- Update generateDefaultValue to return undefined for optional object parameters
- Add comprehensive tests for required vs non-required objects
- Fixes issue where MCP Inspector sends empty objects {} for optional parameters
- Objects with required properties still return populated objects
- Empty optional objects now return undefined to be omitted from requests
Refs #771
- Create shared validateRedirectUrl utility to centralize URL validation
- Only allow HTTP and HTTPS protocols in OAuth authorization URLs
- Fix three vulnerable redirect paths that bypassed validation:
- AuthDebugger.tsx: Direct window.location.href redirect
- OAuthFlowProgress.tsx: window.open() without validation
- OAuthFlowProgress.tsx: Direct anchor href attribute
- Add comprehensive test coverage for URL validation
- Update existing auth.ts to use shared validation utility
This prevents malicious MCP servers from injecting javascript: or data:
protocol URLs that would execute XSS attacks when users are redirected
to the authorization endpoint.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Make JsonSchemaType.type optional to support const-only schemas
- Add JsonSchemaConst type for schema objects using const values
- Update oneOf/anyOf to accept both full schemas and const schemas
- Add comprehensive tests for oneOf with const and title patterns
This fixes TypeScript compilation errors when using the JSON Schema
specification's recommended approach for labeled enums:
{ "type": "string", "oneOf": [{ "const": "red", "title": "Stop" }] }
Replaces deprecated enumNames pattern with spec-compliant implementation.
Resolved conflicts by adopting the improved form input handling from main:
- Standardized JsonSchemaType.required to only accept string arrays (JSON Schema standard)
- Adopted enhanced object and array rendering with proper nested support
- Improved boolean field rendering (removed extra wrapper div)
- Enhanced array handling with add/remove functionality
- Simplified required field validation logic
This maintains elicitation functionality while benefiting from the form input fixes.
- Update client to read MCP_PROXY_PORT from URL parameters
- Update server to include port in displayed URL when non-default
- Update start scripts to pass SERVER_PORT to client
- Use DEFAULT_MCP_PROXY_LISTEN_PORT constant instead of magic numbers
This fixes the issue where the client couldn't connect to the proxy
when SERVER_PORT was set to a non-default value.
- Add is_session_item field to ConfigItem type to control storage location
- Store auth tokens in sessionStorage (cleared on browser close)
- Store other settings in localStorage (persist between sessions)
- Maintain backward compatibility with existing config structure
This provides better security for auth tokens while preserving user
preferences across browser sessions.
- Add MCP_PROXY_AUTH_TOKEN configuration field to store session token
- Update useConnection hook to include proxy auth token in all requests
- Add separate proxy auth headers to avoid conflicts with MCP server auth
- Add specific error handling for proxy authentication failures
- Show helpful toast message directing users to Configuration settings
- Update README with instructions for configuring token in UI
The client now properly authenticates with the proxy server using the
session token displayed in the proxy console.
- Extract tool results rendering into separate ToolResults component
- Hoist checkContentCompatibility function to module level following codebase conventions
- Add ajv@6.12.6 as direct dependency to client package.json
- All tests pass and linting is clean
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove unused catch parameter in ToolsTab.tsx
- Replace 'as any' with @ts-expect-error in test for invalid schema
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Applied consistent formatting to ToolsTab.tsx and schemaUtils.ts
to fix linting issues. No functional changes.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Added extensive test coverage for the new structured output features:
Schema Utilities Tests:
- Tests for cacheToolOutputSchemas function
- Tests for validateToolOutput with various scenarios
- Tests for getToolOutputValidator and hasOutputSchema helpers
- Coverage for valid/invalid schemas and edge cases
- Tests for nested object validation
ToolsTab Component Tests:
- Tests for output schema display and expand/collapse functionality
- Tests for structured content validation display
- Tests for validation error messages
- Tests for unstructured content title logic
- Tests for compatibility checking between structured/unstructured content
- Tests ensuring compatibility check only runs with output schemas
All tests passing with 100% coverage of new functionality.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
This commit adds comprehensive support for structured output validation in tool calls,
following the MCP specification for tools with output schemas.
UI Changes:
1. Output Schema Display:
- Added collapsible output schema section in ToolsTab
- Shows output schemas after input fields, before the Run Tool button
- Default view shows 8 lines with scrolling, expandable to full view
- Expand/Collapse button with chevron icons for better UX
2. Structured Content Display:
- New "Structured Content" section when tools return structuredContent
- Shows structured data in a formatted JSON view
- Validation status indicator (green checkmark for valid, red X for errors)
- Detailed validation error messages when content doesn't match schema
3. Unstructured Content Labeling:
- Added "Unstructured Content" heading when both structured and unstructured content exist
- Only shows label when structured content is also present
- Maintains clean UI when only unstructured content exists
4. Compatibility Checking:
- Checks if unstructured content matches structured content (when output schema exists)
- Shows compatibility status with blue (compatible) or yellow (incompatible) indicators
- Detailed messages explain why content doesn't match
- Only runs compatibility check for tools with output schemas
5. Validation Error Handling:
- Shows error when tool with output schema doesn't return structured content
- Clear error messages for schema validation failures
- Maintains proper error state display
Technical Implementation:
- Added schema validation utilities using Ajv (same as SDK)
- Caches compiled validators for performance
- Validates on tool result display, not during the call
- Follows SDK's Client.callTool validation pattern
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
