- Added comprehensive test coverage for proxy authentication using X-MCP-Proxy-Auth header
- Tests verify proper header separation between proxy and server authentication
- Fixed transport mocks to properly capture options and headers
- Updated config structure in tests to match production code
- All proxy auth tests now passing
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Changed proxy authentication to use a custom header (X-MCP-Proxy-Auth) instead of the standard Authorization header. This prevents conflicts when the proxy needs to forward the client's Authorization header to upstream MCP servers.
- Updated client to send proxy auth token in X-MCP-Proxy-Auth header
- Updated server auth middleware to check X-MCP-Proxy-Auth header
- Applies to all transport types (SSE, stdio, streamable-http)
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add MCP_PROXY_AUTH_TOKEN configuration field to store session token
- Update useConnection hook to include proxy auth token in all requests
- Add separate proxy auth headers to avoid conflicts with MCP server auth
- Add specific error handling for proxy authentication failures
- Show helpful toast message directing users to Configuration settings
- Update README with instructions for configuring token in UI
The client now properly authenticates with the proxy server using the
session token displayed in the proxy console.
* In server/src/index.ts
- add delete handler for /mcp endpoint
- gets the server transport for the sessionId
- calls terminateSession on it
- removes the webapp and server transports for the sessionId from the maps
- returns status 200 to the client.
* In client/src/lib/hooks/useConnection.ts
- import Transport
- add useState for clientTransport, type Transport or null initialized to null
- in connect() function
- move creation of client transport down a ways, just before calling client.connect with it
- immendiately efter calling client.connect, call setClientTransport with the connected transport (has to happen after, so that what's saved has the abort controller, etc. otherwise it doesn't work to save it prior.
- in disconnect() function
- immediately call clientTransport.terminateSession if transportType is "streamable-http"
- setClientTransport to null
* In useConnection.ts
- In the case for "stdio", let the transportOptions be the same as "sse"
because it will use that transport to the proxy regardless
* Hooks are in multiple places in the codebase and some camelCase, some snake-case. This PR relocates them all to the lib/hooks folder and normalizes camelCase naming. Settled on src/client/lib/hooks for the location since most of them were already there.
- Refactor/move useTheme.ts from client/src/lib to client/src/lib/hooks
- Refactor/move useToast.ts from client/src/hooks/ to client/src/lib/hooks/useToast.ts
- Removed client/src/hooks
* In index.ts,
- refactor transport webAppTransports to be a map with the session id as key and transport as value.
* Implement /mcp GET and POST endpoints using StreamableHTTPServerTransport and doing the new session in the POST (opposite from SSE) handler.
* In package.json
- update the SDK to 1.10.2
* In useConnection.ts
- import StreamableHTTPClientTransport
- NOTE: while we NEED to do this, it causes useConnection.test.ts to fail with " ReferenceError: TransformStream is not defined"
- in connect method
- instantiate the appropriate transport
* In server/index.js
- add get/post handlers for /mcp
- amend console log on SSE connect, with deprecation message
- add /stdio GET handler and refactored /sse GET handler to not also do stdio. Each transport has its own handler now
- add appropriate headers to streamable-http request
* In /client/src/lib/hooks/useConnection.ts
- in connect function
- create server url properly based on new transport type.
Changes client information and access tokens to use server-specific keys in sessionStorage. This fixes issues where changing the server URL would try to use tokens from a different server.
Lint issues fixed:
1. Removed unused error variable in catch block
2. Changed 'ActionTypes' type to enum
3. Removed unnecessary interface extensions
4. Removed unused export component
5. Added the missing dependencies to useMemo
6. Fixed the inline function issue by changing it to useMemo
