@mcp-use/inspector 20.0.0-beta.16 → 20.0.0-beta.17

package/dist/server/{chunk-OWR2BIBW.js → chunk-RKFQG67Z.js}

@@ -1,11 +1,10 @@
 import {
   registerInspectorProxyRoutes
-} from "./chunk-UJLXHNQP.js";
+} from "./chunk-EKD2XITW.js";
 
 // src/server/create-dev-api-app.ts
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { logger } from "hono/logger";
 function createDevApiApp() {
   const app = new Hono();
   app.use(
@@ -27,7 +26,6 @@ function createDevApiApp() {
       exposeHeaders: ["*"]
     })
   );
-  app.use("/inspector/api/*", logger());
   registerInspectorProxyRoutes(app, {
     oauthProxyAllowedOrigins: [],
     oauthProxyAllowLoopback: true

package/dist/server/{chunk-K2F2AJOI.js → chunk-V5A5XLFJ.js}

@@ -1,5 +1,6 @@
 // src/server/proxy/oauth-proxy.ts
 import { lookup } from "dns/promises";
+import { Buffer } from "buffer";
 import { isIP } from "net";
 var SAFE_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "accept",
@@ -24,6 +25,8 @@ var ENDPOINT_FIELDS = [
 ];
 var BINDING_TTL_MS = 10 * 60 * 1e3;
 var MAX_BINDINGS = 100;
+var CONFIDENTIAL_CLIENT_TTL_MS = 24 * 60 * 60 * 1e3;
+var MAX_CONFIDENTIAL_CLIENTS = 500;
 function mountOAuthProxy(app, options = {}) {
   const {
     basePath = "/oauth",
@@ -32,15 +35,17 @@ function mountOAuthProxy(app, options = {}) {
     timeoutMs = 1e4,
     maxRequestBodyBytes = 64 * 1024,
     maxResponseBodyBytes = 1024 * 1024,
+    callbackPath = "/oauth/callback",
     enableLogging = true,
     authenticate,
     validateServerUrl
   } = options;
   const origins = new Set(allowedOrigins.map(normalizeOrigin));
   const bindings = /* @__PURE__ */ new Map();
+  const confidentialClients = /* @__PURE__ */ new Map();
   app.use(`${basePath}/*`, async (c, next) => {
     const origin = c.req.header("Origin");
-    if (origin && !isAllowedOrigin(origin, c.req.url, origins)) {
+    if (origin && !isAllowedOrigin(origin, c, origins)) {
       return c.json({ error: "Origin not allowed" }, 403);
     }
     if (c.req.method === "OPTIONS") {
@@ -197,7 +202,24 @@ function mountOAuthProxy(app, options = {}) {
     }
     try {
       const headers = filterRequestHeaders(request.headers);
-      const body = serializeBody(request.body, headers);
+      let body = serializeBody(request.body, headers);
+      if (endpointKind === "registration") {
+        const publicOrigin = normalizeOrigin(
+          c.req.header("Origin") ?? new URL(c.req.url).origin
+        );
+        body = enforceRegistrationRedirectUri(
+          body,
+          headers,
+          new URL(callbackPath, publicOrigin).toString()
+        );
+      } else {
+        body = applyConfidentialClientAuthentication({
+          body,
+          headers,
+          bindingKey,
+          clients: confidentialClients
+        });
+      }
       if (new TextEncoder().encode(body ?? "").byteLength > maxRequestBodyBytes) {
         return c.json({ error: "OAuth request body too large" }, 413);
       }
@@ -225,6 +247,14 @@ function mountOAuthProxy(app, options = {}) {
         } catch {
         }
       }
+      if (endpointKind === "registration" && upstream.ok && responseBody && typeof responseBody === "object" && !Array.isArray(responseBody)) {
+        responseBody = retainConfidentialClient({
+          responseBody,
+          binding,
+          bindingKey,
+          clients: confidentialClients
+        });
+      }
