inspector/clients/web/server
Repository files (latest commit first)
Filename Latest commit message Latest commit date
cliffhall adde9ccf94 fix: bind loopback by address and pin the sandbox port so containers work
Two defaults that each break the Inspector inside a container.

#1951 — the web UI never loads in a VS Code dev container. `HOST` defaulted
to the NAME `localhost`, and `server.listen(port, host)` resolves a name
through `dns.lookup` and binds the SINGLE address it gets back. Since Node 17
the default result order is `verbatim`, so on a glibc Linux host — whose
/etc/hosts maps localhost to both 127.0.0.1 and ::1 — that is `::1`. The
server bound IPv6 loopback only and refused every IPv4 client, including the
dev container port forwarder. It presents as an endless spinner rather than a
connection error because the forwarder accepts on the host side before failing
to connect inward. Default to the ADDRESS 127.0.0.1 instead; an explicit
HOST=localhost is still honored as typed.

#2008 — the Apps tab is unreachable in any container. The MCP Apps sandbox
listened on an OS-assigned port, so it changed every run and could never be
named in a devcontainer `forwardPorts`, a `docker run -p`, or a tunnel. Default
it to a fixed 6275, mirroring CLIENT_PORT's fixed 6274, and retry once on an
OS-assigned port (loudly) if it is taken — the collision a dynamic default
never had.

Verified in the reporter's exact image
(mcr.microsoft.com/devcontainers/typescript-node:4-24-trixie): both listeners
come up on 127.0.0.1 and answer 200 on 6274 and 6275/sandbox.

Also EXPOSE 6275 and set MCP_SANDBOX_PORT in the image, and document both
defaults in the web README, the migration guide, and the root README's Docker
section.

Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-15 12:33:27 -04:00
..
browser-externalized-builtin-gate.ts build(web): fail vite build on a browser-externalized Node built-in (#1769) (#1777) 2026-07-25 19:45:11 -04:00
ensure-web-build.ts feat(web): build dist on demand for prod --web + end-to-end CI smoke (#1486) (#1497) 2026-06-16 18:34:52 -04:00
inject-auth-token.ts feat(auth): inject MCP_INSPECTOR_API_TOKEN into served index.html (#1378) (#1382) 2026-05-30 20:10:27 -04:00
resolve-bind-host.ts fix: bind loopback by address and pin the sandbox port so containers work 2026-08-15 12:33:27 -04:00
run-web.ts feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1796) 2026-07-26 22:15:10 -04:00
sandbox-controller.ts fix: bind loopback by address and pin the sandbox port so containers work 2026-08-15 12:33:27 -04:00
server.ts feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1796) 2026-07-26 22:15:10 -04:00
start-vite-dev-server.ts feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1796) 2026-07-26 22:15:10 -04:00
types.ts Port v1.5 web dev backend (vite-hono-plugin + remote-server bootstrap) (#1321) 2026-05-18 19:22:14 -04:00
vite-base-config.ts fix: load @napi-rs/keyring lazily so an unsupported platform degrades instead of crashing (#1905) (#1948) 2026-08-08 18:15:20 -07:00
vite-hono-plugin.ts feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1796) 2026-07-26 22:15:10 -04:00
web-server-config.ts feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1796) 2026-07-26 22:15:10 -04:00