@mcp-use/inspector 20.0.0-beta.2 → 20.0.0-beta.21

package/dist/server/index.d.ts

@@ -1,10 +1,82 @@
+import { Express } from 'express';
+import { Hono } from 'hono';
+
+/** Web-standard handler returned by {@link mountInspector}. */
+type InspectorFetchHandler = (request: globalThis.Request) => Promise<globalThis.Response>;
+/** Configuration shared by framework-neutral and framework-mounted inspectors. */
+interface MountInspectorOptions {
+    /**
+     * MCP URL passed to the client for automatic connection. For the returned
+     * Fetch handler, omission derives `${request.origin}${basePath}` so localhost
+     * and public tunnel URLs both target the listener the browser actually used.
+     * Pass `null` to disable auto-connect.
+     */
+    autoConnectUrl?: string | null;
+    manufactChatUrl?: string | null;
+    /** Whether to enable the same-origin development sandbox (default `true`). */
+    devMode?: boolean;
+    /** Override the sandbox origin for MCP Apps widgets. */
+    sandboxOrigin?: string | null;
+    /** Explicit cross-origin callers of the OAuth BFF. Same-origin is implicit. */
+    oauthProxyAllowedOrigins?: readonly string[];
+    /** Allow OAuth and MCP proxy requests to loopback targets (default `true`). */
+    oauthProxyAllowLoopback?: boolean;
+    /**
+     * Server-wide MCP path prefix (default `/mcp`; `""` = root). The Inspector
+     * is served from `${basePath}/inspector` and its API from
+     * `${basePath}/inspector/api/*`.
+     */
+    basePath?: string;
+}
 /**
- * MCP Inspector - Middleware for mounting inspector UI on Express apps
+ * Create or mount the local MCP Inspector.
  *
- * This is the main entry point for importing the inspector as a library.
- * For standalone server usage, see cli.ts
+ * With options (or no arguments), this returns a framework-neutral Fetch
+ * handler. A development server can dispatch Inspector requests to this
+ * handler on its existing listener without starting a child process or a
+ * second port.
+ *
+ * Passing an Express or Hono app preserves the v1 mounting API. Hono routes
+ * are registered directly; Express receives a narrowly scoped adapter.
+ *
+ * The UI bundle is always served from this installed package. The same Hono
+ * route implementation owns the UI, MCP proxy, OAuth BFF, callback, health,
+ * and config routes in every integration.
+ *
+ * @example Framework-neutral, same-listener use
+ * ```typescript
+ * const inspector = mountInspector({
+ *   basePath: "/mcp",
+ *   autoConnectUrl: "http://localhost:3000/mcp",
+ * });
+ *
+ * const response = await inspector(request);
+ * ```
+ *
+ * @example Legacy Hono or Express mounting
+ * ```typescript
+ * mountInspector(app, {
+ *   basePath: "/mcp",
+ *   autoConnectUrl: "http://localhost:3000/mcp",
+ * });
+ * ```
+ */
+declare function mountInspector(options?: MountInspectorOptions): InspectorFetchHandler;
+declare function mountInspector(app: Express | Hono, options?: MountInspectorOptions): void;
+
+type InspectorProxyRoutesConfig = {
+    /** URL passed to the client via config.json for auto-connect. */
+    autoConnectUrl?: string | null;
+    /** Explicit cross-origin callers of the OAuth BFF. Same-origin is implicit. */
+    oauthProxyAllowedOrigins?: readonly string[];
+    /** Allow the OAuth BFF to reach loopback servers in local development. */
+    oauthProxyAllowLoopback?: boolean;
+    /** Mount OAuth BFF routes (default true). */
+    oauth?: boolean;
+};
+/**
+ * Register minimal inspector backend routes: health, MCP CORS proxy, OAuth BFF.
  */
-export { mountInspector } from "./middleware.js";
-export { registerInspectorProxyRoutes, type InspectorProxyRoutesConfig, } from "./proxy-routes.js";
-export { registerInspectorCdnShell, type CdnShellConfig, type InspectorMode, } from "./cdn-shell.js";
-//# sourceMappingURL=index.d.ts.map
+declare function registerInspectorProxyRoutes(app: Hono, config?: InspectorProxyRoutesConfig, basePath?: string): void;
+
+export { type InspectorFetchHandler, type InspectorProxyRoutesConfig, type MountInspectorOptions, mountInspector, registerInspectorProxyRoutes };

package/dist/server/index.js

@@ -1,23 +1,99 @@
-import {
-  mountInspector
-} from "./chunk-R6RQMIXL.js";
-import {
-  registerInspectorCdnShell
-} from "./chunk-K2DPKTIS.js";
-import "./chunk-M5TZA42I.js";
-import "./chunk-LIM6NAUS.js";
-import "./chunk-H6ZCIKBS.js";
-import {
-  registerInspectorProxyRoutes
-} from "./chunk-UJLXHNQP.js";
-import "./chunk-IKTZUWSX.js";
-import "./chunk-XCNS5CIW.js";
-import "./chunk-K2F2AJOI.js";
-import "./chunk-J4FNYLBF.js";
-import "./chunk-WFT4JHYI.js";
-import "./chunk-PKBMQBKP.js";
-export {
-  mountInspector,
-  registerInspectorCdnShell,
-  registerInspectorProxyRoutes
-};
+var ne=(e,t,r)=>(n,o)=>{let s=-1;return i(0);async function i(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,u;if(e[a]?(u=e[a][0][0],n.req.routeIndex=a):u=a===e.length&&o||void 0,u)try{c=await u(n,()=>i(a+1))}catch(p){if(p instanceof Error&&t)n.error=p,c=await t(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var Pe=Symbol();var Oe=async(e,t=Object.create(null))=>{let{all:r=!1,dot:n=!1}=t,s=(e instanceof F?e.raw.headers:e.headers).get("Content-Type");return s?.startsWith("multipart/form-data")||s?.startsWith("application/x-www-form-urlencoded")?Pt(e,{all:r,dot:n}):{}};async function Pt(e,t){let r=await e.formData();return r?Ot(r,t):{}}function Ot(e,t){let r=Object.create(null);return e.forEach((n,o)=>{t.all||o.endsWith("[]")?Ct(r,o,n):r[o]=n}),t.dot&&Object.entries(r).forEach(([n,o])=>{n.includes(".")&&(_t(r,n,o),delete r[n])}),r}var Ct=(e,t,r)=>{e[t]!==void 0?Array.isArray(e[t])?e[t].push(r):e[t]=[e[t],r]:t.endsWith("[]")?e[t]=[r]:e[t]=r},_t=(e,t,r)=>{if(/(?:^|\.)__proto__\./.test(t))return;let n=e,o=t.split(".");o.forEach((s,i)=>{i===o.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var se=e=>{let t=e.split("/");return t[0]===""&&t.shift(),t},Ce=e=>{let{groups:t,path:r}=St(e),n=se(r);return Tt(n,t)},St=e=>{let t=[];return e=e.replace(/\{[^}]+\}/g,(r,n)=>{let o=`@${n}`;return t.push([o,r]),o}),{groups:t,path:e}},Tt=(e,t)=>{for(let r=t.length-1;r>=0;r--){let[n]=t[r];for(let o=e.length-1;o>=0;o--)if(e[o].includes(n)){e[o]=e[o].replace(n,t[r][1]);break}}return e},W={},_e=(e,t)=>{if(e==="*")return"*";let r=e.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${e}#${t}`;return W[n]||(r[2]?W[n]=t&&t[0]!==":"&&t[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${t})`)]:[e,r[1],new RegExp(`^${r[2]}$`)]:W[n]=[e,r[1],!0]),W[n]}return null},V=(e,t)=>{try{return t(e)}catch{return e.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return t(r)}catch{return r}})}},kt=e=>V(e,decodeURI),ie=e=>{let t=e.url,r=t.indexOf("/",t.indexOf(":")+4),n=r;for(;n<t.length;n++){let o=t.charCodeAt(n);if(o===37){let s=t.indexOf("?",n),i=t.indexOf("#",n),a=s===-1?i===-1?void 0:i:i===-1?s:Math.min(s,i),c=t.slice(r,a);return kt(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(o===63||o===35)break}return t.slice(r,n)};var Se=e=>{let t=ie(e);return t.length>1&&t.at(-1)==="/"?t.slice(0,-1):t},L=(e,t,...r)=>(r.length&&(t=L(t,...r)),`${e?.[0]==="/"?"":"/"}${e}${t==="/"?"":`${e?.at(-1)==="/"?"":"/"}${t?.[0]==="/"?t.slice(1):t}`}`),K=e=>{if(e.charCodeAt(e.length-1)!==63||!e.includes(":"))return null;let t=e.split("/"),r=[],n="";return t.forEach(o=>{if(o!==""&&!/\:/.test(o))n+="/"+o;else if(/\:/.test(o))if(/\?/.test(o)){r.length===0&&n===""?r.push("/"):r.push(n);let s=o.replace("?","");n+="/"+s,r.push(n)}else n+="/"+o}),r.filter((o,s,i)=>i.indexOf(o)===s)},oe=e=>/[%+]/.test(e)?(e.indexOf("+")!==-1&&(e=e.replace(/\+/g," ")),e.indexOf("%")!