       return c.json({
         status: upstream.status,
         statusText: upstream.statusText,
@@ -331,6 +361,7 @@ async function bindProtectedResource(metadata, serverUrl, binding, allowLoopback
   }
   binding.authorizationServers = issuers;
   binding.endpoints.clear();
+  binding.tokenEndpointAuthMethods.clear();
 }
 async function bindAuthorizationServer(metadata, expectedIssuer, binding, allowLoopback) {
   if (typeof metadata.issuer !== "string" || canonicalUrl(new URL(metadata.issuer)) !== expectedIssuer) {
@@ -339,6 +370,11 @@ async function bindAuthorizationServer(metadata, expectedIssuer, binding, allowL
     );
   }
   binding.endpoints.clear();
+  binding.tokenEndpointAuthMethods = new Set(
+    Array.isArray(metadata.token_endpoint_auth_methods_supported) ? metadata.token_endpoint_auth_methods_supported.filter(
+      (method) => typeof method === "string"
+    ) : []
+  );
   for (const [field, kind] of ENDPOINT_FIELDS) {
     const value = metadata[field];
     if (value === void 0) continue;
@@ -435,7 +471,17 @@ function filterResponseHeaders(headers) {
 }
 function serializeBody(body, headers) {
   if (body === void 0 || body === null) return void 0;
-  if (typeof body === "string") return body;
+  if (typeof body === "string") {
+    if (!headers.has("content-type")) {
+      try {
+        JSON.parse(body);
+        headers.set("content-type", "application/json");
+      } catch {
+        headers.set("content-type", "application/x-www-form-urlencoded");
+      }
+    }
+    return body;
+  }
   const contentType = headers.get("content-type") ?? "";
   if (contentType.includes("application/x-www-form-urlencoded") && typeof body === "object" && !Array.isArray(body)) {
     const params = new URLSearchParams();
@@ -451,6 +497,77 @@ function serializeBody(body, headers) {
   }
   return JSON.stringify(body);
 }
+function confidentialClientKey(bindingKey, clientId) {
+  return `${bindingKey}\0${clientId}`;
+}
+function retainConfidentialClient(options) {
+  const { responseBody, binding, bindingKey, clients } = options;
+  const clientId = responseBody.client_id;
+  const clientSecret = responseBody.client_secret;
+  if (typeof clientId !== "string" || typeof clientSecret !== "string") {
+    return responseBody;
+  }
+  const returnedMethod = responseBody.token_endpoint_auth_method;
+  const authMethod = returnedMethod === "client_secret_post" || returnedMethod === "client_secret_basic" ? returnedMethod : binding.tokenEndpointAuthMethods.has("client_secret_basic") ? "client_secret_basic" : "client_secret_post";
+  const upstreamExpiry = responseBody.client_secret_expires_at;
+  const expiresAt = upstreamExpiry === 0 ? Number.POSITIVE_INFINITY : typeof upstreamExpiry === "number" && upstreamExpiry > 0 ? upstreamExpiry * 1e3 : Date.now() + CONFIDENTIAL_CLIENT_TTL_MS;
+  pruneConfidentialClients(clients);
+  clients.set(confidentialClientKey(bindingKey, clientId), {
+    clientSecret,
+    authMethod,
+    expiresAt
+  });
+  while (clients.size > MAX_CONFIDENTIAL_CLIENTS) {
+    const oldest = clients.keys().next().value;
+    if (!oldest) break;
+    clients.delete(oldest);
+  }
+  const browserSafe = { ...responseBody };
+  delete browserSafe.client_secret;
+  delete browserSafe.client_secret_expires_at;
+  browserSafe.token_endpoint_auth_method = "none";
+  return browserSafe;
+}
