@mcp-use/inspector 20.0.0-beta.16 → 20.0.0-beta.17

package/dist/client/auth/manufact-auth.d.ts

@@ -13,7 +13,7 @@ interface ManufactAuthSnapshot {
 }
 export declare function canShareManufactSession(inspectorUrl: string, cloudOrigin: string): boolean;
 export declare function getSharedManufactSession(chatApiUrl: string): Promise<ManufactUser | null>;
-export declare function authorizeManufact(chatApiUrl: string, options?: {
+export declare function authorizeManufact(chatApiUrl: string, _options?: {
     isRetry?: boolean;
 }): Promise<void>;
 export declare function completeManufactAuthorization(url?: URL): Promise<void>;

package/dist/client/auth/manufact-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manufact-auth.d.ts","sourceRoot":"","sources":["../../../src/client/auth/manufact-auth.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA6BD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;CAClC;AAgDD,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAeT;AAiUD,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;AAgED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAsEf;AAED,wBAAsB,6BAA6B,CACjD,GAAG,MAAgC,GAClC,OAAO,CAAC,IAAI,CAAC,CAmCf;AA0FD,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG;IACtE,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B,CAiDA"}
+{"version":3,"file":"manufact-auth.d.ts","sourceRoot":"","sources":["../../../src/client/auth/manufact-auth.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AA6BD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;CAClC;AAgDD,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAeT;AAiUD,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAE9B;AAgED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAsEf;AAED,wBAAsB,6BAA6B,CACjD,GAAG,MAAgC,GAClC,OAAO,CAAC,IAAI,CAAC,CAmCf;AA0FD,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG;IACtE,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B,CAiDA"}

package/dist/client/index.js

@@ -15774,7 +15774,7 @@ async function load(origin) {
   loading.set(origin, promise);
   return promise;
 }
-async function authorizeManufact(chatApiUrl, options) {
+async function authorizeManufact(chatApiUrl, _options) {
   const origin = authOrigin(chatApiUrl);
   pendingAuthorizeChatApiUrl = chatApiUrl;
   setSkipSharedSession(origin, false);

package/dist/server/{chunk-XCNS5CIW.js → chunk-2K7OKCVV.js}

@@ -1,10 +1,11 @@
 import {
   isSafeProxyTarget
-} from "./chunk-K2F2AJOI.js";
+} from "./chunk-V5A5XLFJ.js";
 
