@mcp-use/inspector 20.0.0-beta.15 → 20.0.0-beta.17

package/dist/cli.js

@@ -4,132 +4,21 @@
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { cors as cors2 } from "hono/cors";
-import { logger as logger2 } from "hono/logger";
 import open from "open";
 
-// src/server/asset-urls.ts
-var JSDELIVR_INSPECTOR_TAG = "beta";
-var DEFAULT_REMOTE_ASSETS_URL = `https://cdn.jsdelivr.net/npm/@mcp-use/inspector@${JSDELIVR_INSPECTOR_TAG}/dist/cdn/inspector.js`;
-function inspectorStylesUrl(assetsUrl) {
-  return assetsUrl.replace(/\.js(?=$|[?#])/, ".css");
-}
-function resolveInspectorAssetUrls(inspectorMode2, basePath) {
-  const envUrl = process.env.INSPECTOR_ASSETS_URL ?? process.env.MCP_USE_INSPECTOR_ASSETS_URL;
-  if (envUrl) {
-    return {
-      jsUrl: envUrl,
-      cssUrl: inspectorStylesUrl(envUrl),
-      useLocal: false,
-      resolveLatest: false
-    };
-  }
-  const legacyBase = process.env.INSPECTOR_CDN_BASE;
-  if (legacyBase) {
-    const base = legacyBase.replace(/\/$/, "");
-    if (/\.js(?:$|[?#])/.test(base)) {
-      return {
-        jsUrl: base,
-        cssUrl: inspectorStylesUrl(base),
-        useLocal: false,
-        resolveLatest: false
-      };
-    }
-    return {
-      jsUrl: `${base}/inspector.js`,
-      cssUrl: `${base}/inspector.css`,
-      useLocal: false,
-      resolveLatest: false
-    };
-  }
-  if (inspectorMode2 === "standalone") {
-    const prefix = basePath;
-    return {
-      jsUrl: `${prefix}/dist/cdn/inspector.js`,
-      cssUrl: `${prefix}/dist/cdn/inspector.css`,
-      useLocal: true,
-      resolveLatest: false
-    };
-  }
-  const jsUrl = DEFAULT_REMOTE_ASSETS_URL;
-  return {
-    jsUrl,
-    cssUrl: inspectorStylesUrl(jsUrl),
-    useLocal: false,
-    resolveLatest: true
-  };
-}
-
 // src/server/favicon-links.ts
 var FAVICON_CACHE_VERSION = "4";
-var INSPECTOR_FAVICON_ASSETS = [
-  "favicon.svg",
-  "favicon-96x96.png",
-  "favicon.ico",
-  "apple-touch-icon.png",
-  "site.webmanifest",
-  "web-app-manifest-192x192.png",
-  "web-app-manifest-512x512.png",
-  "favicon-black.svg",
-  "favicon-white.svg"
-];
 function renderInspectorFaviconLinks(basePath = "") {
   const prefix = basePath.replace(/\/$/, "");
   const href = `${prefix}/favicon-black.svg?v=${FAVICON_CACHE_VERSION}`;
   return `<link rel="icon" type="image/svg+xml" href="${href}" />`;
 }
 
-// src/server/favicon-static.ts
+// src/server/static-assets.ts
 import { existsSync, readFileSync } from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 var CONTENT_TYPES = {
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".ico": "image/x-icon",
-  ".webmanifest": "application/manifest+json"
-};
-function resolveFaviconDir() {
-  const here = path.dirname(fileURLToPath(import.meta.url));
-  for (const dir of [
-    path.resolve(here, "cdn"),
-    // dist/cli.js (bundled)
-    path.resolve(here, "../cdn"),
-    // dist/server/*.js
-    path.resolve(here, "../../public")
-    // src/server/*.ts (dev)
-  ]) {
-    if (existsSync(path.join(dir, "favicon-black.svg"))) {
-      return dir;
-    }
-  }
-  throw new Error(
-    "Inspector favicon assets not found (expected dist/cdn or public/)"
-  );
-}
-function registerInspectorFaviconStatic(app2, basePath = "") {
-  const faviconDir = resolveFaviconDir();
-  const p = (suffix) => `${basePath}${suffix}`;
-  for (const file of INSPECTOR_FAVICON_ASSETS) {
-    app2.get(p(`/${file}`), (c) => {
-      try {
-        const data = readFileSync(path.join(faviconDir, file));
-        const ext = path.extname(file);
-        return c.body(data, 200, {
-          "Content-Type": CONTENT_TYPES[ext] ?? "application/octet-stream",
-          "Cache-Control": "public, max-age=3600"
-        });
-      } catch {
-        return c.notFound();
-      }
-    });
-  }
-}
-
-// src/server/static-assets.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import path2 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-var CONTENT_TYPES2 = {
   ".js": "application/javascript",
   ".css": "text/css",
   ".svg": "image/svg+xml",
@@ -137,40 +26,44 @@ var CONTENT_TYPES2 = {
   ".ico": "image/x-icon",
   ".webmanifest": "application/manifest+json"
 };
-function resolveDistCdnDir() {
-  const here = path2.dirname(fileURLToPath2(import.meta.url));