+function applyConfidentialClientAuthentication(options) {
+  const { body, headers, bindingKey, clients } = options;
+  if (!body || !(headers.get("content-type") ?? "").includes(
+    "application/x-www-form-urlencoded"
+  )) {
+    return body;
+  }
+  const params = new URLSearchParams(body);
+  const clientId = params.get("client_id");
+  if (!clientId) return body;
+  const key = confidentialClientKey(bindingKey, clientId);
+  const client = clients.get(key);
+  if (!client) return body;
+  if (client.expiresAt <= Date.now()) {
+    clients.delete(key);
+    return body;
+  }
+  params.delete("client_secret");
+  if (client.authMethod === "client_secret_basic") {
+    const encoded = Buffer.from(
+      `${encodeOAuthClientCredential(clientId)}:${encodeOAuthClientCredential(client.clientSecret)}`,
+      "utf8"
+    ).toString("base64");
+    headers.set("authorization", `Basic ${encoded}`);
+  } else {
+    headers.delete("authorization");
+    params.set("client_id", clientId);
+    params.set("client_secret", client.clientSecret);
+  }
+  return params.toString();
+}
+function encodeOAuthClientCredential(value) {
+  return new URLSearchParams({ value }).toString().slice("value=".length);
+}
+function pruneConfidentialClients(clients) {
+  const now = Date.now();
+  for (const [key, client] of clients) {
+    if (client.expiresAt <= now) clients.delete(key);
+  }
+}
 async function readRequestCapped(request, maxBytes) {
   const declared = Number(request.headers.get("content-length"));
   if (Number.isFinite(declared) && declared > maxBytes) {
@@ -510,6 +627,7 @@ function getBinding(bindings, key) {
   return {
     authorizationServers: /* @__PURE__ */ new Set(),
     endpoints: /* @__PURE__ */ new Map(),
+    tokenEndpointAuthMethods: /* @__PURE__ */ new Set(),
     updatedAt: Date.now()
   };
 }
@@ -532,6 +650,23 @@ function canonicalUrl(url) {
   }
   return copy.toString().replace(/\/$/, "");
 }
+function enforceRegistrationRedirectUri(body, headers, callbackUrl) {
+  if (!body) return body;
+  const contentType = headers.get("content-type") ?? "";
+  if (!contentType.includes("json")) return body;
+  try {
+    const parsed = JSON.parse(body);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return body;
+    }
+    return JSON.stringify({
+      ...parsed,
+      redirect_uris: [callbackUrl]
+    });
+  } catch {
+    return body;
+  }
+}
 function normalizeOrigin(origin) {
   const url = new URL(origin);
   if (url.pathname !== "/" || url.search || url.hash) {
@@ -539,10 +674,18 @@ function normalizeOrigin(origin) {
   }
   return url.origin;
 }
-function isAllowedOrigin(origin, requestUrl, allowed) {
+function isAllowedOrigin(origin, c, allowed) {
   try {
     const normalized = normalizeOrigin(origin);
-    return normalized === new URL(requestUrl).origin || allowed.has(normalized);
+    if (normalized === new URL(c.req.url).origin || allowed.has(normalized)) {
+      return true;
+    }
+    const originUrl = new URL(normalized);
+    const forwardedHost = c.req.header("x-forwarded-host")?.split(",")[0]?.trim();
+    const requestHost = forwardedHost || c.req.header("host");
+    if (!requestHost || originUrl.host !== requestHost) return false;
+    const forwardedProto = c.req.header("x-forwarded-proto")?.split(",")[0]?.trim();
+    return !forwardedProto || `${forwardedProto}:` === originUrl.protocol;
   } catch {
     return false;
   }

