inspector/client
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Cliff Hall 5c782ada7c
feat: add URL-mode elicitation support (#1423)
* feat: add URL-mode elicitation support

The MCP spec (2025-11-25) added URL-mode elicitation alongside form mode,
allowing servers to direct users to external URLs for out-of-band
interactions (auth flows, payments, sensitive data). This implements
client-side support for rendering and handling URL-mode elicitation
requests, and announces the capability during initialization.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: add consent dialog for URL elicitation and separate Accept button

Replace the clickable URL link with a consent dialog that displays the
URL as plain text when "Open URL" is clicked, letting the user confirm
before navigating. Add a separate "Accept" button that resolves the
elicitation without the content field, per the MCP spec.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: preserve structured McpError data in request history

When a tool call returns an MCP error (e.g. -32042 URLElicitationRequired),
the catch block was only capturing error.message (a string), discarding the
structured error.code and error.data fields.

Now McpError instances push the full JSON-RPC error structure to history:
  { error: { code, message, data } }

This means the Response panel will show the complete error including
data.elicitations for -32042, rather than just a message string.

* Revert "fix: preserve structured McpError data in request history"

This reverts commit 86f6d093f6596d6a9a52b85df24b66fa2e354d07.

* fix: enforce HTTPS-only for URL elicitation per SEP-1036

Address Claude review on #1423:
- Validate the server-supplied URL before opening it; refuse non-https
  schemes (http/file/javascript/data) and malformed URLs, disabling the
  "Open URL" button and showing an error state instead of calling
  window.open (SEP-1036 URL Security Requirements, a spec MUST).
- Display the parsed destination host prominently in the consent dialog
  to surface look-alike/embedded-credential URLs.
- Document that elicitation/complete is surfaced via the notification
  panel and resolved manually (no auto-correlation), a conscious choice
  per the spec's MAY/SHOULD.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: evalstate <1936278+evalstate@users.noreply.github.com>
2026-06-03 18:09:38 -07:00
..
bin fix(client): fix dev mode hanging on Windows (#1051) 2026-02-03 07:41:38 -07:00
e2e prettier 2025-08-05 14:08:57 +01:00
public switch favicon 2024-11-19 14:13:19 -08:00
src feat: add URL-mode elicitation support (#1423) 2026-06-03 18:09:38 -07:00
.gitignore init client 2024-10-07 16:28:05 -07:00
components.json run prettier 2024-11-04 21:29:59 +00:00
eslint.config.js feat: add default Authorization Bearer header and clean up legacy auth 2025-09-15 20:19:56 +05:30
index.html Full-width #root 2025-07-01 09:30:36 -07:00
jest.config.cjs Add MCP Apps support to Inspector (#1044) 2026-02-05 20:02:20 -07:00
LICENSE fix: include LICENSE file in published npm packages 2026-02-04 12:37:55 +00:00
package.json Add repository field to workspace package.json files for npm trusted publishing (#1202) 2026-04-14 13:41:47 -07:00
playwright.config.ts prettier fix 2025-06-19 07:02:06 -07:00
postcss.config.js run prettier 2024-11-04 21:29:59 +00:00
README.md init client 2024-10-07 16:28:05 -07:00
tailwind.config.js Make tailwind config work on Windows 2024-11-26 16:51:50 +01:00
tsconfig.app.json Exclude tests from build in tsconfig.app.json 2025-12-03 10:16:33 -05:00
tsconfig.jest.json Handle edge case and add tests for functions 2025-02-27 06:40:01 -07:00
tsconfig.json init client 2024-10-07 16:28:05 -07:00
tsconfig.node.json init client 2024-10-07 16:28:05 -07:00
vite.config.ts Update Vite configuration to enable host access and fix proxy server URL to use the current hostname. 2025-03-20 22:04:59 +08:00

React + TypeScript + Vite

This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.

Currently, two official plugins are available:

Expanding the ESLint configuration

If you are developing a production application, we recommend updating the configuration to enable type aware lint rules:

  • Configure the top-level parserOptions property like this:
export default tseslint.config({
  languageOptions: {
    // other options...
    parserOptions: {
      project: ["./tsconfig.node.json", "./tsconfig.app.json"],
      tsconfigRootDir: import.meta.dirname,
    },
  },
});
  • Replace tseslint.configs.recommended to tseslint.configs.recommendedTypeChecked or tseslint.configs.strictTypeChecked
  • Optionally add ...tseslint.configs.stylisticTypeChecked
  • Install eslint-plugin-react and update the config:
// eslint.config.js
import react from "eslint-plugin-react";

export default tseslint.config({
  // Set the react version
  settings: { react: { version: "18.3" } },
  plugins: {
    // Add the react plugin
    react,
  },
  rules: {
    // other rules...
    // Enable its recommended rules
    ...react.configs.recommended.rules,
    ...react.configs["jsx-runtime"].rules,
  },
});