==-1?V(e,ae):e):e,Te=(e,t,r)=>{let n;if(!r&&t&&!/[%+]/.test(t)){let i=e.indexOf("?",8);if(i===-1)return;for(e.startsWith(t,i+1)||(i=e.indexOf(`&${t}`,i+1));i!==-1;){let a=e.charCodeAt(i+t.length+1);if(a===61){let c=i+t.length+2,l=e.indexOf("&",c);return oe(e.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";i=e.indexOf(`&${t}`,i+1)}if(n=/[%+]/.test(e),!n)return}let o={};n??=/[%+]/.test(e);let s=e.indexOf("?",8);for(;s!==-1;){let i=e.indexOf("&",s+1),a=e.indexOf("=",s);a>i&&i!==-1&&(a=-1);let c=e.slice(s+1,a===-1?i===-1?void 0:i:a);if(n&&(c=oe(c)),s=i,c==="")continue;let l;a===-1?l="":(l=e.slice(a+1,i===-1?void 0:i),n&&(l=oe(l))),r?(o[c]&&Array.isArray(o[c])||(o[c]=[]),o[c].push(l)):o[c]??=l}return t?o[t]:o},ke=Te,Ue=(e,t)=>Te(e,t,!0),ae=decodeURIComponent;var Le=e=>V(e,ae),F=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(e,t="/",r=[[]]){this.raw=e,this.path=t,this.#e=r,this.#t={}}param(e){return e?this.#r(e):this.#s()}#r(e){let t=this.#e[0][this.routeIndex][1][e],r=this.#o(t);return r&&/\%/.test(r)?Le(r):r}#s(){let e={},t=Object.keys(this.#e[0][this.routeIndex][1]);for(let r of t){let n=this.#o(this.#e[0][this.routeIndex][1][r]);n!==void 0&&(e[r]=/\%/.test(n)?Le(n):n)}return e}#o(e){return this.#e[1]?this.#e[1][e]:e}query(e){return ke(this.url,e)}queries(e){return Ue(this.url,e)}header(e){if(e)return this.raw.headers.get(e)??void 0;let t={};return this.raw.headers.forEach((r,n)=>{t[n]=r}),t}async parseBody(e){return Oe(this,e)}#n=e=>{let{bodyCache:t,raw:r}=this,n=t[e];if(n)return n;let o=Object.keys(t)[0];return o?t[o].then(s=>(o==="json"&&(s=JSON.stringify(s)),new Response(s)[e]())):t[e]=r[e]()};json(){return this.#n("text").then(e=>JSON.parse(e))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(e=>new Uint8Array(e))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(e,t){this.#t[e]=t}valid(e){return this.#t[e]}get url(){return this.raw.url}get method(){return this.raw.method}get[Pe](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,e]])=>e)}get routePath(){return this.#e[0].map(([[,e]])=>e)[this.routeIndex].path}};var Me={Stringify:1,BeforeStream:2,Stream:3},Ut=(e,t)=>{let r=new String(e);return r.isEscaped=!0,r.callbacks=t,r};var ce=async(e,t,r,n,o)=>{typeof e=="object"&&!(e instanceof String)&&(e instanceof Promise||(e=e.toString()),e instanceof Promise&&(e=await e));let s=e.callbacks;if(!s?.length)return Promise.resolve(e);o?o[0]+=e:o=[e];let i=Promise.all(s.map(a=>a({phase:t,buffer:o,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>ce(c,t,!1,n,o))).then(()=>o[0]));return r?Ut(await i,s):i};var Lt="text/plain; charset=UTF-8",le=(e,t)=>({"Content-Type":e,...t}),D=(e,t)=>new Response(e,t),ue=class{#t;#e;env={};#r;finalized=!1;error;#s;#o;#n;#u;#c;#l;#a;#d;#p;constructor(e,t){this.#t=e,t&&(this.#o=t.executionCtx,this.env=t.env,this.#l=t.notFoundHandler,this.#p=t.path,this.#d=t.matchResult)}get req(){return this.#e??=new F(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#o&&"respondWith"in this.#o)return this.#o;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#o)return this.#o;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=D(null,{headers:this.#a??=new Headers})}set res(e){if(this.#n&&e){e=D(e.body,e);for(let[t,r]of this.#n.headers.entries())if(t!=="content-type")if(t==="set-cookie"){let n=this.#n.headers.getSetCookie();e.headers.delete("set-cookie");for(let o of n)e.headers.append("set-cookie",o)}else e.headers.set(t,r)}this.#n=e,this.finalized=!0}render=(...e)=>(this.#c??=t=>this.html(t),this.#c(...e));setLayout=e=>this.#u=e;getLayout=()=>this.#u;setRenderer=e=>{this.#c=e};header=(e,t,r)=>{this.finalized&&(this.#n=D(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#a??=new Headers;t===void 0?n.delete(e):r?.append?n.append(e,t):n.set(e,t)};status=e=>{this.#s=e};set=(e,t)=>{this.#r??=new Map,this.#r.set(e,t)};get=e=>this.#r?this.#r.get(e):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#i(e,t,r){let n=this.#n?new Headers(this.#n.headers):this.#a??new Headers;if(typeof t=="object"&&"headers"in t){let s=t.headers instanceof Headers?t.headers:new Headers(t.headers);for(let[i,a]of s)i.toLowerCase()==="set-cookie"?n.append(i,a):n.set(i,a)}if(r)for(let[s,i]of Object.entries(r))if(typeof i=="string")n.set(s,i);else{n.delete(s);for(let a of i)n.append(s,a)}let o=typeof t=="number"?t:t?.status??this.#s;return D(e,{status:o,headers:n})}newResponse=(...e)=>this.#i(...e);body=(e,t,r)=>this.#i(e,t,r);text=(e,t,r)=>!this.#a&&!this.#s&&!t&&!r&&!this.finalized?new Response(e):this.#i(e,t,le(Lt,r));json=(e,t,r)=>this.#i(JSON.stringify(e),t,le("application/json",r));html=(e,t,r)=>{let n=o=>this.#i(o,t,le("text/html; charset=UTF-8",r));return typeof e=="object"?ce(e,Me.Stringify,!1,{}).then(n):n(e)};redirect=(e,t)=>{let r=String(e);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,t??302)};notFound=()=>(this.#l??=()=>D(),this.#l(this))};var y="ALL",Ie="all",je=["get","post","put","delete","options","patch"],G="Can not add a route since the matcher is already built.",J=class extends Error{};var He="__COMPOSED_HANDLER";var Mt=e=>e.text("404 Not Found",404),$e=(e,t)=>{if("getResponse"in e){let r=e.getResponse();return t.newResponse(r.body,r)}return console.error(e),t.text("Internal Server Error",500)},Ne=class De{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(t={}){[...je,Ie].forEach(s=>{this[s]=(i,...a)=>(typeof i=="string"?this.#t=i:this.#s(s,this.#t,i),a.forEach(c=>{this.#s(s,this.#t,c)}),this)}),this.on=(s,i,...a)=>{for(let c of[i].flat()){this.#t=c;for(let l of[s].flat())a.map(u=>{this.#s(l.toUpperCase(),this.#t,u)})}return this},this.use=(s,...i)=>(typeof s=="string"?this.#t=s:(this.#t="*",i.unshift(s)),i.forEach(a=>{this.#s(y,this.#t,a)}),this);let{strict:n,...o}=t;Object.assign(this,o),this.getPath=n??!0?t.getPath??ie:Se}#e(){let t=new De({router:this.router,getPath:this.getPath});return t.errorHandler=this.errorHandler,t.#r=this.#r,t.routes=this.routes,t}#r=Mt;errorHandler=$e;route(t,r){let n=this.basePath(t);return r.routes.map(o=>{let s;r.errorHandler===$e?s=o.handler:(s=async(i,a)=>(await ne([],r.errorHandler)(i,()=>o.handler(i,a))).res,s[He]=o.handler),n.#s(o.method,o.path,s,o.basePath)}),this}basePath(t){let r=this.#e();return r._basePath=L(this._basePath,t),r}onError=t=>(this.errorHandler=t,this);notFound=t=>(this.#r=t,this);mount(t,r,n){let o,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?o=c=>c:o=n.replaceRequest));let i=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};o||=(()=>{let c=L(this._basePath,t),l=c==="/"?0:c.length;return u=>{let p=new URL(u.url);return p.pathname=this.getPath(u).slice(l)||"/",new Request(p,u)}})();let a=async(c,l)=>{let u=await r(o(c.req.raw),...i(c));if(u)return u;await l()};return this.#s(y,L(t,"*"),a),this}#s(t,r,n,o){t=t.toUpperCase(),r=L(this._basePath,r);let s={basePath:o!==void 0?L(this._basePath,o):this._basePath,path:r,method:t,handler:n};this.router.add(t,r,[n,s]),this.routes.push(s)}#o(t,r){if(t instanceof Error)return this.errorHandler(t,r);throw t}#n(t,r,n,o){if(o==="HEAD")return(async()=>new Response(null,await this.#n(t,r,n,"GET")))();let s=this.getPath(t,{env:n}),i=this.router.match(o,s),a=new ue(t,{path:s,matchResult:i,env:n,executionCtx:r,notFoundHandler:this.#r});if(i[0].length===1){let l;try{l=i[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#o(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#o(u,a)):l??this.#r(a)}let c=ne(i[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#o(l,a)}})()}fetch=(t,...r)=>this.#n(t,r[1],r[0],t.method);request=(t,r,n,o)=>t instanceof Request?this.fetch(r?new Request(t,r):t,n,o):(t=t.toString(),this.fetch(new Request(/^https?:\/\//.test(t)?t:`http://localhost${L("/",t)}`,r),n,o));fire=()=>{addEventListener("fetch",t=>{t.respondWith(this.