 // src/server/proxy/mcp-proxy.ts
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
+var MAX_REDIRECTS = 3;
 function isOpenEndedSseResponse(contentType, contentLength) {
   return contentType.includes("text/event-stream") && !contentLength;
 }
@@ -88,81 +89,48 @@ function mountMcpProxy(app, options = {}) {
       const requestHeaders = c.req.header();
       for (const [key, value] of Object.entries(requestHeaders)) {
         const lowerKey = key.toLowerCase();
-        if (!lowerKey.startsWith("x-proxy-") && !lowerKey.startsWith("x-target-") && !lowerKey.startsWith("x-mcp-") && !lowerKey.startsWith("x-forwarded-") && !lowerKey.startsWith("cf-") && lowerKey !== "x-original-host" && lowerKey !== "host" && lowerKey !== "accept-encoding" && lowerKey !== "cdn-loop") {
+        if (!lowerKey.startsWith("x-proxy-") && !lowerKey.startsWith("x-target-") && !lowerKey.startsWith("x-mcp-") && !lowerKey.startsWith("x-forwarded-") && !lowerKey.startsWith("cf-") && lowerKey !== "x-original-host" && lowerKey !== "host" && lowerKey !== "origin" && lowerKey !== "referer" && lowerKey !== "cookie" && lowerKey !== "proxy-authorization" && lowerKey !== "accept-encoding" && lowerKey !== "cdn-loop" && !lowerKey.startsWith("sec-fetch-")) {
           headers[key] = value;
         }
       }
       headers["Accept-Encoding"] = "identity";
-      try {
-        const targetUrlObj = new URL(targetUrl);
-        headers.Host = targetUrlObj.host;
-      } catch {
-        return c.json({ error: "Invalid target URL" }, 400);
-      }
       const body = method !== "GET" && method !== "HEAD" ? new Uint8Array(await c.req.arrayBuffer()).slice() : void 0;
-      const response = await fetch(targetUrl, {
-        method,
-        headers,
-        body,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
+      let currentUrl = targetUrl;
+      let currentMethod = method;
+      let currentBody = body;
+      for (let redirectCount = 0; ; redirectCount += 1) {
+        const response = await fetch(currentUrl, {
+          method: currentMethod,
+          headers,
+          body: currentBody,
+          redirect: "manual"
+        });
         const location = response.headers.get("location");
-        if (location) {
-          const redirectUrl = new URL(location, targetUrl).toString();
-          if (!await isSafeProxyTarget(
-            redirectUrl,
-            options.allowLoopback ?? false
-          ) || options.validateRequest && !await options.validateRequest(redirectUrl, c)) {
-            return c.json({ error: "Redirect target is not allowed" }, 403);
-          }
-          const redirectResponse = await fetch(redirectUrl, {
-            method,
-            headers,
-            body,
-            redirect: "manual"
-          });
-          const redirectHeaders = {};
-          redirectResponse.headers.forEach((value, key) => {
-            const lowerKey = key.toLowerCase();
-            if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length") {
-              redirectHeaders[key] = value;
-            }
-          });
-          return new Response(redirectResponse.body, {
-            status: redirectResponse.status,
-            statusText: redirectResponse.statusText,
-            headers: redirectHeaders
-          });
+        if (!(response.status >= 300 && response.status < 400 && location)) {
+          return proxyResponse(response);
         }
-      }
-      const responseHeaders = {};
-      response.headers.forEach((value, key) => {
-        const lowerKey = key.toLowerCase();
-        if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length") {
-          responseHeaders[key] = value;
+        if (redirectCount >= MAX_REDIRECTS) {
+          return c.json({ error: "Too many upstream redirects" }, 502);
         }
-      });
-      const contentType = response.headers.get("content-type") || "";
-      const upstreamContentLength = response.headers.get("content-length");
-      const isTrueStream = isOpenEndedSseResponse(
-        contentType,
-        upstreamContentLength
-      );
-      if (isTrueStream) {
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers: responseHeaders
-        });
+        const redirectUrl = new URL(location, currentUrl);
+        if (!await isSafeProxyTarget(
+          redirectUrl.toString(),
+          options.allowLoopback ?? false
+        ) || options.validateRequest && !await options.validateRequest(redirectUrl.toString(), c)) {
+          return c.json({ error: "Redirect target is not allowed" }, 403);
+        }
+        if (redirectUrl.origin !== new URL(currentUrl).origin) {
+          deleteHeader(headers, "authorization");
+          deleteHeader(headers, "proxy-authorization");
+        }
+        if (response.status === 303 || (response.status === 301 || response.status === 302) && currentMethod === "POST") {
+          currentMethod = "GET";
+          currentBody = void 0;
+          deleteHeader(headers, "content-type");
+          deleteHeader(headers, "content-length");
+        }
+        currentUrl = redirectUrl.toString();
       }
-      const bodyBuffer = await response.arrayBuffer();
-      responseHeaders["Content-Length"] = String(bodyBuffer.byteLength);
-      return new Response(bodyBuffer, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: responseHeaders
-      });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
       const targetUrl = c.req.header("X-Target-URL");
@@ -192,6 +160,38 @@ function mountMcpProxy(app, options = {}) {
     }
   });
 }
+function deleteHeader(headers, name) {
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === name) delete headers[key];
+  }
+}
+async function proxyResponse(response) {
+  const responseHeaders = {};
+  response.headers.forEach((value, key) => {
+    const lowerKey = key.toLowerCase();
+    if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length" && lowerKey !== "set-cookie") {
+      responseHeaders[key] = value;
+    }
+  });
+  const isTrueStream = isOpenEndedSseResponse(
+    response.headers.get("content-type") || "",
+    response.headers.get("content-length")
+  );
+  if (isTrueStream) {
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: responseHeaders
+    });
+  }
+  const bodyBuffer = await response.arrayBuffer();
+  responseHeaders["Content-Length"] = String(bodyBuffer.byteLength);
+  return new Response(bodyBuffer, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: responseHeaders
+  });
+}
 
