@mcp-use/inspector 12.0.4-canary.0 → 20.0.0-beta.0

package/dist/server/chunk-5B3SXGZP.js

@@ -0,0 +1,43 @@
+import {
+  mountMcpProxy
+} from "./chunk-6XWDZEFF.js";
+import {
+  mountOAuthProxy
+} from "./chunk-K2F2AJOI.js";
+
+// src/server/proxy-routes.ts
+function registerInspectorProxyRoutes(app, config, basePath = "") {
+  const p = (suffix) => `${basePath}${suffix}`;
+  const allowLoopback = config?.oauthProxyAllowLoopback ?? false;
+  const mountOAuth = config?.oauth !== false;
+  app.get(p("/inspector/health"), (c) => {
+    return c.json({
+      status: "ok",
+      protocol: "mcp-use-inspector-preview",
+      version: 1,
+      capabilities: ["view-preview"]
+    });
+  });
+  mountMcpProxy(app, {
+    path: p("/inspector/api/proxy"),
+    allowLoopback
+  });
+  if (mountOAuth) {
+    mountOAuthProxy(app, {
+      basePath: p("/inspector/api/oauth"),
+      enableLogging: true,
+      allowedOrigins: config?.oauthProxyAllowedOrigins ?? [],
+      allowLoopback
+    });
+  }
+  if (config?.autoConnectUrl !== void 0) {
+    const autoConnectUrl = config.autoConnectUrl;
+    app.get(p("/inspector/config.json"), (c) => {
+      return c.json({ autoConnectUrl: autoConnectUrl ?? null });
+    });
+  }
+}
+
+export {
+  registerInspectorProxyRoutes
+};