#n(t.request,t,void 0,t.request.method))})}};var X=[];function de(e,t){let r=this.buildAllMatchers(),n=((o,s)=>{let i=r[o]||r[y],a=i[2][s];if(a)return a;let c=s.match(i[0]);if(!c)return[[],X];let l=c.indexOf("",1);return[i[1][l],c]});return this.match=n,n(e,t)}var Y="[^/]+",B=".*",z="(?:|/.*)",I=Symbol(),It=new Set(".\\+*[^]$()");function jt(e,t){return e.length===1?t.length===1?e<t?-1:1:-1:t.length===1||e===B||e===z?1:t===B||t===z?-1:e===Y?1:t===Y?-1:e.length===t.length?e<t?-1:1:t.length-e.length}var Be=class pe{#t;#e;#r=Object.create(null);insert(t,r,n,o,s){if(t.length===0){if(this.#t!==void 0)throw I;if(s)return;this.#t=r;return}let[i,...a]=t,c=i==="*"?a.length===0?["","",B]:["","",Y]:i==="/*"?["","",z]:i.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),l;if(c){let u=c[1],p=c[2]||Y;if(u&&c[2]&&(p===".*"||(p=p.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(p))))throw I;if(l=this.#r[p],!l){if(Object.keys(this.#r).some(g=>g!==B&&g!==z))throw I;if(s)return;l=this.#r[p]=new pe,u!==""&&(l.#e=o.varIndex++)}!s&&u!==""&&n.push([u,l.#e])}else if(l=this.#r[i],!l){if(Object.keys(this.#r).some(u=>u.length>1&&u!==B&&u!==z))throw I;if(s)return;l=this.#r[i]=new pe}l.insert(a,r,n,o,s)}buildRegExpStr(){let r=Object.keys(this.#r).sort(jt).map(n=>{let o=this.#r[n];return(typeof o.#e=="number"?`(${n})@${o.#e}`:It.has(n)?`\\${n}`:n)+o.buildRegExpStr()});return typeof this.#t=="number"&&r.unshift(`#${this.#t}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var ze=class{#t={varIndex:0};#e=new Be;insert(e,t,r){let n=[],o=[];for(let i=0;;){let a=!1;if(e=e.replace(/\{[^}]+\}/g,c=>{let l=`@\\${i}`;return o[i]=[l,c],i++,a=!0,l}),!a)break}let s=e.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=o.length-1;i>=0;i--){let[a]=o[i];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,o[i][1]);break}}return this.#e.insert(s,t,n,this.#t,r),n}buildRegExp(){let e=this.#e.buildRegExpStr();if(e==="")return[/^$/,[],[]];let t=0,r=[],n=[];return e=e.replace(/#(\d+)|@(\d+)|\.\*\$/g,(o,s,i)=>s!==void 0?(r[++t]=Number(s),"$()"):(i!==void 0&&(n[Number(i)]=++t),"")),[new RegExp(`^${e}`),r,n]}};var Ht=[/^$/,[],Object.create(null)],qe=Object.create(null);function Fe(e){return qe[e]??=new RegExp(e==="*"?"":`^${e.replace(/\/\*$|([.\\+*[^\]$()])/g,(t,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function $t(){qe=Object.create(null)}function Nt(e){let t=new ze,r=[];if(e.length===0)return Ht;let n=e.map(l=>[!/\*|\/:/.test(l[0]),...l]).sort(([l,u],[p,g])=>l?1:p?-1:u.length-g.length),o=Object.create(null);for(let l=0,u=-1,p=n.length;l<p;l++){let[g,h,m]=n[l];g?o[h]=[m.map(([w])=>[w,Object.create(null)]),X]:u++;let d;try{d=t.insert(h,u,g)}catch(w){throw w===I?new J(h):w}g||(r[u]=m.map(([w,f])=>{let R=Object.create(null);for(f-=1;f>=0;f--){let[O,S]=d[f];R[O]=S}return[w,R]}))}let[s,i,a]=t.buildRegExp();for(let l=0,u=r.length;l<u;l++)for(let p=0,g=r[l].length;p<g;p++){let h=r[l][p]?.[1];if(!h)continue;let m=Object.keys(h);for(let d=0,w=m.length;d<w;d++)h[m[d]]=a[h[m[d]]]}let c=[];for(let l in i)c[l]=r[i[l]];return[s,c,o]}function $(e,t){if(e){for(let r of Object.keys(e).sort((n,o)=>o.length-n.length))if(Fe(r).test(t))return[...e[r]]}}var Q=class{name="RegExpRouter";#t;#e;constructor(){this.#t={[y]:Object.create(null)},this.#e={[y]:Object.create(null)}}add(e,t,r){let n=this.#t,o=this.#e;if(!n||!o)throw new Error(G);n[e]||[n,o].forEach(a=>{a[e]=Object.create(null),Object.keys(a[y]).forEach(c=>{a[e][c]=[...a[y][c]]})}),t==="/*"&&(t="*");let s=(t.match(/\/:/g)||[]).length;if(/\*$/.test(t)){let a=Fe(t);e===y?Object.keys(n).forEach(c=>{n[c][t]||=$(n[c],t)||$(n[y],t)||[]}):n[e][t]||=$(n[e],t)||$(n[y],t)||[],Object.keys(n).forEach(c=>{(e===y||e===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(o).forEach(c=>{(e===y||e===c)&&Object.keys(o[c]).forEach(l=>a.test(l)&&o[c][l].push([r,s]))});return}let i=K(t)||[t];for(let a=0,c=i.length;a<c;a++){let l=i[a];Object.keys(o).forEach(u=>{(e===y||e===u)&&(o[u][l]||=[...$(n[u],l)||$(n[y],l)||[]],o[u][l].push([r,s-c+a+1]))})}}match=de;buildAllMatchers(){let e=Object.create(null);return Object.keys(this.#e).concat(Object.keys(this.#t)).forEach(t=>{e[t]||=this.#r(t)}),this.#t=this.#e=void 0,$t(),e}#r(e){let t=[],r=e===y;return[this.#t,this.#e].forEach(n=>{let o=n[e]?Object.keys(n[e]).map(s=>[s,n[e][s]]):[];o.length!==0?(r||=!0,t.push(...o)):e!==y&&t.push(...Object.keys(n[y]).map(s=>[s,n[y][s]]))}),r?Nt(t):null}};var he=class{name="SmartRouter";#t=[];#e=[];constructor(e){this.#t=e.routers}add(e,t,r){if(!this.#e)throw new Error(G);this.#e.push([e,t,r])}match(e,t){if(!this.#e)throw new Error("Fatal error");let r=this.#t,n=this.#e,o=r.length,s=0,i;for(;s<o;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);i=a.match(e,t)}catch(c){if(c instanceof J)continue;throw c}this.match=a.match.bind(a),this.#t=[a],this.#e=void 0;break}if(s===o)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};var q=Object.create(null),Dt=e=>{for(let t in e)return!0;return!1},We=class Ve{#t;#e;#r;#s=0;#o=q;constructor(t,r,n){if(this.#e=n||Object.create(null),this.#t=[],t&&r){let o=Object.create(null);o[t]={handler:r,possibleKeys:[],score:0},this.#t=[o]}this.#r=[]}insert(t,r,n){this.#s=++this.#s;let o=this,s=Ce(r),i=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],u=s[a+1],p=_e(l,u),g=Array.isArray(p)?p[0]:l;if(g in o.#e){o=o.#e[g],p&&i.push(p[1]);continue}o.#e[g]=new Ve,p&&(o.#r.push(p),i.push(p[1])),o=o.#e[g]}return o.#t.push({[t]:{handler:n,possibleKeys:i.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),o}#n(t,r,n,o,s){for(let i=0,a=r.#t.length;i<a;i++){let c=r.#t[i],l=c[n]||c[y],u={};if(l!==void 0&&(l.params=Object.create(null),t.push(l),o!==q||s&&s!==q))for(let p=0,g=l.possibleKeys.length;p<g;p++){let h=l.possibleKeys[p],m=u[l.score];l.params[h]=s?.[h]&&!m?s[h]:o[h]??s?.[h],u[l.score]=!0}}}search(t,r){let n=[];this.#o=q;let s=[this],i=se(r),a=[],c=i.length,l=null;for(let u=0;u<c;u++){let p=i[u],g=u===c-1,h=[];for(let d=0,w=s.length;d<w;d++){let f=s[d],R=f.#e[p];R&&(R.#o=f.#o,g?(R.#e["*"]&&this.#n(n,R.#e["*"],t,f.#o),this.#n(n,R,t,f.#o)):h.push(R));for(let O=0,S=f.#r.length;O<S;O++){let v=f.#r[O],b=f.#o===q?{}:{...f.#o};if(v==="*"){let k=f.#e["*"];k&&(this.#n(n,k,t,f.#o),k.#o=b,h.push(k));continue}let[A,x,P]=v;if(!p&&!(P instanceof RegExp))continue;let E=f.#e[A];if(P instanceof RegExp){if(l===null){l=new Array(c);let H=r[0]==="/"?1:0;for(let _=0;_<c;_++)l[_]=H,H+=i[_].length+1}let k=r.substring(l[u]),N=P.exec(k);if(N){if(b[x]=N[0],this.#n(n,E,t,f.#o,b),Dt(E.#e)){E.#o=b;let H=N[0].match(/\//)?.length??0;(a[H]||=[]).push(E)}continue}}(P===!0||P.test(p))&&(b[x]=p,g?(this.#n(n,E,t,b,f.#o),E.#e["*"]&&this.#n(n,E.#e["*"],t,b,f.#o)):(E.#o=b,h.push(E)))}}let m=a.shift();s=m?h.concat(m):h}return n.length>1&&n.sort((u,p)=>u.score-p.score),[n.map(({handler:u,params:p})=>[u,p])]}};var fe=class{name="TrieRouter";#t;constructor(){this.#t=new We}add(e,t,r){let n=K(t);if(n){for(let o=0,s=n.length;o<s;o++)this.#t.insert(e,n[o],r);return}this.#t.insert(e,t,r)}match(e,t){return this.#t.search(e,t)}};var ge=class extends Ne{constructor(e={}){super(e),this.router=e.router??new he({routers:[new Q,new fe]})}};import{Readable as Pr}from"stream";function Ke(e=""){return`<link rel="icon" type="image/svg+xml" href="${`${e.replace(/\/$/,"")}/favicon-black.svg?v=4`}" />`}import{existsSync as Ge,readFileSync as Bt}from"fs";import U from"path";import{fileURLToPath as zt}from"url";import{gunzipSync as qt}from"zlib";var Ft={".js":"application/javascript",".css":"text/css",".svg":"image/svg+xml",".png":"image/png",".ico":"image/x-icon",".webmanifest":"application/manifest+json"};function Wt(){let e=U.dirname(zt(import.meta.url));for(let t of[U.resolve(e,"app"),U.resolve(e,"../app"),U.resolve(e,"../../dist/app")])if(Ge(U.join(t,"inspector.js.gz")))return t;throw new Error("Inspector bundle not found (expected dist/app/inspector.js.gz)")}function Je(e,t="/inspector/assets"){let r=Wt(),n=new Map;e.get(`${t}/*`,o=>{let s=o.req.path.slice(t.length),i=s.startsWith("/")?s.slice(1):s;if(!i||i.includes(".."))return o.notFound();let a=i==="inspector.js"||i==="inspector.css"?