package/dist/server/cli.js

@@ -4,28 +4,25 @@ import {
   isValidUrl
 } from "./chunk-KD7K27XK.js";
 import {
-  registerInspectorCdnShell
-} from "./chunk-FHC5ZGMM.js";
-import "./chunk-M5TZA42I.js";
+  registerInspectorShell
+} from "./chunk-EPPZCSJQ.js";
+import "./chunk-PZF2PUDE.js";
 import {
   getInspectorVersion
-} from "./chunk-R5ZEVRE5.js";
-import "./chunk-JZT7N2BJ.js";
+} from "./chunk-RFJAZOK7.js";
+import "./chunk-WFT4JHYI.js";
 import {
   registerInspectorProxyRoutes
-} from "./chunk-UJLXHNQP.js";
+} from "./chunk-EKD2XITW.js";
 import "./chunk-IKTZUWSX.js";
-import "./chunk-XCNS5CIW.js";
-import "./chunk-K2F2AJOI.js";
-import "./chunk-J4FNYLBF.js";
-import "./chunk-WFT4JHYI.js";
+import "./chunk-2K7OKCVV.js";
+import "./chunk-V5A5XLFJ.js";
 import "./chunk-PKBMQBKP.js";
 
 // src/server/cli.ts
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { logger } from "hono/logger";
 import open from "open";
 var args = process.argv.slice(2);
 var mcpUrl;
@@ -98,15 +95,13 @@ app.use(
     exposeHeaders: ["*"]
   })
 );
-app.use("/inspector/api/proxy/*", logger());
-var inspectorMode = process.env.MCP_INSPECTOR_MODE ?? (process.env.RAILWAY_ENVIRONMENT_NAME ? "cloud" : "standalone");
 registerInspectorProxyRoutes(app, {
   autoConnectUrl: mcpUrl,
   oauthProxyAllowedOrigins: [],
-  oauthProxyAllowLoopback: inspectorMode === "standalone"
+  oauthProxyAllowLoopback: true
 });
-registerInspectorCdnShell(app, {
-  inspectorMode,
+registerInspectorShell(app, {
+  inspectorMode: "standalone",
   manufactChatUrl: process.env.MANUFACT_CHAT_URL
 });
 async function startServer() {

package/dist/server/create-dev-api-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-dev-api-app.d.ts","sourceRoot":"","sources":["../../src/server/create-dev-api-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,qEAAqE;AACrE,wBAAgB,eAAe,IAAI,IAAI,CA+BtC"}
+{"version":3,"file":"create-dev-api-app.d.ts","sourceRoot":"","sources":["../../src/server/create-dev-api-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,qEAAqE;AACrE,wBAAgB,eAAe,IAAI,IAAI,CA6BtC"}

package/dist/server/create-dev-api-app.js

@@ -1,10 +1,10 @@
 import {
   createDevApiApp
-} from "./chunk-OWR2BIBW.js";
-import "./chunk-UJLXHNQP.js";
+} from "./chunk-RKFQG67Z.js";
+import "./chunk-EKD2XITW.js";
 import "./chunk-IKTZUWSX.js";
-import "./chunk-XCNS5CIW.js";
-import "./chunk-K2F2AJOI.js";
+import "./chunk-2K7OKCVV.js";
+import "./chunk-V5A5XLFJ.js";
 import "./chunk-PKBMQBKP.js";
 export {
   createDevApiApp

package/dist/server/favicon-links.d.ts

@@ -1,12 +1,12 @@
 /** Bust Chrome's aggressive favicon cache when the asset changes. */
 export declare const FAVICON_CACHE_VERSION = "4";
-/** Static favicon assets copied to CDN / public alongside the inspector bundle. */
+/** Static favicon assets copied alongside the Inspector browser bundle. */
 export declare const INSPECTOR_FAVICON_ASSETS: readonly ["favicon.svg", "favicon-96x96.png", "favicon.ico", "apple-touch-icon.png", "site.webmanifest", "web-app-manifest-192x192.png", "web-app-manifest-512x512.png", "favicon-black.svg", "favicon-white.svg"];
 /**
  * Render `<link>` tags for inspector favicons.
  *
  * Uses same-origin `favicon-black.svg` (light icon in all color schemes).
- * Do not point at inspector-cdn — production CDN still ships a dark-mode SVG.
+ * Keep favicon URLs on the same package-local asset route as the application.
  */
 export declare function renderInspectorFaviconLinks(basePath?: string): string;
 //# sourceMappingURL=favicon-links.d.ts.map