 export {
   isOpenEndedSseResponse,

package/dist/server/{chunk-UJLXHNQP.js → chunk-EKD2XITW.js}

@@ -1,9 +1,9 @@
 import {
   mountMcpProxy
-} from "./chunk-XCNS5CIW.js";
+} from "./chunk-2K7OKCVV.js";
 import {
   mountOAuthProxy
-} from "./chunk-K2F2AJOI.js";
+} from "./chunk-V5A5XLFJ.js";
 
 // src/server/proxy-routes.ts
 function registerInspectorProxyRoutes(app, config, basePath = "") {
@@ -25,6 +25,7 @@ function registerInspectorProxyRoutes(app, config, basePath = "") {
   if (mountOAuth) {
     mountOAuthProxy(app, {
       basePath: p("/inspector/api/oauth"),
+      callbackPath: p("/inspector/oauth/callback"),
       enableLogging: true,
       allowedOrigins: config?.oauthProxyAllowedOrigins ?? [],
       allowLoopback

package/dist/server/{chunk-FHC5ZGMM.js → chunk-EPPZCSJQ.js}

@@ -1,76 +1,21 @@
 import {
   registerInspectorStaticAssets
-} from "./chunk-M5TZA42I.js";
+} from "./chunk-PZF2PUDE.js";
 import {
   getInspectorVersion
-} from "./chunk-R5ZEVRE5.js";
-import {
-  resolveInspectorAssetUrls
-} from "./chunk-JZT7N2BJ.js";
-import {
-  registerInspectorFaviconStatic
-} from "./chunk-J4FNYLBF.js";
+} from "./chunk-RFJAZOK7.js";
 import {
   renderInspectorFaviconLinks
 } from "./chunk-WFT4JHYI.js";
 