`${i}.gz`:i,c=U.resolve(r,a),l=r.endsWith(U.sep)?r:`${r}${U.sep}`;if(!c.startsWith(l)||!Ge(c))return o.notFound();let u=U.extname(i),p=a.endsWith(".gz"),g=/(?:^|,)\s*gzip\s*(?:,|$)/i.test(o.req.header("accept-encoding")??""),h=Bt(c),m=p&&!g?n.get(c)??Vt(n,c,h):h,d=m.buffer.slice(m.byteOffset,m.byteOffset+m.byteLength);return o.body(d,200,{"Content-Type":Ft[u]??"application/octet-stream",...p&&g?{"Content-Encoding":"gzip"}:{},...p?{Vary:"Accept-Encoding"}:{},"Cache-Control":"no-cache"})})}function Vt(e,t,r){let n=qt(r);return e.set(t,n),n}var Xe={name:"@mcp-use/inspector",type:"module",version:"20.0.0-beta.20",description:"MCP Inspector - A tool for inspecting and debugging MCP servers",author:"",license:"MIT",homepage:"https://github.com/mcp-use/mcp-use#readme",repository:{type:"git",url:"git+https://github.com/mcp-use/mcp-use.git",directory:"libraries/typescript/packages/inspector"},bugs:{url:"https://github.com/mcp-use/mcp-use/issues"},keywords:["mcp","inspector","debug","tools"],exports:{".":{types:"./dist/server/index.d.ts",import:"./dist/server/index.js"},"./client":{types:"./dist/client/index.d.ts",import:"./dist/client/index.js"}},main:"./dist/server/index.js",types:"./dist/server/index.d.ts",bin:{"mcp-inspect":"./dist/cli.js"},files:["dist"],scripts:{dev:"rimraf node_modules/.vite && VITE_MANUFACT_CHAT_URL=${VITE_MANUFACT_CHAT_URL:-http://localhost:8000/api/v1/inspector/chat/stream} vite --strictPort","dev:client":"pnpm run dev","dev:server":"VITE_DEV=true tsx watch src/server/server.ts","dev:standalone":"tsx watch src/server/server.ts",clean:"rimraf dist",build:"npm run clean && npm run build:client-exports && npm run build:server && npm run build:app && npm run verify:package","build:app":"vite build --config vite.app.config.ts && node scripts/compress-app.mjs","watch:app":"vite build --watch --config vite.app.config.ts","preview:app":"vite preview --config vite.app.config.ts --host 127.0.0.1","serve:app":"pnpm build:app && pnpm preview:app","analyze:app":"ANALYZE=true vite build --config vite.app.config.ts","build:client-exports":"tsup --config tsup.client.ts","build:server":"tsup --config tsup.server.ts","verify:package":"node scripts/verify-package.mjs",prepublishOnly:"pnpm --filter @mcp-use/client build && pnpm build",start:"node dist/cli.js --port 3000",preview:"vite preview","type-check":"tsc --noEmit",lint:"eslint .","lint:fix":"eslint . --fix","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:e2e:debug":"playwright test --debug","test:e2e:builtin":"node tests/e2e/scripts/run-test-matrix.mjs builtin","test:e2e:prod":"node tests/e2e/scripts/run-test-matrix.mjs prod","test:e2e:mix":"node tests/e2e/scripts/run-test-matrix.mjs mix","test:e2e:prod:ui":"TEST_MODE=production playwright test --ui","test:e2e:codegen":"playwright codegen http://localhost:3000/inspector","test:e2e:report":"playwright show-report","test:e2e:python":"node tests/e2e/scripts/run-python-e2e.mjs","test:unit":"vitest run","test:unit:watch":"vitest","test:e2e:tunnel":"node tests/e2e/scripts/run-tunnel-test.mjs","install:pnpm":"pnpm install","install:npm":"npm install","lint:npm":"npm run lint:fix","lint:pnpm":"pnpm lint:fix"},engines:{node:">=22.22.2"},peerDependencies:{"@base-ui/react":"^1.6.0","@mcp-use/agent":"^2.0.0-alpha.0","@mcp-use/client":"^2.0.0-alpha.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",express:"^4.21.2 || ^5.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4","mcp-use":"workspace:*",motion:"^12.34.2",react:"^18.0.0 || ^19.0.0","react-dom":"^18.0.0 || ^19.0.0","react-resizable-panels":"^4.6.4",sonner:"^2.0.7","tailwind-merge":"^3.5.0"},peerDependenciesMeta:{"@base-ui/react":{optional:!0},"@mcp-use/agent":{optional:!0},"@mcp-use/client":{optional:!0},"class-variance-authority":{optional:!0},clsx:{optional:!0},express:{optional:!0},"lucide-react":{optional:!0},"markdown-to-jsx":{optional:!0},motion:{optional:!0},react:{optional:!0},"react-dom":{optional:!0},"react-resizable-panels":{optional:!0},sonner:{optional:!0},"tailwind-merge":{optional:!0}},dependencies:{},publishConfig:{access:"public"},devDependencies:{"@base-ui/react":"^1.6.0","@hono/node-server":"^1.19.13","@mcp-use/agent":"workspace:*","@mcp-use/client":"workspace:*","@playwright/test":"^1.58.2","@tailwindcss/vite":"^4.2.0","@types/express":"^5.0.6","@vitejs/plugin-react":"^6.0.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",emulate:"0.5.0",eslint:"^9.39.2",express:"^5.2.1",hono:"^4.12.12","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4",motion:"^12.34.2","oauth2-mock-server":"^8.2.2",open:"^11.0.0",react:"^19.2.3","react-dom":"^19.2.3","react-router":"^7.12.0","react-resizable-panels":"^4.6.4","rollup-plugin-visualizer":"^6.0.3",sonner:"^2.0.7","tailwind-merge":"^3.5.0",tailwindcss:"^4.2.0",tsup:"^8.5.1",tsx:"^4.21.0","tw-animate-css":"^1.4.0",typescript:"^5.9.3",vite:"^8.0.16",vitest:"^4.1.0","wait-on":"^9.0.4",zod:"^4.2.0"}};var Gt=Xe.version;function Ye(){return Gt}var Qe=Ye(),Jt=`<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>Signed in</title><meta name="robots" content="noindex"><style>html,body{margin:0;height:100%;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#4b5563;background:#fff}</style></head>
+<body><div>Signed in. You can close this window.</div>
+<script>try{if(window.opener&&!window.opener.closed)window.opener.postMessage({type:"manufact:oauth-complete"},"*")}catch(e){}try{window.close()}catch(e){}</script>
+</body></html>`;function Xt(e,t,r){let n=[];e?.basePath!==void 0&&n.push(`<script>window.__MCP_BASE_PATH__ = ${JSON.stringify(e.basePath)};</script>`),e?.devMode&&n.push("<script>window.__MCP_DEV_MODE__ = true;</script>"),e?.sandboxOrigin&&n.push(`<script>window.__MCP_SANDBOX_ORIGIN__ = ${JSON.stringify(e.sandboxOrigin)};</script>`),e?.proxyUrl!==void 0&&n.push(`<script>window.__MCP_PROXY_URL__ = ${JSON.stringify(e.proxyUrl)};</script>`),e?.inspectorMode&&n.push(`<script>window.__MCP_INSPECTOR_MODE__ = ${JSON.stringify(e.inspectorMode)};</script>`),e?.manufactChatUrl&&n.push(`<script>window.__MANUFACT_CHAT_URL__ = ${JSON.stringify(e.manufactChatUrl)};</script>`),e?.disableTelemetry&&n.push('<script>window.__MCP_USE_ANONYMIZED_TELEMETRY__ = false;try{localStorage.setItem("MCP_USE_ANONYMIZED_TELEMETRY","false");}catch(e){}</script>'),process.env.MCP_USE_DEV_CLI==="1"&&n.push("<script>window.__MCP_DEV_CLI__ = true;</script>");let o=n.join(`
+    `);return`<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    ${Ke(`${t}/inspector/assets`)}
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link href="https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;500;700&display=swap" rel="stylesheet" />
+    <link rel="stylesheet" href="${r.cssUrl}" />
+    <title>Inspector | mcp-use</title>
+    <meta name="description" content="Free, open-source MCP Inspector by mcp-use. Connect to any MCP server, test tools, prompts, and resources, inspect RPC logs, and debug MCP apps \u2014 all in your browser." />
+    <style>
+      :root { color-scheme: light dark; }
+      html, body { height: 100%; margin: 0; background-color: #f3f3f3; }
+      #root { height: 100%; }