package/dist/server/chunk-6XWDZEFF.js

@@ -0,0 +1,194 @@
+import {
+  isSafeProxyTarget
+} from "./chunk-K2F2AJOI.js";
+
+// src/server/proxy/mcp-proxy.ts
+import { cors } from "hono/cors";
+import { logger } from "hono/logger";
+function mountMcpProxy(app, options = {}) {
+  const basePath = options.path || "/mcp/proxy";
+  const enableLogging = options.enableLogging !== false;
+  app.use(
+    `${basePath}/*`,
+    cors({
+      origin: "*",
+      allowHeaders: [
+        "Authorization",
+        "Content-Type",
+        "Accept",
+        "X-Target-URL",
+        "X-MCP-Target",
+        "Mcp-Session-Id",
+        "mcp-session-id",
+        "mcp-protocol-version",
+        "X-Server-Id",
+        "X-Requested-With"
+      ],
+      exposeHeaders: ["*"]
+    })
+  );
+  if (enableLogging) {
+    app.use(`${basePath}/*`, logger());
+  }
+  app.all(`${basePath}/*`, async (c) => {
+    try {
+      if (options.authenticate) {
+        const isAuthenticated = await options.authenticate(c);
+        if (!isAuthenticated) {
+          return c.json({ error: "Unauthorized" }, 401);
+        }
+      }
+      const targetUrl = c.req.header("X-Target-URL");
+      if (!targetUrl) {
+        return c.json(
+          {
+            error: "X-Target-URL header is required",
+            usage: "Set X-Target-URL header to the MCP server URL you want to proxy to"
+          },
+          400
+        );
+      }
+      if (!await isSafeProxyTarget(targetUrl, options.allowLoopback ?? false)) {
+        return c.json(
+          {
+            error: "Invalid target URL",
+            details: "Target is not allowed by the proxy network policy"
+          },
+          403
+        );
+      }
+      if (options.validateRequest) {
+        const isValid = await options.validateRequest(targetUrl, c);
+        if (!isValid) {
+          return c.json(
+            {
+              error: "Invalid target URL",
+              details: "The requested target URL is not allowed"
+            },
+            403
+          );
+        }
+      }
+      try {
+        new URL(targetUrl);
+      } catch {
+        return c.json(
+          {
+            error: "Invalid target URL format",
+            details: "The X-Target-URL must be a valid HTTP/HTTPS URL"
+          },
+          400
+        );
+      }
+      const method = c.req.method;
+      const headers = {};
+      const requestHeaders = c.req.header();
+      for (const [key, value] of Object.entries(requestHeaders)) {
+        const lowerKey = key.toLowerCase();
+        if (!lowerKey.startsWith("x-proxy-") && !lowerKey.startsWith("x-target-") && !lowerKey.startsWith("x-mcp-") && !lowerKey.startsWith("x-forwarded-") && !lowerKey.startsWith("cf-") && lowerKey !== "x-original-host" && lowerKey !== "host" && lowerKey !== "accept-encoding" && lowerKey !== "cdn-loop") {
+          headers[key] = value;
+        }
+      }
+      headers["Accept-Encoding"] = "identity";
+      try {
+        const targetUrlObj = new URL(targetUrl);
+        headers.Host = targetUrlObj.host;
+      } catch {
+        return c.json({ error: "Invalid target URL" }, 400);
+      }
+      const body = method !== "GET" && method !== "HEAD" ? new Uint8Array(await c.req.arrayBuffer()).slice() : void 0;
+      const response = await fetch(targetUrl, {
+        method,
+        headers,
+        body,
+        redirect: "manual"
+      });
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (location) {
+          const redirectUrl = new URL(location, targetUrl).toString();
+          if (!await isSafeProxyTarget(
+            redirectUrl,
+            options.allowLoopback ?? false
+          ) || options.validateRequest && !await options.validateRequest(redirectUrl, c)) {
+            return c.json({ error: "Redirect target is not allowed" }, 403);
+          }
+          const redirectResponse = await fetch(redirectUrl, {
+            method,
+            headers,
+            body,
+            redirect: "manual"
+          });
+          const redirectHeaders = {};
+          redirectResponse.headers.forEach((value, key) => {
+            const lowerKey = key.toLowerCase();
+            if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length") {
+              redirectHeaders[key] = value;
+            }
+          });
+          return new Response(redirectResponse.body, {
+            status: redirectResponse.status,
+            statusText: redirectResponse.statusText,
+            headers: redirectHeaders
+          });
+        }
+      }
+      const responseHeaders = {};
+      response.headers.forEach((value, key) => {
+        const lowerKey = key.toLowerCase();
+        if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length") {
+          responseHeaders[key] = value;
+        }
+      });
+      const contentType = response.headers.get("content-type") || "";
+      const isSSE = contentType.includes("text/event-stream");
+      const isGetRequest = c.req.method === "GET";
+      const upstreamContentLength = response.headers.get("content-length");
+      const isTrueStream = isSSE && isGetRequest && !upstreamContentLength;
+      if (isTrueStream) {
+        return new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers: responseHeaders
+        });
+      }
+      const bodyBuffer = await response.arrayBuffer();
+      responseHeaders["Content-Length"] = String(bodyBuffer.byteLength);
+      return new Response(bodyBuffer, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: responseHeaders
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      const targetUrl = c.req.header("X-Target-URL");
+      const isConnectionRefused = error instanceof Error && (error.message.includes("ECONNREFUSED") || error.message.includes("fetch failed"));
+      if (isConnectionRefused) {
+        console.warn(
+          `[MCP Proxy] Connection refused to ${targetUrl || "unknown target"} - server may not be running`
+        );
+      } else {
+        console.error(
+          "[MCP Proxy] Request failed:",
+          message,
+          "\nTarget URL:",
+          targetUrl || "unknown",
+          "\nError:",
+          error
+        );
+      }
+      return c.json(
+        {
+          error: "Proxy request failed",
+          details: message,
+          targetUrl: targetUrl || "unknown"
+        },
+        500
+      );
+    }
+  });
+}
+
+export {
+  mountMcpProxy
+};