-// src/server/cdn-shell.ts
+// src/server/inspector-shell.ts
 var INSPECTOR_VERSION = getInspectorVersion();
-var INSPECTOR_VERSION_RESOLVER_URL = "https://data.jsdelivr.com/v1/packages/npm/@mcp-use/inspector/resolved?specifier=beta";
-var INSPECTOR_CDN_PACKAGE_URL = "https://cdn.jsdelivr.net/npm/@mcp-use/inspector";
 var OAUTH_POPUP_CLOSED_HTML = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><title>Signed in</title><meta name="robots" content="noindex"><style>html,body{margin:0;height:100%;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#4b5563;background:#fff}</style></head>
 <body><div>Signed in. You can close this window.</div>
 <script>try{if(window.opener&&!window.opener.closed)window.opener.postMessage({type:"manufact:oauth-complete"},"*")}catch(e){}try{window.close()}catch(e){}</script>
 </body></html>`;
-function renderDefaultInspectorAssetLoader() {
-  return `<script type="module">
-      const resolverUrl = ${JSON.stringify(INSPECTOR_VERSION_RESOLVER_URL)};
-      const packageUrl = ${JSON.stringify(INSPECTOR_CDN_PACKAGE_URL)};
-      const versionPattern = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/;
-
-      try {
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 10_000);
-        let response;
-        try {
-          response = await fetch(resolverUrl, { signal: controller.signal });
-        } finally {
-          clearTimeout(timeout);
-        }
-        if (!response.ok) {
-          throw new Error(\`Inspector version resolver returned HTTP \${response.status}\`);
-        }
-
-        const resolved = await response.json();
-        if (
-          resolved?.name !== "@mcp-use/inspector" ||
-          typeof resolved.version !== "string" ||
-          !versionPattern.test(resolved.version)
-        ) {
-          throw new Error("Inspector version resolver returned an invalid release");
-        }
-
-        const version = resolved.version;
-        const assetBase = \`\${packageUrl}@\${version}/dist/cdn\`;
-        const stylesheet = document.createElement("link");
-        stylesheet.rel = "stylesheet";
-        stylesheet.href = \`\${assetBase}/inspector.css\`;
-        document.head.append(stylesheet);
-
-        window.__INSPECTOR_VERSION__ = version;
-        await import(\`\${assetBase}/inspector.js\`);
-      } catch (error) {
-        console.error("[Inspector] Failed to load the latest Inspector release:", error);
-        document.querySelector(".mcp-boot-spinner")?.remove();
-        const label = document.querySelector(".mcp-boot-label");
-        if (label) {
-          label.textContent = "Unable to load Inspector. Reload to try again.";
-        }
-      }
-    </script>`;
-}
-function generateCdnShellHtml(config, basePath, assets) {
+function generateInspectorShellHtml(config, basePath, assets) {
   const scripts = [];
   if (config?.basePath !== void 0) {
     scripts.push(
@@ -105,22 +50,20 @@ function generateCdnShellHtml(config, basePath, assets) {
       `<script>window.__MCP_USE_ANONYMIZED_TELEMETRY__ = false;try{localStorage.setItem("MCP_USE_ANONYMIZED_TELEMETRY","false");}catch(e){}</script>`
     );
   }
+  if (process.env.MCP_USE_DEV_CLI === "1") {
+    scripts.push(`<script>window.__MCP_DEV_CLI__ = true;</script>`);
+  }
   const runtimeScripts = scripts.join("\n    ");
-  const assetPreconnects = assets.resolveLatest ? `    <link rel="preconnect" href="https://data.jsdelivr.com" crossorigin />
-    <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin />` : "";
-  const stylesheetTag = assets.resolveLatest ? "" : `    <link rel="stylesheet" href="${assets.cssUrl}" />`;
-  const assetLoader = assets.resolveLatest ? renderDefaultInspectorAssetLoader() : `<script type="module" src="${assets.jsUrl}"></script>`;
   return `<!doctype html>
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    ${renderInspectorFaviconLinks(basePath)}
+    ${renderInspectorFaviconLinks(`${basePath}/inspector/assets`)}
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-${assetPreconnects}
     <link href="https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;500;700&display=swap" rel="stylesheet" />
-${stylesheetTag}
+    <link rel="stylesheet" href="${assets.cssUrl}" />
     <title>Inspector | mcp-use</title>
     <meta name="description" content="Free, open-source MCP Inspector by mcp-use. Connect to any MCP server, test tools, prompts, and resources, inspect RPC logs, and debug MCP apps \u2014 all in your browser." />
     <style>
@@ -200,12 +143,17 @@ ${stylesheetTag}
         </div>
       </div>
     </div>
-    ${assetLoader}
+    <script type="module" src="${assets.jsUrl}"></script>
   </body>
 </html>`;
 }
-function registerInspectorCdnShell(app, config, basePath = "") {
-  const assets = resolveInspectorAssetUrls(config?.inspectorMode, basePath);
+function registerInspectorShell(app, config, basePath = "") {
+  const assetsPath = `${basePath}/inspector/assets`;
+  const version = encodeURIComponent(INSPECTOR_VERSION);
+  const assets = {
+    jsUrl: `${assetsPath}/inspector.js?v=${version}`,
+    cssUrl: `${assetsPath}/inspector.css?v=${version}`
+  };
   const p = (suffix) => `${basePath}${suffix}`;
   const effectiveConfig = {
     ...config,
@@ -214,10 +162,11 @@ function registerInspectorCdnShell(app, config, basePath = "") {
     disableTelemetry: config?.disableTelemetry ?? process.env.MCP_USE_ANONYMIZED_TELEMETRY === "false"
   };
   const serveShell = (c) => {
-    const assets2 = resolveInspectorAssetUrls(config?.inspectorMode, basePath);
-    return c.html(generateCdnShellHtml(effectiveConfig, basePath, assets2));
+    return c.html(
+      generateInspectorShellHtml(effectiveConfig, basePath, assets)
+    );
   };
-  registerInspectorFaviconStatic(app, basePath);
+  registerInspectorStaticAssets(app, assetsPath);
   app.get(
     p("/inspector/oauth-popup-closed.html"),
     (c) => c.html(OAUTH_POPUP_CLOSED_HTML)
@@ -237,17 +186,14 @@ function registerInspectorCdnShell(app, config, basePath = "") {
     }
     return serveShell(c);
   });
-  if (basePath === "") {
+  if (basePath === "" && config?.rootRedirect !== false) {
     app.get("/", (c) => {
       const url = new URL(c.req.url);
       return c.redirect(`${p("/inspector")}${url.search}`);
     });
   }
-  if (assets.useLocal) {
-    registerInspectorStaticAssets(app, basePath);
-  }
 }
 