package/dist/server/favicon-links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"favicon-links.d.ts","sourceRoot":"","sources":["../../src/server/favicon-links.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,oNAU3B,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,SAAK,GAAG,MAAM,CAIjE"}
+{"version":3,"file":"favicon-links.d.ts","sourceRoot":"","sources":["../../src/server/favicon-links.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,oNAU3B,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,SAAK,GAAG,MAAM,CAIjE"}

package/dist/server/index.d.ts

@@ -1,10 +1,9 @@
 /**
- * MCP Inspector - Middleware for mounting inspector UI on Express apps
+ * MCP Inspector - local Fetch handler and framework mounting adapters
  *
  * This is the main entry point for importing the inspector as a library.
  * For standalone server usage, see cli.ts
  */
-export { mountInspector } from "./middleware.js";
+export { mountInspector, type InspectorFetchHandler, type MountInspectorOptions, } from "./middleware.js";
 export { registerInspectorProxyRoutes, type InspectorProxyRoutesConfig, } from "./proxy-routes.js";
-export { registerInspectorCdnShell, type CdnShellConfig, type InspectorMode, } from "./cdn-shell.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,4BAA4B,EAC5B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC"}

package/dist/server/index.js

@@ -1,23 +1,18 @@
 import {
   mountInspector
-} from "./chunk-QXOCY5ZE.js";
-import {
-  registerInspectorCdnShell
-} from "./chunk-FHC5ZGMM.js";
-import "./chunk-M5TZA42I.js";
-import "./chunk-R5ZEVRE5.js";
-import "./chunk-JZT7N2BJ.js";
+} from "./chunk-JWDVSQED.js";
+import "./chunk-EPPZCSJQ.js";
+import "./chunk-PZF2PUDE.js";
+import "./chunk-RFJAZOK7.js";
+import "./chunk-WFT4JHYI.js";
 import {
   registerInspectorProxyRoutes
-} from "./chunk-UJLXHNQP.js";
+} from "./chunk-EKD2XITW.js";
 import "./chunk-IKTZUWSX.js";
-import "./chunk-XCNS5CIW.js";
-import "./chunk-K2F2AJOI.js";
-import "./chunk-J4FNYLBF.js";
-import "./chunk-WFT4JHYI.js";
+import "./chunk-2K7OKCVV.js";
+import "./chunk-V5A5XLFJ.js";
 import "./chunk-PKBMQBKP.js";
 export {
   mountInspector,
-  registerInspectorCdnShell,
   registerInspectorProxyRoutes
 };

package/dist/server/{cdn-shell.d.ts → inspector-shell.d.ts}

@@ -1,7 +1,6 @@
 import type { Hono } from "hono";
-import { type InspectorMode } from "./asset-urls.js";
-export type { InspectorMode } from "./asset-urls.js";
-export type CdnShellConfig = {
+type InspectorMode = "standalone" | "embedded" | "cloud";
+type InspectorShellConfig = {
     basePath?: string;
     devMode?: boolean;
     sandboxOrigin?: string | null;
@@ -10,9 +9,12 @@ export type CdnShellConfig = {
     inspectorMode?: InspectorMode;
     manufactChatUrl?: string | null;
     disableTelemetry?: boolean;
+    /** Preserve the standalone CLI's `/` to `/inspector` redirect (default true). */
+    rootRedirect?: boolean;
 };
 /**
  * Serve the inspector UI at `${basePath}/inspector`.
  */
-export declare function registerInspectorCdnShell(app: Hono, config?: CdnShellConfig, basePath?: string): void;
-//# sourceMappingURL=cdn-shell.d.ts.map
+export declare function registerInspectorShell(app: Hono, config?: InspectorShellConfig, basePath?: string): void;
+export {};
+//# sourceMappingURL=inspector-shell.d.ts.map