+function resolveInspectorAppDir() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
   for (const dir of [
-    path2.resolve(here, "cdn"),
+    path.resolve(here, "app"),
     // dist/cli.js (bundled)
-    path2.resolve(here, "../cdn")
+    path.resolve(here, "../app"),
     // dist/server/*.js
+    path.resolve(here, "../../dist/app")
+    // src/server/*.ts (workspace dev)
   ]) {
-    if (existsSync2(path2.join(dir, "inspector.js"))) {
+    if (existsSync(path.join(dir, "inspector.js"))) {
       return dir;
     }
   }
   throw new Error(
-    "Inspector bundle not found (expected dist/cdn/inspector.js)"
+    "Inspector bundle not found (expected dist/app/inspector.js)"
   );
 }
-function registerInspectorStaticAssets(app2, basePath = "") {
-  const cdnDir = resolveDistCdnDir();
-  const mountPath = `${basePath}/dist/cdn`;
+function registerInspectorStaticAssets(app2, mountPath = "/inspector/assets") {
+  const appDir = resolveInspectorAppDir();
   app2.get(`${mountPath}/*`, (c) => {
     const subPath = c.req.path.slice(mountPath.length);
     const relative = subPath.startsWith("/") ? subPath.slice(1) : subPath;
     if (!relative || relative.includes("..")) {
       return c.notFound();
     }
-    const file = path2.resolve(cdnDir, relative);
-    const root = cdnDir.endsWith(path2.sep) ? cdnDir : `${cdnDir}${path2.sep}`;
-    if (!file.startsWith(root) || !existsSync2(file)) {
+    const file = path.resolve(appDir, relative);
+    const root = appDir.endsWith(path.sep) ? appDir : `${appDir}${path.sep}`;
+    if (!file.startsWith(root) || !existsSync(file)) {
       return c.notFound();
     }
-    const ext = path2.extname(file);
-    return c.body(readFileSync2(file), 200, {
-      "Content-Type": CONTENT_TYPES2[ext] ?? "application/octet-stream",
-      "Cache-Control": "public, max-age=3600"
+    const ext = path.extname(file);
+    return c.body(readFileSync(file), 200, {
+      "Content-Type": CONTENT_TYPES[ext] ?? "application/octet-stream",
+      // Standalone assets use stable URLs across CLI restarts. Revalidate them
+      // so a rebuilt or upgraded Inspector cannot keep running an hour-old UI
+      // bundle that predates its storage migrations or proxy contract.
+      "Cache-Control": "no-cache"
     });
   });
 }
@@ -179,7 +72,7 @@ function registerInspectorStaticAssets(app2, basePath = "") {
 var package_default = {
   name: "@mcp-use/inspector",
   type: "module",
-  version: "20.0.0-beta.14",
+  version: "20.0.0-beta.16",
   description: "MCP Inspector - A tool for inspecting and debugging MCP servers",
   author: "",
   license: "MIT",
@@ -201,7 +94,13 @@ var package_default = {
   exports: {
     ".": {
       types: "./dist/server/index.d.ts",
-      import: "./dist/server/index.js"
+      import: "./dist/server/index.js",
+      default: "./dist/server/index.js"
+    },
+    "./dev": {
+      types: "./dist/server/index.d.ts",
+      import: "./dist/server/index.js",
+      default: "./dist/server/index.js"
     },
     "./proxy": {
       types: "./dist/server/proxy-routes.d.ts",
@@ -225,12 +124,13 @@ var package_default = {
     "dev:client": "pnpm run dev",
     "dev:server": "VITE_DEV=true tsx watch src/server/server.ts",
     "dev:standalone": "tsx watch src/server/server.ts",
-    build: "npm run build:client && npm run build:client-exports && npm run build:server && npm run build:cli && npm run build:cdn",
-    "build:cdn": "vite build --config vite.cdn.config.ts",
-    "watch:cdn": "vite build --watch --config vite.cdn.config.ts",
-    "preview:cdn": "vite preview --config vite.cdn.config.ts --host 127.0.0.1",
-    "serve:cdn": "pnpm build:cdn && pnpm preview:cdn",
-    "analyze:cdn": "ANALYZE=true vite build --config vite.cdn.config.ts",
+    clean: "rimraf dist",
+    build: "npm run clean && npm run build:client && npm run build:client-exports && npm run build:server && npm run build:cli && npm run build:app",
+    "build:app": "vite build --config vite.app.config.ts",
+    "watch:app": "vite build --watch --config vite.app.config.ts",
+    "preview:app": "vite preview --config vite.app.config.ts --host 127.0.0.1",
+    "serve:app": "pnpm build:app && pnpm preview:app",
+    "analyze:app": "ANALYZE=true vite build --config vite.app.config.ts",
