this.callbacks = callbacks;
}
async start(): Promise<void> {
return this.baseTransport.start();

4
core/mcp/oauthManager.ts
View file

@ -41,11 +41,13 @@ export interface OAuthManagerParams {
* InspectorClient creates this when oauth is configured and delegates all OAuth methods.
*/
export class OAuthManager {
private params: OAuthManagerParams;
private oauthConfig: OAuthManagerConfig;
private oauthStateMachine: OAuthStateMachine | null = null;
private oauthState: AuthGuidedState | null = null;
constructor(private params: OAuthManagerParams) {
constructor(params: OAuthManagerParams) {
this.params = params;
this.oauthConfig = { ...params.initialConfig };
}

8
core/mcp/remote/node/server.ts
View file

@ -17,7 +17,7 @@ import {
} from "../../../storage/store-io.js";
import type { LogEvent } from "pino";
import { Hono } from "hono";
import type { Context, Next } from "hono";
import type { Context, Env, Next } from "hono";
import { streamSSE } from "hono/streaming";
import { createTransportNode } from "../../node/transport.js";
import type { RemoteConnectRequest, RemoteSendRequest } from "../types.js";
@ -277,7 +277,7 @@ export function createRemoteApp(
process.env[API_SERVER_ENV_VARS.AUTH_TOKEN] ||
randomBytes(32).toString("hex");
const app = new Hono();
const app = new Hono<Env>();
const sessions = new Map<string, RemoteSession>();
const { logger: fileLogger, allowedOrigins } = options;
const storageDir = options.storageDir ?? getDefaultStorageDir();
@ -453,9 +453,7 @@ export function createRemoteApp(
return c.json({ error: "Session not found" }, 404);
}
// hono's streamSSE generic typing has tightened since v1.5; cast the
// route-typed Context down to the broader Context shape it expects.
return streamSSE(c as unknown as Parameters<typeof streamSSE>[0], async (stream) => {
return streamSSE(c, async (stream) => {
session.setEventConsumer((event) => {
const data = JSON.stringify(event);
void stream.writeSSE({

11
core/mcp/remote/remoteClientTransport.ts
View file

@ -99,6 +99,8 @@ export class RemoteClientTransport implements Transport {
null;
private eventStreamAbort: AbortController | null = null;
private closed = false;
private readonly options: RemoteTransportOptions;
private readonly config: import("../types.js").MCPServerConfig;
/**
* Intentionally returns undefined. The MCP Client checks transport.sessionId to detect
@ -112,9 +114,12 @@ export class RemoteClientTransport implements Transport {
}
constructor(
private readonly options: RemoteTransportOptions,
private readonly config: import("../types.js").MCPServerConfig,
) {}
options: RemoteTransportOptions,
config: import("../types.js").MCPServerConfig,
) {
this.options = options;
this.config = config;
}
private get fetchFn(): typeof fetch {
return this.options.fetchFn ?? globalThis.fetch;

6
core/mcp/samplingCreateMessage.ts
View file

@ -28,14 +28,16 @@ export class SamplingCreateMessage {
public readonly taskId?: string;
private resolvePromise?: (result: CreateMessageResult) => void;
private rejectPromise?: (error: Error) => void;
private onRemove: (id: string) => void;
constructor(
request: CreateMessageRequest,
resolve: (result: CreateMessageResult) => void,
reject: (error: Error) => void,
private onRemove: (id: string) => void,
onRemove: (id: string) => void,
) {
this.id = `sampling-${Date.now()}-${Math.random()}`;
this.onRemove = onRemove;
this.id = `sampling-${crypto.randomUUID()}`;
this.timestamp = new Date();
this.request = request;
// Extract taskId from request params metadata if present