modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(web): only use a public address on a fixed listener port (#1862)

Browse source 
Addresses Copilot review round 2. A reverse proxy routes a public address to
one stable port, so neither MCP_SANDBOX_FULL_ADDRESS nor
MCP_APP_ORIGIN_FULL_ADDRESS is used when the listener's port is OS-assigned:
an explicit 0, a config-time collision resolved to 0, or the EADDRINUSE
fallback. Validation warnings also stop echoing the URL path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HzuzRPJv7M8wGe3wyw5sSg
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-14 01:10:29 -04:00
commit 925461a043
1 changed files with 110 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

19
clients/web/server/sandbox-controller.ts
View file

@ -341,17 +341,20 @@ export function createSandboxController(
const derivedUrl = `http://${urlHost}:${actualPort}/sandbox`;
// An operator-supplied public URL (#1862) replaces the derived one
// only now that the listener it routes to is actually up — and only
// on the port it was configured for. After the EADDRINUSE fallback
// the proxy still routes the public URL to the PINNED port, which
// someone else holds, so advertising it would send the browser to
// the wrong listener. The derived URL at least works locally.
if (publicUrl && retriedDynamic) {
// when that listener is on a FIXED port. A reverse proxy routes the
// public URL to one stable port; an OS-assigned port (an explicit
// `0`, a config-time collision resolved to `0`, or the EADDRINUSE
// fallback, where someone else holds the pinned port) is not it, so
// advertising the public URL would send the browser to the wrong
// listener or none. The derived URL at least works locally.
const onFixedPort = port !== 0 && !retriedDynamic;
if (publicUrl && !onFixedPort) {
console.warn(
`Sandbox: not advertising MCP_SANDBOX_FULL_ADDRESS, since it routes to port ${port}, ` +
`which is taken; advertising ${derivedUrl} instead.`,
`Sandbox: not advertising MCP_SANDBOX_FULL_ADDRESS, since the sandbox is not on a fixed ` +
`port for it to route to; advertising ${derivedUrl} instead.`,
);
}
sandboxUrl = publicUrl && !retriedDynamic ? publicUrl : derivedUrl;
sandboxUrl = publicUrl && onFixedPort ? publicUrl : derivedUrl;
boundPort = actualPort;
settle({ port: actualPort, url: sandboxUrl });
});