package/dist/server/inspector-shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspector-shell.d.ts","sourceRoot":"","sources":["../../src/server/inspector-shell.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAM1C,KAAK,aAAa,GAAG,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;AAEzD,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAkJF;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,IAAI,EACT,MAAM,CAAC,EAAE,oBAAoB,EAC7B,QAAQ,GAAE,MAAW,QAyDtB"}

package/dist/server/inspector-shell.js

@@ -0,0 +1,10 @@
+import {
+  registerInspectorShell
+} from "./chunk-EPPZCSJQ.js";
+import "./chunk-PZF2PUDE.js";
+import "./chunk-RFJAZOK7.js";
+import "./chunk-WFT4JHYI.js";
+import "./chunk-PKBMQBKP.js";
+export {
+  registerInspectorShell
+};

package/dist/server/middleware.d.ts

@@ -1,40 +1,65 @@
 import type { Express } from "express";
 import { Hono } from "hono";
-/**
- * Mount the MCP Inspector UI at a specified path on an Express or Hono app
- * Similar to how FastAPI mounts Swagger UI at /docs
- *
- * @param app - Express or Hono application instance
- * @param config - Optional configuration including autoConnectUrl
- *
- * @example
- * ```typescript
- * import { MCPServer } from 'mcp-use'
- * import { mountInspector } from '@mcp-use/inspector'
- *
- * const server = new MCPServer({ name: 'my-server', version: '1.0.0' })
- * mountInspector(server) // Mounts at /inspector
- * mountInspector(server, { autoConnectUrl: 'http://localhost:3000/mcp' }) // With auto-connect
- * ```
- */
-export declare function mountInspector(app: Express | Hono, config?: {
+/** Web-standard handler returned by {@link mountInspector}. */
+export type InspectorFetchHandler = (request: globalThis.Request) => Promise<globalThis.Response>;
+/** Configuration shared by framework-neutral and framework-mounted inspectors. */
+export interface MountInspectorOptions {
+    /**
+     * MCP URL passed to the client for automatic connection. For the returned
+     * Fetch handler, omission derives `${request.origin}${basePath}` so localhost
+     * and public tunnel URLs both target the listener the browser actually used.
+     * Pass `null` to disable auto-connect.
+     */
     autoConnectUrl?: string | null;
     manufactChatUrl?: string | null;
-    /** Whether the server is running in development mode (enables same-origin sandbox) */
+    /** Whether to enable the same-origin development sandbox (default `true`). */
     devMode?: boolean;
-    /** Override the sandbox origin for MCP Apps widgets (e.g., for production reverse proxies) */
+    /** Override the sandbox origin for MCP Apps widgets. */
     sandboxOrigin?: string | null;
     /** Explicit cross-origin callers of the OAuth BFF. Same-origin is implicit. */
     oauthProxyAllowedOrigins?: readonly string[];
-    /** Allow OAuth discovery against loopback targets. Use only for local development. */
+    /** Allow OAuth and MCP proxy requests to loopback targets (default `true`). */
     oauthProxyAllowLoopback?: boolean;
     /**
-     * Normalized server-wide path prefix the embedding server mounts its whole
-     * framework surface under (default `/mcp`; `""` = root). The inspector
-     * relocates to `${basePath}/inspector` and its proxy/API live under
-     * `${basePath}/inspector/api/*`. Injected into the client HTML as
-     * `window.__MCP_BASE_PATH__` so the client can derive its own URLs.
+     * Server-wide MCP path prefix (default `/mcp`; `""` = root). The Inspector
+     * is served from `${basePath}/inspector` and its API from
+     * `${basePath}/inspector/api/*`.
      */
     basePath?: string;
-}): void;
+}
+/**
+ * Create or mount the local MCP Inspector.
+ *
+ * With options (or no arguments), this returns a framework-neutral Fetch
+ * handler. A development server can dispatch Inspector requests to this
+ * handler on its existing listener without starting a child process or a
+ * second port.
+ *
+ * Passing an Express or Hono app preserves the v1 mounting API. Hono routes
+ * are registered directly; Express receives a narrowly scoped adapter.
+ *
+ * The UI bundle is always served from this installed package. The same Hono
+ * route implementation owns the UI, MCP proxy, OAuth BFF, callback, health,
+ * and config routes in every integration.
+ *
+ * @example Framework-neutral, same-listener use
+ * ```typescript
+ * const inspector = mountInspector({
+ *   basePath: "/mcp",
+ *   autoConnectUrl: "http://localhost:3000/mcp",
+ * });
+ *
+ * const response = await inspector(request);
+ * ```
+ *
+ * @example Legacy Hono or Express mounting
+ * ```typescript
+ * mountInspector(app, {
+ *   basePath: "/mcp",
+ *   autoConnectUrl: "http://localhost:3000/mcp",
+ * });
+ * ```
+ */
+export declare function mountInspector(options?: MountInspectorOptions): InspectorFetchHandler;
+export declare function mountInspector(app: Express | Hono, options?: MountInspectorOptions): void;
 //# sourceMappingURL=middleware.d.ts.map

