modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
2,038 commits 1 branch 87 tags 30 MiB
Commit graph

2,038 commits

This branch
This branch
All branches
Author SHA1 Message Date
Cliff Hall
5f1eb0aeea
 		Merge pull request #1125 from modelcontextprotocol/dependabot/github_actions/actions/upload-artifact-7 
chore(deps): bump actions/upload-artifact from 6 to 7
 2026-04-11 17:50:35 -04:00
Cliff Hall
6e2e73390f
 		Merge pull request #1117 from modelcontextprotocol/dependabot/npm_and_yarn/npm_and_yarn-ccf8cbde5a 
chore(deps): bump hono from 4.12.1 to 4.12.2 in the npm_and_yarn group across 1 directory
 2026-04-11 17:50:01 -04:00
Cliff Hall
5cdbeaa07a
 		Merge pull request #1047 from BobDickinson/web-client-oauth-proxy-fetch 
Inspector client: Added proxy fetch for use by auth (to avoid CORS issues)
 2026-04-11 13:37:17 -04:00
Cliff Hall
443288fb25
 		Merge pull request #1182 from modelcontextprotocol/revert-996-fix/oauth-cors-proxy-support 
Revert "Fix: OAuth CORS errors when Connection Type is 'Via Proxy'"
 2026-04-09 11:03:06 -04:00
Cliff Hall
2539711bc0
 		Revert "Fix: OAuth CORS errors when Connection Type is 'Via Proxy'" 2026-04-09 10:54:52 -04:00
Cliff Hall
efbae5f927
 		Merge pull request #996 from asoorm/fix/oauth-cors-proxy-support 
Fix: OAuth CORS errors when Connection Type is 'Via Proxy'
 2026-04-09 10:53:33 -04:00
Ahmet Soormally
48f51cd758 test: update oauth-proxy tests for fallback behavior 
Fix error message expectations to match unwrapped proxyFetch errors.
Add tests for root-level well-known URL fallback with non-root paths.
 2026-04-07 22:41:39 +01:00
Ahmet Soormally
2e524ff361 fix: add root-level fallback for well-known URL discovery via proxy 
When the MCP server is at a non-root path (e.g. /mcp), path-aware
discovery (/.well-known/oauth-protected-resource/mcp) may 404 if the
server only serves metadata at the root. The SDK's direct-mode
discovery already falls back to root-level URLs in this case. This
adds the same fallback to the proxy discovery functions.
 2026-04-07 22:31:25 +01:00
Ahmet Soormally
d898b3e82f
 		Merge branch 'main' into fix/oauth-cors-proxy-support 2026-04-07 23:13:05 +02:00
Bob Dickinson
446a9bc1cf Addressed all Claude review issues. 2026-04-07 10:33:28 -07:00
Bob Dickinson
c04cd9958d Merge branch 'main' into web-client-oauth-proxy-fetch 2026-04-06 19:23:24 -07:00
Bob Dickinson
6e796ac744 Fix for 401 errors not being sent back through the proxy (and relying on error string text matching to detect an OAuth 401) 2026-04-06 17:05:02 -07:00
Bob Dickinson
c344ffb87c Modified proxy fetch to return all response payloads (not just 200), which should fix the failures reported with proxy auth. I have not yet verified that locally (pending repro details). 2026-04-06 12:03:13 -07:00
Bob Dickinson
f2a34b67de Fixed broken tests. One was broken by a merge from main, one was broken because the TLS verification changed. Without pinned deps (package lock) it's hard to track down the dep change actually caused this - fix was to use http instead of https example.com test urls. 2026-04-06 11:10:24 -07:00
Cliff Hall
dd53302e12
 		Merge pull request #1177 from Dinesht04/fix/fix-value-overflow 2026-04-04 10:17:28 -04:00
Dinesht04
c5fda85c20 fix: add horizontal scrolling for long values in json view 2026-04-04 15:41:24 +05:30
Cliff Hall
94d98ec56e
 		Merge pull request #1173 from asoorm/fix/930-redirect-uri-mismatch 
fix: ensure DCR always registers both redirect URIs
 2026-04-02 12:35:16 -04:00
Ahmet Soormally
abe1cf9b4f fix: ensure DCR always registers both redirect URIs 
The `redirect_uris` getter used `this.redirectUrl`, which is overridden
by `DebugInspectorOAuthClientProvider` to return `/oauth/callback/debug`.
This caused the `Set` deduplication to collapse both URIs into one,
so DCR only registered `/oauth/callback/debug`. The normal connection
flow then sent `/oauth/callback` in the authorize request, which was
never registered — causing spec-compliant OAuth servers to reject it.

