* Pinned server-everything, fixed all tests to work with current pinned version, fixed problem with undetected failures (isError: true payloads).
* First working vitest implementation
* Refactoring some single-use configs fixtures and into the refeencing tests
* No tests refere to server-everything (or any other server from a registry), all tests actually validate what they say they test.
* Removed server-everything dep from CI, minor cleanup
* Addressed Claude PR review comments: Added tsx dev dependency, beefed up process termination (possible leak on Windows), beefed up http server cleanup (close all connections), removed unused hasValidJsonOutput, reduced CLI timeout to give it breathing room with vitest timeout.
* Made both stdio and http test servers fully composable, cleaned up types, terminology, and usage.
fix: OAuth DCR scope field compliance
Omits the scope field entirely when undefined, per RFC 7591. This allows OAuth servers to assign default scopes instead of registering clients with no scopes.
Tested with Keycloak DCR.
Ensures fresh installs without lock file get the patched version.
🦉 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update @modelcontextprotocol/sdk from 1.24.3 to 1.25.2 to fix ReDoS
vulnerability (GHSA-8r9q-7v3j-jr4g) and qs to 6.14.1 to fix DoS
vulnerability (GHSA-6rw7-vpxm-498p).
🦉 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Modify claude.yml
1. Added "Get PR details" step (NEW - lines 28-51)
This new step runs ONLY when the trigger is a PR-related comment. It:
- Detects if it's a PR comment vs regular issue
- Fetches the PR information using GitHub API
- Extracts the fork's repository name and commit SHA
- Sets them as outputs (steps.pr.outputs.sha and steps.pr.outputs.repo)
Why? The original workflow couldn't see fork PR code because it only checked out the main repo.
2. Split checkout into TWO conditional steps (CHANGED - lines 53-62)
Before: One checkout step that always checked out main repo with fetch-depth: 1
After: Two checkout steps:
- "Checkout PR branch" - Runs if PR details were fetched successfully, checks out the fork's PR branch
- "Checkout repository" - Runs otherwise (for regular issues), checks out main repo
Why? Need different checkout behavior for PRs (checkout fork) vs issues (checkout main).
3. Changed fetch-depth from 1 to 0 (CHANGED)
Before: fetch-depth: 1 (only latest commit)
After: fetch-depth: 0 (full git history)
Why? Claude Code needs more context to understand the codebase and provide better reviews.
Summary
The original workflow could only see the main repo's code. When you commented @claude on a fork PR, it would review the wrong code!
These changes make it check out the actual PR branch from the fork when reviewing PRs, while keeping the original behavior for regular issues.
The server-side error handling only checked for SseError instances
when detecting 401 responses from MCP servers. StreamableHTTPClientTransport
throws a different error type (generic Error with "HTTP 401" message)
when there's no authProvider configured.
This caused the proxy to return 500 instead of 401 to the client,
preventing the OAuth discovery and redirect flow from triggering.
Added is401Error() helper that checks for:
- SseError with code 401
- StreamableHTTPError with code 401
- Generic Error with "HTTP 401" or "(401)" in message
Fixes#960🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Clarify in contribution guidelines that during V2 development, V1
contributions should focus on bug fixes and MCP spec compliance.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Align tests with new form-first rendering and UI behavior:
- Labels prefer schema `title` over property key.
- Descriptions shown for boolean checkboxes and select fields.
- Explicit mode switching between Form/JSON when needed.
- Add comprehensive coverage for enum schema variants:
- Titled single-select via `oneOf`/`anyOf` with `{ const, title }`.
- Untitled single-select via `enum` (with legacy `enumNames` labels).
- Untitled multi-select via `items.enum` with `minItems`/`maxItems` helper text.
- Titled multi-select via `items.anyOf`/`oneOf` with `{ const, title }`.
- Adjust complex/JSON-mode tests to click “Switch to JSON” before asserting textarea and clipboard interactions.
- Fix debounced JSON update expectations to assert parsed objects rather than raw text.
Files updated:
- `client/src/components/__tests__/DynamicJsonForm.test.tsx`
- `client/src/components/__tests__/DynamicJsonForm.array.test.tsx`
In DynamicJsonForm.tsx,
- Support all five enum shapes used by MCP SDK:
- Titled single-select via `oneOf`/`anyOf` with `{ const, title }`
- Untitled single-select via `enum`
- Titled legacy single-select with optional `enumNames` for labels
- Titled multi-select via `items.anyOf`/`oneOf`
- Untitled multi-select via `items.enum`
- Show field descriptions for string select fields and boolean checkboxes (consistent help text above inputs).
- Prefer schema property `title` for object field labels; fall back to the JSON key when missing.
- Allow top‑level form rendering for objects with properties, arrays with items, and primitive types (was overly strict before).
- Multi-select UI: sensible list size and `minItems`/`maxItems` helper text when present.
- JSON editor fallback, copy/format controls, and debounced parsing preserved.
- apply defaults for optional fields during form init
In schemaUtils.ts
- `generateDefaultValue` now includes optional properties that declare a `default`, ensuring fields like strings show their defaults on first render.
In jsonUtils.ts
- Add legacy `enumNames?: string[]` and array constraints `minItems?`/`maxItems?`.
