@mcp-use/inspector 20.0.0-beta.5 → 20.0.0-beta.50

package/dist/server/index.d.ts

@@ -1,10 +1,82 @@
+import { Express } from 'express';
+import { Hono } from 'hono';
+
+/** Web-standard handler returned by {@link mountInspector}. */
+type InspectorFetchHandler = (request: globalThis.Request) => Promise<globalThis.Response>;
+/** Configuration shared by framework-neutral and framework-mounted inspectors. */
+interface MountInspectorOptions {
+    /**
+     * MCP URL passed to the client for automatic connection. For the returned
+     * Fetch handler, omission derives `${request.origin}${basePath}` so localhost
+     * and public tunnel URLs both target the listener the browser actually used.
+     * Pass `null` to disable auto-connect.
+     */
+    autoConnectUrl?: string | null;
+    manufactChatUrl?: string | null;
+    /** Whether to enable the same-origin development sandbox (default `true`). */
+    devMode?: boolean;
+    /** Override the sandbox origin for MCP Apps widgets. */
+    sandboxOrigin?: string | null;
+    /** Explicit cross-origin callers of the OAuth BFF. Same-origin is implicit. */
+    oauthProxyAllowedOrigins?: readonly string[];
+    /** Allow OAuth and MCP proxy requests to loopback targets (default `true`). */
+    oauthProxyAllowLoopback?: boolean;
+    /**
+     * Server-wide MCP path prefix (default `/mcp`; `""` = root). The Inspector
+     * is served from `${basePath}/inspector` and its API from
+     * `${basePath}/inspector/api/*`.
+     */
+    basePath?: string;
+}
 /**
- * MCP Inspector - Middleware for mounting inspector UI on Express apps
+ * Create or mount the local MCP Inspector.
  *
- * This is the main entry point for importing the inspector as a library.
- * For standalone server usage, see cli.ts
+ * With options (or no arguments), this returns a framework-neutral Fetch
+ * handler. A development server can dispatch Inspector requests to this
+ * handler on its existing listener without starting a child process or a
+ * second port.
+ *
+ * Passing an Express or Hono app preserves the v1 mounting API. Hono routes
+ * are registered directly; Express receives a narrowly scoped adapter.
+ *
+ * The UI bundle is always served from this installed package. The same Hono
+ * route implementation owns the UI, MCP proxy, OAuth BFF, callback, health,
+ * and config routes in every integration.
+ *
+ * @example Framework-neutral, same-listener use
+ * ```typescript
+ * const inspector = mountInspector({
+ *   basePath: "/mcp",
+ *   autoConnectUrl: "http://localhost:3000/mcp",
+ * });
+ *
+ * const response = await inspector(request);
+ * ```
+ *
+ * @example Legacy Hono or Express mounting
+ * ```typescript
+ * mountInspector(app, {
+ *   basePath: "/mcp",
+ *   autoConnectUrl: "http://localhost:3000/mcp",
+ * });
+ * ```
+ */
+declare function mountInspector(options?: MountInspectorOptions): InspectorFetchHandler;
+declare function mountInspector(app: Express | Hono, options?: MountInspectorOptions): void;
+
+type InspectorProxyRoutesConfig = {
+    /** URL passed to the client via config.json for auto-connect. */
+    autoConnectUrl?: string | null;
+    /** Explicit cross-origin callers of the OAuth BFF. Same-origin is implicit. */
+    oauthProxyAllowedOrigins?: readonly string[];
+    /** Allow the OAuth BFF to reach loopback servers in local development. */
+    oauthProxyAllowLoopback?: boolean;
+    /** Mount OAuth BFF routes (default true). */
+    oauth?: boolean;
+};
+/**
+ * Register minimal inspector backend routes: health, MCP CORS proxy, OAuth BFF.
  */
-export { mountInspector } from "./middleware.js";
-export { registerInspectorProxyRoutes, type InspectorProxyRoutesConfig, } from "./proxy-routes.js";
-export { registerInspectorCdnShell, type CdnShellConfig, type InspectorMode, } from "./cdn-shell.js";
-//# sourceMappingURL=index.d.ts.map
+declare function registerInspectorProxyRoutes(app: Hono, config?: InspectorProxyRoutesConfig, basePath?: string): void;
+
+export { type InspectorFetchHandler, type InspectorProxyRoutesConfig, type MountInspectorOptions, mountInspector, registerInspectorProxyRoutes };

package/dist/server/index.js

@@ -1,23 +1,371 @@
-import {
-  mountInspector
-} from "./chunk-SQ4XNMLT.js";
-import {
-  registerInspectorCdnShell
-} from "./chunk-DSTNUYWX.js";
-import "./chunk-M5TZA42I.js";
-import "./chunk-ZCGLU5T7.js";
-import "./chunk-H6ZCIKBS.js";
-import {
-  registerInspectorProxyRoutes
-} from "./chunk-UJLXHNQP.js";
-import "./chunk-IKTZUWSX.js";
-import "./chunk-XCNS5CIW.js";
-import "./chunk-K2F2AJOI.js";
-import "./chunk-J4FNYLBF.js";
-import "./chunk-WFT4JHYI.js";
-import "./chunk-PKBMQBKP.js";
-export {
-  mountInspector,
-  registerInspectorCdnShell,
-  registerInspectorProxyRoutes
+var Jt=Object.create;var ke=Object.defineProperty;var Gt=Object.getOwnPropertyDescriptor;var Yt=Object.getOwnPropertyNames;var Xt=Object.getPrototypeOf,Qt=Object.prototype.hasOwnProperty;var z=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Zt=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of Yt(e))!Qt.call(t,o)&&o!==r&&ke(t,o,{get:()=>e[o],enumerable:!(n=Gt(e,o))||n.enumerable});return t};var er=(t,e,r)=>(r=t!=null?Jt(Xt(t)):{},Zt(e||!t||!t.__esModule?ke(r,"default",{value:t,enumerable:!0}):r,t));var st=z((Ho,ot)=>{"use strict";ot.exports=class{constructor(e={}){this.points=e.points,this.duration=e.duration,this.blockDuration=e.blockDuration,this.execEvenly=e.execEvenly,this.execEvenlyMinDelayMs=e.execEvenlyMinDelayMs,this.keyPrefix=e.keyPrefix}get points(){return this._points}set points(e){if(Number.isFinite(e))this._points=e;else throw new Error("points must be set and must be a finite number")}get duration(){return this._duration}set duration(e){if(typeof e=="number"&&Number.isFinite(e)&&e>=0)this._duration=e;else throw new Error("duration must be set and must be a finite, non-negative number")}get msDuration(){return this.duration*1e3}get blockDuration(){return this._blockDuration}set blockDuration(e){this._blockDuration=typeof e>"u"?0:e}get msBlockDuration(){return this.blockDuration*1e3}get execEvenly(){return this._execEvenly}set execEvenly(e){this._execEvenly=typeof e>"u"?!1:!!e}get execEvenlyMinDelayMs(){return this._execEvenlyMinDelayMs===void 0?this._getExecEvenlyMinDelayMsDefault():this._execEvenlyMinDelayMs}set execEvenlyMinDelayMs(e){this._execEvenlyMinDelayMs=e}_getExecEvenlyMinDelayMsDefault(){return this.points>0?Math.ceil(this.msDuration/this.points):0}get keyPrefix(){return this._keyPrefix}set keyPrefix(e){if(typeof e>"u"&&(e="rlflx"),typeof e!="string")throw new Error("keyPrefix must be string");this._keyPrefix=e}_getKeySecDuration(e={}){return e&&e.customDuration>=0?e.customDuration:this.duration}getKey(e){return this.keyPrefix.length>0?`${this.keyPrefix}:${e}`:e}parseKey(e){return this.keyPrefix.length>0?e.substring(this.keyPrefix.length+1):e}consume(){throw new Error("You have to implement the method 'consume'!")}penalty(){throw new Error("You have to implement the method 'penalty'!")}reward(){throw new Error("You have to implement the method 'reward'!")}get(){throw new Error("You have to implement the method 'get'!")}set(){throw new Error("You have to implement the method 'set'!")}block(){throw new Error("You have to implement the method 'block'!")}delete(){throw new Error("You have to implement the method 'delete'!")}}});var at=z((Bo,it)=>{"use strict";it.exports=class{constructor(e,r,n=null){this.value=e,this.expiresAt=r,this.timeoutId=n}get value(){return this._value}set value(e){this._value=parseInt(e,10)}get expiresAt(){return this._expiresAt}set expiresAt(e){e instanceof Date?this._expiresAt=e.getTime():this._expiresAt=e}get timeoutId(){return this._timeoutId}set timeoutId(e){this._timeoutId=e}}});var Re=z((Fo,ct)=>{"use strict";ct.exports=class{constructor(e,r,n,o){this.remainingPoints=typeof e>"u"?0:e,this.msBeforeNext=typeof r>"u"?0:r,this.consumedPoints=typeof n>"u"?0:n,this.isFirstInDuration=typeof o>"u"?!1:o}get msBeforeNext(){return this._msBeforeNext}set msBeforeNext(e){return this._msBeforeNext=e,this}get remainingPoints(){return this._remainingPoints}set remainingPoints(e){return this._remainingPoints=e,this}get consumedPoints(){return this._consumedPoints}set consumedPoints(e){return this._consumedPoints=e,this}get isFirstInDuration(){return this._isFirstInDuration}set isFirstInDuration(e){this._isFirstInDuration=!!e}_getDecoratedProperties(){return{remainingPoints:this.remainingPoints,msBeforeNext:this.msBeforeNext,consumedPoints:this.consumedPoints,isFirstInDuration:this.isFirstInDuration}}[Symbol.for("nodejs.util.inspect.custom")](){return this._getDecoratedProperties()}toString(){return JSON.stringify(this._getDecoratedProperties())}toJSON(){return this._getDecoratedProperties()}}});var dt=z((Wo,ut)=>{"use strict";var lt=at(),_e=Re();ut.exports=class{constructor(){this._storage=new Map}incrby(e,r,n){let o=this._storage.get(e);if(o){let s=o.expiresAt?o.expiresAt-Date.now():-1;return!o.expiresAt||s>0?