 export {
-  registerInspectorCdnShell
+  registerInspectorShell
 };

package/dist/server/chunk-JWDVSQED.js

@@ -0,0 +1,156 @@
+import {
+  registerInspectorShell
+} from "./chunk-EPPZCSJQ.js";
+import {
+  registerInspectorProxyRoutes
+} from "./chunk-EKD2XITW.js";
+
+// src/server/middleware.ts
+import { Hono } from "hono";
+import { Readable } from "stream";
+function mountInspector(appOrOptions, maybeOptions) {
+  if (isMountableApp(appOrOptions)) {
+    const app = appOrOptions;
+    const options2 = maybeOptions;
+    const basePath2 = normalizeInspectorBasePath(options2?.basePath);
+    if (isHonoApp(app)) {
+      registerInspectorRoutes(app, options2, basePath2);
+      return;
+    }
+    const inspectorApp = createInspectorApp(options2, basePath2);
+    const inspectorFetch = toInspectorFetchHandler(inspectorApp);
+    app.use(
+      createExpressInspectorMiddleware(
+        inspectorFetch,
+        inspectorApp.routes.map((route) => route.path)
+      )
+    );
+    return;
+  }
+  const options = appOrOptions;
+  const basePath = normalizeInspectorBasePath(options?.basePath);
+  return toInspectorFetchHandler(createInspectorApp(options, basePath));
+}
+function createInspectorApp(options, basePath) {
+  const app = new Hono();
+  registerInspectorRoutes(app, options, basePath);
+  return app;
+}
+function registerInspectorRoutes(app, options, basePath) {
+  const routesConfig = {
+    oauthProxyAllowedOrigins: options?.oauthProxyAllowedOrigins ?? [],
+    // mountInspector is development tooling. Loopback is therefore useful and
+    // safe by default, while callers embedding it elsewhere can opt out.
+    oauthProxyAllowLoopback: options?.oauthProxyAllowLoopback ?? true
+  };
+  if (options?.autoConnectUrl !== void 0) {
+    routesConfig.autoConnectUrl = options.autoConnectUrl;
+  } else {
+    app.get(`${basePath}/inspector/config.json`, (c) => {
+      const requestUrl = new URL(c.req.url);
+      return c.json({ autoConnectUrl: `${requestUrl.origin}${basePath}` });
+    });
+  }
+  registerInspectorProxyRoutes(app, routesConfig, basePath);
+  registerInspectorShell(
+    app,
+    {
+      devMode: options?.devMode ?? true,
+      sandboxOrigin: options?.sandboxOrigin,
+      inspectorMode: "embedded",
+      rootRedirect: false,
+      basePath,
+      proxyUrl: `${basePath}/inspector/api/proxy`,
+      manufactChatUrl: options?.manufactChatUrl
+    },
+    basePath
+  );
+}
+function toInspectorFetchHandler(app) {
+  return (request) => Promise.resolve(app.fetch(request));
+}
+function createExpressInspectorMiddleware(fetch, registeredPaths) {
+  const exactPaths = new Set(
+    registeredPaths.filter((path) => !path.includes("*"))
+  );
+  const prefixPaths = registeredPaths.filter((path) => path.endsWith("/*")).map((path) => path.slice(0, -1));
+  return (req, res, next) => {
+    const url = new URL(req.originalUrl || req.url || "", requestOrigin(req));
+    if (!exactPaths.has(url.pathname) && !prefixPaths.some((prefix) => url.pathname.startsWith(prefix))) {
+      next();
+      return;
+    }
+    const request = expressRequestToFetchRequest(req, url);
+    void fetch(request).then((fetchResponse) => writeFetchResponse(res, fetchResponse)).catch(next);
+  };
+}
+function requestOrigin(req) {
+  const forwardedProtocol = firstHeaderValue(req.headers["x-forwarded-proto"]);
+  const protocol = forwardedProtocol || req.protocol || "http";
+  const forwardedHost = firstHeaderValue(req.headers["x-forwarded-host"]);
+  const host = forwardedHost || firstHeaderValue(req.headers.host) || "localhost";
+  return `${protocol}://${host}`;
+}
+function firstHeaderValue(value) {
+  return Array.isArray(value) ? value[0] ?? "" : (value ?? "").split(",")[0].trim();
+}
+function expressRequestToFetchRequest(req, url) {
+  const init = {
+    method: req.method,
+    headers: req.headers
+  };
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    if (req.body !== void 0) {
+      init.body = bodyToRequestBody(req.body);
+    } else {
+      init.body = Readable.toWeb(req);
+      init.duplex = "half";
+    }
+  }
+  return new globalThis.Request(url, init);
+}
+function bodyToRequestBody(body) {
+  if (typeof body === "string" || body instanceof ArrayBuffer || ArrayBuffer.isView(body) || body instanceof Blob || body instanceof FormData || body instanceof URLSearchParams || body instanceof ReadableStream) {
+    return body;
+  }
+  return JSON.stringify(body);
+}
+async function writeFetchResponse(res, fetchResponse) {
+  res.status(fetchResponse.status);
+  fetchResponse.headers.forEach((value, key) => {
+    if (key !== "set-cookie") res.setHeader(key, value);
+  });
+  const setCookies = fetchResponse.headers.getSetCookie();
+  if (setCookies.length > 0) res.setHeader("set-cookie", setCookies);
+  if (!fetchResponse.body) {
+    res.end();
+    return;
+  }
+  const reader = fetchResponse.body.getReader();
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    res.write(value);
+  }
+  res.end();
+}
+function isMountableApp(value) {
+  if (!value || typeof value !== "object" && typeof value !== "function") {
+    return false;
+  }
+  return typeof value.use === "function" || isHonoApp(value);
+}
+function isHonoApp(value) {
+  return !!value && typeof value === "object" && typeof value.fetch === "function" && typeof value.route === "function";
+}
+function normalizeInspectorBasePath(raw) {
+  if (raw === void 0) return "/mcp";
+  let value = raw.trim().replace(/\/{2,}/g, "/").replace(/\/+$/, "");
+  if (value === "" || value === "/") return "";
+  if (!value.startsWith("/")) value = `/${value}`;
+  return value;
+}
+
+export {
+  mountInspector
+};

