jeetul.samaiya
e08ce8cee9
feat: add default Authorization Bearer header and clean up legacy auth
...
- Provide "Authorization: Bearer " as default starting header
- Remove legacy auth props from components
- Centralize migration logic and fix localStorage cleanup
- Update tests for new auth architecture
2025-09-15 20:19:56 +05:30
Jeetul Samaiya
f36c649bb9
Merge branch 'main' into main
2025-09-15 19:30:18 +05:30
Ola Hungerford
3075cbbf18
Merge branch 'main' into alejandro.borbolla/copy-input
2025-09-14 21:27:07 -07:00
Jeetul Samaiya
743bb52d92
Merge branch 'main' into main
2025-09-11 12:12:33 +05:30
jeetul.samaiya
90ab419d12
fix: enhance error handling for custom headers and improve test coverage for header management
2025-09-10 21:01:24 +05:30
jeetul.samaiya
6f727b6662
fix: update error handling in JSON parsing and add ESLint rule for unused variables
2025-09-09 13:44:57 +05:30
jeetul.samaiya
cb8c45456b
refactor: improve code formatting and readability across multiple files
2025-09-09 13:44:57 +05:30
jeetul.samaiya
c5acc63129
Add support for custom headers and migrate from legacy auth
...
- Introduced CustomHeaders component for managing custom headers.
- Updated Sidebar to include CustomHeaders component.
- Enhanced useConnection hook to handle custom headers and legacy auth migration.
- Added tests for custom headers functionality.
- Updated package.json and package-lock.json for new dependencies.
2025-09-09 13:44:57 +05:30
Wei He
d728d54614
fix: toast message when copying server entry for a Streamable HTTP transport URL
2025-09-06 23:47:54 -04:00
Max Gerber
71583caf3b
fix: correct authState.authorizationUrl type to URL
2025-09-05 18:40:48 -07:00
lorenzo.neumann
801ae28ecb
feat: add clear buttons for request history and server notifications
...
fixes #780
2025-09-04 13:37:19 +02:00
Alejandro Borbolla
2fd781ab81
fix: CI by removing unused useEffect
2025-09-01 18:32:16 +02:00
Alejandro Borbolla
16e0077090
fix: Assess PR comments (typo)
2025-09-01 18:31:52 +02:00
Ola Hungerford
6505468fbe
Merge branch 'main' into alejandro.borbolla/copy-input
2025-08-31 20:38:40 -07:00
Ola Hungerford
f22aa1f5e2
Merge pull request #741 from cliffhall/stderr-handling
...
Handling of stderr on STDIO servers
2025-08-21 19:10:19 -07:00
Ola Hungerford
d48164aa09
Merge pull request #719 from richardkmichael/fix-704-trim-command-whitespace
...
fix: Trim whitespace from Command input to prevent ENOENT
2025-08-21 18:50:52 -07:00
cliffhall
9dbd5cc85b
* Remove handling of out-of-spec 'notification/stderr' messages. It's not a thing. See https://github.com/modelcontextprotocol/servers/pull/2469
...
* Inspect the stderr output of STDIO servers and attempt to assign an appropriate RFC 5424 Syslog Protocol level before sending a leveled logging message to the client
2025-08-21 18:01:29 -04:00
Cliff Hall
8a5a4e5b6a
Merge pull request #740 from modelcontextprotocol/fix/validate-urls
...
Fix/validate urls for http/https scheme only in auth flow
2025-08-21 12:15:19 -04:00
Jenn Newton
a018a6d758
Apply Prettier formatting
...
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-08-21 15:41:33 +00:00
Jenn Newton
fa2e6b0c40
Fix to properly open in new tab for OAuth
...
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-08-21 15:31:53 +00:00
Ola Hungerford
acc0530988
Merge branch 'main' into fix-704-trim-command-whitespace
2025-08-20 20:47:37 -07:00
Jenn Newton
650f3090d2
fix: add validation for OAuth redirect URLs
...
- Create shared validateRedirectUrl utility to centralize URL validation
- Only allow HTTP and HTTPS protocols in OAuth authorization URLs
- Fix three vulnerable redirect paths that bypassed validation:
- AuthDebugger.tsx: Direct window.location.href redirect
- OAuthFlowProgress.tsx: window.open() without validation
- OAuthFlowProgress.tsx: Direct anchor href attribute
- Add comprehensive test coverage for URL validation
- Update existing auth.ts to use shared validation utility
This prevents malicious MCP servers from injecting javascript: or data:
protocol URLs that would execute XSS attacks when users are redirected
to the authorization endpoint.