Use the base callback URLs directly instead of the polymorphic getter
so both URIs are always registered regardless of which subclass
initiates DCR.

Fixes #930
 2026-04-02 15:42:20 +01:00
Cliff Hall
26c9f60d43
 		Merge branch 'main' into web-client-oauth-proxy-fetch 2026-03-18 18:41:05 -04:00
Ahmet Soormally
b083d4e1a0 feat: add OAuth proxy support to eliminate CORS issues 
Add server-side proxy endpoints for OAuth discovery, client registration,
and token exchange to avoid CORS issues when using proxy connection mode.

Server proxy endpoints:
- GET /oauth/resource-metadata - proxies OAuth protected resource metadata
- GET /oauth/metadata - proxies OAuth authorization server metadata
- POST /oauth/register - proxies dynamic client registration
- POST /oauth/token - proxies token exchange

Client changes:
- Construct correct RFC 9728/8414 path-aware well-known URLs client-side
- Route all OAuth discovery through proxy when in proxy connection mode
- Eliminate direct browser fetches that fail with CORS in proxy mode
 2026-03-09 13:43:30 +00:00
Cliff Hall
7c8b031ffa
 		Merge pull request #1127 from MumuTW/fix-tools-tab-decimal-input-1080 
Fix decimal typing behavior for number inputs in tools form
 2026-03-07 19:12:35 -05:00
MumuTW
fdbf896a04 Fix decimal input handling in DynamicJsonForm number fields 2026-03-06 05:45:13 +00:00
dependabot[bot]
5abcdb4853
 		chore(deps): bump actions/upload-artifact from 6 to 7 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-02 22:15:18 +00:00
dependabot[bot]
bbf0284f91
 		chore(deps): bump hono in the npm_and_yarn group across 1 directory 
Bumps the npm_and_yarn group with 1 update in the / directory: [hono](https://github.com/honojs/hono).


Updates `hono` from 4.12.1 to 4.12.2
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.1...v4.12.2)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-27 16:01:25 +00:00
Copilot
db0827b246
 		chore: bump version to 0.21.1 (#1116)
Some checks failed
CLI Tests / test (push) Has been cancelled
Details
0.21.1 
* Initial plan

* chore: bump version to 0.21.1

Co-authored-by: olaservo <16480113+olaservo@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: olaservo <16480113+olaservo@users.noreply.github.com>
Co-authored-by: Ola Hungerford <olahungerford@gmail.com>
 2026-02-27 11:00:05 -05:00
Cliff Hall
8c7017a75d
 		Merge pull request #1098 from olaservo/main 
Remove misleading structured content compatibility warning
 2026-02-25 13:11:52 -05:00
Ola Hungerford
e853652cea
 		Merge branch 'main' into main 2026-02-25 05:33:27 -07:00
James Woods
bb791cdede
 		fix: include server/static in published package files (#1113) 
The sandbox_proxy.html file was not shipped in the npm package because
the files arrays in both package.json and server/package.json only
included the build directory. The server code resolves the file via
join(__dirname, '..', 'static', 'sandbox_proxy.html') which expects
static/ as a sibling of build/, but it was missing from the package.
 2026-02-25 05:31:41 -07:00
Cliff Hall
1e23d37769
 		Merge pull request #1112 from modelcontextprotocol/copilot/bump-version-to-0-21-0 0.21.0 
chore: bump version to 0.21.0
 2026-02-24 11:57:14 -05:00
copilot-swe-agent[bot]
58478bc88b chore: bump version to 0.21.0 
Co-authored-by: olaservo <16480113+olaservo@users.noreply.github.com>
 2026-02-24 15:48:58 +00:00
copilot-swe-agent[bot]
238eadfb19 Initial plan 2026-02-24 15:46:41 +00:00
Bob Dickinson
c4c6e6b6b1
 		Merge pull request #1072 from cliffhall/hide-run-as-task-if-not-supported 
Manage display of "Run as Task" checkbox on Tools Tab
 2026-02-23 19:06:43 -08:00
cliffhall
92b6c89354 Formatting 2026-02-23 11:49:44 -05:00
cliffhall
f64a7ea6e3 Fix review issues from Claude's code review 
- Default taskSupport fallback to "forbidden" per MCP spec (was "optional")
- Fix import path to use @/ alias consistently
- Fix misleading "type guard" comment on getTaskSupport
- Extract getTaskSupport to a variable to avoid duplicate calls in render
- Export ExtendedTool and import in tests instead of duplicating