(o.value=o.value+r,new _e(0,s,o.value,!1)):this.set(e,r,n)}return this.set(e,r,n)}set(e,r,n){let o=n*1e3,s=this._storage.get(e);s&&s.timeoutId&&clearTimeout(s.timeoutId);let i=new lt(r,o>0?Date.now()+o:null);return this._storage.set(e,i),o>0&&(i.timeoutId=setTimeout(()=>{this._storage.delete(e)},o),i.timeoutId.unref&&i.timeoutId.unref()),new _e(0,o===0?-1:o,i.value,!0)}get(e){let r=this._storage.get(e);if(r){let n=r.expiresAt?r.expiresAt-Date.now():-1;return new _e(0,n,r.value,!1)}return null}delete(e){let r=this._storage.get(e);return r?(r.timeoutId&&clearTimeout(r.timeoutId),this._storage.delete(e),!0):!1}_restoreRecord(e,r,n){let o=Date.now(),s=n!==null;if(s&&!Number.isFinite(n)||s&&n<=o)return;let i=s?n-o:0,a=this._storage.get(e);a&&a.timeoutId&&clearTimeout(a.timeoutId);let c=new lt(r,n);this._storage.set(e,c),i>0&&(c.timeoutId=setTimeout(()=>{this._storage.delete(e)},i),c.timeoutId.unref&&c.timeoutId.unref())}}});var ft=z((Vo,ht)=>{"use strict";var yr=st(),wr=dt(),pt=Re(),Ee=class extends yr{constructor(e={}){super(e),this._memoryStorage=new wr}consume(e,r=1,n={}){return new Promise((o,s)=>{let i=this.getKey(e),a=this._getKeySecDuration(n),c=this._memoryStorage.incrby(i,r,a);if(c.remainingPoints=Math.max(this.points-c.consumedPoints,0),c.consumedPoints>this.points)this.blockDuration>0&&c.consumedPoints<=this.points+r&&(c=this._memoryStorage.set(i,c.consumedPoints,this.blockDuration)),s(c);else if(this.execEvenly&&this.points>0&&c.msBeforeNext>0&&!c.isFirstInDuration){let l=Math.ceil(c.msBeforeNext/(c.remainingPoints+2));l<this.execEvenlyMinDelayMs&&(l=c.consumedPoints*this.execEvenlyMinDelayMs),c.msBeforeNext=Math.max(c.msBeforeNext-l,0),setTimeout(o,l,c)}else o(c)})}penalty(e,r=1,n={}){let o=this.getKey(e);return new Promise(s=>{let i=this._getKeySecDuration(n),a=this._memoryStorage.incrby(o,r,i);a.remainingPoints=Math.max(this.points-a.consumedPoints,0),s(a)})}reward(e,r=1,n={}){let o=this.getKey(e);return new Promise(s=>{let i=this._getKeySecDuration(n),a=this._memoryStorage.incrby(o,-r,i);a.remainingPoints=Math.max(this.points-a.consumedPoints,0),s(a)})}block(e,r){let n=r*1e3,o=this.points+1;return this._memoryStorage.set(this.getKey(e),o,r),Promise.resolve(new pt(0,n===0?-1:n,o))}set(e,r,n){let o=(n>=0?n:this.duration)*1e3;return this._memoryStorage.set(this.getKey(e),r,n),Promise.resolve(new pt(0,o===0?-1:o,r))}get(e){let r=this._memoryStorage.get(this.getKey(e));return r!==null&&(r.remainingPoints=Math.max(this.points-r.consumedPoints,0)),Promise.resolve(r)}delete(e){return Promise.resolve(this._memoryStorage.delete(this.getKey(e)))}dump(){let e=[];for(let[r,n]of this._memoryStorage._storage)e.push({key:this.parseKey(r),value:n.value,expiresAt:n.expiresAt});return{version:1,dumpedAt:Date.now(),storage:e}}restore(e,r=!1){if(!e||typeof e!="object"||e.version!==1)return;let n=r?{invalid:{count:0,keys:[]},expired:{count:0,keys:[]},restored:{count:0,keys:[]}}:{invalid:0,expired:0,restored:0},o=(s,i)=>{r?(n[s].count+=1,n[s].keys.push(i)):n[s]+=1};if(!Array.isArray(e.storage))return n;for(let s of e.storage){if(!s||typeof s!="object"){o("invalid","N/A");continue}let i=typeof s.key=="string"||typeof s.key=="number",a=Number.isFinite(s.value),c=s.expiresAt===null||Number.isFinite(s.expiresAt);if(!i||!a||!c){o("invalid",s.key);continue}if(s.expiresAt!==null&&s.expiresAt<=Date.now()){o("expired",s.key);continue}this._memoryStorage._restoreRecord(this.getKey(s.key),s.value,s.expiresAt),o("restored",s.key)}return n}};ht.exports=Ee});var le=(t,e,r)=>(n,o)=>{let s=-1;return i(0);async function i(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,u;if(t[a]?(u=t[a][0][0],n.req.routeIndex=a):u=a===t.length&&o||void 0,u)try{c=await u(n,()=>i(a+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var De=Symbol();var Ue=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,s=(t instanceof Y?t.raw.headers:t.headers).get("Content-Type");return s?.startsWith("multipart/form-data")||s?.startsWith("application/x-www-form-urlencoded")?tr(t,{all:r,dot:n}):{}};async function tr(t,e){let r=await t.formData();return r?rr(r,e):{}}function rr(t,e){let r=Object.create(null);return t.forEach((n,o)=>{e.all||o.endsWith("[]")?nr(r,o,n):r[o]=n}),e.dot&&Object.entries(r).forEach(([n,o])=>{n.includes(".")&&(or(r,n,o),delete r[n])}),r}var nr=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},or=(t,e,r)=>{if(/(?:^|\.)__proto__\./.test(e))return;let n=t,o=e.split(".");o.forEach((s,i)=>{i===o.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var de=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},je=t=>{let{groups:e,path:r}=sr(t),n=de(r);return ir(n,e)},sr=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let o=`@${n}`;return e.push([o,r]),o}),{groups:e,path:t}},ir=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let o=t.length-1;o>=0;o--)if(t[o].includes(n)){t[o]=t[o].replace(n,e[r][1]);break}}return t},X={},Ne=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return X[n]||(r[2]?X[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:X[n]=[t,r[1],!0]),X[n]}return null},Q=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},ar=t=>Q(t,decodeURI),pe=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let o=e.charCodeAt(n);if(o===37){let s=e.indexOf("?",n),i=e.indexOf("#",n),a=s===-1?i===-1?void 0:i:i===-1?s:Math.min(s,i),c=e.slice(r,a);return ar(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(o===63||o===35)break}return e.slice(r,n)};var He=t=>{let e=pe(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},k=(t,e,...r)=>(r.length&&(e=k(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),Z=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(o=>{if(o!==""&&!/\:/.test(o))n+="/"+o;else if(/\:/.test(o))if(/\?/.test(o)){r.length===0&&n===""?r.push("/"):r.push(n);let s=o.replace("?","");n+="/"+s,r.push(n)}else n+="/"+o}),r.filter((o,s,i)=>i.indexOf(o)===s)},ue=t=>/[%+]/.test(t)?(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),t.indexOf("%")!==-1?Q(t,he):t):t,$e=(t,e,r)=>{let n;if(!r&&e&&!/[%+]/.test(e)){let i=t.indexOf("?",8);if(i===-1)return;for(t.startsWith(e,i+1)||(i=t.indexOf(`&${e}`,i+1));i!==-1;){let a=t.charCodeAt(i+e.length+1);if(a===61){let c=i+e.length+2,l=t.indexOf("&",c);return ue(t.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";i=t.indexOf(`&${e}`,i+1)}if(n=/[%+]/.test(t),!n)return}let o={};n??=/[%+]/.test(t);let s=t.indexOf("?",8);for(;s!==-1;){let i=t.indexOf("&",s+1),a=t.indexOf("=",s);a>i&&i!==-1&&(a=-1);let c=t.slice(s+1,a===-1?i===-1?void 0:i:a);if(n&&(c=ue(c)),s=i,c==="")continue;let l;a===-1?l="":(l=t.slice(a+1,i===-1?void 0:i),n&&(l=ue(l))),r?(o[c]&&Array.isArray(o[c])||(o[c]=[]),o[c].push(l)):o[c]??=l}return e?o[e]:o},Be=$e,qe=(t,e)=>$e(t,e,!0),he=decodeURIComponent;var Fe=t=>Q(t,he),Y=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#e=r,this.#t={}}param(t){return t?this.#r(t):this.#s()}#r(t){let e=this.#e[0][this.routeIndex][1][t],r=this.#o(e);return r&&/\%/.test(r)?Fe(r):r}#s(){let t={},e=Object.keys(this.#e[0][this.routeIndex][1]);for(let r of e){let n=this.#o(this.#e[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=/\%/.test(n)?Fe(n):n)}return t}#o(t){return this.#e[1]?this.#e[1][t]:t}query(t){return Be(this.url,t)}queries(t){return qe(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e={};return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return Ue(this,t)}#n=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;let o=Object.keys(e)[0];return o?e[o].then(s=>(o==="json"&&(s=JSON.stringify(s)),new Response(s)[t]())):e[t]=r[t]()};json(){return this.#n("text").then(t=>JSON.parse(t))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(t,e){this.#t[t]=e}valid(t){return this.#t[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[De](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,t]])=>t)}get routePath(){return this.#e[0].map(([[,t]])=>t)[this.routeIndex].path}};var ze={Stringify:1,BeforeStream:2,Stream:3},cr=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var fe=async(t,e,r,n,o)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let s=t.callbacks;if(!s?.length)return Promise.resolve(t);o?o[0]+=t:o=[t];let i=Promise.all(s.map(a=>a({phase:e,buffer:o,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>fe(c,e,!1,n,o))).then(()=>o[0]));return r?cr(await i,s):i};var lr="text/plain; charset=UTF-8",me=(t,e)=>({"Content-Type":t,...e}),W=(t,e)=>new Response(t,e),ge=class{#t;#e;env={};#r;finalized=!1;error;#s;#o;#n;#u;#c;#l;#a;#d;#p;constructor(t,e){this.#t=t,e&&(this.#o=e.executionCtx,this.env=e.env,this.#l=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#e??=new Y(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#o&&"respondWith"in this.#o)return this.#o;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#o)return this.#o;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=W(null,{headers:this.#a??=new Headers})}set res(t){if(this.#n&&t){t=W(t.body,t);for(let[e,r]of this.#n.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#n.headers.getSetCookie();t.headers.delete("set-cookie");for(let o of n)t.headers.append("set-cookie",o)}else t.headers.set(e,r)}this.#n=t,this.finalized=!0}render=(...t)=>(this.#c??=e=>this.html(e),this.#c(...t));setLayout=t=>this.#u=t;getLayout=()=>this.#u;setRenderer=t=>{this.#c=t};header=(t,e,r)=>{this.finalized&&(this.