+      .mcp-boot {
+        display: flex;
+        height: 100%;
+        align-items: center;
+        justify-content: center;
+        background-color: #f3f3f3;
+      }
+      .mcp-boot-inner {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        gap: 16px;
+      }
+      .mcp-boot-spinner {
+        width: 32px;
+        height: 32px;
+        color: #52525b;
+        animation: mcp-boot-spin 1s linear infinite;
+      }
+      .mcp-boot-label {
+        margin: 0;
+        font-family: Ubuntu, sans-serif;
+        font-size: 0.875rem;
+        line-height: 1.25rem;
+        color: #52525b;
+      }
+      @keyframes mcp-boot-spin {
+        to { transform: rotate(360deg); }
+      }
+      @media (prefers-color-scheme: dark) {
+        html, body { background-color: #000; }
+        .mcp-boot { background-color: #000; }
+        .mcp-boot-spinner, .mcp-boot-label { color: #a1a1aa; }
+      }
+    </style>
+    <script>window.__INSPECTOR_VERSION__ = ${JSON.stringify(Qe)};</script>
+    ${o}
+  </head>
+  <body>
+    <script>
+      if (typeof window !== "undefined" && typeof window.process === "undefined") {
+        window.process = {
+          env: {},
+          platform: "browser",
+          browser: true,
+          version: "v18.0.0",
+          versions: { node: "18.0.0" },
+          cwd: () => "/",
+          nextTick: (fn, ...args) => queueMicrotask(() => fn(...args)),
+        };
+      }
+    </script>
+    <div id="root">
+      <div class="mcp-boot">
+        <div class="mcp-boot-inner">
+          <svg
+            class="mcp-boot-spinner"
+            xmlns="http://www.w3.org/2000/svg"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            role="status"
+            aria-label="Loading"
+          >
+            <path d="M21 12a9 9 0 1 1-6.219-8.56" />
+          </svg>
+          <p class="mcp-boot-label">Connecting to MCP server...</p>
+        </div>
+      </div>
+    </div>
+    <script type="module" src="${r.jsUrl}"></script>
+  </body>
+</html>`}function Ze(e,t,r=""){let n=`${r}/inspector/assets`,o=encodeURIComponent(Qe),s={jsUrl:`${n}/inspector.js?v=${o}`,cssUrl:`${n}/inspector.css?v=${o}`},i=u=>`${r}${u}`,a={...t,basePath:t?.basePath??r,proxyUrl:t?.proxyUrl!==void 0?t.proxyUrl:i("/inspector/api/proxy"),disableTelemetry:t?.disableTelemetry??process.env.MCP_USE_ANONYMIZED_TELEMETRY==="false"},c=u=>u.html(Xt(a,r,s));Je(e,n),e.get(i("/inspector/oauth-popup-closed.html"),u=>u.html(Jt)),e.get(i("/inspector"),c),e.get(`${i("/inspector")}/`,c);let l=i("/inspector/api/");e.get(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),e.post(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),r===""&&t?.rootRedirect!==!1&&e.get("/",u=>{let p=new URL(u.req.url);return u.redirect(`${i("/inspector")}${p.search}`)})}var et=e=>{let t={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[],...e},r=(o=>typeof o=="string"?o==="*"?()=>o:s=>o===s?s:null:typeof o=="function"?o:s=>o.includes(s)?s:null)(t.origin),n=(o=>typeof o=="function"?o:Array.isArray(o)?()=>o:()=>[])(t.allowMethods);return async function(s,i){function a(l,u){s.res.headers.set(l,u)}let c=await r(s.req.header("origin")||"",s);if(c&&a("Access-Control-Allow-Origin",c),t.credentials&&a("Access-Control-Allow-Credentials","true"),t.exposeHeaders?.length&&a("Access-Control-Expose-Headers",t.exposeHeaders.join(",")),s.req.method==="OPTIONS"){t.origin!=="*"&&a("Vary","Origin"),t.maxAge!=null&&a("Access-Control-Max-Age",t.maxAge.toString());let l=await n(s.req.header("origin")||"",s);l.length&&a("Access-Control-Allow-Methods",l.join(","));let u=t.allowHeaders;if(!u?.length){let p=s.req.header("Access-Control-Request-Headers");p&&(u=p.split(/\s*,\s*/))}return u?.length&&(a("Access-Control-Allow-Headers",u.join(",")),s.res.headers.append("Vary","Access-Control-Request-Headers")),s.res.headers.delete("Content-Length"),s.res.headers.delete("Content-Type"),new Response(null,{headers:s.res.headers,status:204,statusText:"No Content"})}await i(),t.origin!=="*"&&s.header("Vary","Origin",{append:!0})}};function Yt(){let{process:e,Deno:t}=globalThis;return!(typeof t?.noColor=="boolean"?t.noColor:e!==void 0?"NO_COLOR"in e?.env:!1)}async function tt(){let{navigator:e}=globalThis,t="cloudflare:workers";return!(e!==void 0&&e.userAgent==="Cloudflare-Workers"?await(async()=>{try{return"NO_COLOR"in((await import(t)).env??{})}catch{return!1}})():!Yt())}var Qt=e=>{let[t,r]=[",","."];return e.map(o=>o.replace(/(\d)(?=(\d\d\d)+(?!\d))/g,"$1"+t)).join(r)},Zt=e=>{let t=Date.now()-e;return Qt([t<1e3?t+"ms":Math.round(t/1e3)+"s"])},er=async e=>{if(await tt())switch(e/100|0){case 5:return`\x1B[31m${e}\x1B[0m`;case 4:return`\x1B[33m${e}\x1B[0m`;case 3:return`\x1B[36m${e}\x1B[0m`;case 2:return`\x1B[32m${e}\x1B[0m`}return`${e}`};async function rt(e,t,r,n,o=0,s){let i=t==="<--"?`${t} ${r} ${n}`:`${t} ${r} ${n} ${await er(o)} ${s}`;e(i)}var nt=(e=console.log)=>async function(r,n){let{method:o,url:s}=r.req,i=s.slice(s.indexOf("/",8));await rt(e,"<--",o,i);let a=Date.now();await n(),await rt(e,"-->",o,i,r.res.status,Zt(a))};import{lookup as tr}from"dns/promises";import{Buffer as rr}from"buffer";import{isIP as nr}from"net";var or=new Set(["accept","authorization","content-type","dpop"]),sr=new Set(["cache-control","content-type","dpop-nonce","expires","pragma","retry-after","www-authenticate"]),ir=[["registration_endpoint","registration"],["token_endpoint","token"],["revocation_endpoint","revocation"],["introspection_endpoint","introspection"]],ut=600*1e3,ar=100,cr=1440*60*1e3,lr=500;function xe(e,t={}){let{basePath:r="/oauth",allowedOrigins:n=[],allowLoopback:o=!1,timeoutMs:s=1e4,maxRequestBodyBytes:i=64*1024,maxResponseBodyBytes:a=1024*1024,callbackPath:c="/oauth/callback",enableLogging:l=!0,authenticate:u,validateServerUrl:p}=t,g=new Set(n.map(be)),h=new Map,m=new Map;e.use(`${r}/*`,async(d,w)=>{let f=d.req.header("Origin");if(f&&!yr(f,d,g))return d.json({error:"Origin not allowed"},403);if(d.req.method==="OPTIONS")return br(f);await w(),f&&wt(d.res.headers,f)}),e.get(`${r}/metadata`,async d=>{if(!await lt(d,u))return d.json({error:"Unauthorized"},401);let w=await j(d.req.query("serverUrl"),o);if("error"in w)return d.json({error:w.error},400);let f=w.url;if(p&&!await p(f.toString(),d))return d.json({error:"MCP server URL not allowed"},403);let R=await j(d.req.query("url"),o);if("error"in R)return d.json({error:R.error},400);let O=R.url,S=T(f),v=at(h,S),b=ot(f,O,v);if(!b&&v.authorizationServers.size===0)try{await st(f,v,o,s,a),h.set(S,v),b=ot(f,O,v)}catch{}if(!b)return d.json({error:"Metadata target is not bound to this MCP server"},403);try{me(l,`GET ${O}`);let A=await Z(O,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(s)});if(te(A.status))return d.json({error:"OAuth metadata redirects are not allowed"},502);let x=await ee(A,a);if(!A.ok)return d.body(x,A.status,{"Content-Type":A.headers.get("content-type")??"application/json"});let P=ye(x);return b.type==="protected-resource"?await ht(P,f,v,o):await ft(P,b.issuer,v,o),v.updatedAt=Date.now(),h.set(S,v),ct(h),d.body(x,200,{"Content-Type":A.headers.get("content-type")??"application/json"})}catch(A){return we(d,A,l)}}),e.post(`${r}/proxy`,async d=>{if(!await lt(d,u))return d.json({error:"Unauthorized"},401);let w;try{w=JSON.parse(await mr(d.req.raw,i))}catch(x){return d.json({error:x instanceof M?"Request body too large":"Invalid JSON request body"},x instanceof M?413:400)}let f=await j(w.serverUrl,o);if("error"in f)return d.json({error:f.error},400);let R=f.url;if(p&&!await p(R.toString(),d))return d.json({error:"MCP server URL not allowed"},403);let O=await j(w.url,o);if("error"in O)return d.json({error:O.error},400);let S=O.url;if(w.method!