     "build:client": "vite build",
     "build:client-exports": "tsup --config tsup.client.ts && tsc -p tsconfig.client.json --emitDeclarationOnly --declaration",
     "build:server": "tsup 'src/server/**/*.ts' --format esm --out-dir dist/server && tsc -p tsconfig.server.json --emitDeclarationOnly --declaration",
@@ -270,8 +170,20 @@ var package_default = {
     "react-router": "^7.12.0"
   },
   peerDependenciesMeta: {
+    "@mcp-use/client": {
+      optional: true
+    },
     express: {
       optional: true
+    },
+    react: {
+      optional: true
+    },
+    "react-dom": {
+      optional: true
+    },
+    "react-router": {
+      optional: true
     }
   },
   dependencies: {
@@ -325,63 +237,14 @@ function getInspectorVersion() {
   return VERSION;
 }
 
-// src/server/cdn-shell.ts
+// src/server/inspector-shell.ts
 var INSPECTOR_VERSION = getInspectorVersion();
-var INSPECTOR_VERSION_RESOLVER_URL = "https://data.jsdelivr.com/v1/packages/npm/@mcp-use/inspector/resolved?specifier=beta";
-var INSPECTOR_CDN_PACKAGE_URL = "https://cdn.jsdelivr.net/npm/@mcp-use/inspector";
 var OAUTH_POPUP_CLOSED_HTML = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><title>Signed in</title><meta name="robots" content="noindex"><style>html,body{margin:0;height:100%;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#4b5563;background:#fff}</style></head>
 <body><div>Signed in. You can close this window.</div>
 <script>try{if(window.opener&&!window.opener.closed)window.opener.postMessage({type:"manufact:oauth-complete"},"*")}catch(e){}try{window.close()}catch(e){}</script>
 </body></html>`;
-function renderDefaultInspectorAssetLoader() {
-  return `<script type="module">
-      const resolverUrl = ${JSON.stringify(INSPECTOR_VERSION_RESOLVER_URL)};
-      const packageUrl = ${JSON.stringify(INSPECTOR_CDN_PACKAGE_URL)};
-      const versionPattern = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/;
-
-      try {
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 10_000);
-        let response;
-        try {
-          response = await fetch(resolverUrl, { signal: controller.signal });
-        } finally {
-          clearTimeout(timeout);
-        }
-        if (!response.ok) {
-          throw new Error(\`Inspector version resolver returned HTTP \${response.status}\`);
-        }
-
-        const resolved = await response.json();
-        if (
-          resolved?.name !== "@mcp-use/inspector" ||
-          typeof resolved.version !== "string" ||
-          !versionPattern.test(resolved.version)
-        ) {
-          throw new Error("Inspector version resolver returned an invalid release");
-        }
-
-        const version = resolved.version;
-        const assetBase = \`\${packageUrl}@\${version}/dist/cdn\`;
-        const stylesheet = document.createElement("link");
-        stylesheet.rel = "stylesheet";
-        stylesheet.href = \`\${assetBase}/inspector.css\`;
-        document.head.append(stylesheet);
-
-        window.__INSPECTOR_VERSION__ = version;
-        await import(\`\${assetBase}/inspector.js\`);
-      } catch (error) {
-        console.error("[Inspector] Failed to load the latest Inspector release:", error);
-        document.querySelector(".mcp-boot-spinner")?.remove();
-        const label = document.querySelector(".mcp-boot-label");
-        if (label) {
-          label.textContent = "Unable to load Inspector. Reload to try again.";
-        }
-      }
-    </script>`;
-}
-function generateCdnShellHtml(config, basePath, assets) {
+function generateInspectorShellHtml(config, basePath, assets) {
   const scripts = [];
   if (config?.basePath !== void 0) {
     scripts.push(
@@ -416,22 +279,20 @@ function generateCdnShellHtml(config, basePath, assets) {
       `<script>window.__MCP_USE_ANONYMIZED_TELEMETRY__ = false;try{localStorage.setItem("MCP_USE_ANONYMIZED_TELEMETRY","false");}catch(e){}</script>`
     );
   }
+  if (process.env.MCP_USE_DEV_CLI === "1") {
+    scripts.push(`<script>window.__MCP_DEV_CLI__ = true;</script>`);
+  }
   const runtimeScripts = scripts.join("\n    ");
-  const assetPreconnects = assets.resolveLatest ? `    <link rel="preconnect" href="https://data.jsdelivr.com" crossorigin />
-    <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin />` : "";