package/dist/server/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAmC,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,GAAG,IAAI,EACnB,MAAM,CAAC,EAAE;IACP,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,sFAAsF;IACtF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,IAAI,CA4DN"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAmC,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ5B,+DAA+D;AAC/D,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,UAAU,CAAC,OAAO,KACxB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAElC,kFAAkF;AAClF,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,cAAc,CAC5B,OAAO,CAAC,EAAE,qBAAqB,GAC9B,qBAAqB,CAAC;AAEzB,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,GAAG,IAAI,EACnB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,IAAI,CAAC"}

package/dist/server/middleware.js

@@ -1,16 +1,14 @@
 import {
   mountInspector
-} from "./chunk-QXOCY5ZE.js";
-import "./chunk-FHC5ZGMM.js";
-import "./chunk-M5TZA42I.js";
-import "./chunk-R5ZEVRE5.js";
-import "./chunk-JZT7N2BJ.js";
-import "./chunk-UJLXHNQP.js";
-import "./chunk-IKTZUWSX.js";
-import "./chunk-XCNS5CIW.js";
-import "./chunk-K2F2AJOI.js";
-import "./chunk-J4FNYLBF.js";
+} from "./chunk-JWDVSQED.js";
+import "./chunk-EPPZCSJQ.js";
+import "./chunk-PZF2PUDE.js";
+import "./chunk-RFJAZOK7.js";
 import "./chunk-WFT4JHYI.js";
+import "./chunk-EKD2XITW.js";
+import "./chunk-IKTZUWSX.js";
+import "./chunk-2K7OKCVV.js";
+import "./chunk-V5A5XLFJ.js";
 import "./chunk-PKBMQBKP.js";
 export {
   mountInspector

package/dist/server/proxy/index.js

@@ -1,10 +1,10 @@
 import "../chunk-IKTZUWSX.js";
 import {
   mountMcpProxy
-} from "../chunk-XCNS5CIW.js";
+} from "../chunk-2K7OKCVV.js";
 import {
   mountOAuthProxy
-} from "../chunk-K2F2AJOI.js";
+} from "../chunk-V5A5XLFJ.js";
 import "../chunk-PKBMQBKP.js";
 export {
   mountMcpProxy,