#n=W(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#a??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#s=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#i(t,e,r){let n=this.#n?new Headers(this.#n.headers):this.#a??new Headers;if(typeof e=="object"&&"headers"in e){let s=e.headers instanceof Headers?e.headers:new Headers(e.headers);for(let[i,a]of s)i.toLowerCase()==="set-cookie"?n.append(i,a):n.set(i,a)}if(r)for(let[s,i]of Object.entries(r))if(typeof i=="string")n.set(s,i);else{n.delete(s);for(let a of i)n.append(s,a)}let o=typeof e=="number"?e:e?.status??this.#s;return W(t,{status:o,headers:n})}newResponse=(...t)=>this.#i(...t);body=(t,e,r)=>this.#i(t,e,r);text=(t,e,r)=>!this.#a&&!this.#s&&!e&&!r&&!this.finalized?new Response(t):this.#i(t,e,me(lr,r));json=(t,e,r)=>this.#i(JSON.stringify(t),e,me("application/json",r));html=(t,e,r)=>{let n=o=>this.#i(o,e,me("text/html; charset=UTF-8",r));return typeof t=="object"?fe(t,ze.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#l??=()=>W(),this.#l(this))};var v="ALL",We="all",Ve=["get","post","put","delete","options","patch"],ee="Can not add a route since the matcher is already built.",te=class extends Error{};var Ke="__COMPOSED_HANDLER";var ur=t=>t.text("404 Not Found",404),Je=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},Ge=class Ye{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(e={}){[...Ve,We].forEach(s=>{this[s]=(i,...a)=>(typeof i=="string"?this.#t=i:this.#s(s,this.#t,i),a.forEach(c=>{this.#s(s,this.#t,c)}),this)}),this.on=(s,i,...a)=>{for(let c of[i].flat()){this.#t=c;for(let l of[s].flat())a.map(u=>{this.#s(l.toUpperCase(),this.#t,u)})}return this},this.use=(s,...i)=>(typeof s=="string"?this.#t=s:(this.#t="*",i.unshift(s)),i.forEach(a=>{this.#s(v,this.#t,a)}),this);let{strict:n,...o}=e;Object.assign(this,o),this.getPath=n??!0?e.getPath??pe:He}#e(){let e=new Ye({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=ur;errorHandler=Je;route(e,r){let n=this.basePath(e);return r.routes.map(o=>{let s;r.errorHandler===Je?s=o.handler:(s=async(i,a)=>(await le([],r.errorHandler)(i,()=>o.handler(i,a))).res,s[Ke]=o.handler),n.#s(o.method,o.path,s,o.basePath)}),this}basePath(e){let r=this.#e();return r._basePath=k(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let o,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?o=c=>c:o=n.replaceRequest));let i=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};o||=(()=>{let c=k(this._basePath,e),l=c==="/"?0:c.length;return u=>{let p=new URL(u.url);return p.pathname=this.getPath(u).slice(l)||"/",new Request(p,u)}})();let a=async(c,l)=>{let u=await r(o(c.req.raw),...i(c));if(u)return u;await l()};return this.#s(v,k(e,"*"),a),this}#s(e,r,n,o){e=e.toUpperCase(),r=k(this._basePath,r);let s={basePath:o!==void 0?k(this._basePath,o):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,s]),this.routes.push(s)}#o(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#n(e,r,n,o){if(o==="HEAD")return(async()=>new Response(null,await this.#n(e,r,n,"GET")))();let s=this.getPath(e,{env:n}),i=this.router.match(o,s),a=new ge(e,{path:s,matchResult:i,env:n,executionCtx:r,notFoundHandler:this.#r});if(i[0].length===1){let l;try{l=i[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#o(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#o(u,a)):l??this.#r(a)}let c=le(i[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#o(l,a)}})()}fetch=(e,...r)=>this.#n(e,r[1],r[0],e.method);request=(e,r,n,o)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,o):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${k("/",e)}`,r),n,o));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#n(e.request,e,void 0,e.request.method))})}};var re=[];function ye(t,e){let r=this.buildAllMatchers(),n=((o,s)=>{let i=r[o]||r[v],a=i[2][s];if(a)return a;let c=s.match(i[0]);if(!c)return[[],re];let l=c.indexOf("",1);return[i[1][l],c]});return this.match=n,n(t,e)}var ne="[^/]+",V=".*",K="(?:|/.*)",H=Symbol(),dr=new Set(".\\+*[^]$()");function pr(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1||t===V||t===K?1:e===V||e===K?-1:t===ne?1:e===ne?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var Xe=class we{#t;#e;#r=Object.create(null);insert(e,r,n,o,s){if(e.length===0){if(this.#t!==void 0)throw H;if(s)return;this.#t=r;return}let[i,...a]=e,c=i==="*"?a.length===0?["","",V]:["","",ne]:i==="/*"?["","",K]:i.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),l;if(c){let u=c[1],p=c[2]||ne;if(u&&c[2]&&(p===".*"||(p=p.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(p))))throw H;if(l=this.#r[p],!l){if(Object.keys(this.#r).some(h=>h!==V&&h!==K))throw H;if(s)return;l=this.#r[p]=new we,u!==""&&(l.#e=o.varIndex++)}!s&&u!==""&&n.push([u,l.#e])}else if(l=this.#r[i],!l){if(Object.keys(this.#r).some(u=>u.length>1&&u!==V&&u!==K))throw H;if(s)return;l=this.#r[i]=new we}l.insert(a,r,n,o,s)}buildRegExpStr(){let r=Object.keys(this.#r).sort(pr).map(n=>{let o=this.#r[n];return(typeof o.#e=="number"?`(${n})@${o.#e}`:dr.has(n)?`\\${n}`:n)+o.buildRegExpStr()});return typeof this.#t=="number"&&r.unshift(`#${this.#t}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var Qe=class{#t={varIndex:0};#e=new Xe;insert(t,e,r){let n=[],o=[];for(let i=0;;){let a=!1;if(t=t.replace(/\{[^}]+\}/g,c=>{let l=`@\\${i}`;return o[i]=[l,c],i++,a=!0,l}),!a)break}let s=t.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=o.length-1;i>=0;i--){let[a]=o[i];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,o[i][1]);break}}return this.#e.insert(s,e,n,this.#t,r),n}buildRegExp(){let t=this.#e.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(o,s,i)=>s!==void 0?(r[++e]=Number(s),"$()"):(i!==void 0&&(n[Number(i)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var hr=[/^$/,[],Object.create(null)],Ze=Object.create(null);function et(t){return Ze[t]??=new RegExp(t==="*"?"":`^${t.replace(/\/\*$|([.\\+*[^\]$()])/g,(e,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function fr(){Ze=Object.create(null)}function mr(t){let e=new Qe,r=[];if(t.length===0)return hr;let n=t.map(l=>[!/\*|\/:/.test(l[0]),...l]).sort(([l,u],[p,h])=>l?1:p?-1:u.length-h.length),o=Object.create(null);for(let l=0,u=-1,p=n.length;l<p;l++){let[h,f,y]=n[l];h?o[f]=[y.map(([g])=>[g,Object.create(null)]),re]:u++;let w;try{w=e.insert(f,u,h)}catch(g){throw g===H?new te(f):g}h||(r[u]=y.map(([g,d])=>{let m=Object.create(null);for(d-=1;d>=0;d--){let[x,C]=w[d];m[x]=C}return[g,m]}))}let[s,i,a]=e.buildRegExp();for(let l=0,u=r.length;l<u;l++)for(let p=0,h=r[l].length;p<h;p++){let f=r[l][p]?.[1];if(!f)continue;let y=Object.keys(f);for(let w=0,g=y.length;w<g;w++)f[y[w]]=a[f[y[w]]]}let c=[];for(let l in i)c[l]=r[i[l]];return[s,c,o]}function q(t,e){if(t){for(let r of Object.keys(t).sort((n,o)=>o.length-n.length))if(et(r).test(e))return[...t[r]]}}var oe=class{name="RegExpRouter";#t;#e;constructor(){this.#t={[v]:Object.create(null)},this.#e={[v]:Object.create(null)}}add(t,e,r){let n=this.#t,o=this.#e;if(!n||!o)throw new Error(ee);n[t]||[n,o].forEach(a=>{a[t]=Object.create(null),Object.keys(a[v]).forEach(c=>{a[t][c]=[...a[v][c]]})}),e==="/*"&&(e="*");let s=(e.match(/\/:/g)||[]).length;if(/\*$/.test(e)){let a=et(e);t===v?Object.keys(n).forEach(c=>{n[c][e]||=q(n[c],e)||q(n[v],e)||[]}):n[t][e]||=q(n[t],e)||q(n[v],e)||[],Object.keys(n).forEach(c=>{(t===v||t===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(o).forEach(c=>{(t===v||t===c)&&Object.keys(o[c]).forEach(l=>a.test(l)&&o[c][l].push([r,s]))});return}let i=Z(e)||[e];for(let a=0,c=i.length;a<c;a++){let l=i[a];Object.keys(o).forEach(u=>{(t===v||t===u)&&(o[u][l]||=[...q(n[u],l)||q(n[v],l)||[]],o[u][l].push([r,s-c+a+1]))})}}match=ye;buildAllMatchers(){let t=Object.create(null);return Object.keys(this.#e).concat(Object.keys(this.#t)).forEach(e=>{t[e]||=this.#r(e)}),this.#t=this.#e=void 0,fr(),t}#r(t){let e=[],r=t===v;return[this.#t,this.#e].forEach(n=>{let o=n[t]?Object.keys(n[t]).map(s=>[s,n[t][s]]):[];o.length!==0?(r||=!0,e.push(...o)):t!==v&&e.push(...Object.keys(n[v]).map(s=>[s,n[v][s]]))}),r?mr(e):null}};var be=class{name="SmartRouter";#t=[];#e=[];constructor(t){this.#t=t.routers}add(t,e,r){if(!this.#e)throw new Error(ee);this.#e.push([t,e,r])}match(t,e){if(!this.#e)throw new Error("Fatal error");let r=this.#t,n=this.#e,o=r.length,s=0,i;for(;s<o;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);i=a.match(t,e)}catch(c){if(c instanceof te)continue;throw c}this.match=a.match.bind(a),this.#t=[a],this.#e=void 0;break}if(s===o)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};var J=Object.create(null),gr=t=>{for(let e in t)return!0;return!1},tt=class rt{#t;#e;#r;#s=0;#o=J;constructor(e,r,n){if(this.#e=n||Object.create(null),this.#t=[],e&&r){let o=Object.create(null);o[e]={handler:r,possibleKeys:[],score:0},this.#t=[o]}this.#r=[]}insert(e,r,n){this.#s=++this.#s;let o=this,s=je(r),i=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],u=s[a+1],p=Ne(l,u),h=Array.isArray(p)?p[0]:l;if(h in o.#e){o=o.#e[h],p&&i.push(p[1]);continue}o.#e[h]=new rt,p&&(o.#r.push(p),i.push(p[1])),o=o.#e[h]}return o.#t.push({[e]:{handler:n,possibleKeys:i.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),o}#n(e,r,n,o,s){for(let i=0,a=r.#t.length;i<a;i++){let c=r.