13dafe457b* refactor(web): update OAuth E2E tests to use new authentication method - Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration. - Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs. - Ensured that the tests continue to validate the expected authorization URL after the change. Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process. * Guided-auth removal, OAuth smoke testing, and TUI/CLI support * Added CLI OAuth runner flags tests * Added clarifying comment on port 0 binding * README notes on TUI oauth callback port, prettier fixes for CLI tests * CIMD validation uses inline like EMA IdP * Fixed TUI test failures from merge * test: bring 5 OAuth files over the 90 per-file coverage gate The guided-auth-removal work added/touched several files that fell below the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run the gate (it's local-only), so validate + test:integration passed while these gaps slipped through. Bring them all back over the line: - core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the provably-dead guards (empty host, out-of-range port, String(err) fallback, pathname "/" fallback) -- all rejected by new URL() upstream -- with justified v8 ignore comments instead of lowering the gate. - core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return. - core/react/useClientSettingsDraft.ts: test the functional-updater path, the stale-onChange-after-close prev===null guard, and the timer-fires-after-close value===null guard. - ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear. - clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration kinds, the expired IdP session, and the configured-scope/empty-scope branches of formatScopes. npm run coverage now passes (exit 0) across web, cli, tui, launcher. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: cliffhall <cliff@futurescale.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3.8 KiB
3.8 KiB
Inspector V2 Scope
Brief | V1 Problems | V2 Scope | V2 Tech Stack | V2 UX
Table of Contents
- Protocol Features
- OAuth Handling
- Transport Types
- Connection Type
- Logging Level Control
- Copy Server configuration
- Custom Auth-related properties
- Timeout management
- Schema parsing for Elicitation, Tool Input Schemas
- Form inputs vs JSON editor for:
- Proxy server
- Previous Security Fixes
- Server file maintenance
- Plugin architecture
Protocol Features
- Tools
- Resources
- Resource Subscriptions
- Resource Templates
- Prompts
- Elicitation
- Sampling with stubbed response
- Roots
- Logging
- Completions
- Metadata
- Pagination
- resources/list
- resources/templates/list
- prompts/list
- tools/list
- Cancellation (of in progress requests)
- Ping
OAuth Handling
authenticate()/completeOAuthFlow()(SDK-backed authorization-code flow)- Connection Info for auth debugging
- Enterprise-managed authorization (EMA / XAA) — see EMA / XAA
- Mid-session authorization (401 after connect: token refresh, step-up scopes, web remote reconnect) — see Mid-session auth
- Authorization hardening (MCP 2026-07-28 SEPs:
iss, DCR client type, issuer-bound credentials, step-up scope union) — see Auth hardening - OAuth smoke testing (manual procedures against hosted servers) — see Smoke testing
Transport Types
- STDIO
- SSE
- SHTTP
Logging Level Control
- Present and synchronized when connecting to server with logging capability
Copy Server configuration
- As config file server entry
- As config file containing server entry
Custom Auth-related properties
- Custom headers
- Client ID
- Secret
- Scope
Timeout management
- Request timeout
- Request timeout on progress (bool)
- Maximum total timeout
Schema parsing for Elicitation, Tool Input Schemas
- New enum types
- anyOf /oneOf
- $ref
- $defs
Form inputs vs JSON editor for:
- Elicitation, tool input, resource template, and prompt vars, sampling response
- Field types of primitive, object, array
- Nullable field types
- Defaults
Proxy server
- Required for testing STDIO servers and HTTP servers that can’t open up their CORS origin for testing
- Implement a feature configuration file rather than disparate environment variables for everything
- Handle auth flows instead of browser when "via proxy" connection type selected
Previous Security Fixes
- Unique proxy server session token to prevent unauthorized access to the proxy server's ability to execute local processes and connect to MCP servers.
- Bind to localhost by default to prevent DNS rebinding attacks (never 0.0.0.0)
- Fix/validate redirect urls for http/https scheme only in auth flow
Server file maintenance
- Opening screen similar to MCPJam servers list
- Adding, changing, and deleting a server would hit endpoints on the proxy server update the inspector’s servers.json config file
Plugin architecture
- Allow third parties to extend the Inspector with functionality we do not wish to maintain, but which would still be useful to developers within the context of the Inspector, e.g., LLMs, evals, OpenAI Apps SDK playground