modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(web): only use a public address on a fixed listener port (#1862)

Browse source 
Addresses Copilot review round 2. A reverse proxy routes a public address to
one stable port, so neither MCP_SANDBOX_FULL_ADDRESS nor
MCP_APP_ORIGIN_FULL_ADDRESS is used when the listener's port is OS-assigned:
an explicit 0, a config-time collision resolved to 0, or the EADDRINUSE
fallback. Validation warnings also stop echoing the URL path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HzuzRPJv7M8wGe3wyw5sSg
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-14 01:10:29 -04:00
commit 925461a043
1 changed files with 110 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

12
clients/web/server/app-origin-controller.ts
View file

@ -334,8 +334,10 @@ export function createAppOriginController(
* (#1862) when it is still safe to use, else the bind-derived one.
*
* Two reasons to refuse it here rather than only at config time:
* - After the EADDRINUSE fallback the reverse proxy still routes the
* public origin to the PINNED port, which someone else holds.
* - A reverse proxy routes the public origin to one stable port, so it
* is only usable on a FIXED port: not an explicit `0`, not a
* config-time collision resolved to `0`, and not the EADDRINUSE
* fallback, where someone else holds the pinned port.
* - It must differ from every trusted ancestor — the sandbox proxy and
* the Inspector page, i.e. `embedderOrigins`. The frame is granted
* `allow-same-origin` on this path, so sharing either origin hands
@ -345,10 +347,10 @@ export function createAppOriginController(
*/
const adoptedOrigin = (derived: string): string => {
if (!publicOrigin) return derived;
if (retriedDynamic) {
if (port === 0 || retriedDynamic) {
console.warn(
`App origin: not using MCP_APP_ORIGIN_FULL_ADDRESS, since it routes to port ${port}, ` +
`which is taken; serving app documents from ${derived} instead.`,
`App origin: not using MCP_APP_ORIGIN_FULL_ADDRESS, since the listener is not on a fixed ` +
`port for it to route to; serving app documents from ${derived} instead.`,
);
return derived;
}