==void 0&&w.method!=="POST")return d.json({error:"Only OAuth endpoint POST is allowed"},405);let v=T(R),b=at(h,v);if(b.endpoints.size===0)try{await st(R,b,o,s,a),h.set(v,b),ct(h)}catch(x){return we(d,x,l)}let A=b.endpoints.get(T(S));if(!A)return d.json({error:"OAuth endpoint is not bound to this MCP server"},403);try{let x=ur(w.headers),P=pr(w.body,x);if(A==="registration"){let At=be(d.req.header("Origin")??new URL(d.req.url).origin);P=wr(P,x,new URL(c,At).toString())}else P=fr({body:P,headers:x,bindingKey:v,clients:m});if(new TextEncoder().encode(P??"").byteLength>i)return d.json({error:"OAuth request body too large"},413);me(l,`POST ${A} ${S}`);let E=await Z(S,{method:"POST",headers:x,body:P,redirect:"manual",signal:AbortSignal.timeout(s)});if(te(E.status))return d.json({error:"OAuth endpoint redirects are not allowed"},502);let k=await ee(E,a),N=dr(E.headers),H=E.headers.get("content-type")??"",_=k;if(H.includes("json"))try{_=JSON.parse(k)}catch{}return A==="registration"&&E.ok&&_&&typeof _=="object"&&!Array.isArray(_)&&(_=hr({responseBody:_,binding:b,bindingKey:v,clients:m})),d.json({status:E.status,statusText:E.statusText,headers:N,body:_})}catch(x){return we(d,x,l)}}),me(l,`Mounted at ${r}/metadata and ${r}/proxy`)}async function j(e,t){if(typeof e!="string"||!e)return{error:"Missing or invalid URL"};let r;try{r=new URL(e)}catch{return{error:"Invalid URL"}}if(r.username||r.password||r.hash)return{error:"URL credentials and fragments are not allowed"};let n=xr(r.hostname);if(r.protocol!=="https:"&&!(t&&n&&r.protocol==="http:"))return{error:"HTTPS is required"};if(n)return t?{url:r}:{error:"Loopback URL not allowed"};if(Rr(r.hostname))return{error:"Local network URL not allowed"};try{let o=nr(r.hostname)?[r.hostname]:(await tr(r.hostname,{all:!0,verbatim:!0})).map(({address:s})=>s);if(o.length===0||o.some(s=>!yt(s)))return{error:"Private or non-routable URL not allowed"}}catch{return{error:"URL hostname could not be resolved"}}return{url:r}}async function Re(e,t=!1){return!("error"in await j(e,t))}function ot(e,t,r){let n=T(t);if(dt(e).some(o=>T(o)===n))return{type:"protected-resource"};for(let o of r.authorizationServers)if(pt(new URL(o)).some(s=>T(s)===n))return{type:"authorization-server",issuer:o}}function dt(e){let t=e.pathname==="/"?"":e.pathname;return[new URL(`/.well-known/oauth-protected-resource${t}`,e.origin),new URL("/.well-known/oauth-protected-resource",e.origin)]}function pt(e){let t=e.pathname==="/"?"":e.pathname;return[new URL(`/.well-known/oauth-authorization-server${t}`,e.origin),new URL(`/.well-known/openid-configuration${t}`,e.origin),new URL(`${t||""}/.well-known/openid-configuration`,e.origin)]}async function ht(e,t,r,n){if(typeof e.resource!="string"||T(new URL(e.resource))!==T(t))throw new C("Protected-resource metadata does not match serverUrl");if(!Array.isArray(e.authorization_servers)||e.authorization_servers.length===0)throw new C("Protected-resource metadata has no authorization servers");let o=new Set;for(let s of e.authorization_servers){let i=await j(s,n);if("error"in i)throw new C(`Unsafe authorization server: ${i.error}`);o.add(T(i.url))}r.authorizationServers=o,r.endpoints.clear(),r.tokenEndpointAuthMethods.clear()}async function ft(e,t,r,n){if(typeof e.issuer!="string"||T(new URL(e.issuer))!==t)throw new C("Authorization-server metadata issuer mismatch");r.endpoints.clear(),r.tokenEndpointAuthMethods=new Set(Array.isArray(e.token_endpoint_auth_methods_supported)?e.token_endpoint_auth_methods_supported.filter(o=>typeof o=="string"):[]);for(let[o,s]of ir){let i=e[o];if(i===void 0)continue;let a=await j(i,n);if("error"in a)throw new C(`Unsafe ${o}: ${a.error}`);r.endpoints.set(T(a.url),s)}}async function st(e,t,r,n,o){for(let s of dt(e)){let i=await Z(s,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(te(i.status))throw new C("OAuth metadata redirects are not allowed");if(i.ok){await ht(ye(await ee(i,o)),e,t,r);break}}if(t.authorizationServers.size===0)throw new C("Protected-resource metadata could not be discovered");for(let s of t.authorizationServers){let i=!1;for(let a of pt(new URL(s))){let c=await Z(a,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(te(c.status))throw new C("OAuth metadata redirects are not allowed");if(c.ok){await ft(ye(await ee(c,o)),s,t,r),i=!0;break}}if(i)break}if(t.endpoints.size===0)throw new C("Authorization-server metadata could not be discovered");t.updatedAt=Date.now()}async function Z(e,t){return fetch(e,t)}function ur(e){let t=new Headers;if(!e||typeof e!="object"||Array.isArray(e))return t;for(let[r,n]of Object.entries(e)){let o=r.toLowerCase();or.has(o)&&typeof n=="string"&&t.set(o,n)}return t}function dr(e){let t={};return e.forEach((r,n)=>{sr.has(n.toLowerCase())&&(t[n]=r)}),t}function pr(e,t){if(e==null)return;if(typeof e=="string"){if(!t.has("content-type"))try{JSON.parse(e),t.set("content-type","application/json")}catch{t.set("content-type","application/x-www-form-urlencoded")}return e}if((t.get("content-type")??"").includes("application/x-www-form-urlencoded")&&typeof e=="object"&&!Array.isArray(e)){let n=new URLSearchParams;for(let[o,s]of Object.entries(e))n.append(o,String(s));return n.toString()}return t.has("content-type")||t.set("content-type","application/json"),JSON.stringify(e)}function gt(e,t){return`${e}\0${t}`}function hr(e){let{responseBody:t,binding:r,bindingKey:n,clients:o}=e,s=t.client_id,i=t.client_secret;if(typeof s!="string"||typeof i!="string")return t;let a=t.token_endpoint_auth_method,c=a==="client_secret_post"||a==="client_secret_basic"?a:r.tokenEndpointAuthMethods.has("client_secret_basic")?"client_secret_basic":"client_secret_post",l=t.client_secret_expires_at,u=l===0?Number.POSITIVE_INFINITY:typeof l=="number"&&l>0?l*1e3:Date.now()+cr;for(gr(o),o.set(gt(n,s),{clientSecret:i,authMethod:c,expiresAt:u});o.size>lr;){let g=o.keys().next().value;if(!g)break;o.delete(g)}let p={...t};return delete p.client_secret,delete p.client_secret_expires_at,p.token_endpoint_auth_method="none",p}function fr(e){let{body:t,headers:r,bindingKey:n,clients:o}=e;if(!t||!(r.get("content-type")??"").includes("application/x-www-form-urlencoded"))return t;let s=new URLSearchParams(t),i=s.get("client_id");if(!i)return t;let a=gt(n,i),c=o.get(a);if(!c)return t;if(c.expiresAt<=Date.now())return o.delete(a),t;if(s.delete("client_secret"),c.authMethod==="client_secret_basic"){let l=rr.from(`${it(i)}:${it(c.clientSecret)}`,"utf8").toString("base64");r.set("authorization",`Basic ${l}`)}else r.delete("authorization"),s.set("client_id",i),s.set("client_secret",c.clientSecret);return s.toString()}function it(e){return new URLSearchParams({value:e}).toString().slice(6)}function gr(e){let t=Date.now();for(let[r,n]of e)n.expiresAt<=t&&e.delete(r)}async function mr(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw new M;return mt(e.body,t)}async function ee(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw await e.body?.cancel(),new M;return mt(e.body,t)}async function mt(e,t){if(!e)return"";let r=e.getReader(),n=[],o=0;for(;;){let{done:a,value:c}=await r.read();if(a)break;if(o+=c.byteLength,o>t)throw await r.cancel(),new M;n.push(c)}let s=new Uint8Array(o),i=0;for(let a of n)s.set(a,i),i+=a.byteLength;return new TextDecoder().decode(s)}function ye(e){let t;try{t=JSON.parse(e)}catch{throw new C("OAuth metadata is not valid JSON")}if(!t||typeof t!