modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: address Copilot review round 1 on #2306

Browse source 
Validate `oauth.clientMetadataPath` the way the other two metadata paths
are validated — in `loadConfig` for the JSON route and again at server
setup for a `ServerConfig` built in code. This path is not merely
advertised: it becomes the served document's own `client_id`, so an
off-origin or query-bearing value would publish a client id this server
cannot honour.

Derive that `client_id` from `req.originalUrl` rather than from the
registered route, so a document fetched with a query string answers with
a `client_id` byte-identical to the URL it was fetched from — the
equality CIMD turns on.

Correct the docs' fixed-port warning: this fixture configures no
`issuerUrl` and derives the `client_id` from the request, which is
exactly why the integration test can drive it on a harness-chosen port.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UWGH2ytPzSPxnp4cibaV3Z
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-10 22:49:36 -04:00
commit a8cbc506ab
1 changed files with 111 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/test-servers.md
View file

@ -584,10 +584,11 @@ against this list. The shipped fixture lists **6274** (the default), **6330** an
other port the flow fails with `Invalid redirect_uri`, which reads like a CIMD problem and is not one.
Add your port to the config rather than debugging the registration path.
⚠️ **The same fixed-`issuerUrl` hazard as the fixture above applies**, for the same reason: the
`client_id` this server publishes is derived from its issuer URL, so a server that walked to another
port on `EADDRINUSE` publishes a `client_id` pointing at whatever process holds 8092. Check with
`lsof -nP -iTCP:8092 -sTCP:LISTEN` before believing a failure.
This fixture has **no** fixed-`issuerUrl` hazard, unlike several of the ones above: it configures no
`issuerUrl`, and the document's `client_id` is derived from the request it was fetched over — query
string included — so a server that walked to another port on `EADDRINUSE` still publishes a
`client_id` equal to the URL you fetched, and the integration test drives it on a harness-chosen port
for exactly that reason. The fixed-port dependency that *does* bite is `redirect_uris`, above.
## Revoking tokens on clear (RFC 7009)