Add server-side proxy endpoints for OAuth discovery, client registration,
and token exchange to avoid CORS issues when using proxy connection mode.
Server proxy endpoints:
- GET /oauth/resource-metadata - proxies OAuth protected resource metadata
- GET /oauth/metadata - proxies OAuth authorization server metadata
- POST /oauth/register - proxies dynamic client registration
- POST /oauth/token - proxies token exchange
Client changes:
- Construct correct RFC 9728/8414 path-aware well-known URLs client-side
- Route all OAuth discovery through proxy when in proxy connection mode
- Eliminate direct browser fetches that fail with CORS in proxy mode
The sandbox_proxy.html file was not shipped in the npm package because
the files arrays in both package.json and server/package.json only
included the build directory. The server code resolves the file via
join(__dirname, '..', 'static', 'sandbox_proxy.html') which expects
static/ as a sibling of build/, but it was missing from the package.
- Updated all package.json files to version 0.20.0
- Updated workspace dependencies in root package.json
- Updated package-lock.json
- Verified version consistency with check-version-consistency script
Co-authored-by: Ola Hungerford <olaservo@users.noreply.github.com>
- Updated version in root package.json
- Updated version in cli/package.json
- Updated version in client/package.json
- Updated version in server/package.json
- Updated workspace dependencies in root package.json
- Updated package-lock.json via npm install
Co-authored-by: Ola Hungerford <olaservo@users.noreply.github.com>
Ensures fresh installs without lock file get the patched version.
🦉 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Version 0.17.3 had TypeScript build errors that prevented successful builds. This patch release fixes those errors and bumps the version to 0.17.4.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* In package.json under cli/, client/, server/ and /
- bump @modelcontextprotocol/sdk to ^1.20.1
* In client/package.json
- bump @vitejs/plugin-react to ^5.0.4
- bump vite to ^7.1.11
* In package-lock.json
- bump playwright to 1.56.1
- cascading changes to rollup and other dependencies
Add npm override to lock get-intrinsic to version 1.3.0, preventing
upgrades to 1.3.1 which requires the generator-function package.
The generator-function package is not available in Anthropic's internal
Artifactory, causing installation failures when users run
`npx @modelcontextprotocol/inspector` and npm resolves to get-intrinsic@1.3.1.
This override ensures all installations use get-intrinsic@1.3.0 which does
not have the generator-function dependency.
- New feature: Connection Type
- Reverts "fix: filter out client_secret when storing OAuth client information"
- Fixes STDIO "Headers is undefined" message when connecting to an SSE server.
- in createCustomFetch function
- convert finalHeaders to headers object for node-fetch compatibility
- for SSE streams, convert node stream to response body to web ReadableStream since EventSource polyfill expects web-compatible stream
* In package-lock.json and package.json
- add node-fetch as a dependency
This fixes#600
- set TS SDK to 1.17.5, which has the automatic log level handling
* In useConnection.ts
- push the logging/setLevel message onto the message history stack so it is clear in the Inspector that it has been sent.
- Install husky and lint-staged dev dependencies
- Configure pre-commit hook to run prettier on staged files
- Only format changed files to improve performance
- Prevents CI formatting failures by formatting locally