package/dist/server/{chunk-M5TZA42I.js → chunk-PZF2PUDE.js}

@@ -10,45 +10,49 @@ var CONTENT_TYPES = {
   ".ico": "image/x-icon",
   ".webmanifest": "application/manifest+json"
 };
-function resolveDistCdnDir() {
+function resolveInspectorAppDir() {
   const here = path.dirname(fileURLToPath(import.meta.url));
   for (const dir of [
-    path.resolve(here, "cdn"),
+    path.resolve(here, "app"),
     // dist/cli.js (bundled)
-    path.resolve(here, "../cdn")
+    path.resolve(here, "../app"),
     // dist/server/*.js
+    path.resolve(here, "../../dist/app")
+    // src/server/*.ts (workspace dev)
   ]) {
     if (existsSync(path.join(dir, "inspector.js"))) {
       return dir;
     }
   }
   throw new Error(
-    "Inspector bundle not found (expected dist/cdn/inspector.js)"
+    "Inspector bundle not found (expected dist/app/inspector.js)"
   );
 }
-function registerInspectorStaticAssets(app, basePath = "") {
-  const cdnDir = resolveDistCdnDir();
-  const mountPath = `${basePath}/dist/cdn`;
+function registerInspectorStaticAssets(app, mountPath = "/inspector/assets") {
+  const appDir = resolveInspectorAppDir();
   app.get(`${mountPath}/*`, (c) => {
     const subPath = c.req.path.slice(mountPath.length);
     const relative = subPath.startsWith("/") ? subPath.slice(1) : subPath;
     if (!relative || relative.includes("..")) {
       return c.notFound();
     }
-    const file = path.resolve(cdnDir, relative);
-    const root = cdnDir.endsWith(path.sep) ? cdnDir : `${cdnDir}${path.sep}`;
+    const file = path.resolve(appDir, relative);
+    const root = appDir.endsWith(path.sep) ? appDir : `${appDir}${path.sep}`;
     if (!file.startsWith(root) || !existsSync(file)) {
       return c.notFound();
     }
     const ext = path.extname(file);
     return c.body(readFileSync(file), 200, {
       "Content-Type": CONTENT_TYPES[ext] ?? "application/octet-stream",
-      "Cache-Control": "public, max-age=3600"
+      // Standalone assets use stable URLs across CLI restarts. Revalidate them
+      // so a rebuilt or upgraded Inspector cannot keep running an hour-old UI
+      // bundle that predates its storage migrations or proxy contract.
+      "Cache-Control": "no-cache"
     });
   });
 }
 