-  const stylesheetTag = assets.resolveLatest ? "" : `    <link rel="stylesheet" href="${assets.cssUrl}" />`;
-  const assetLoader = assets.resolveLatest ? renderDefaultInspectorAssetLoader() : `<script type="module" src="${assets.jsUrl}"></script>`;
   return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    ${renderInspectorFaviconLinks(basePath)}
+    ${renderInspectorFaviconLinks(`${basePath}/inspector/assets`)}
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-${assetPreconnects}
     <link href="https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;500;700&display=swap" rel="stylesheet" />
-${stylesheetTag}
+    <link rel="stylesheet" href="${assets.cssUrl}" />
     <title>Inspector | mcp-use</title>
     <meta name="description" content="Free, open-source MCP Inspector by mcp-use. Connect to any MCP server, test tools, prompts, and resources, inspect RPC logs, and debug MCP apps \u2014 all in your browser." />
     <style>
@@ -511,12 +372,17 @@ ${stylesheetTag}
         </div>
       </div>
     </div>
-    ${assetLoader}
+    <script type="module" src="${assets.jsUrl}"></script>
   </body>
 </html>`;
 }
-function registerInspectorCdnShell(app2, config, basePath = "") {
-  const assets = resolveInspectorAssetUrls(config?.inspectorMode, basePath);
+function registerInspectorShell(app2, config, basePath = "") {
+  const assetsPath = `${basePath}/inspector/assets`;
+  const version = encodeURIComponent(INSPECTOR_VERSION);
+  const assets = {
+    jsUrl: `${assetsPath}/inspector.js?v=${version}`,
+    cssUrl: `${assetsPath}/inspector.css?v=${version}`
+  };
   const p = (suffix) => `${basePath}${suffix}`;
   const effectiveConfig = {
     ...config,
@@ -525,10 +391,11 @@ function registerInspectorCdnShell(app2, config, basePath = "") {
     disableTelemetry: config?.disableTelemetry ?? process.env.MCP_USE_ANONYMIZED_TELEMETRY === "false"
   };
   const serveShell = (c) => {
-    const assets2 = resolveInspectorAssetUrls(config?.inspectorMode, basePath);
-    return c.html(generateCdnShellHtml(effectiveConfig, basePath, assets2));
+    return c.html(
+      generateInspectorShellHtml(effectiveConfig, basePath, assets)
+    );
   };
-  registerInspectorFaviconStatic(app2, basePath);
+  registerInspectorStaticAssets(app2, assetsPath);
   app2.get(
     p("/inspector/oauth-popup-closed.html"),
     (c) => c.html(OAUTH_POPUP_CLOSED_HTML)
@@ -548,15 +415,12 @@ function registerInspectorCdnShell(app2, config, basePath = "") {
     }
     return serveShell(c);
   });
-  if (basePath === "") {
+  if (basePath === "" && config?.rootRedirect !== false) {
     app2.get("/", (c) => {
       const url = new URL(c.req.url);
       return c.redirect(`${p("/inspector")}${url.search}`);
     });
   }
-  if (assets.useLocal) {
-    registerInspectorStaticAssets(app2, basePath);
-  }
 }
 
 // src/server/proxy/mcp-proxy.ts
@@ -565,6 +429,7 @@ import { logger } from "hono/logger";
 
 // src/server/proxy/oauth-proxy.ts
 import { lookup } from "dns/promises";
+import { Buffer } from "buffer";
 import { isIP } from "net";
 var SAFE_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "accept",
@@ -589,6 +454,8 @@ var ENDPOINT_FIELDS = [
 ];
 var BINDING_TTL_MS = 10 * 60 * 1e3;
 var MAX_BINDINGS = 100;
+var CONFIDENTIAL_CLIENT_TTL_MS = 24 * 60 * 60 * 1e3;
+var MAX_CONFIDENTIAL_CLIENTS = 500;
 function mountOAuthProxy(app2, options = {}) {
   const {
     basePath = "/oauth",
@@ -597,15 +464,17 @@ function mountOAuthProxy(app2, options = {}) {
     timeoutMs = 1e4,
     maxRequestBodyBytes = 64 * 1024,
     maxResponseBodyBytes = 1024 * 1024,
+    callbackPath = "/oauth/callback",
     enableLogging = true,
     authenticate,
     validateServerUrl
   } = options;
   const origins = new Set(allowedOrigins.map(normalizeOrigin));
   const bindings = /* @__PURE__ */ new Map();
+  const confidentialClients = /* @__PURE__ */ new Map();
   app2.use(`${basePath}/*`, async (c, next) => {
     const origin = c.req.header("Origin");
-    if (origin && !isAllowedOrigin(origin, c.req.url, origins)) {
+    if (origin && !isAllowedOrigin(origin, c, origins)) {
       return c.json({ error: "Origin not allowed" }, 403);
     }
     if (c.req.method === "OPTIONS") {