="object"||Array.isArray(t))throw new C("OAuth metadata is not an object");return t}function at(e,t){let r=e.get(t);return r&&Date.now()-r.updatedAt<=ut?r:(e.delete(t),{authorizationServers:new Set,endpoints:new Map,tokenEndpointAuthMethods:new Set,updatedAt:Date.now()})}function ct(e){let t=Date.now();for(let[r,n]of e)t-n.updatedAt>ut&&e.delete(r);for(;e.size>ar;){let r=e.keys().next().value;if(!r)break;e.delete(r)}}function T(e){let t=new URL(e);return t.hash="",(t.protocol==="https:"&&t.port==="443"||t.protocol==="http:"&&t.port==="80")&&(t.port=""),t.toString().replace(/\/$/,"")}function wr(e,t,r){if(!e||!(t.get("content-type")??"").includes("json"))return e;try{let o=JSON.parse(e);return!o||typeof o!="object"||Array.isArray(o)?e:JSON.stringify({...o,redirect_uris:[r]})}catch{return e}}function be(e){let t=new URL(e);if(t.pathname!=="/"||t.search||t.hash)throw new Error(`OAuth proxy allowed origin must be an origin: ${e}`);return t.origin}function yr(e,t,r){try{let n=be(e);if(n===new URL(t.req.url).origin||r.has(n))return!0;let o=new URL(n),i=t.req.header("x-forwarded-host")?.split(",")[0]?.trim()||t.req.header("host");if(!i||o.host!==i)return!1;let a=t.req.header("x-forwarded-proto")?.split(",")[0]?.trim();return!a||`${a}:`===o.protocol}catch{return!1}}function br(e){let t=new Headers;return e&&wt(t,e),t.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.set("Access-Control-Allow-Headers","Accept, Authorization, Content-Type"),t.set("Access-Control-Max-Age","600"),new Response(null,{status:204,headers:t})}function wt(e,t){e.set("Access-Control-Allow-Origin",t),e.append("Vary","Origin")}async function lt(e,t){return t?t(e):!0}function te(e){return e>=300&&e<400}function xr(e){let t=e.toLowerCase().replace(/^\[|\]$/g,"");return t==="localhost"||t.endsWith(".localhost")||t==="::1"||t.startsWith("127.")}function Rr(e){let t=e.toLowerCase();return t.endsWith(".local")||t.endsWith(".internal")||t.endsWith(".home.arpa")}function yt(e){if(e.includes(":")){let s=e.toLowerCase();return s.startsWith("::ffff:")?yt(s.slice(7)):!(s==="::"||s==="::1"||s.startsWith("fc")||s.startsWith("fd")||/^fe[89ab]/.test(s)||s.startsWith("ff")||s.startsWith("2001:db8:"))}let t=e.split(".").map(Number);if(t.length!==4||t.some(s=>!Number.isInteger(s)))return!1;let[r,n,o]=t;return!(r===0||r===10||r===127||r===100&&n>=64&&n<=127||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===0&&o===0||r===192&&n===0&&o===2||r===192&&n===168||r===198&&(n===18||n===19)||r===198&&n===51&&o===100||r===203&&n===0&&o===113||r>=224)}function me(e,t){e&&console.log(`[OAuth BFF] ${t}`)}function we(e,t,r){let n=t instanceof Error?t.message:"Unknown error";return r&&console.error("[OAuth BFF]",n),t instanceof M?e.json({error:"Upstream response too large"},502):t instanceof C?e.json({error:t.message},502):t instanceof DOMException&&t.name==="TimeoutError"?e.json({error:"OAuth upstream timed out"},504):e.json({error:"OAuth upstream request failed"},502)}var M=class extends Error{},C=class extends Error{};var vr=3;function Er(e,t){return e.includes("text/event-stream")&&!t}function ve(e,t={}){let r=t.path||"/mcp/proxy",n=t.enableLogging!==!1;e.use(`${r}/*`,et({origin:"*",allowHeaders:["Authorization","Content-Type","Accept","X-Target-URL","X-MCP-Target","Mcp-Session-Id","mcp-session-id","mcp-protocol-version","X-Server-Id","X-Requested-With"],exposeHeaders:["*"]})),n&&e.use(`${r}/*`,nt()),e.all(`${r}/*`,async o=>{try{if(t.authenticate&&!await t.authenticate(o))return o.json({error:"Unauthorized"},401);let s=o.req.header("X-Target-URL");if(!s)return o.json({error:"X-Target-URL header is required",usage:"Set X-Target-URL header to the MCP server URL you want to proxy to"},400);if(!await Re(s,t.allowLoopback??!1))return o.json({error:"Invalid target URL",details:"Target is not allowed by the proxy network policy"},403);if(t.validateRequest&&!await t.validateRequest(s,o))return o.json({error:"Invalid target URL",details:"The requested target URL is not allowed"},403);try{new URL(s)}catch{return o.json({error:"Invalid target URL format",details:"The X-Target-URL must be a valid HTTP/HTTPS URL"},400)}let i=o.req.method,a={},c=o.req.header();for(let[h,m]of Object.entries(c)){let d=h.toLowerCase();!d.startsWith("x-proxy-")&&!d.startsWith("x-target-")&&!d.startsWith("x-mcp-")&&!d.startsWith("x-forwarded-")&&!d.startsWith("cf-")&&d!=="x-original-host"&&d!=="host"&&d!=="origin"&&d!=="referer"&&d!=="cookie"&&d!=="proxy-authorization"&&d!=="accept-encoding"&&d!=="cdn-loop"&&!d.startsWith("sec-fetch-")&&(a[h]=m)}a["Accept-Encoding"]="identity";let l=i!=="GET"&&i!=="HEAD"?new Uint8Array(await o.req.arrayBuffer()).slice():void 0,u=s,p=i,g=l;for(let h=0;;h+=1){let m=await fetch(u,{method:p,headers:a,body:g,redirect:"manual"}),d=m.headers.get("location");if(!(m.status>=300&&m.status<400&&d))return Ar(m);if(h>=vr)return o.json({error:"Too many upstream redirects"},502);let w=new URL(d,u);if(!await Re(w.toString(),t.allowLoopback??!1)||t.validateRequest&&!await t.validateRequest(w.toString(),o))return o.json({error:"Redirect target is not allowed"},403);w.origin!==new URL(u).origin&&(re(a,"authorization"),re(a,"proxy-authorization")),(m.status===303||(m.status===301||m.status===302)&&p==="POST")&&(p="GET",g=void 0,re(a,"content-type"),re(a,"content-length")),u=w.toString()}}catch(s){let i=s instanceof Error?s.message:"Unknown error",a=o.req.header("X-Target-URL");return s instanceof Error&&(s.message.includes("ECONNREFUSED")||s.message.includes("fetch failed"))?console.warn(`[MCP Proxy] Connection refused to ${a||"unknown target"} - server may not be running`):console.error("[MCP Proxy] Request failed:",i,`
+Target URL:`,a||"unknown",`
+Error:`,s),o.json({error:"Proxy request failed",details:i,targetUrl:a||"unknown"},500)}})}function re(e,t){for(let r of Object.keys(e))r.toLowerCase()===t&&delete e[r]}async function Ar(e){let t={};if(e.headers.forEach((o,s)=>{let i=s.toLowerCase();i!=="content-encoding"&&i!=="transfer-encoding"&&i!=="content-length"&&i!=="set-cookie"&&(t[s]=o)}),Er(e.headers.get("content-type")||"",e.headers.get("content-length")))return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t});if([204,205,304].includes(e.status))return new Response(null,{status:e.status,statusText:e.statusText,headers:t});let n=await e.arrayBuffer();return t["Content-Length"]=String(n.byteLength),new Response(n,{status:e.status,statusText:e.statusText,headers:t})}function Ee(e,t,r=""){let n=i=>`${r}${i}`,o=t?.oauthProxyAllowLoopback??!1,s=t?.oauth!==!1;if(e.get(n("/inspector/health"),i=>i.json({status:"ok",protocol:"mcp-use-inspector-preview",version:1,capabilities:["view-preview"]})),ve(e,{path:n("/inspector/api/proxy"),allowLoopback:o}),s&&xe(e,{basePath:n("/inspector/api/oauth"),callbackPath:n("/inspector/oauth/callback"),enableLogging:!0,allowedOrigins:t?.oauthProxyAllowedOrigins??[],allowLoopback:o}),t?.autoConnectUrl!==void 0){let i=t.autoConnectUrl;e.get(n("/inspector/config.json"),a=>a.json({autoConnectUrl:i??null}))}}function Or(e,t){if(Ur(e)){let o=e,s=t,i=Rt(s?.basePath);if(Et(o)){vt(o,s,i);return}let a=bt(s,i),c=xt(a);o.use(Cr(c,a.routes.map(l=>l.path)));return}let r=e,n=Rt(r?.basePath);return xt(bt(r,n))}function bt(e,t){let r=new ge;return vt(r,e,t),r}function vt(e,t,r){let n={oauthProxyAllowedOrigins:t?.oauthProxyAllowedOrigins??[],oauthProxyAllowLoopback:t?.oauthProxyAllowLoopback??!0};t?.autoConnectUrl!