From abe1cf9b4f4cfeb7de317824b350534fcb5b9c5b Mon Sep 17 00:00:00 2001
From: Ahmet Soormally <ahmet@mangomm.co.uk>
Date: Thu, 2 Apr 2026 15:42:20 +0100
Subject: [PATCH 1/2] fix: ensure DCR always registers both redirect URIs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `redirect_uris` getter used `this.redirectUrl`, which is overridden
by `DebugInspectorOAuthClientProvider` to return `/oauth/callback/debug`.
This caused the `Set` deduplication to collapse both URIs into one,
so DCR only registered `/oauth/callback/debug`. The normal connection
flow then sent `/oauth/callback` in the authorize request, which was
never registered — causing spec-compliant OAuth servers to reject it.

Use the base callback URLs directly instead of the polymorphic getter
so both URIs are always registered regardless of which subclass
initiates DCR.

Fixes #930
---
 client/src/lib/auth.ts | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/client/src/lib/auth.ts b/client/src/lib/auth.ts
index 87993610..b8366ef6 100644
--- a/client/src/lib/auth.ts
+++ b/client/src/lib/auth.ts
@@ -146,10 +146,15 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
   }
 
   get redirect_uris() {
-    // Normally register both redirect URIs to support both normal and debug flows
-    // In debug subclass, redirectUrl may be the same as debugRedirectUrl, so remove duplicates
+    // Always register both redirect URIs to support both normal and debug flows.
+    // Use the base URLs directly (not this.redirectUrl) to avoid the debug subclass
+    // override collapsing both URIs into one, which causes the normal flow's
+    // /authorize request to use an unregistered redirect_uri.
     // See: https://github.com/modelcontextprotocol/inspector/issues/825
-    return [...new Set([this.redirectUrl, this.debugRedirectUrl])];
+    // See: https://github.com/modelcontextprotocol/inspector/issues/930
+    const callbackUrl = window.location.origin + "/oauth/callback";
+    const debugCallbackUrl = window.location.origin + "/oauth/callback/debug";
+    return [callbackUrl, debugCallbackUrl];
   }
 
   get clientMetadata(): OAuthClientMetadata {

From c5fda85c201bca3e9b7f1521027d88d271b7455c Mon Sep 17 00:00:00 2001
From: Dinesht04 <dineshtyagi567@gmail.com>
Date: Sat, 4 Apr 2026 15:41:24 +0530
Subject: [PATCH 2/2] fix: add horizontal scrolling for long values in json
 view

---
 client/src/components/JsonView.tsx | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/client/src/components/JsonView.tsx b/client/src/components/JsonView.tsx
index 8c520ebe..c79cbf7b 100644
--- a/client/src/components/JsonView.tsx
+++ b/client/src/components/JsonView.tsx
@@ -55,7 +55,12 @@ const JsonView = memo(
     }, [toast, normalizedData, setCopied]);
 
     return (
-      <div className={clsx("p-4 border rounded relative", className)}>
+      <div
+        className={clsx(
+          "p-4 border overflow-x-auto rounded relative",
+          className,
+        )}
+      >
         {withCopyButton && (
           <Button
             size="icon"