#t[i],l=c[n]||c[v],u={};if(l!==void 0&&(l.params=Object.create(null),e.push(l),o!==J||s&&s!==J))for(let p=0,h=l.possibleKeys.length;p<h;p++){let f=l.possibleKeys[p],y=u[l.score];l.params[f]=s?.[f]&&!y?s[f]:o[f]??s?.[f],u[l.score]=!0}}}search(e,r){let n=[];this.#o=J;let s=[this],i=de(r),a=[],c=i.length,l=null;for(let u=0;u<c;u++){let p=i[u],h=u===c-1,f=[];for(let w=0,g=s.length;w<g;w++){let d=s[w],m=d.#e[p];m&&(m.#o=d.#o,h?(m.#e["*"]&&this.#n(n,m.#e["*"],e,d.#o),this.#n(n,m,e,d.#o)):f.push(m));for(let x=0,C=d.#r.length;x<C;x++){let O=d.#r[x],_=d.#o===J?{}:{...d.#o};if(O==="*"){let P=d.#e["*"];P&&(this.#n(n,P,e,d.#o),P.#o=_,f.push(P));continue}let[E,A,R]=O;if(!p&&!(R instanceof RegExp))continue;let b=d.#e[E];if(R instanceof RegExp){if(l===null){l=new Array(c);let U=r[0]==="/"?1:0;for(let j=0;j<c;j++)l[j]=U,U+=i[j].length+1}let P=r.substring(l[u]),M=R.exec(P);if(M){if(_[A]=M[0],this.#n(n,b,e,d.#o,_),gr(b.#e)){b.#o=_;let U=M[0].match(/\//)?.length??0;(a[U]||=[]).push(b)}continue}}(R===!0||R.test(p))&&(_[A]=p,h?(this.#n(n,b,e,_,d.#o),b.#e["*"]&&this.#n(n,b.#e["*"],e,_,d.#o)):(b.#o=_,f.push(b)))}}let y=a.shift();s=y?f.concat(y):f}return n.length>1&&n.sort((u,p)=>u.score-p.score),[n.map(({handler:u,params:p})=>[u,p])]}};var xe=class{name="TrieRouter";#t;constructor(){this.#t=new tt}add(t,e,r){let n=Z(e);if(n){for(let o=0,s=n.length;o<s;o++)this.#t.insert(t,n[o],r);return}this.#t.insert(t,e,r)}match(t,e){return this.#t.search(t,e)}};var ve=class extends Ge{constructor(t={}){super(t),this.router=t.router??new be({routers:[new oe,new xe]})}};import{Readable as cn}from"stream";function nt(t=""){return`<link rel="icon" type="image/svg+xml" href="${`${t.replace(/\/$/,"")}/favicon-black.svg?v=4`}" />`}import{existsSync as mt,readFileSync as vr}from"fs";import I from"path";import{fileURLToPath as Rr}from"url";import{gunzipSync as _r}from"zlib";var T=er(ft(),1);function F(t,e){return t.header("Retry-After",String(br(e))),t.json({error:"Too Many Requests"},429)}function br(t){return t&&typeof t=="object"&&"msBeforeNext"in t&&typeof t.msBeforeNext=="number"&&Number.isFinite(t.msBeforeNext)?Math.max(1,Math.ceil(t.msBeforeNext/1e3)):60}var Er={".js":"application/javascript",".css":"text/css",".svg":"image/svg+xml",".png":"image/png",".ico":"image/x-icon",".webmanifest":"application/manifest+json"};function Pr(){let t=I.dirname(Rr(import.meta.url));for(let e of[I.resolve(t,"app"),I.resolve(t,"../app"),I.resolve(t,"../../dist/app")])if(mt(I.join(e,"inspector.js.gz")))return e;throw new Error("Inspector bundle not found (expected dist/app/inspector.js.gz)")}function gt(t,e="/inspector/assets"){let r=Pr(),n=new Map,o=new T.default({points:600,duration:60}),s=async(i,a)=>{try{await o.consume(i.req)}catch(c){return F(i,c)}return a()};t.use(`${e}/*`,s),t.get(`${e}/*`,async i=>{let a=i.req.path.slice(e.length),c=a.startsWith("/")?a.slice(1):a;if(!c||c.includes(".."))return i.notFound();let l=c==="inspector.js"||c==="inspector.css"?`${c}.gz`:c,u=I.resolve(r,l),p=r.endsWith(I.sep)?r:`${r}${I.sep}`;if(!u.startsWith(p)||!mt(u))return i.notFound();let h=I.extname(c),f=l.endsWith(".gz"),y=/(?:^|,)\s*gzip\s*(?:,|$)/i.test(i.req.header("accept-encoding")??""),w=vr(u),g=f&&!y?n.get(u)??Ar(n,u,w):w,d=g.buffer.slice(g.byteOffset,g.byteOffset+g.byteLength);return i.body(d,200,{"Content-Type":Er[h]??"application/octet-stream",...f&&y?{"Content-Encoding":"gzip"}:{},...f?{Vary:"Accept-Encoding"}:{},"Cache-Control":"no-cache"})})}function Ar(t,e,r){let n=_r(r);return t.set(e,n),n}var yt={name:"@mcp-use/inspector",type:"module",version:"20.0.0-beta.50",description:"MCP Inspector - A tool for inspecting and debugging MCP servers",author:"",license:"MIT",homepage:"https://github.com/mcp-use/mcp-use#readme",repository:{type:"git",url:"git+https://github.com/mcp-use/mcp-use.git",directory:"libraries/typescript/packages/inspector"},bugs:{url:"https://github.com/mcp-use/mcp-use/issues"},keywords:["mcp","inspector","debug","tools"],exports:{".":{types:"./dist/server/index.d.ts",import:"./dist/server/index.js"},"./client":{types:"./dist/client/index.d.ts",import:"./dist/client/index.js"}},main:"./dist/server/index.js",types:"./dist/server/index.d.ts",bin:{"mcp-inspect":"./dist/cli.js"},files:["dist"],scripts:{dev:"rimraf node_modules/.vite && VITE_MANUFACT_CHAT_URL=${VITE_MANUFACT_CHAT_URL:-http://localhost:8000/api/v1/inspector/chat/stream} vite --strictPort","dev:client":"pnpm run dev","dev:server":"VITE_DEV=true tsx watch src/server/server.ts","dev:standalone":"tsx watch src/server/server.ts",clean:"rimraf dist",build:"npm run clean && npm run build:client-exports && npm run build:server && npm run build:app && npm run verify:package","build:app":"vite build --config vite.app.config.ts && node scripts/compress-app.mjs","watch:app":"vite build --watch --config vite.app.config.ts","preview:app":"vite preview --config vite.app.config.ts --host 127.0.0.1","serve:app":"pnpm build:app && pnpm preview:app","analyze:app":"ANALYZE=true vite build --config vite.app.config.ts","build:client-exports":"tsup --config tsup.client.ts","build:server":"tsup --config tsup.server.ts","verify:package":"node scripts/verify-package.mjs",prepublishOnly:"pnpm --filter @mcp-use/client build && pnpm build",start:"node dist/cli.js --port 3000",preview:"vite preview","type-check":"tsc --noEmit",lint:"eslint .","lint:fix":"eslint . --fix","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:e2e:debug":"playwright test --debug","test:e2e:builtin":"node tests/e2e/scripts/run-test-matrix.mjs builtin","test:e2e:prod":"node tests/e2e/scripts/run-test-matrix.mjs prod","test:e2e:mix":"node tests/e2e/scripts/run-test-matrix.mjs mix","test:e2e:prod:ui":"TEST_MODE=production playwright test --ui","test:e2e:codegen":"playwright codegen http://localhost:3000/inspector","test:e2e:report":"playwright show-report","test:e2e:python":"node tests/e2e/scripts/run-python-e2e.mjs","test:unit":"vitest run","test:unit:watch":"vitest","test:e2e:tunnel":"node tests/e2e/scripts/run-tunnel-test.mjs","install:pnpm":"pnpm install","install:npm":"npm install","lint:npm":"npm run lint:fix","lint:pnpm":"pnpm lint:fix"},engines:{node:">=22.22.2"},peerDependencies:{"@base-ui/react":"^1.6.0","@mcp-use/agent":"^2.0.0-alpha.0","@mcp-use/client":"^2.0.0-alpha.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",express:"^4.21.2 || ^5.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4","mcp-use":"workspace:*",motion:"^12.34.2",react:"^18.0.0 || ^19.0.0","react-dom":"^18.0.0 || ^19.0.0","react-resizable-panels":"^4.6.4",sonner:"^2.0.7","tailwind-merge":"^3.5.0"},peerDependenciesMeta:{"@base-ui/react":{optional:!0},"@mcp-use/agent":{optional:!0},"@mcp-use/client":{optional:!0},"class-variance-authority":{optional:!0},clsx:{optional:!0},express:{optional:!0},"lucide-react":{optional:!0},"markdown-to-jsx":{optional:!0},motion:{optional:!0},react:{optional:!0},"react-dom":{optional:!0},"react-resizable-panels":{optional:!0},sonner:{optional:!0},"tailwind-merge":{optional:!0}},dependencies:{},publishConfig:{access:"public"},devDependencies:{"@base-ui/react":"^1.6.0","@hono/node-server":"^1.19.13","@mcp-use/agent":"workspace:*","@mcp-use/client":"workspace:*","@playwright/test":"^1.58.2","@tailwindcss/vite":"^4.2.0","@types/express":"^5.0.6","@vitejs/plugin-react":"^6.0.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",emulate:"0.5.0",eslint:"^9.39.2",express:"^5.2.1",hono:"^4.12.12","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4",motion:"^12.34.2","oauth2-mock-server":"^8.2.2",open:"^11.0.0",react:"^19.2.3","react-dom":"^19.2.3","react-router":"^7.12.0","react-resizable-panels":"^4.6.4","rate-limiter-flexible":"^11.2.0","rollup-plugin-visualizer":"^6.0.3",sonner:"^2.0.7","tailwind-merge":"^3.5.0",tailwindcss:"^4.2.0",tsup:"^8.5.1",tsx:"^4.21.0","tw-animate-css":"^1.4.0",typescript:"^5.9.3",vite:"^8.0.16",vitest:"^4.1.0","wait-on":"^9.0.4",zod:"^4.2.0"}};var Cr=yt.version;function wt(){return Cr}var Or=`<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; img-src * data: blob: 'unsafe-inline'; media-src * blob: data:; font-src * blob: data:; script-src * 'wasm-unsafe-eval' 'unsafe-inline' 'unsafe-eval' blob: data:; style-src * blob: data: 'unsafe-inline'; connect-src * data: blob: about:; frame-src * blob: data: http://localhost:* https://localhost:* http://127.0.0.1:* https://127.0.0.1:*;"
+    />
+    <title>MCP Apps Sandbox Proxy</title>
+    <style>
+      html, body { margin: 0; padding: 0; height: 100%; width: 100%; overflow: hidden; }
+      * { box-sizing: border-box; }
+      iframe { display: block; background-color: transparent; border: 0px none transparent; padding: 0px; width: 100%; height: 100%; }
+    </style>
+  </head>
+  <body>
+    <script>
+      function sanitizeDomain(domain) {
+        if (typeof domain !== "string") return "";
+        return domain.replace(/['"<>;]/g, "").trim();
+      }
+
+      function buildAllowAttribute(permissions) {
+        if (!permissions) return "";
+        const allowList = [];
+        if (permissions.camera) allowList.push("camera *");
+        if (permissions.microphone) allowList.push("microphone *");
