Replace explicit property assignments with shorthand syntax when
property names match variable names (e.g., SERVER_PORT: SERVER_PORT
becomes just SERVER_PORT).
Simplifies the startup flow by consolidating browser opening
in the client script rather than the start script for prod.
We were duplicating a lot of logging, making it easy for
logs to go out of sync - this is a proposal to consolidate:
- server only logs info about itself
- client only logs info about itself
To reduce the number of places we print connection information
to the user.
Refactored startProdClient to match startDevClient's logging pattern,
ensuring consistent user feedback whether auto-open is enabled or disabled.
Also ensures that we log full information on how to open the browser
regardless of whether MCP_AUTO_OPEN_ENABLED=false.
Address PR feedback by restructuring getClientUrl to always include
MCP_PROXY_PORT parameter when using non-default port, regardless of
auth status. Also improved code clarity by using params.size check.
- Update client to read MCP_PROXY_PORT from URL parameters
- Update server to include port in displayed URL when non-default
- Update start scripts to pass SERVER_PORT to client
- Use DEFAULT_MCP_PROXY_LISTEN_PORT constant instead of magic numbers
This fixes the issue where the client couldn't connect to the proxy
when SERVER_PORT was set to a non-default value.
Checked for icon name changes by teaching Claude to search the lucide-react repo with:
`git log -i -E --grep '(rename|change)' 0.448.0^...0.523.0
..then searching for any of the found icons in the Inspector imports.
Per PR feedback from cliffhall:
- Changed PORT to SERVER_PORT in server/src/index.ts
- Changed PORT to CLIENT_PORT in client/bin/client.js
- Added parseInt() for CLIENT_PORT consistency
- Updated start.js to pass correct env var names
This improves clarity by using specific environment variables for
server and client ports instead of the generic PORT variable.
- Extract duplicated URL generation code into getClientUrl() helper function in start.js
- Replace all 127.0.0.1 references with localhost for consistency across codebase
- Update server to respect HOST environment variable for URL generation
- Remove 127.0.0.1 from default allowed origins in CORS configuration
- Update documentation to use localhost instead of 127.0.0.1
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete the security hardening started in e8e9909 by also binding the client to localhost only.
Previously only the server was protected while the client remained exposed to the network,
allowing attackers to access the server through the client as a proxy.
Changes:
- Add HOST environment variable support to client (prod mode)
- Configure Vite dev server to bind to localhost by default
- Update browser auto-open URLs to use actual host instead of hardcoded 127.0.0.1
- Fix missing cancelled parameter in startProdClient function
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* pass resource in auth debugger, reusing server url
* throw error on resource url mismatch to match regular auth flow
* lint & tests
* add test
* make authserver url make more sense
* use latest typescript sdk
* more lenient resource checking
* pick resource, and store in state
* fixing tests and types
* [auth] use sdk function for selecting resource (#537)
* use sdk function
* bump typescript sdk
* fix some tests
Number inputs were immediately converting values to Number() on every
keystroke, which prevented users from typing negative numbers since
the intermediate "-" character cannot be converted to a valid number.
Now the input stores the raw string value and only converts to Number
when the value is non-empty, allowing proper negative number entry.
- Extracted 4 functions: startDevServer, startProdServer, startDevClient, startProdClient
- Eliminated deep nesting in main() function
- Each function has a single responsibility
- Main function now clearly shows the flow: parse args → start server → start client
- No functional changes, purely organizational refactoring
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Unified start.js to handle both dev and production modes with --dev flag
- Generate session token in parent process, pass via MCP_PROXY_TOKEN env var
- Enable browser auto-open even when authentication is enabled by including token in URL
- Auto-reloads now work seamlessly with persistent tokens across hot reloads
- Simplified npm scripts - dev and dev:windows now use the same unified script
- Better developer experience with consistent token handling
The token is generated once per session and remains stable through server/client
reloads, making development smoother while maintaining security.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Added comprehensive test coverage for proxy authentication using X-MCP-Proxy-Auth header
- Tests verify proper header separation between proxy and server authentication
- Fixed transport mocks to properly capture options and headers
- Updated config structure in tests to match production code
- All proxy auth tests now passing
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Changed proxy authentication to use a custom header (X-MCP-Proxy-Auth) instead of the standard Authorization header. This prevents conflicts when the proxy needs to forward the client's Authorization header to upstream MCP servers.
- Updated client to send proxy auth token in X-MCP-Proxy-Auth header
- Updated server auth middleware to check X-MCP-Proxy-Auth header
- Applies to all transport types (SSE, stdio, streamable-http)
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Remove all window.location mocking from AuthDebugger tests as it was causing "Cannot redefine property" errors in CI. The tests work correctly with JSDOM's default window.location implementation.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
