* Inspect the stderr output of STDIO servers and attempt to assign an appropriate RFC 5424 Syslog Protocol level before sending a leveled logging message to the client
* Inspect the stderr output of STDIO servers and attempt to assign an appropriate RFC 5424 Syslog Protocol level before sending a leveled logging message to the client
Adds stdio inheritance to prevent Node.js from dropping console output after 8192 characters due to premature stdout pipe closure before output finishes flushing. Without this, calls like this would truncate after 8192 characters, leading to broken json output:
```
npx --node-options=--inspect -y @modelcontextprotocol/inspector --cli --config .mcp.json --server notion --method tools/list
```
```
# notion mcp server
"notion": {
"//": "doppler needs to expose OPENAPI_MCP_HEADERS (and NOTION_TOKEN within it)",
"command": "bash",
"args": [
"-c",
"doppler run -p 'mcp' -c \"user_${MCP_USER:-$USER}\" -- npx -y @notionhq/notion-mcp-server"
]
},
```
You can see this in their [openapi spec](https://github.com/makenotion/notion-mcp-server/blob/main/scripts/notion-openapi.json), which powers their MCP server.
- Create shared validateRedirectUrl utility to centralize URL validation
- Only allow HTTP and HTTPS protocols in OAuth authorization URLs
- Fix three vulnerable redirect paths that bypassed validation:
- AuthDebugger.tsx: Direct window.location.href redirect
- OAuthFlowProgress.tsx: window.open() without validation
- OAuthFlowProgress.tsx: Direct anchor href attribute
- Add comprehensive test coverage for URL validation
- Update existing auth.ts to use shared validation utility
This prevents malicious MCP servers from injecting javascript: or data:
protocol URLs that would execute XSS attacks when users are redirected
to the authorization endpoint.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Install husky and lint-staged dev dependencies
- Configure pre-commit hook to run prettier on staged files
- Only format changed files to improve performance
- Prevents CI formatting failures by formatting locally
- In auth.ts
- in InspectorOAuthClientProvider constructor
- add optional scope param
- set instance var this.scope to scope param
- in clientMetadata getter
- add scope param set to this.scope or ""
- in useConnection.ts
- in handleAuthError handler
- move instantiation of serverAuthProvider until after scope has been determined
- pass scope to InspectorOAuthClientProvider constructor
- In oauth-state-machine.ts
- in token_request transition
- ensure resource is URL type, not string
- this fixes Quick flow which was sending string, while guided was using proper URL type and working