+        if (permissions.geolocation) allowList.push("geolocation *");
+        if (permissions.clipboardWrite) allowList.push("clipboard-write *");
+        return allowList.join("; ");
+      }
+
+      function buildCSP(csp) {
+        if (!csp) {
+          return [
+            "default-src 'none'",
+            "script-src 'unsafe-inline'",
+            "style-src 'unsafe-inline'",
+            "img-src data:",
+            "font-src data:",
+            "media-src data:",
+            "connect-src 'none'",
+            "frame-src 'none'",
+            "object-src 'none'",
+            "base-uri 'none'",
+          ].join("; ");
+        }
+
+        const connectDomains = (csp.connectDomains || []).map(sanitizeDomain).filter(Boolean);
+        const resourceDomains = (csp.resourceDomains || []).map(sanitizeDomain).filter(Boolean);
+        const frameDomains = (csp.frameDomains || []).map(sanitizeDomain).filter(Boolean);
+        const baseUriDomains = (csp.baseUriDomains || []).map(sanitizeDomain).filter(Boolean);
+        const scriptDirectives = (csp.scriptDirectives || []).filter(function(d) { return typeof d === "string" && d.length > 0; });
+
+        const connectSrc = connectDomains.length > 0 ? connectDomains.join(" ") : "'none'";
+        const resourceSrc = resourceDomains.length > 0 ? ["data:", "blob:", ...resourceDomains].join(" ") : "data: blob:";
+        const frameSrc = frameDomains.length > 0 ? frameDomains.join(" ") : "'none'";
+        const baseUri = baseUriDomains.length > 0 ? baseUriDomains.join(" ") : "'none'";
+        const scriptSrcParts = ["'unsafe-inline'", resourceSrc];
+        if (scriptDirectives.length > 0) scriptSrcParts.push(scriptDirectives.join(" "));
+
+        return [
+          "default-src 'none'",
+          "script-src " + scriptSrcParts.join(" "),
+          "style-src 'unsafe-inline' " + resourceSrc,
+          "img-src " + resourceSrc,
+          "font-src " + resourceSrc,
+          "media-src " + resourceSrc,
+          "connect-src " + connectSrc,
+          "frame-src " + frameSrc,
+          "object-src 'none'",
+          "base-uri " + baseUri,
+        ].join("; ");
+      }
+
+      function buildViolationListenerScript() {
+        return \`<script>
+document.addEventListener('securitypolicyviolation', function(e) {
+  var violation = {
+    type: 'mcp-apps:csp-violation',
+    directive: e.violatedDirective,
+    blockedUri: e.blockedURI,
+    sourceFile: e.sourceFile || null,
+    lineNumber: e.lineNumber || null,
+    columnNumber: e.columnNumber || null,
+    effectiveDirective: e.effectiveDirective,
+    originalPolicy: e.originalPolicy,
+    disposition: e.disposition,
+    timestamp: Date.now()
+  };
+  console.warn('[MCP Apps CSP Violation]', violation.directive, ':', violation.blockedUri);
+  window.parent.postMessage(violation, '*');
+});
+
+function serializeConsoleArgs(args) {
+  try {
+    return Array.from(args || []).map(function(arg) {
+      if (arg instanceof Error) {
+        return {
+          type: 'Error',
+          message: arg.message,
+          stack: arg.stack,
+          name: arg.name,
+        };
+      }
+      if (typeof arg === 'object' && arg !== null) {
+        try {
+          return JSON.parse(JSON.stringify(arg));
+        } catch (e) {
+          return String(arg);
+        }
+      }
+      return arg;
+    });
+  } catch (e) {
+    return [String(args)];
+  }
+}
+
+function sendConsoleToParent(level, args) {
+  try {
+    window.parent.postMessage({
+      type: 'iframe-console-log',
+      level: level,
+      args: serializeConsoleArgs(args),
+      timestamp: new Date().toISOString(),
+      url: window.location.href,
+    }, '*');
+  } catch (e) {}
+}
+
+var originalConsoleError = console.error.bind(console);
+console.error = function() {
+  var args = Array.from(arguments);
+  originalConsoleError.apply(console, args);
+  sendConsoleToParent('error', args);
 };
+
+window.addEventListener('error', function(event) {
+  sendConsoleToParent('error', [{
+    message: event.message,
+    filename: event.filename,
+    lineno: event.lineno,
+    colno: event.colno,
+    error: event.error ? {
+      message: event.error.message,
+      stack: event.error.stack,
+      name: event.error.name,
+    } : null,
+  }]);
+});
+
+window.addEventListener('unhandledrejection', function(event) {
+  sendConsoleToParent('error', [{
+    message: 'Unhandled Promise Rejection',
+    reason: event.reason ? String(event.reason) : 'Unknown',
+    error: event.reason instanceof Error ? {
+      message: event.reason.message,
+      stack: event.reason.stack,
+      name: event.reason.name,
+    } : null,
+  }]);
+});
+</\` + \`script>\`;
+      }
+
+      function injectCSP(html, cspValue) {
+        const cspMeta = '<meta http-equiv="Content-Security-Policy" content="' + cspValue + '">';
+        const violationListener = buildViolationListenerScript();
+        const injection = cspMeta + violationListener;
+
+        if (html.includes("<head>")) {
+          return html.replace("<head>", "<head>" + injection);
+        } else if (html.includes("<HEAD>")) {
+          return html.replace("<HEAD>", "<HEAD>" + injection);
+        } else if (html.includes("<html>")) {
+          return html.replace("<html>", "<html><head>" + injection + "</head>");
+        } else if (html.includes("<HTML>")) {
+          return html.replace("<HTML>", "<HTML><head>" + injection + "</head>");
+        } else if (html.includes("<!DOCTYPE") || html.includes("<!doctype")) {
+          return html.replace(/(<!DOCTYPE[^>]*>|<!doctype[^>]*>)/i, "$1<head>" + injection + "</head>");
+        } else {
+          return injection + html;
+        }
+      }
+
+      // Query params from host (csp_mode, permissions, widget_csp). AppFrame only
+      // sends { html, csp } in sandbox-resource-ready; we carry the rest on the URL.
+      // Blob URLs cannot reliably carry search params, so the CDN shell injects
+      // window.__SANDBOX_SEARCH__ via buildSandboxProxyBlobHtml.
+      const query = new URLSearchParams(
+        typeof window.__SANDBOX_SEARCH__ === "string"
+          ? window.__SANDBOX_SEARCH__
+          : location.search
+      );
+      const queryCspMode = query.get("csp_mode") || "permissive";
+      let queryPermissions = null;
+      let queryWidgetCsp = null;
+      try {
+        const rawPerm = query.get("permissions");
+        if (rawPerm) queryPermissions = JSON.parse(rawPerm);
+      } catch (e) {}
+      try {
+        const rawCsp = query.get("widget_csp");
+        if (rawCsp) queryWidgetCsp = JSON.parse(rawCsp);
+      } catch (e) {}
+
+      const inner = document.createElement("iframe");
+      inner.style = "width:100%; height:100%; border:none;";
+      inner.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
+      document.body.appendChild(inner);
+
+      window.addEventListener("message", async (event) => {
+        if (event.source === window.parent) {
+          if (event.data && event.data.method === "ui/notifications/sandbox-resource-ready") {
+            const params = event.data.params || {};
+            const html = params.html;
+            const sandbox = params.sandbox;
+            // Prefer message csp when present; fall back to URL widget_csp
+            const csp = params.csp != null ? params.csp : queryWidgetCsp;
+            const permissions = params.permissions != null ? params.permissions : queryPermissions;
+            const permissive =
+              typeof params.permissive === "boolean"
+                ? params.permissive
+                : queryCspMode === "permissive";
+            if (typeof sandbox === "string") {
+              inner.setAttribute("sandbox", sandbox);
+            }
+            const allowAttribute = buildAllowAttribute(permissions);
+            if (allowAttribute) {
+              inner.setAttribute("allow", allowAttribute);
+            }
+            if (typeof html === "string") {
+              if (permissive) {
+                const permissiveCsp = [
+                  "default-src * 'unsafe-inline' 'unsafe-eval' data: blob: filesystem: about:",
+                  "script-src * 'unsafe-inline' 'unsafe-eval' data: blob:",
+                  "style-src * 'unsafe-inline' data: blob:",
+                  "img-src * data: blob: https: http:",
+                  "media-src * data: blob: https: http:",
+                  "font-src * data: blob: https: http:",
+                  "connect-src * data: blob: https: http: ws: wss: about:",
+                  "frame-src * data: blob: https: http: about:",
+                  "object-src * data: blob:",
+                  "base-uri *",
+                  "form-action *",
+                ].join("; ");
+                const processedHtml = injectCSP(html, permissiveCsp);
+                inner.srcdoc = processedHtml;
+              } else {
+                const cspValue = buildCSP(csp);
+                const processedHtml = injectCSP(html, cspValue);
+                inner.srcdoc = processedHtml;
+              }
+            }
+          } else {
+            if (inner && inner.contentWindow) {