@@ -762,7 +631,24 @@ function mountOAuthProxy(app2, options = {}) {
     }
     try {
       const headers = filterRequestHeaders(request.headers);
-      const body = serializeBody(request.body, headers);
+      let body = serializeBody(request.body, headers);
+      if (endpointKind === "registration") {
+        const publicOrigin = normalizeOrigin(
+          c.req.header("Origin") ?? new URL(c.req.url).origin
+        );
+        body = enforceRegistrationRedirectUri(
+          body,
+          headers,
+          new URL(callbackPath, publicOrigin).toString()
+        );
+      } else {
+        body = applyConfidentialClientAuthentication({
+          body,
+          headers,
+          bindingKey,
+          clients: confidentialClients
+        });
+      }
       if (new TextEncoder().encode(body ?? "").byteLength > maxRequestBodyBytes) {
         return c.json({ error: "OAuth request body too large" }, 413);
       }
@@ -790,6 +676,14 @@ function mountOAuthProxy(app2, options = {}) {
         } catch {
         }
       }
+      if (endpointKind === "registration" && upstream.ok && responseBody && typeof responseBody === "object" && !Array.isArray(responseBody)) {
+        responseBody = retainConfidentialClient({
+          responseBody,
+          binding,
+          bindingKey,
+          clients: confidentialClients
+        });
+      }
       return c.json({
         status: upstream.status,
         statusText: upstream.statusText,
@@ -859,18 +753,18 @@ function classifyMetadataTarget(serverUrl, target, binding) {
   return void 0;
 }
 function protectedResourceMetadataUrls(serverUrl) {
-  const path3 = serverUrl.pathname === "/" ? "" : serverUrl.pathname;
+  const path2 = serverUrl.pathname === "/" ? "" : serverUrl.pathname;
   return [
-    new URL(`/.well-known/oauth-protected-resource${path3}`, serverUrl.origin),
+    new URL(`/.well-known/oauth-protected-resource${path2}`, serverUrl.origin),
     new URL("/.well-known/oauth-protected-resource", serverUrl.origin)
   ];
 }
 function authorizationServerMetadataUrls(issuer) {
-  const path3 = issuer.pathname === "/" ? "" : issuer.pathname;
+  const path2 = issuer.pathname === "/" ? "" : issuer.pathname;
   return [
-    new URL(`/.well-known/oauth-authorization-server${path3}`, issuer.origin),
-    new URL(`/.well-known/openid-configuration${path3}`, issuer.origin),
-    new URL(`${path3 || ""}/.well-known/openid-configuration`, issuer.origin)
+    new URL(`/.well-known/oauth-authorization-server${path2}`, issuer.origin),
+    new URL(`/.well-known/openid-configuration${path2}`, issuer.origin),
+    new URL(`${path2 || ""}/.well-known/openid-configuration`, issuer.origin)
   ];
 }
 async function bindProtectedResource(metadata, serverUrl, binding, allowLoopback) {
@@ -896,6 +790,7 @@ async function bindProtectedResource(metadata, serverUrl, binding, allowLoopback
   }
   binding.authorizationServers = issuers;
   binding.endpoints.clear();
+  binding.tokenEndpointAuthMethods.clear();
 }
 async function bindAuthorizationServer(metadata, expectedIssuer, binding, allowLoopback) {
   if (typeof metadata.issuer !== "string" || canonicalUrl(new URL(metadata.issuer)) !== expectedIssuer) {
@@ -904,6 +799,11 @@ async function bindAuthorizationServer(metadata, expectedIssuer, binding, allowL
     );
   }
   binding.endpoints.clear();
+  binding.tokenEndpointAuthMethods = new Set(
+    Array.isArray(metadata.token_endpoint_auth_methods_supported) ? metadata.token_endpoint_auth_methods_supported.filter(
+      (method) => typeof method === "string"
+    ) : []
+  );
   for (const [field, kind] of ENDPOINT_FIELDS) {
     const value = metadata[field];
     if (value === void 0) continue;
@@ -1000,7 +900,17 @@ function filterResponseHeaders(headers) {
 }
 function serializeBody(body, headers) {
   if (body === void 0 || body === null) return void 0;
-  if (typeof body === "string") return body;
+  if (typeof body === "string") {
+    if (!headers.has("content-type")) {
+      try {
+        JSON.parse(body);
+        headers.set("content-type", "application/json");
+      } catch {
+        headers.set("content-type", "application/x-www-form-urlencoded");
+      }
+    }
+    return body;
+  }
   const contentType = headers.get("content-type") ?? "";