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-08-20 10:08:20 -03:00
Stephen Halter
36a30fa3db
prettier --write client/src/components/OAuthDebugCallback.tsx
2025-08-18 13:01:13 -07:00
Ola Hungerford
f2865a36e3
Merge branch 'main' into halter73/restore-resource
2025-08-15 14:34:48 -07:00
Richard Michael
410f792d29
Remove redundant mock and timer clear
2025-08-14 14:25:51 -07:00
Richard Michael
34938b72d3
Tidy test descriptions and titles
2025-08-14 14:25:51 -07:00
Richard Michael
399e16afa4
Re-organize Sidebar tests
...
- Tests were mistakenly grouped in Environment Variables block
- Tests follow UI order, top-to-bottom
2025-08-14 14:25:51 -07:00
Richard Michael
8d8af870ba
Trim whitespace from command on blur
2025-08-14 14:25:51 -07:00
Bobby Tiernay
34b39530d1
fix: failing test from SDK update
2025-08-14 14:02:29 -04:00
Bobby Tiernay
74900fca5d
feat: unify OAuth scope discovery between automatic and manual flows
...
- Add shared discoverScopes function in auth.ts with resource metadata preference
- Update automatic flow (handleAuthError) to use dynamic scope discovery
- Update manual flow (OAuth state machine) to use shared scope discovery logic
- Add comprehensive test suite for discoverScopes function (11 test cases)
- Fix empty array handling to return undefined instead of empty string
- Maintain backward compatibility with existing oauthScope parameter
- All quality gates pass: TypeScript, linting, formatting, and tests
Resolves OAuth scope discovery inconsistency where automatic flow used static
scopes while manual flow used metadata scopes. Both flows now use identical
shared logic with proper resource metadata preference.
2025-08-14 14:02:29 -04:00
Stephen Halter
10b4681e3c
Also fix authorizationUrl type
2025-08-14 10:47:15 -07:00
Stephen Halter
fc4aeb392f
Restore AuthDebuggerState.resource as URL
...
Not doing so prevents the resource URI from getting sent to the
OAuth server's token endpoint during the "Quick OAuth flow"
2025-08-13 14:00:08 -07:00
Ola Hungerford
ddd06c207c
Merge branch 'main' into dcr-fallback-fix
2025-08-13 05:34:14 -07:00
2underscores
9ef2a6c22d
Use new auth svr discovery method from latest auth SDK
2025-08-12 14:13:31 +10:00
2underscores
e9f1da383e
Tests for client discovery
2025-08-12 13:22:09 +10:00
Mats Julius Funke
fda879ccc1
ci: added test for the DynamicJsonForm
2025-08-04 09:32:24 +02:00
Mats Julius Funke
cc3f9df33c
fix: fix type error by handling array of types in JSON schema validation
2025-08-04 09:26:24 +02:00
Mats Julius Funke
bcba0dc007
fix: removed tools tab test as its probably overkill and introduces to much new code
2025-08-02 16:11:43 +02:00
Mats Julius Funke
edd10e48a9
fix: updated import path npm test passes now
2025-08-02 16:01:16 +02:00
Mats Julius Funke
f73d8e6f8a
fix: support FastMCP union types in tool parameter forms
2025-08-02 15:59:45 +02:00
Alejandro Borbolla
5bbd9f736d
feat: Copy the input parameters of tools
2025-07-31 17:41:33 +02:00
Alejandro Borbolla
8589faa4c4
refactor: Use useCopy() in JsonView
2025-07-31 17:39:53 +02:00
Ola Hungerford
14657973bd
Merge branch 'main' into dev/eh/tool-meta-support
2025-07-30 21:20:21 -07:00
Ola Hungerford
f274a52612
Merge branch 'main' into feature/completion-context
2025-07-26 09:41:56 -07:00
Cliff Hall
eda6c05ba1
Merge branch 'main' into feature/elicitations
2025-07-24 11:00:41 -04:00
Ola Hungerford
144755b369
Merge branch 'main' into feature/elicitations
2025-07-23 21:50:48 -07:00
Xiao Yijun
1c9b47a0e8
refactor: ui improvement
2025-07-21 11:24:54 +08:00
Alex Andru
6b204b5d29
feat: add active tab system
2025-07-18 18:21:40 +02:00
Xiao Yijun
91aacba85d
Merge branch 'main' into feat-support-enter-oauth-client-information-manually
2025-07-14 17:24:38 +08:00
Xiao Yijun
9e8042949d
refactor: update label for redirect URL
2025-07-14 17:23:02 +08:00