+              inner.contentWindow.postMessage(event.data, "*");
+            }
+          }
+        } else if (event.source === inner.contentWindow) {
+          window.parent.postMessage(event.data, "*");
+        }
+      });
+
+      window.parent.postMessage({
+        jsonrpc: "2.0",
+        method: "ui/notifications/sandbox-proxy-ready",
+        params: {},
+      }, "*");
+    </script>
+  </body>
+</html>`;function bt(t){let r="<script>window.__SANDBOX_SEARCH__ = "+JSON.stringify(t).replace(/</g,"\\u003c")+";</script>";return Or.replace("<body>","<body>"+r)}var xt=wt();function Mr(t){let e=t.hostname==="localhost"?"127.0.0.1":t.hostname==="127.0.0.1"||t.hostname==="::1"?"localhost":void 0;if(!e)return;let r=new URL(t.origin);return r.hostname=e,r.origin}var Lr=`<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>Signed in</title><meta name="robots" content="noindex"><style>html,body{margin:0;height:100%;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#4b5563;background:#fff}</style></head>
+<body><div>Signed in. You can close this window.</div>
+<script>try{if(window.opener&&!window.opener.closed)window.opener.postMessage({type:"manufact:oauth-complete"},"*")}catch(e){}try{window.close()}catch(e){}</script>
+</body></html>`;function Tr(t,e,r){let n=[];t?.basePath!==void 0&&n.push(`<script>window.__MCP_BASE_PATH__ = ${JSON.stringify(t.basePath)};</script>`),t?.devMode&&n.push("<script>window.__MCP_DEV_MODE__ = true;</script>"),t?.sandboxOrigin&&n.push(`<script>window.__MCP_SANDBOX_ORIGIN__ = ${JSON.stringify(t.sandboxOrigin)};</script>`),t?.proxyUrl!==void 0&&n.push(`<script>window.__MCP_PROXY_URL__ = ${JSON.stringify(t.proxyUrl)};</script>`),t?.inspectorMode&&n.push(`<script>window.__MCP_INSPECTOR_MODE__ = ${JSON.stringify(t.inspectorMode)};</script>`),t?.manufactChatUrl&&n.push(`<script>window.__MANUFACT_CHAT_URL__ = ${JSON.stringify(t.manufactChatUrl)};</script>`),t?.disableTelemetry&&n.push('<script>window.__MCP_USE_ANONYMIZED_TELEMETRY__ = false;try{localStorage.setItem("MCP_USE_ANONYMIZED_TELEMETRY","false");}catch(e){}</script>'),process.env.MCP_USE_DEV_CLI==="1"&&n.push("<script>window.__MCP_DEV_CLI__ = true;</script>");let o=n.join(`
+    `);return`<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    ${nt(`${e}/inspector/assets`)}
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link href="https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;500;700&display=swap" rel="stylesheet" />
+    <link rel="stylesheet" href="${r.cssUrl}" />
+    <title>Inspector | mcp-use</title>
+    <meta name="description" content="Free, open-source MCP Inspector by mcp-use. Connect to any MCP server, test tools, prompts, and resources, inspect RPC logs, and debug MCP apps \u2014 all in your browser." />
+    <style>
+      :root { color-scheme: light dark; }
+      html, body { height: 100%; margin: 0; background-color: #f3f3f3; }
+      #root { height: 100%; }
+      .mcp-boot {
+        display: flex;
+        height: 100%;
+        align-items: center;
+        justify-content: center;
+        background-color: #f3f3f3;
+      }
+      .mcp-boot-inner {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        gap: 16px;
+      }
+      .mcp-boot-spinner {
+        width: 32px;
+        height: 32px;
+        color: #52525b;
+        animation: mcp-boot-spin 1s linear infinite;
+      }
+      .mcp-boot-label {
+        margin: 0;
+        font-family: Ubuntu, sans-serif;
+        font-size: 0.875rem;
+        line-height: 1.25rem;
+        color: #52525b;
+      }
+      @keyframes mcp-boot-spin {
+        to { transform: rotate(360deg); }
+      }
+      @media (prefers-color-scheme: dark) {
+        html, body { background-color: #000; }
+        .mcp-boot { background-color: #000; }
+        .mcp-boot-spinner, .mcp-boot-label { color: #a1a1aa; }
+      }
+    </style>
+    <script>window.__INSPECTOR_VERSION__ = ${JSON.stringify(xt)};</script>
+    ${o}
+  </head>
+  <body>
+    <script>
+      if (typeof window !== "undefined" && typeof window.process === "undefined") {
+        window.process = {
+          env: {},
+          platform: "browser",
+          browser: true,
+          version: "v18.0.0",
+          versions: { node: "18.0.0" },
+          cwd: () => "/",
+          nextTick: (fn, ...args) => queueMicrotask(() => fn(...args)),
+        };
+      }
+    </script>
+    <div id="root">
+      <div class="mcp-boot">
+        <div class="mcp-boot-inner">
+          <svg
+            class="mcp-boot-spinner"
+            xmlns="http://www.w3.org/2000/svg"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            role="status"
+            aria-label="Loading"
+          >
+            <path d="M21 12a9 9 0 1 1-6.219-8.56" />
+          </svg>
+          <p class="mcp-boot-label">Connecting to MCP server...</p>
+        </div>
+      </div>
+    </div>
+    <script type="module" src="${r.jsUrl}"></script>
+  </body>
+</html>`}function vt(t,e,r=""){let n=`${r}/inspector/assets`,o=encodeURIComponent(xt),s={jsUrl:`${n}/inspector.js?v=${o}`,cssUrl:`${n}/inspector.css?v=${o}`},i=u=>`${r}${u}`,a={...e,basePath:e?.basePath??r,proxyUrl:e?.proxyUrl!==void 0?e.proxyUrl:i("/inspector/api/proxy"),disableTelemetry:e?.disableTelemetry??process.env.MCP_USE_ANONYMIZED_TELEMETRY==="false"},c=u=>{let p=new URL(u.req.url),h={...a,sandboxOrigin:a.sandboxOrigin??Mr(p)??null};return u.html(Tr(h,r,s))};gt(t,n),t.get(i("/inspector/oauth-popup-closed.html"),u=>u.html(Lr)),t.get(i("/inspector/sandbox"),u=>u.html(bt(new URL(u.req.url).search))),t.get(i("/inspector"),c),t.get(`${i("/inspector")}/`,c);let l=i("/inspector/api/");t.get(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),t.post(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),r===""&&e?.rootRedirect!==!1&&t.get("/",u=>{let p=new URL(u.req.url);return u.redirect(`${i("/inspector")}${p.search}`)})}var Rt=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[],...t},r=(o=>typeof o=="string"?o==="*"?()=>o:s=>o===s?s:null:typeof o=="function"?o:s=>o.includes(s)?s:null)(e.origin),n=(o=>typeof o=="function"?o:Array.isArray(o)?()=>o:()=>[])(e.allowMethods);return async function(s,i){function a(l,u){s.res.headers.set(l,u)}let c=await r(s.req.header("origin")||"",s);if(c&&a("Access-Control-Allow-Origin",c),e.credentials&&a("Access-Control-Allow-Credentials","true"),e.exposeHeaders?.length&&a("Access-Control-Expose-Headers",e.exposeHeaders.join(",")),s.req.method==="OPTIONS"){e.origin!=="*"&&a("Vary","Origin"),e.maxAge!=null&&a("Access-Control-Max-Age",e.maxAge.toString());let l=await n(s.req.header("origin")||"",s);l.length&&a("Access-Control-Allow-Methods",l.join(","));let u=e.allowHeaders;if(!u?.length){let p=s.req.header("Access-Control-Request-Headers");p&&(u=p.split(/\s*,\s*/))}return u?.length&&(a("Access-Control-Allow-Headers",u.join(",")),s.res.headers.append("Vary","Access-Control-Request-Headers")),s.res.headers.delete("Content-Length"),s.res.headers.delete("Content-Type"),new Response(null,{headers:s.res.headers,status:204,statusText:"No Content"})}await i(),e.origin!=="*"&&s.header("Vary","Origin",{append:!0})}};function Ir(){let{process:t,Deno:e}=globalThis;return!(typeof e?.noColor=="boolean"?e.noColor:t!==void 0?"NO_COLOR"in t?.env:!1)}async function _t(){let{navigator:t}=globalThis,e="cloudflare:workers";return!(t!==void 0&&t.userAgent==="Cloudflare-Workers"?await(async()=>{try{return"NO_COLOR"in((await import(e)).env??{})}catch{return!1}})():!Ir())}var kr=t=>{let[e,r]=[",","."];return t.map(o=>o.replace(/(\d)(?=(\d\d\d)+(?!\d))/g,"$1"+e)).join(r)},Dr=t=>{let e=Date.now()-t;return kr([e<1e3?e+"ms":Math.round(e/1e3)+"s"])},Ur=async t=>{if(await _t())switch(t/100|0){case 5:return`\x1B[31m${t}\x1B[0m`;case 4:return`\x1B[33m${t}\x1B[0m`;case 3:return`\x1B[36m${t}\x1B[0m`;case 2:return`\x1B[32m${t}\x1B[0m`}return`${t}`};async function Et(t,e,r,n,o=0,s){let i=e==="<--"?