feat(cli): lift config-file headers/timeouts/OAuth into serverSettings (#1482) (#1500)

* feat(cli): lift config-file headers/timeouts/OAuth into serverSettings (#1482)

The CLI resolved file-sourced servers via resolveServerConfigs(), which
returns bare MCPServerConfig and dropped disk-level headers, timeouts, and
OAuth — CLI connections from a --catalog/--config file silently ignored
them. The TUI already lifted these via mcpConfigToServerEntries().

Extract the TUI's catalog/config -> per-server-settings resolution into a
shared core module (core/mcp/node/servers.ts: loadServerEntries +
selectServerEntry) and route both CLI and TUI through it, so the two share
one file->settings path. --header still overrides the file's headers for
the run while preserving the file's timeouts/OAuth.

- core: add loadServerEntries/selectServerEntry/headersToServerSettings
- tui: tui-servers.ts re-exports the shared core helpers (no logic dup)
- cli: resolve via loadServerEntries + selectServerEntry; drop the
  CLI-only conflict check and bare-config path
- tests: core servers.test.ts (settings lifting, header merge/override,
  stdio overrides, seed/error/conflict, selection); CLI integration tests
  asserting a config header is sent over HTTP and --header overrides it
- docs: CLI README note on file settings being applied

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(core): address #1500 review — dedup overrides, drop dead wrapper, clearer error, spec refresh

- Remove the now-unused resolveLaunchServerConfigs() wrapper (both CLI and
  TUI route through loadServerEntries now); migrate its default-catalog
  launch tests to compose withDefaultCatalogPath + resolveServerConfigs.
- Deduplicate applyStdioOverrides against config.ts applyOverrides: export
  the latter (now trims cwd) and reuse it in servers.ts.
- selectServerEntry's unknown-name error is source-agnostic ("not found"
  not "not found in config file") since entries may be a single ad-hoc
  default, where "config file" would mislead.
- Refresh specification/ docs (v2_cli_tui_launcher.md,
  v2_catalog_launch_config.md): CLI/TUI resolution now via
  loadServerEntries/selectServerEntry; mark gap G1 resolved (#1482);
  withDefaultConfigPath → withDefaultCatalogPath.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(cli): extend smoke:cli to cover #1482 lift→serverSettings

Adds end-to-end smoke coverage for the config-file headers/timeouts/OAuth
lift introduced in #1482:

- unknown --server now errors source-agnostically ("not found")
- multi-server catalog selection via --server (and the omit-it error)
- --header merge does not break the stdio connect path
- HTTP transport: a config-file `headers` object is lifted onto the wire,
  and a CLI --header overrides it (verified against an in-process test
  server's recorded requests via a non-blocking spawn)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-06-20 11:33:21 -04:00 • committed by GitHub
commit e72d4307f3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 1033 additions and 420 deletions