   if (contentType.includes("application/x-www-form-urlencoded") && typeof body === "object" && !Array.isArray(body)) {
     const params = new URLSearchParams();
@@ -1016,6 +926,77 @@ function serializeBody(body, headers) {
   }
   return JSON.stringify(body);
 }
+function confidentialClientKey(bindingKey, clientId) {
+  return `${bindingKey}\0${clientId}`;
+}
+function retainConfidentialClient(options) {
+  const { responseBody, binding, bindingKey, clients } = options;
+  const clientId = responseBody.client_id;
+  const clientSecret = responseBody.client_secret;
+  if (typeof clientId !== "string" || typeof clientSecret !== "string") {
+    return responseBody;
+  }
+  const returnedMethod = responseBody.token_endpoint_auth_method;
+  const authMethod = returnedMethod === "client_secret_post" || returnedMethod === "client_secret_basic" ? returnedMethod : binding.tokenEndpointAuthMethods.has("client_secret_basic") ? "client_secret_basic" : "client_secret_post";
+  const upstreamExpiry = responseBody.client_secret_expires_at;
+  const expiresAt = upstreamExpiry === 0 ? Number.POSITIVE_INFINITY : typeof upstreamExpiry === "number" && upstreamExpiry > 0 ? upstreamExpiry * 1e3 : Date.now() + CONFIDENTIAL_CLIENT_TTL_MS;
+  pruneConfidentialClients(clients);
+  clients.set(confidentialClientKey(bindingKey, clientId), {
+    clientSecret,
+    authMethod,
+    expiresAt
+  });
+  while (clients.size > MAX_CONFIDENTIAL_CLIENTS) {
+    const oldest = clients.keys().next().value;
+    if (!oldest) break;
+    clients.delete(oldest);
+  }
+  const browserSafe = { ...responseBody };
+  delete browserSafe.client_secret;
+  delete browserSafe.client_secret_expires_at;
+  browserSafe.token_endpoint_auth_method = "none";
+  return browserSafe;
+}
+function applyConfidentialClientAuthentication(options) {
+  const { body, headers, bindingKey, clients } = options;
+  if (!body || !(headers.get("content-type") ?? "").includes(
+    "application/x-www-form-urlencoded"
+  )) {
+    return body;
+  }
+  const params = new URLSearchParams(body);
+  const clientId = params.get("client_id");
+  if (!clientId) return body;
+  const key = confidentialClientKey(bindingKey, clientId);
+  const client = clients.get(key);
+  if (!client) return body;
+  if (client.expiresAt <= Date.now()) {
+    clients.delete(key);
+    return body;
+  }
+  params.delete("client_secret");
+  if (client.authMethod === "client_secret_basic") {
+    const encoded = Buffer.from(
+      `${encodeOAuthClientCredential(clientId)}:${encodeOAuthClientCredential(client.clientSecret)}`,
+      "utf8"
+    ).toString("base64");
+    headers.set("authorization", `Basic ${encoded}`);
+  } else {
+    headers.delete("authorization");
+    params.set("client_id", clientId);
+    params.set("client_secret", client.clientSecret);
+  }
+  return params.toString();
+}
+function encodeOAuthClientCredential(value) {
+  return new URLSearchParams({ value }).toString().slice("value=".length);
+}
+function pruneConfidentialClients(clients) {
+  const now = Date.now();
+  for (const [key, client] of clients) {
+    if (client.expiresAt <= now) clients.delete(key);
+  }
+}
 async function readRequestCapped(request, maxBytes) {
   const declared = Number(request.headers.get("content-length"));
   if (Number.isFinite(declared) && declared > maxBytes) {
@@ -1075,6 +1056,7 @@ function getBinding(bindings, key) {
   return {
     authorizationServers: /* @__PURE__ */ new Set(),
     endpoints: /* @__PURE__ */ new Map(),
+    tokenEndpointAuthMethods: /* @__PURE__ */ new Set(),
     updatedAt: Date.now()
   };
 }
@@ -1097,6 +1079,23 @@ function canonicalUrl(url) {
   }
   return copy.toString().replace(/\/$/, "");
 }
+function enforceRegistrationRedirectUri(body, headers, callbackUrl) {
+  if (!body) return body;
+  const contentType = headers.get("content-type") ?? "";
+  if (!contentType.includes("json")) return body;
+  try {
+    const parsed = JSON.parse(body);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return body;
+    }
+    return JSON.stringify({
+      ...parsed,
+      redirect_uris: [callbackUrl]
+    });
+  } catch {
+    return body;
+  }
+}
 function normalizeOrigin(origin) {
   const url = new URL(origin);