`${e} ${r} ${n}`:`${e} ${r} ${n} ${await Ur(o)} ${s}`;t(i)}var Pt=(t=console.log)=>async function(r,n){let{method:o,url:s}=r.req,i=s.slice(s.indexOf("/",8));await Et(t,"<--",o,i);let a=Date.now();await n(),await Et(t,"-->",o,i,r.res.status,Dr(a))};import{lookup as jr}from"dns/promises";import{Buffer as Nr}from"buffer";import{isIP as Hr}from"net";var $r=new Set(["accept","authorization","content-type","dpop"]),Br=new Set(["cache-control","content-type","dpop-nonce","expires","pragma","retry-after","www-authenticate"]),qr=[["registration_endpoint","registration"],["token_endpoint","token"],["revocation_endpoint","revocation"],["introspection_endpoint","introspection"]],Tt=600*1e3,Fr=100,zr=1440*60*1e3,Wr=500;function Oe(t,e={}){let{basePath:r="/oauth",allowedOrigins:n=[],allowLoopback:o=!1,timeoutMs:s=1e4,maxRequestBodyBytes:i=64*1024,maxResponseBodyBytes:a=1024*1024,callbackPath:c="/oauth/callback",enableLogging:l=!0,authenticate:u,validateServerUrl:p,rateLimiter:h=new T.default({points:120,duration:60})}=e,f=new Set(n.map(Ce)),y=new Map,w=new Map,g=async(d,m)=>{try{await h.consume(d.req)}catch(x){return F(d,x)}return m()};t.use(`${r}/*`,async(d,m)=>{let x=d.req.header("Origin");if(x&&!en(x,d,f))return d.json({error:"Origin not allowed"},403);if(d.req.method==="OPTIONS")return tn(x);await m(),x&&Ht(d.res.headers,x)}),t.use(`${r}/*`,g),t.get(`${r}/metadata`,async d=>{if(!await Lt(d,u))return d.json({error:"Unauthorized"},401);let m=await B(d.req.query("serverUrl"),o);if("error"in m)return d.json({error:m.error},400);let x=m.url;if(p&&!await p(x.toString(),d))return d.json({error:"MCP server URL not allowed"},403);let C=await B(d.req.query("url"),o);if("error"in C)return d.json({error:C.error},400);let O=C.url,_=L(x),E=Ot(y,_),A=At(x,O,E);if(!A&&E.authorizationServers.size===0)try{await St(x,E,o,s,a),y.set(_,E),A=At(x,O,E)}catch{}if(!A)return d.json({error:"Metadata target is not bound to this MCP server"},403);try{Pe(l,`GET ${O}`);let R=await se(O,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(s)});if(ae(R.status))return d.json({error:"OAuth metadata redirects are not allowed"},502);let b=await ie(R,a);if(!R.ok)return d.body(b,R.status,{"Content-Type":R.headers.get("content-type")??"application/json"});let P=Se(b);return A.type==="protected-resource"?await Dt(P,x,E,o):await Ut(P,A.issuer,E,o),E.updatedAt=Date.now(),y.set(_,E),Mt(y),d.body(b,200,{"Content-Type":R.headers.get("content-type")??"application/json"})}catch(R){return Ae(d,R,l)}}),t.post(`${r}/proxy`,async d=>{if(!await Lt(d,u))return d.json({error:"Unauthorized"},401);let m;try{m=JSON.parse(await Qr(d.req.raw,i))}catch(b){return d.json({error:b instanceof D?"Request body too large":"Invalid JSON request body"},b instanceof D?413:400)}let x=await B(m.serverUrl,o);if("error"in x)return d.json({error:x.error},400);let C=x.url;if(p&&!await p(C.toString(),d))return d.json({error:"MCP server URL not allowed"},403);let O=await B(m.url,o);if("error"in O)return d.json({error:O.error},400);let _=O.url;if(m.method!==void 0&&m.method!=="POST")return d.json({error:"Only OAuth endpoint POST is allowed"},405);let E=L(C),A=Ot(y,E);if(A.endpoints.size===0)try{await St(C,A,o,s,a),y.set(E,A),Mt(y)}catch(b){return Ae(d,b,l)}let R=A.endpoints.get(L(_));if(!R)return d.json({error:"OAuth endpoint is not bound to this MCP server"},403);try{let b=Vr(m.headers),P=Jr(m.body,b);if(R==="registration"){let Kt=Ce(d.req.header("Origin")??new URL(d.req.url).origin);P=Zr(P,b,new URL(c,Kt).toString())}else P=Yr({body:P,headers:b,bindingKey:E,clients:w});if(new TextEncoder().encode(P??"").byteLength>i)return d.json({error:"OAuth request body too large"},413);Pe(l,`POST ${R} ${_}`);let M=await se(_,{method:"POST",headers:b,body:P,redirect:"manual",signal:AbortSignal.timeout(s)});if(ae(M.status))return d.json({error:"OAuth endpoint redirects are not allowed"},502);let U=await ie(M,a),j=Kr(M.headers),Vt=M.headers.get("content-type")??"",N=U;if(Vt.includes("json"))try{N=JSON.parse(U)}catch{}return R==="registration"&&M.ok&&N&&typeof N=="object"&&!Array.isArray(N)&&(N=Gr({responseBody:N,binding:A,bindingKey:E,clients:w})),d.json({status:M.status,statusText:M.statusText,headers:j,body:N})}catch(b){return Ae(d,b,l)}}),Pe(l,`Mounted at ${r}/metadata and ${r}/proxy`)}async function B(t,e){if(typeof t!="string"||!t)return{error:"Missing or invalid URL"};let r;try{r=new URL(t)}catch{return{error:"Invalid URL"}}if(r.username||r.password||r.hash)return{error:"URL credentials and fragments are not allowed"};let n=rn(r.hostname);if(r.protocol!=="https:"&&!(e&&n&&r.protocol==="http:"))return{error:"HTTPS is required"};if(n)return e?{url:r}:{error:"Loopback URL not allowed"};if(nn(r.hostname))return{error:"Local network URL not allowed"};try{let o=Hr(r.hostname)?[r.hostname]:(await jr(r.hostname,{all:!0,verbatim:!0})).map(({address:s})=>s);if(o.length===0||o.some(s=>!$t(s)))return{error:"Private or non-routable URL not allowed"}}catch{return{error:"URL hostname could not be resolved"}}return{url:r}}async function Me(t,e=!1){return!("error"in await B(t,e))}function At(t,e,r){let n=L(e);if(It(t).some(o=>L(o)===n))return{type:"protected-resource"};for(let o of r.authorizationServers)if(kt(new URL(o)).some(s=>L(s)===n))return{type:"authorization-server",issuer:o}}function It(t){let e=t.pathname==="/"?"":t.pathname;return[new URL(`/.well-known/oauth-protected-resource${e}`,t.origin),new URL("/.well-known/oauth-protected-resource",t.origin)]}function kt(t){let e=t.pathname==="/"?"":t.pathname;return[new URL(`/.well-known/oauth-authorization-server${e}`,t.origin),new URL(`/.well-known/openid-configuration${e}`,t.origin),new URL(`${e||""}/.well-known/openid-configuration`,t.origin)]}async function Dt(t,e,r,n){if(typeof t.resource!="string"||L(new URL(t.resource))!==L(e))throw new S("Protected-resource metadata does not match serverUrl");if(!Array.isArray(t.authorization_servers)||t.authorization_servers.length===0)throw new S("Protected-resource metadata has no authorization servers");let o=new Set;for(let s of t.authorization_servers){let i=await B(s,n);if("error"in i)throw new S(`Unsafe authorization server: ${i.error}`);o.add(L(i.url))}r.authorizationServers=o,r.endpoints.clear(),r.tokenEndpointAuthMethods.clear()}async function Ut(t,e,r,n){if(typeof t.issuer!="string"||L(new URL(t.issuer))!==e)throw new S("Authorization-server metadata issuer mismatch");r.endpoints.clear(),r.tokenEndpointAuthMethods=new Set(Array.isArray(t.token_endpoint_auth_methods_supported)?t.token_endpoint_auth_methods_supported.filter(o=>typeof o=="string"):[]);for(let[o,s]of qr){let i=t[o];if(i===void 0)continue;let a=await B(i,n);if("error"in a)throw new S(`Unsafe ${o}: ${a.error}`);r.endpoints.set(L(a.url),s)}}async function St(t,e,r,n,o){for(let s of It(t)){let i=await se(s,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(ae(i.status))throw new S("OAuth metadata redirects are not allowed");if(i.ok){await Dt(Se(await ie(i,o)),t,e,r);break}}if(e.authorizationServers.size===0)throw new S("Protected-resource metadata could not be discovered");for(let s of e.authorizationServers){let i=!1;for(let a of kt(new URL(s))){let c=await se(a,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(ae(c.status))throw new S("OAuth metadata redirects are not allowed");if(c.ok){await Ut(Se(await ie(c,o)),s,e,r),i=!0;break}}if(i)break}if(e.endpoints.size===0)throw new S("Authorization-server metadata could not be discovered");e.updatedAt=Date.now()}async function se(t,e){return fetch(t,e)}function Vr(t){let e=new Headers;if(!t||typeof t!="object"||Array.isArray(t))return e;for(let[r,n]of Object.entries(t)){let o=r.toLowerCase();$r.has(o)&&typeof n=="string"&&e.set(o,n)}return e}function Kr(t){let e={};return t.forEach((r,n)=>{Br.has(n.toLowerCase())&&(e[n]=r)}),e}function Jr(t,e){if(t==null)return;if(typeof t=="string"){if(!e.has("content-type"))try{JSON.parse(t),e.set("content-type","application/json")}catch{e.set("content-type","application/x-www-form-urlencoded")}return t}if((e.get("content-type")??"").includes("application/x-www-form-urlencoded")&&typeof t=="object"&&!Array.isArray(t)){let n=new URLSearchParams;for(let[o,s]of Object.entries(t))n.append(o,String(s));return n.toString()}return e.has("content-type")||e.set("content-type","application/json"),JSON.stringify(t)}function jt(t,e){return`${t}\0${e}`}function Gr(t){let{responseBody:e,binding:r,bindingKey:n,clients:o}=t,s=e.client_id,i=e.client_secret;if(typeof s!="string"||typeof i!="string")return e;let a=e.token_endpoint_auth_method,c=a==="client_secret_post"||a==="client_secret_basic"?a:r.tokenEndpointAuthMethods.has("client_secret_basic")?"client_secret_basic":"client_secret_post",l=e.client_secret_expires_at,u=l===0?Number.POSITIVE_INFINITY:typeof l=="number"&&l>0?l*1e3:Date.now()+zr;for(Xr(o),o.set(jt(n,s),{clientSecret:i,authMethod:c,expiresAt:u});o.size>Wr;){let h=o.keys().next().value;if(!h)break;o.delete(h)}let p={...e};return delete p.client_secret,delete p.client_secret_expires_at,p.token_endpoint_auth_method="none",p}function Yr(t){let{body:e,headers:r,bindingKey:n,clients:o}=t;if(!e||!(r.get("content-type")??"").includes("application/x-www-form-urlencoded"))return e;let s=new URLSearchParams(e),i=s.get("client_id");if(!i)return e;let a=jt(n,i),c=o.get(a);if(!c)return e;if(c.expiresAt<=Date.now())return o.delete(a),e;if(s.delete("client_secret"),c.authMethod==="client_secret_basic"){let l=Nr.from(`${Ct(i)}:${Ct(c.clientSecret)}`,"utf8").toString("base64");r.set("authorization",`Basic ${l}`)}else r.delete("authorization"),s.set("client_id",i),s.set("client_secret",c.clientSecret);return s.toString()}function Ct(t){return new URLSearchParams({value:t}).toString().slice(6)}function Xr(t){let e=Date.now();for(let[r,n]of t)n.expiresAt<=e&&t.delete(r)}async function Qr(t,e){let r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw new D;return Nt(t.body,e)}async function ie(t,e){let r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw await t.body?.cancel(),new D;return Nt(t.body,e)}async function Nt(t,e){if(!t)return"";let r=t.getReader(),n=[],o=0;for(;;){let{done:a,value:c}=await r.read();if(a)break;if(o+=c.byteLength,o>e)throw await r.cancel(),new D;n.push(c)}let s=new Uint8Array(o),i=0;for(let a of n)s.set(a,i),i+=a.byteLength;return new TextDecoder().decode(s)}function Se(t){let e;try{e=JSON.parse(t)}catch{throw new S("OAuth metadata is not valid JSON")}if(!e||typeof e!