View file

@ -78,6 +78,8 @@ npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com --tr
npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com --transport http --method tools/list --header "X-API-Key: your-api-key"
```
When a server is loaded from a `--catalog`/`--config` file, its per-server settings (headers, connection/request timeouts, and OAuth) are applied to the connection — the same resolution the TUI uses. A `--header` flag overrides the file's headers for that run while leaving the file's timeouts and OAuth in place.
## Options
### MCP server (which server to connect to)

View file

@ -18,6 +18,7 @@ import {
createEchoTool,
createTestServerInfo,
} from "@modelcontextprotocol/inspector-test-server";
import type { MCPServerConfig } from "@modelcontextprotocol/inspector-core/mcp/index.js";
describe("CLI Tests", () => {
describe("Basic CLI Mode", () => {
@ -320,6 +321,100 @@ describe("CLI Tests", () => {
});
});
describe("Config-file settings lifting (#1482)", () => {
it("applies a config file's custom header on a tools/call over HTTP", async () => {
const server = createTestServerHttp({
serverInfo: createTestServerInfo(),
tools: [createEchoTool()],
});
let configPath: string | undefined;
try {
await server.start();
// Write a config whose server carries disk-level headers + a timeout.
// `headers`/`requestTimeout` are Inspector-extension fields not present
// on MCPServerConfig, so build the entry as a loose record.
configPath = createTestConfig({
mcpServers: {
web: {
type: "streamable-http",
url: server.url,
headers: { "X-Custom-Token": "secret-123" },
requestTimeout: 8000,
} as unknown as MCPServerConfig,
},
});
const result = await runCli([
"--config",
configPath,
"--server",
"web",
"--cli",
"--method",
"tools/call",
"--tool-name",
"echo",
"--tool-arg",
"message=hi",
]);
expectCliSuccess(result);
// The server should have received a request carrying the disk header
// (Express lower-cases header names), proving the CLI lifted it from
// the config file into the connection's settings.
const sawHeader = server
.getRecordedRequests()
.some((r) => r.headers["x-custom-token"] === "secret-123");
expect(sawHeader).toBe(true);
} finally {
await server.stop();
if (configPath) deleteConfigFile(configPath);
}
});
it("overrides a config file's header with --header", async () => {
const server = createTestServerHttp({
serverInfo: createTestServerInfo(),
tools: [createEchoTool()],
});
let configPath: string | undefined;
try {
await server.start();
configPath = createTestConfig({
mcpServers: {
web: {
type: "streamable-http",
url: server.url,
headers: { "X-Custom-Token": "from-disk" },
} as unknown as MCPServerConfig,
},
});
const result = await runCli([
"--config",
configPath,
"--server",
"web",
"--header",
"X-Custom-Token: from-cli",
"--cli",
"--method",
"tools/list",
]);
expectCliSuccess(result);
const tokens = server
.getRecordedRequests()
.map((r) => r.headers["x-custom-token"]);
expect(tokens).toContain("from-cli");
expect(tokens).not.toContain("from-disk");
} finally {
await server.stop();
if (configPath) deleteConfigFile(configPath);
}
});
});
describe("Resource Options", () => {
it("should read resource with URI", async () => {
const { command, args } = getTestMcpServerCommand();

View file

@ -8,7 +8,6 @@ import type {
InspectorServerSettings,
MCPServerConfig,
} from "@inspector/core/mcp/types.js";
import { DEFAULT_TASK_TTL_MS } from "@inspector/core/mcp/types.js";
import { InspectorClient } from "@inspector/core/mcp/index.js";
import {
ManagedToolsState,
@ -18,9 +17,8 @@ import {
} from "@inspector/core/mcp/state/index.js";
import {
createTransportNode,
resolveLaunchServerConfigs,
serverSourceConflict,
hasAdHocServerOptions,
loadServerEntries,
selectServerEntry,
parseKeyValuePair as parseEnvPair,
parseHeaderPair,
} from "@inspector/core/mcp/node/index.js";
@ -46,23 +44,6 @@ type MethodArgs = {
metadata?: Record<string, string>;
};
function headersToServerSettings(
headers?: Record<string, string>,
): InspectorServerSettings | undefined {
if (!headers || Object.keys(headers).length === 0) {
return undefined;
}
return {
headers: Object.entries(headers).map(([key, value]) => ({ key, value })),
metadata: [],
connectionTimeout: 0,
requestTimeout: 0,
taskTtl: DEFAULT_TASK_TTL_MS,
autoRefreshOnListChanged: false,
roots: [],
};
}
async function callMethod(
serverConfig: MCPServerConfig,
serverSettings: InspectorServerSettings | undefined,
@ -397,30 +378,24 @@ function parseArgs(argv?: string[]): {
// back to MCP_CATALOG_PATH — keeps CLI and TUI flag resolution identical.
catalogPath: options.catalog?.trim() || process.env.MCP_CATALOG_PATH,
configPath: options.config?.trim() || undefined,
serverName: options.server,
target: targetArgs.length > 0 ? targetArgs : undefined,
transport: options.transport,
serverUrl: options.serverUrl,
cwd: options.cwd,
env: options.e,
// `--header` is merged into the resolved server's settings (overriding any
// file-level headers); file timeouts/OAuth are preserved. See #1482.
headers: options.header,
};
const conflict = serverSourceConflict({
hasCatalog: Boolean(serverOptions.catalogPath?.trim()),
hasConfig: Boolean(serverOptions.configPath?.trim()),
hasAdHoc: hasAdHocServerOptions(serverOptions),
});
if (conflict) {
throw new Error(conflict);
}
const configs = resolveLaunchServerConfigs(serverOptions, "single");
const serverConfig = configs[0];
if (!serverConfig) {
throw new Error(
"Could not resolve server config. Specify a URL or command, or use --config and --server.",
);
}
// Shared with the TUI: resolves the catalog/config source (or ad-hoc target),
// enforces the conflict matrix, and lifts disk headers/timeouts/OAuth into
// per-server settings. `--server` selects one when the file has several.
const entries = loadServerEntries(serverOptions);
const { config: serverConfig, settings: serverSettings } = selectServerEntry(
entries,
options.server,
);
if (!options.method) {
throw new Error(
@ -456,7 +431,7 @@ function parseArgs(argv?: string[]): {
return {
serverConfig,
serverSettings: headersToServerSettings(options.header),
serverSettings,
methodArgs,
};
}