   if (url.pathname !== "/" || url.search || url.hash) {
@@ -1104,10 +1103,18 @@ function normalizeOrigin(origin) {
   }
   return url.origin;
 }
-function isAllowedOrigin(origin, requestUrl, allowed) {
+function isAllowedOrigin(origin, c, allowed) {
   try {
     const normalized = normalizeOrigin(origin);
-    return normalized === new URL(requestUrl).origin || allowed.has(normalized);
+    if (normalized === new URL(c.req.url).origin || allowed.has(normalized)) {
+      return true;
+    }
+    const originUrl = new URL(normalized);
+    const forwardedHost = c.req.header("x-forwarded-host")?.split(",")[0]?.trim();
+    const requestHost = forwardedHost || c.req.header("host");
+    if (!requestHost || originUrl.host !== requestHost) return false;
+    const forwardedProto = c.req.header("x-forwarded-proto")?.split(",")[0]?.trim();
+    return !forwardedProto || `${forwardedProto}:` === originUrl.protocol;
   } catch {
     return false;
   }
@@ -1179,6 +1186,7 @@ var InvalidUpstreamError = class extends Error {
 };
 
 // src/server/proxy/mcp-proxy.ts
+var MAX_REDIRECTS = 3;
 function isOpenEndedSseResponse(contentType, contentLength) {
   return contentType.includes("text/event-stream") && !contentLength;
 }
@@ -1262,81 +1270,48 @@ function mountMcpProxy(app2, options = {}) {
       const requestHeaders = c.req.header();
       for (const [key, value] of Object.entries(requestHeaders)) {
         const lowerKey = key.toLowerCase();
-        if (!lowerKey.startsWith("x-proxy-") && !lowerKey.startsWith("x-target-") && !lowerKey.startsWith("x-mcp-") && !lowerKey.startsWith("x-forwarded-") && !lowerKey.startsWith("cf-") && lowerKey !== "x-original-host" && lowerKey !== "host" && lowerKey !== "accept-encoding" && lowerKey !== "cdn-loop") {
+        if (!lowerKey.startsWith("x-proxy-") && !lowerKey.startsWith("x-target-") && !lowerKey.startsWith("x-mcp-") && !lowerKey.startsWith("x-forwarded-") && !lowerKey.startsWith("cf-") && lowerKey !== "x-original-host" && lowerKey !== "host" && lowerKey !== "origin" && lowerKey !== "referer" && lowerKey !== "cookie" && lowerKey !== "proxy-authorization" && lowerKey !== "accept-encoding" && lowerKey !== "cdn-loop" && !lowerKey.startsWith("sec-fetch-")) {
           headers[key] = value;
         }
       }
       headers["Accept-Encoding"] = "identity";
-      try {
-        const targetUrlObj = new URL(targetUrl);
-        headers.Host = targetUrlObj.host;
-      } catch {
-        return c.json({ error: "Invalid target URL" }, 400);
-      }
       const body = method !== "GET" && method !== "HEAD" ? new Uint8Array(await c.req.arrayBuffer()).slice() : void 0;
-      const response = await fetch(targetUrl, {
-        method,
-        headers,
-        body,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
+      let currentUrl = targetUrl;
+      let currentMethod = method;
+      let currentBody = body;
+      for (let redirectCount = 0; ; redirectCount += 1) {
+        const response = await fetch(currentUrl, {
+          method: currentMethod,
+          headers,
+          body: currentBody,
+          redirect: "manual"
+        });
         const location = response.headers.get("location");
-        if (location) {
-          const redirectUrl = new URL(location, targetUrl).toString();
-          if (!await isSafeProxyTarget(
-            redirectUrl,
-            options.allowLoopback ?? false
-          ) || options.validateRequest && !await options.validateRequest(redirectUrl, c)) {
-            return c.json({ error: "Redirect target is not allowed" }, 403);
-          }
-          const redirectResponse = await fetch(redirectUrl, {
-            method,
-            headers,
-            body,
-            redirect: "manual"
-          });
-          const redirectHeaders = {};
-          redirectResponse.headers.forEach((value, key) => {
-            const lowerKey = key.toLowerCase();
-            if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length") {
-              redirectHeaders[key] = value;
-            }
-          });
-          return new Response(redirectResponse.body, {
-            status: redirectResponse.status,
-            statusText: redirectResponse.statusText,
-            headers: redirectHeaders
-          });