package/dist/server/chunk-ESODOPDD.js

@@ -0,0 +1,50 @@
+import {
+  INSPECTOR_FAVICON_ASSETS
+} from "./chunk-WFT4JHYI.js";
+
+// src/server/favicon-static.ts
+import { existsSync, readFileSync } from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+var CONTENT_TYPES = {
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".webmanifest": "application/manifest+json"
+};
+function resolveFaviconDir() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  for (const dir of [
+    path.resolve(here, "../cdn"),
+    path.resolve(here, "../../public")
+  ]) {
+    if (existsSync(path.join(dir, "favicon-black.svg"))) {
+      return dir;
+    }
+  }
+  throw new Error(
+    "Inspector favicon assets not found (expected dist/cdn or public/)"
+  );
+}
+function registerInspectorFaviconStatic(app, basePath = "") {
+  const faviconDir = resolveFaviconDir();
+  const p = (suffix) => `${basePath}${suffix}`;
+  for (const file of INSPECTOR_FAVICON_ASSETS) {
+    app.get(p(`/${file}`), (c) => {
+      try {
+        const data = readFileSync(path.join(faviconDir, file));
+        const ext = path.extname(file);
+        return c.body(data, 200, {
+          "Content-Type": CONTENT_TYPES[ext] ?? "application/octet-stream",
+          "Cache-Control": "public, max-age=3600"
+        });
+      } catch {
+        return c.notFound();
+      }
+    });
+  }
+}
+
+export {
+  registerInspectorFaviconStatic
+};

package/dist/server/{chunk-57KIBVKX.js → chunk-J67FVPHF.js}

@@ -1,39 +1,35 @@
 import {
-  registerInspectorRoutes
-} from "./chunk-A4VH7AIP.js";
+  registerInspectorCdnShell
+} from "./chunk-TPHRVELX.js";
 import {
-  registerStaticRoutes
-} from "./chunk-UTW44YSH.js";
-import {
-  checkClientFiles,
-  getClientDistPath
-} from "./chunk-IDMHJUEM.js";
+  registerInspectorProxyRoutes
+} from "./chunk-5B3SXGZP.js";
 
 // src/server/middleware.ts
 import { Hono } from "hono";
 function mountInspector(app, config) {
-  const clientDistPath = getClientDistPath();
-  if (!checkClientFiles(clientDistPath)) {
-    console.warn(
-      `\u26A0\uFE0F  MCP Inspector client files not found at ${clientDistPath}`
-    );
-    console.warn(
-      `   Run 'yarn build' in the inspector package to build the UI`
-    );
-  }
-  const runtimeConfig = {
+  const basePath = normalizeInspectorBasePath(config?.basePath);
+  const routesConfig = {
+    autoConnectUrl: config?.autoConnectUrl,
+    oauthProxyAllowedOrigins: config?.oauthProxyAllowedOrigins ?? [],
+    oauthProxyAllowLoopback: config?.oauthProxyAllowLoopback ?? config?.devMode === true
+  };
+  const shellConfig = {
     devMode: config?.devMode,
     sandboxOrigin: config?.sandboxOrigin,
-    inspectorMode: "embedded"
+    inspectorMode: "embedded",
+    basePath,
+    proxyUrl: `${basePath}/inspector/api/proxy`,
+    manufactChatUrl: config?.manufactChatUrl
   };
   if (isHonoApp(app)) {
-    registerInspectorRoutes(app, config);
-    registerStaticRoutes(app, clientDistPath, runtimeConfig);
+    registerInspectorProxyRoutes(app, routesConfig, basePath);
+    registerInspectorCdnShell(app, shellConfig, basePath);
     return;
   }
   const honoApp = new Hono();
-  registerInspectorRoutes(honoApp, config);
-  registerStaticRoutes(honoApp, clientDistPath, runtimeConfig);
+  registerInspectorProxyRoutes(honoApp, routesConfig, basePath);
+  registerInspectorCdnShell(honoApp, shellConfig, basePath);
   app.use((req, res, next) => {
     const url = new URL(req.url || "", `http://${req.headers.host}`);
     const request = new Request(url, {
@@ -50,9 +46,7 @@ function mountInspector(app, config) {
         const reader = fetchResponse.body.getReader();
         while (true) {
           const { done, value } = await reader.read();
-          if (done) {
-            break;
-          }
+          if (done) break;
           res.write(value);
         }
         res.end();
@@ -65,6 +59,13 @@ function mountInspector(app, config) {
 function isHonoApp(app) {
   return typeof app.fetch === "function";
 }
+function normalizeInspectorBasePath(raw) {
+  if (raw === void 0) return "/mcp";
+  let value = raw.trim().replace(/\/{2,}/g, "/").replace(/\/+$/, "");
+  if (value === "" || value === "/") return "";
+  if (!value.startsWith("/")) value = `/${value}`;
+  return value;
+}
 
 export {
   mountInspector