package/dist/server/proxy/mcp-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-proxy.d.ts","sourceRoot":"","sources":["../../../src/server/proxy/mcp-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM1C;;GAEG;AACH,UAAU,eAAe;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAE1D;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,MAAM,EACjB,CAAC,EAAE,OAAO,KACP,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAEhC,mEAAmE;IACnE,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,GAAE,eAAoB,GAAG,IAAI,CA0R5E"}
+{"version":3,"file":"mcp-proxy.d.ts","sourceRoot":"","sources":["../../../src/server/proxy/mcp-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAQ1C;;GAEG;AACH,UAAU,eAAe;IACvB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAE1D;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,MAAM,EACjB,CAAC,EAAE,OAAO,KACP,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAEhC,mEAAmE;IACnE,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,GAAE,eAAoB,GAAG,IAAI,CAiO5E"}

package/dist/server/proxy/mcp-proxy.js

@@ -1,8 +1,8 @@
 import {
   isOpenEndedSseResponse,
   mountMcpProxy
-} from "../chunk-XCNS5CIW.js";
-import "../chunk-K2F2AJOI.js";
+} from "../chunk-2K7OKCVV.js";
+import "../chunk-V5A5XLFJ.js";
 import "../chunk-PKBMQBKP.js";
 export {
   isOpenEndedSseResponse,

package/dist/server/proxy/oauth-proxy.d.ts

@@ -12,6 +12,8 @@ interface OAuthProxyOptions {
     maxRequestBodyBytes?: number;
     /** @default 1048576 */
     maxResponseBodyBytes?: number;
+    /** Exact browser callback path enforced on dynamic registrations. */
+    callbackPath?: string;
     /** @default true */
     enableLogging?: boolean;
     /** Optional authentication applied before any outbound request. */

package/dist/server/proxy/oauth-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-proxy.d.ts","sourceRoot":"","sources":["../../../src/server/proxy/oauth-proxy.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAsB1C,UAAU,iBAAiB;IACzB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+FAA+F;IAC/F,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oBAAoB;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC1D,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,CAAC,EAAE,OAAO,KACP,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AA0BD,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,EACT,OAAO,GAAE,iBAAsB,GAC9B,IAAI,CAkPN;AAkDD,uEAAuE;AACvE,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,aAAa,UAAQ,GACpB,OAAO,CAAC,OAAO,CAAC,CAElB"}
+{"version":3,"file":"oauth-proxy.d.ts","sourceRoot":"","sources":["../../../src/server/proxy/oauth-proxy.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6B1C,UAAU,iBAAiB;IACzB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,+FAA+F;IAC/F,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mEAAmE;IACnE,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC1D,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,CAAC,EAAE,OAAO,KACP,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC;AA4BD,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,EACT,OAAO,GAAE,iBAAsB,GAC9B,IAAI,CAmRN;AAkDD,uEAAuE;AACvE,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,aAAa,UAAQ,GACpB,OAAO,CAAC,OAAO,CAAC,CAElB"}

package/dist/server/proxy/oauth-proxy.js

@@ -1,7 +1,7 @@
 import {
   isSafeProxyTarget,
   mountOAuthProxy
-} from "../chunk-K2F2AJOI.js";
+} from "../chunk-V5A5XLFJ.js";
 import "../chunk-PKBMQBKP.js";
 export {
   isSafeProxyTarget,

package/dist/server/proxy-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-routes.d.ts","sourceRoot":"","sources":["../../src/server/proxy-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,MAAM,MAAM,0BAA0B,GAAG;IACvC,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,0EAA0E;IAC1E,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,6CAA6C;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,MAAM,CAAC,EAAE,0BAA0B,EACnC,QAAQ,GAAE,MAAW,QAmCtB"}
+{"version":3,"file":"proxy-routes.d.ts","sourceRoot":"","sources":["../../src/server/proxy-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,MAAM,MAAM,0BAA0B,GAAG;IACvC,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,0EAA0E;IAC1E,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,6CAA6C;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,EACT,MAAM,CAAC,EAAE,0BAA0B,EACnC,QAAQ,GAAE,MAAW,QAoCtB"}