- set TS SDK to 1.17.5, which has the automatic log level handling
* In useConnection.ts
- push the logging/setLevel message onto the message history stack so it is clear in the Inspector that it has been sent.
Make both clients use name from package.json for consistency and protocol clarity
- web client changes `mcp-inspector` -> `inspector-client` (package.json)
- cli client remains `inspector-cli` (package.json)
Tests verify that proxyFullAddress query parameter is sent for both
STDIO and SSE transports, but not Streamable HTTP, when
MCP_PROXY_FULL_ADDRESS is configured.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
The STDIO and SSE transports use SSE between the client and the proxy
server. SSE requires the client to initiate the MCP conversation
(event-stream) at the endpoint provided by the server. The endpoint
provided by the server must obey where the client sees the server,
rather than being assumed to be server-root `/message`.
The Streamable HTTP endpoint does not need the full proxy address
because the response is an event-stream directly, and does not use SSE.
* Inspect the stderr output of STDIO servers and attempt to assign an appropriate RFC 5424 Syslog Protocol level before sending a leveled logging message to the client
- Create shared validateRedirectUrl utility to centralize URL validation
- Only allow HTTP and HTTPS protocols in OAuth authorization URLs
- Fix three vulnerable redirect paths that bypassed validation:
- AuthDebugger.tsx: Direct window.location.href redirect
- OAuthFlowProgress.tsx: window.open() without validation
- OAuthFlowProgress.tsx: Direct anchor href attribute
- Add comprehensive test coverage for URL validation
- Update existing auth.ts to use shared validation utility
This prevents malicious MCP servers from injecting javascript: or data:
protocol URLs that would execute XSS attacks when users are redirected
to the authorization endpoint.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- In auth.ts
- in InspectorOAuthClientProvider constructor
- add optional scope param
- set instance var this.scope to scope param
- in clientMetadata getter
- add scope param set to this.scope or ""
- in useConnection.ts
- in handleAuthError handler
- move instantiation of serverAuthProvider until after scope has been determined
- pass scope to InspectorOAuthClientProvider constructor
- In oauth-state-machine.ts
- in token_request transition
- ensure resource is URL type, not string
- this fixes Quick flow which was sending string, while guided was using proper URL type and working