 export {
-  resolveDistCdnDir,
+  resolveInspectorAppDir,
   registerInspectorStaticAssets
 };

package/dist/server/{chunk-R5ZEVRE5.js → chunk-RFJAZOK7.js}

@@ -2,7 +2,7 @@
 var package_default = {
   name: "@mcp-use/inspector",
   type: "module",
-  version: "20.0.0-beta.15",
+  version: "20.0.0-beta.16",
   description: "MCP Inspector - A tool for inspecting and debugging MCP servers",
   author: "",
   license: "MIT",
@@ -24,7 +24,13 @@ var package_default = {
   exports: {
     ".": {
       types: "./dist/server/index.d.ts",
-      import: "./dist/server/index.js"
+      import: "./dist/server/index.js",
+      default: "./dist/server/index.js"
+    },
+    "./dev": {
+      types: "./dist/server/index.d.ts",
+      import: "./dist/server/index.js",
+      default: "./dist/server/index.js"
     },
     "./proxy": {
       types: "./dist/server/proxy-routes.d.ts",
@@ -48,12 +54,13 @@ var package_default = {
     "dev:client": "pnpm run dev",
     "dev:server": "VITE_DEV=true tsx watch src/server/server.ts",
     "dev:standalone": "tsx watch src/server/server.ts",
-    build: "npm run build:client && npm run build:client-exports && npm run build:server && npm run build:cli && npm run build:cdn",
-    "build:cdn": "vite build --config vite.cdn.config.ts",
-    "watch:cdn": "vite build --watch --config vite.cdn.config.ts",
-    "preview:cdn": "vite preview --config vite.cdn.config.ts --host 127.0.0.1",
-    "serve:cdn": "pnpm build:cdn && pnpm preview:cdn",
-    "analyze:cdn": "ANALYZE=true vite build --config vite.cdn.config.ts",
+    clean: "rimraf dist",
+    build: "npm run clean && npm run build:client && npm run build:client-exports && npm run build:server && npm run build:cli && npm run build:app",
+    "build:app": "vite build --config vite.app.config.ts",
+    "watch:app": "vite build --watch --config vite.app.config.ts",
+    "preview:app": "vite preview --config vite.app.config.ts --host 127.0.0.1",
+    "serve:app": "pnpm build:app && pnpm preview:app",
+    "analyze:app": "ANALYZE=true vite build --config vite.app.config.ts",
     "build:client": "vite build",
     "build:client-exports": "tsup --config tsup.client.ts && tsc -p tsconfig.client.json --emitDeclarationOnly --declaration",
     "build:server": "tsup 'src/server/**/*.ts' --format esm --out-dir dist/server && tsc -p tsconfig.server.json --emitDeclarationOnly --declaration",
@@ -93,8 +100,20 @@ var package_default = {
     "react-router": "^7.12.0"
   },
   peerDependenciesMeta: {
+    "@mcp-use/client": {
+      optional: true
+    },
     express: {
       optional: true
+    },
+    react: {
+      optional: true
+    },
+    "react-dom": {
+      optional: true
+    },
+    "react-router": {
+      optional: true
     }
   },
   dependencies: {