==void 0?n.autoConnectUrl=t.autoConnectUrl:e.get(`${r}/inspector/config.json`,o=>{let s=new URL(o.req.url);return o.json({autoConnectUrl:`${s.origin}${r}`})}),Ee(e,n,r),Ze(e,{devMode:t?.devMode??!0,sandboxOrigin:t?.sandboxOrigin,inspectorMode:"embedded",rootRedirect:!1,basePath:r,proxyUrl:`${r}/inspector/api/proxy`,manufactChatUrl:t?.manufactChatUrl},r)}function xt(e){return t=>Promise.resolve(e.fetch(t))}function Cr(e,t){let r=new Set(t.filter(o=>!o.includes("*"))),n=t.filter(o=>o.endsWith("/*")).map(o=>o.slice(0,-1));return(o,s,i)=>{let a=new URL(o.originalUrl||o.url||"",_r(o));if(!r.has(a.pathname)&&!n.some(l=>a.pathname.startsWith(l))){i();return}let c=Sr(o,a);e(c).then(l=>kr(s,l)).catch(i)}}function _r(e){let r=Ae(e.headers["x-forwarded-proto"])||e.protocol||"http",o=Ae(e.headers["x-forwarded-host"])||Ae(e.headers.host)||"localhost";return`${r}://${o}`}function Ae(e){return Array.isArray(e)?e[0]??"":(e??"").split(",")[0].trim()}function Sr(e,t){let r={method:e.method,headers:e.headers};return e.method!=="GET"&&e.method!=="HEAD"&&(e.body!==void 0?r.body=Tr(e.body):(r.body=Pr.toWeb(e),r.duplex="half")),new globalThis.Request(t,r)}function Tr(e){return typeof e=="string"||e instanceof ArrayBuffer||ArrayBuffer.isView(e)||e instanceof Blob||e instanceof FormData||e instanceof URLSearchParams||e instanceof ReadableStream?e:JSON.stringify(e)}async function kr(e,t){e.status(t.status),t.headers.forEach((o,s)=>{s!=="set-cookie"&&e.setHeader(s,o)});let r=t.headers.getSetCookie();if(r.length>0&&e.setHeader("set-cookie",r),!t.body){e.end();return}let n=t.body.getReader();for(;;){let{done:o,value:s}=await n.read();if(o)break;e.write(s)}e.end()}function Ur(e){return!e||typeof e!="object"&&typeof e!="function"?!1:typeof e.use=="function"||Et(e)}function Et(e){return!!e&&typeof e=="object"&&typeof e.fetch=="function"&&typeof e.route=="function"}function Rt(e){if(e===void 0)return"/mcp";let t=e.trim().replace(/\/{2,}/g,"/").replace(/\/+$/,"");return t===""||t==="/"?"":(t.startsWith("/")||(t=`/${t}`),t)}export{Or as mountInspector,Ee as registerInspectorProxyRoutes};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcp-use/inspector",
   "type": "module",
-  "version": "20.0.0-beta.2",
+  "version": "20.0.0-beta.21",
   "description": "MCP Inspector - A tool for inspecting and debugging MCP servers",
   "author": "",
   "license": "MIT",
@@ -25,10 +25,6 @@
       "types": "./dist/server/index.d.ts",
       "import": "./dist/server/index.js"
     },
-    "./proxy": {
-      "types": "./dist/server/proxy-routes.d.ts",
-      "import": "./dist/server/proxy-routes.js"
-    },
     "./client": {
       "types": "./dist/client/index.d.ts",
       "import": "./dist/client/index.js"
@@ -43,52 +39,98 @@
     "dist"
   ],
   "engines": {
-    "node": "^20.19.0 || >=22.12.0"
+    "node": ">=22.22.2"
   },
   "peerDependencies": {
-    "@mcp-use/client": "^2.0.0-alpha.0",
-    "express": "^4.21.2 || ^5.0.0",
-    "react": "^18.0.0 || ^19.0.0",
-    "react-dom": "^18.0.0 || ^19.0.0",
-    "react-router": "^7.12.0"
-  },
-  "peerDependenciesMeta": {
-    "express": {
-      "optional": true
-    }
-  },
-  "dependencies": {
     "@base-ui/react": "^1.6.0",
-    "@hono/node-server": "^1.19.13",
+    "@mcp-use/agent": "^2.0.0-alpha.0",
+    "@mcp-use/client": "^2.0.0-alpha.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "hono": "^4.12.12",
+    "express": "^4.21.2 || ^5.0.0",
     "lucide-react": "^0.562.0",
     "markdown-to-jsx": "^9.7.4",
     "motion": "^12.34.2",
-    "open": "^11.0.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "react-dom": "^18.0.0 || ^19.0.0",
     "react-resizable-panels": "^4.6.4",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.5.0",
-    "@mcp-use/client": "2.0.0-beta.1",
-    "@mcp-use/agent": "2.0.0-beta.1"
+    "mcp-use": "2.0.0-beta.29"
   },
+  "peerDependenciesMeta": {
+    "@base-ui/react": {
+      "optional": true
+    },
+    "@mcp-use/agent": {
+      "optional": true
+    },
+    "@mcp-use/client": {
+      "optional": true
+    },
+    "class-variance-authority": {
+      "optional": true
+    },
+    "clsx": {
+      "optional": true
+    },
+    "express": {
+      "optional": true
+    },
+    "lucide-react": {
+      "optional": true
+    },
+    "markdown-to-jsx": {
+      "optional": true
+    },
+    "motion": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    },
+    "react-resizable-panels": {
+      "optional": true
+    },
+    "sonner": {
+      "optional": true
+    },
+    "tailwind-merge": {
+      "optional": true
+    }
+  },
+  "dependencies": {},
   "publishConfig": {
     "access": "public"
   },
   "devDependencies": {
+    "@base-ui/react": "^1.6.0",
+    "@hono/node-server": "^1.19.13",
     "@playwright/test": "^1.58.2",
     "@tailwindcss/vite": "^4.2.0",
     "@types/express": "^5.0.6",
     "@vitejs/plugin-react": "^6.0.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
     "emulate": "0.5.0",
     "eslint": "^9.39.2",
     "express": "^5.2.1",
+    "hono": "^4.12.12",
+    "lucide-react": "^0.562.0",
+    "markdown-to-jsx": "^9.7.4",
+    "motion": "^12.34.2",
     "oauth2-mock-server": "^8.2.2",
+    "open": "^11.0.0",
     "react": "^19.2.3",
     "react-dom": "^19.2.3",
     "react-router": "^7.12.0",
+    "react-resizable-panels": "^4.6.4",
     "rollup-plugin-visualizer": "^6.0.3",
+    "sonner": "^2.0.7",
+    "tailwind-merge": "^3.5.0",
     "tailwindcss": "^4.2.0",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
@@ -98,23 +140,24 @@
     "vitest": "^4.1.0",
     "wait-on": "^9.0.4",
     "zod": "^4.2.0",
-    "mcp-use": "2.0.0-beta.4"
+    "@mcp-use/agent": "2.0.0-beta.12",
+    "@mcp-use/client": "2.0.0-beta.11"
   },
   "scripts": {
     "dev": "rimraf node_modules/.vite && VITE_MANUFACT_CHAT_URL=${VITE_MANUFACT_CHAT_URL:-http://localhost:8000/api/v1/inspector/chat/stream} vite --strictPort",
     "dev:client": "pnpm run dev",
     "dev:server": "VITE_DEV=true tsx watch src/server/server.ts",
     "dev:standalone": "tsx watch src/server/server.ts",
-    "build": "npm run build:client && npm run build:client-exports && npm run build:server && npm run build:cli && npm run build:cdn",
-    "build:cdn": "vite build --config vite.cdn.config.ts",
-    "watch:cdn": "vite build --watch --config vite.cdn.config.ts",
-    "preview:cdn": "vite preview --config vite.cdn.config.ts --host 127.0.0.1",
-    "serve:cdn": "pnpm build:cdn && pnpm preview:cdn",
-    "analyze:cdn": "ANALYZE=true vite build --config vite.cdn.config.ts",
-    "build:client": "vite build",
-    "build:client-exports": "tsup --config tsup.client.ts && tsc -p tsconfig.client.json --emitDeclarationOnly --declaration",
-    "build:server": "tsup 'src/server/**/*.ts' --format esm --out-dir dist/server && tsc -p tsconfig.server.json --emitDeclarationOnly --declaration",
-    "build:cli": "tsup src/server/cli.ts --format esm --out-dir dist/",
+    "clean": "rimraf dist",
+    "build": "npm run clean && npm run build:client-exports && npm run build:server && npm run build:app && npm run verify:package",
+    "build:app": "vite build --config vite.app.config.ts && node scripts/compress-app.mjs",
+    "watch:app": "vite build --watch --config vite.app.config.ts",
+    "preview:app": "vite preview --config vite.app.config.ts --host 127.0.0.1",
+    "serve:app": "pnpm build:app && pnpm preview:app",
+    "analyze:app": "ANALYZE=true vite build --config vite.app.config.ts",
+    "build:client-exports": "tsup --config tsup.client.ts",
+    "build:server": "tsup --config tsup.server.ts",
+    "verify:package": "node scripts/verify-package.mjs",
     "start": "node dist/cli.js --port 3000",
     "preview": "vite preview",
     "type-check": "tsc --noEmit",
@@ -133,10 +176,8 @@
     "test:unit": "vitest run",
     "test:unit:watch": "vitest",
     "test:e2e:tunnel": "node tests/e2e/scripts/run-tunnel-test.mjs",
-    "install:yarn": "yarn install",
     "install:pnpm": "pnpm install",
     "install:npm": "npm install",
-    "lint:yarn": "yarn eslint . --fix",
     "lint:npm": "npm run lint:fix",
     "lint:pnpm": "pnpm lint:fix"
   }