Make both clients use name from package.json for consistency and protocol clarity
- web client changes `mcp-inspector` -> `inspector-client` (package.json)
- cli client remains `inspector-cli` (package.json)
* Inspect the stderr output of STDIO servers and attempt to assign an appropriate RFC 5424 Syslog Protocol level before sending a leveled logging message to the client
- Create shared validateRedirectUrl utility to centralize URL validation
- Only allow HTTP and HTTPS protocols in OAuth authorization URLs
- Fix three vulnerable redirect paths that bypassed validation:
- AuthDebugger.tsx: Direct window.location.href redirect
- OAuthFlowProgress.tsx: window.open() without validation
- OAuthFlowProgress.tsx: Direct anchor href attribute
- Add comprehensive test coverage for URL validation
- Update existing auth.ts to use shared validation utility
This prevents malicious MCP servers from injecting javascript: or data:
protocol URLs that would execute XSS attacks when users are redirected
to the authorization endpoint.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- In auth.ts
- in InspectorOAuthClientProvider constructor
- add optional scope param
- set instance var this.scope to scope param
- in clientMetadata getter
- add scope param set to this.scope or ""
- in useConnection.ts
- in handleAuthError handler
- move instantiation of serverAuthProvider until after scope has been determined
- pass scope to InspectorOAuthClientProvider constructor
- In oauth-state-machine.ts
- in token_request transition
- ensure resource is URL type, not string
- this fixes Quick flow which was sending string, while guided was using proper URL type and working
- Add shared discoverScopes function in auth.ts with resource metadata preference
- Update automatic flow (handleAuthError) to use dynamic scope discovery
- Update manual flow (OAuth state machine) to use shared scope discovery logic
- Add comprehensive test suite for discoverScopes function (11 test cases)
- Fix empty array handling to return undefined instead of empty string
- Maintain backward compatibility with existing oauthScope parameter
- All quality gates pass: TypeScript, linting, formatting, and tests
Resolves OAuth scope discovery inconsistency where automatic flow used static
scopes while manual flow used metadata scopes. Both flows now use identical
shared logic with proper resource metadata preference.
* In useConnection.ts
- During initialization, if there is an error immediately following the client sending 'logging/setLevel', pops up a toast with the message `Server declares logging capability but doesn't implement method "logging/setLevel"`
* In useConnection.ts
- During initialization, if there is an error immediately following the client sending 'logging/setLevel', pops up a toast with the message `Server declares logging capability but doesn't implement method "logging/setLevel"`
This commit removes the prompt argument from the completion state.
The argument is deleted from the context after the completion is handled.
This prevents unexpected behavior and ensures a cleaner state.
This commit adds a `context` argument to the completion handlers in `PromptsTab`, `ResourcesTab`, `useCompletionState`, and `useConnection`.
The context argument allows passing additional information to the completion engine, which can be used to improve the quality of the completions. The context is passed as a dictionary of key-value pairs.
The `ResourcesTab` component was also updated to pass `templateValues` as the `context` to the completion handler.
The `useConnection` hook was updated to include the context in the completion request sent to the server.
Resolved conflicts by adopting the improved form input handling from main:
- Standardized JsonSchemaType.required to only accept string arrays (JSON Schema standard)
- Adopted enhanced object and array rendering with proper nested support
- Improved boolean field rendering (removed extra wrapper div)
- Enhanced array handling with add/remove functionality
- Simplified required field validation logic
This maintains elicitation functionality while benefiting from the form input fixes.
* pass resource in auth debugger, reusing server url
* throw error on resource url mismatch to match regular auth flow
* lint & tests
* add test
* make authserver url make more sense
* use latest typescript sdk
* more lenient resource checking
* pick resource, and store in state
* fixing tests and types
* [auth] use sdk function for selecting resource (#537)
* use sdk function
* bump typescript sdk
* fix some tests