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-23 11:15:53 -05:00
Cliff Hall
4bcffe456b
 		Merge branch 'main' into hide-run-as-task-if-not-supported 2026-02-23 10:32:22 -05:00
dependabot[bot]
6ce441ae70
 		chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#1106) 
Bumps the npm_and_yarn group with 2 updates in the / directory: [ajv](https://github.com/ajv-validator/ajv) and [hono](https://github.com/honojs/hono).


Updates `ajv` from 6.12.6 to 6.14.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](https://github.com/ajv-validator/ajv/compare/v6.12.6...v6.14.0)

Updates `hono` from 4.11.7 to 4.12.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.11.7...v4.12.1)

---
updated-dependencies:
- dependency-name: ajv
  dependency-version: 6.14.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-22 18:04:00 -07:00
John Howard
695972a404
 		oauth: add tenant suffix to oauth flow (#1096) 2026-02-19 06:00:33 -07:00
olaservo
841c42e468 Remove misleading structured content compatibility warning 
The MCP spec allows `content` to be a human-readable summary rather
than a JSON-stringified copy of `structuredContent`. Remove the yellow
warning that was shown when no text block JSON-matched structuredContent,
keeping only the positive blue indicator when a match does exist.

Fixes #1089

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-18 21:06:44 -07:00
Den Delimarsky
f2ed4ef3b9
 		Update SECURITY.md to use GitHub Security Advisories (#1097) 2026-02-18 19:57:45 -07:00
Cliff Hall
f1b42654dd
 		Merge pull request #1075 from infoxicator/fix/apps-tool-result 
fix: add missing tool result to AppsRenderer
 2026-02-16 17:44:43 -05:00
Ruben Casas
f470fcb3a5 Merge branch 'fix/apps-tool-result' of https://github.com/infoxicator/inspector into fix/apps-tool-result 2026-02-16 22:20:32 +00:00
Ruben Casas
87bb2425a3 fix linting error 2026-02-16 22:20:06 +00:00
Cliff Hall
49bcbbe276
 		Merge branch 'main' into fix/apps-tool-result 2026-02-16 15:36:01 -05:00
Ruben Casas
2a84ce3254 chore: remove accidentally committed mcp-ui patch 2026-02-16 16:53:28 +00:00
Ruben Casas
9adc37893c Merge branch 'fix/apps-tool-result' of https://github.com/infoxicator/inspector into fix/apps-tool-result 2026-02-16 16:45:23 +00:00
Ruben Casas
a31ae3e767 feat call tool result from tools tab 2026-02-16 16:44:33 +00:00
Koichi ITO
6573bf9892
 		Merge pull request #1088 from modelcontextprotocol/dependabot/npm_and_yarn/npm_and_yarn-14dc0ebc5a 
Bump qs from 6.14.1 to 6.14.2 in the npm_and_yarn group across 1 directory
 2026-02-15 02:38:10 +09:00
dependabot[bot]
41e0e83fac Bump qs in the npm_and_yarn group across 1 directory 
Bumps the npm_and_yarn group with 1 update in the / directory: [qs](https://github.com/ljharb/qs).


Updates `qs` from 6.14.1 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ljharb/qs/compare/v6.14.1...v6.14.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-02-15 02:35:13 +09:00
Cliff Hall
5e63f732e2
 		Merge pull request #1066 from olaservo/feature/tool-annotations-display 
feat(client): display tool annotations in Tools tab
 2026-02-14 11:37:49 -05:00
Cliff Hall
9ac19d25cc
 		Merge pull request #1055 from modelcontextprotocol/claude/issue-1036-20260204-1236 
fix: include LICENSE file in published npm packages
 2026-02-14 11:21:56 -05:00