+        if (!(response.status >= 300 && response.status < 400 && location)) {
+          return proxyResponse(response);
         }
-      }
-      const responseHeaders = {};
-      response.headers.forEach((value, key) => {
-        const lowerKey = key.toLowerCase();
-        if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length") {
-          responseHeaders[key] = value;
+        if (redirectCount >= MAX_REDIRECTS) {
+          return c.json({ error: "Too many upstream redirects" }, 502);
         }
-      });
-      const contentType = response.headers.get("content-type") || "";
-      const upstreamContentLength = response.headers.get("content-length");
-      const isTrueStream = isOpenEndedSseResponse(
-        contentType,
-        upstreamContentLength
-      );
-      if (isTrueStream) {
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers: responseHeaders
-        });
+        const redirectUrl = new URL(location, currentUrl);
+        if (!await isSafeProxyTarget(
+          redirectUrl.toString(),
+          options.allowLoopback ?? false
+        ) || options.validateRequest && !await options.validateRequest(redirectUrl.toString(), c)) {
+          return c.json({ error: "Redirect target is not allowed" }, 403);
+        }
+        if (redirectUrl.origin !== new URL(currentUrl).origin) {
+          deleteHeader(headers, "authorization");
+          deleteHeader(headers, "proxy-authorization");
+        }
+        if (response.status === 303 || (response.status === 301 || response.status === 302) && currentMethod === "POST") {
+          currentMethod = "GET";
+          currentBody = void 0;
+          deleteHeader(headers, "content-type");
+          deleteHeader(headers, "content-length");
+        }
+        currentUrl = redirectUrl.toString();
       }
-      const bodyBuffer = await response.arrayBuffer();
-      responseHeaders["Content-Length"] = String(bodyBuffer.byteLength);
-      return new Response(bodyBuffer, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: responseHeaders
-      });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
       const targetUrl = c.req.header("X-Target-URL");
@@ -1366,6 +1341,38 @@ function mountMcpProxy(app2, options = {}) {
     }
   });
 }
+function deleteHeader(headers, name) {
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === name) delete headers[key];
+  }
+}
+async function proxyResponse(response) {
+  const responseHeaders = {};
+  response.headers.forEach((value, key) => {
+    const lowerKey = key.toLowerCase();
+    if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length" && lowerKey !== "set-cookie") {
+      responseHeaders[key] = value;
+    }
+  });
+  const isTrueStream = isOpenEndedSseResponse(
+    response.headers.get("content-type") || "",
+    response.headers.get("content-length")
+  );
+  if (isTrueStream) {
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: responseHeaders
+    });
+  }
+  const bodyBuffer = await response.arrayBuffer();
+  responseHeaders["Content-Length"] = String(bodyBuffer.byteLength);
+  return new Response(bodyBuffer, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: responseHeaders
+  });
+}
 
 // src/server/proxy-routes.ts
 function registerInspectorProxyRoutes(app2, config, basePath = "") {
@@ -1387,6 +1394,7 @@ function registerInspectorProxyRoutes(app2, config, basePath = "") {
   if (mountOAuth) {
     mountOAuthProxy(app2, {
       basePath: p("/inspector/api/oauth"),
+      callbackPath: p("/inspector/oauth/callback"),
       enableLogging: true,
       allowedOrigins: config?.oauthProxyAllowedOrigins ?? [],
       allowLoopback
@@ -1502,15 +1510,13 @@ app.use(
     exposeHeaders: ["*"]
   })
 );
-app.use("/inspector/api/proxy/*", logger2());
-var inspectorMode = process.env.MCP_INSPECTOR_MODE ?? (process.env.RAILWAY_ENVIRONMENT_NAME ? "cloud" : "standalone");
 registerInspectorProxyRoutes(app, {
   autoConnectUrl: mcpUrl,
   oauthProxyAllowedOrigins: [],
-  oauthProxyAllowLoopback: inspectorMode === "standalone"
+  oauthProxyAllowLoopback: true
 });
-registerInspectorCdnShell(app, {
-  inspectorMode,
+registerInspectorShell(app, {
+  inspectorMode: "standalone",
   manufactChatUrl: process.env.MANUFACT_CHAT_URL
 });
 async function startServer() {