="object"||Array.isArray(e))throw new S("OAuth metadata is not an object");return e}function Ot(t,e){let r=t.get(e);return r&&Date.now()-r.updatedAt<=Tt?r:(t.delete(e),{authorizationServers:new Set,endpoints:new Map,tokenEndpointAuthMethods:new Set,updatedAt:Date.now()})}function Mt(t){let e=Date.now();for(let[r,n]of t)e-n.updatedAt>Tt&&t.delete(r);for(;t.size>Fr;){let r=t.keys().next().value;if(!r)break;t.delete(r)}}function L(t){let e=new URL(t);return e.hash="",(e.protocol==="https:"&&e.port==="443"||e.protocol==="http:"&&e.port==="80")&&(e.port=""),e.toString().replace(/\/$/,"")}function Zr(t,e,r){if(!t||!(e.get("content-type")??"").includes("json"))return t;try{let o=JSON.parse(t);return!o||typeof o!="object"||Array.isArray(o)?t:JSON.stringify({...o,redirect_uris:[r]})}catch{return t}}function Ce(t){let e=new URL(t);if(e.pathname!=="/"||e.search||e.hash)throw new Error(`OAuth proxy allowed origin must be an origin: ${t}`);return e.origin}function en(t,e,r){try{let n=Ce(t);if(n===new URL(e.req.url).origin||r.has(n))return!0;let o=new URL(n),i=e.req.header("x-forwarded-host")?.split(",")[0]?.trim()||e.req.header("host");if(!i||o.host!==i)return!1;let a=e.req.header("x-forwarded-proto")?.split(",")[0]?.trim();return!a||`${a}:`===o.protocol}catch{return!1}}function tn(t){let e=new Headers;return t&&Ht(e,t),e.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),e.set("Access-Control-Allow-Headers","Accept, Authorization, Content-Type"),e.set("Access-Control-Max-Age","600"),new Response(null,{status:204,headers:e})}function Ht(t,e){t.set("Access-Control-Allow-Origin",e),t.append("Vary","Origin")}async function Lt(t,e){return e?e(t):!0}function ae(t){return t>=300&&t<400}function rn(t){let e=t.toLowerCase().replace(/^\[|\]$/g,"");return e==="localhost"||e.endsWith(".localhost")||e==="::1"||e.startsWith("127.")}function nn(t){let e=t.toLowerCase();return e.endsWith(".local")||e.endsWith(".internal")||e.endsWith(".home.arpa")}function $t(t){if(t.includes(":")){let s=t.toLowerCase();return s.startsWith("::ffff:")?$t(s.slice(7)):!(s==="::"||s==="::1"||s.startsWith("fc")||s.startsWith("fd")||/^fe[89ab]/.test(s)||s.startsWith("ff")||s.startsWith("2001:db8:"))}let e=t.split(".").map(Number);if(e.length!==4||e.some(s=>!Number.isInteger(s)))return!1;let[r,n,o]=e;return!(r===0||r===10||r===127||r===100&&n>=64&&n<=127||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===0&&o===0||r===192&&n===0&&o===2||r===192&&n===168||r===198&&(n===18||n===19)||r===198&&n===51&&o===100||r===203&&n===0&&o===113||r>=224)}function Pe(t,e){t&&console.log(`[OAuth BFF] ${e}`)}function Ae(t,e,r){let n=e instanceof Error?e.message:"Unknown error";return r&&console.error("[OAuth BFF]",n),e instanceof D?t.json({error:"Upstream response too large"},502):e instanceof S?t.json({error:e.message},502):e instanceof DOMException&&e.name==="TimeoutError"?t.json({error:"OAuth upstream timed out"},504):t.json({error:"OAuth upstream request failed"},502)}var D=class extends Error{},S=class extends Error{};var on=3;function sn(t,e){return t.includes("text/event-stream")&&!e}function Le(t,e={}){let r=e.path||"/mcp/proxy",n=e.enableLogging!==!1,o=e.rateLimiter??new T.default({points:120,duration:60}),s=async(i,a)=>{try{await o.consume(i.req)}catch(c){return F(i,c)}return a()};t.use(`${r}/*`,Rt({origin:"*",allowHeaders:["Authorization","Content-Type","Accept","X-Target-URL","X-MCP-Target","Mcp-Session-Id","mcp-session-id","mcp-protocol-version","X-Server-Id","X-Requested-With"],exposeHeaders:["*"]})),n&&t.use(`${r}/*`,Pt()),t.use(`${r}/*`,s),t.all(`${r}/*`,async i=>{try{if(e.authenticate&&!await e.authenticate(i))return i.json({error:"Unauthorized"},401);let a=i.req.header("X-Target-URL");if(!a)return i.json({error:"X-Target-URL header is required",usage:"Set X-Target-URL header to the MCP server URL you want to proxy to"},400);if(!await Me(a,e.allowLoopback??!1))return i.json({error:"Invalid target URL",details:"Target is not allowed by the proxy network policy"},403);if(e.validateRequest&&!await e.validateRequest(a,i))return i.json({error:"Invalid target URL",details:"The requested target URL is not allowed"},403);try{new URL(a)}catch{return i.json({error:"Invalid target URL format",details:"The X-Target-URL must be a valid HTTP/HTTPS URL"},400)}let c=i.req.method,l={},u=i.req.header();for(let[w,g]of Object.entries(u)){let d=w.toLowerCase();!d.startsWith("x-proxy-")&&!d.startsWith("x-target-")&&!d.startsWith("x-mcp-")&&!d.startsWith("x-forwarded-")&&!d.startsWith("cf-")&&d!=="x-original-host"&&d!=="host"&&d!=="origin"&&d!=="referer"&&d!=="cookie"&&d!=="proxy-authorization"&&d!=="accept-encoding"&&d!=="cdn-loop"&&!d.startsWith("sec-fetch-")&&(l[w]=g)}l["Accept-Encoding"]="identity";let p=c!=="GET"&&c!=="HEAD"?new Uint8Array(await i.req.arrayBuffer()).slice():void 0,h=a,f=c,y=p;for(let w=0;;w+=1){let g=await fetch(h,{method:f,headers:l,body:y,redirect:"manual"}),d=g.headers.get("location");if(!(g.status>=300&&g.status<400&&d))return an(g);if(w>=on)return i.json({error:"Too many upstream redirects"},502);let m=new URL(d,h);if(!await Me(m.toString(),e.allowLoopback??!1)||e.validateRequest&&!await e.validateRequest(m.toString(),i))return i.json({error:"Redirect target is not allowed"},403);m.origin!==new URL(h).origin&&(ce(l,"authorization"),ce(l,"proxy-authorization")),(g.status===303||(g.status===301||g.status===302)&&f==="POST")&&(f="GET",y=void 0,ce(l,"content-type"),ce(l,"content-length")),h=m.toString()}}catch(a){let c=a instanceof Error?a.message:"Unknown error",l=i.req.header("X-Target-URL");return a instanceof Error&&(a.message.includes("ECONNREFUSED")||a.message.includes("fetch failed"))?console.warn(`[MCP Proxy] Connection refused to ${l||"unknown target"} - server may not be running`):console.error("[MCP Proxy] Request failed:",c,`
+Target URL:`,l||"unknown",`
+Error:`,a),i.json({error:"Proxy request failed",details:c,targetUrl:l||"unknown"},500)}})}function ce(t,e){for(let r of Object.keys(t))r.toLowerCase()===e&&delete t[r]}async function an(t){let e={};if(t.headers.forEach((o,s)=>{let i=s.toLowerCase();i!=="content-encoding"&&i!=="transfer-encoding"&&i!=="content-length"&&i!=="set-cookie"&&(e[s]=o)}),sn(t.headers.get("content-type")||"",t.headers.get("content-length")))return new Response(t.body,{status:t.status,statusText:t.statusText,headers:e});if([204,205,304].includes(t.status))return new Response(null,{status:t.status,statusText:t.statusText,headers:e});let n=await t.arrayBuffer();return e["Content-Length"]=String(n.byteLength),new Response(n,{status:t.status,statusText:t.statusText,headers:e})}function Te(t,e,r=""){let n=a=>`${r}${a}`,o=e?.oauthProxyAllowLoopback??!1,s=e?.oauth!==!1,i=new T.default({points:120,duration:60});if(t.get(n("/inspector/health"),a=>a.json({status:"ok",protocol:"mcp-use-inspector-preview",version:1,capabilities:["view-preview"]})),Le(t,{path:n("/inspector/api/proxy"),allowLoopback:o,rateLimiter:i}),s&&Oe(t,{basePath:n("/inspector/api/oauth"),callbackPath:n("/inspector/oauth/callback"),enableLogging:!0,allowedOrigins:e?.oauthProxyAllowedOrigins??[],allowLoopback:o,rateLimiter:i}),e?.autoConnectUrl!==void 0){let a=e.autoConnectUrl;t.get(n("/inspector/config.json"),c=>c.json({autoConnectUrl:a??null}))}}function ln(t,e){if(mn(t)){let o=t,s=e,i=Ft(s?.basePath);if(Wt(o)){zt(o,s,i);return}let a=Bt(s,i),c=qt(a);o.use(un(c,a.routes.map(l=>l.path)));return}let r=t,n=Ft(r?.basePath);return qt(Bt(r,n))}function Bt(t,e){let r=new ve;return zt(r,t,e),r}function zt(t,e,r){let n={oauthProxyAllowedOrigins:e?.oauthProxyAllowedOrigins??[],oauthProxyAllowLoopback:e?.oauthProxyAllowLoopback??!0};e?.autoConnectUrl!==void 0?n.autoConnectUrl=e.autoConnectUrl:t.get(`${r}/inspector/config.json`,o=>{let s=new URL(o.req.url);return o.json({autoConnectUrl:`${s.origin}${r}`})}),Te(t,n,r),vt(t,{devMode:e?.devMode??!0,sandboxOrigin:e?.sandboxOrigin,inspectorMode:"embedded",rootRedirect:!1,basePath:r,proxyUrl:`${r}/inspector/api/proxy`,manufactChatUrl:e?.manufactChatUrl},r)}function qt(t){return e=>Promise.resolve(t.fetch(e))}function un(t,e){let r=new Set(e.filter(o=>!o.includes("*"))),n=e.filter(o=>o.endsWith("/*")).map(o=>o.slice(0,-1));return(o,s,i)=>{let a=new URL(o.originalUrl||o.url||"",dn(o));if(!r.has(a.pathname)&&!n.some(l=>a.pathname.startsWith(l))){i();return}let c=pn(o,a);t(c).then(l=>fn(s,l)).catch(i)}}function dn(t){let r=Ie(t.headers["x-forwarded-proto"])||t.protocol||"http",o=Ie(t.headers["x-forwarded-host"])||Ie(t.headers.host)||"localhost";return`${r}://${o}`}function Ie(t){return Array.isArray(t)?t[0]??"":(t??"").split(",")[0].trim()}function pn(t,e){let r={method:t.method,headers:t.headers};return t.method!=="GET"&&t.method!=="HEAD"&&(t.body!==void 0?r.body=hn(t.body):(r.body=cn.toWeb(t),r.duplex="half")),new globalThis.Request(e,r)}function hn(t){return typeof t=="string"||t instanceof ArrayBuffer||ArrayBuffer.isView(t)||t instanceof Blob||t instanceof FormData||t instanceof URLSearchParams||t instanceof ReadableStream?t:JSON.stringify(t)}async function fn(t,e){t.status(e.status),e.headers.forEach((o,s)=>{s!=="set-cookie"&&t.setHeader(s,o)});let r=e.headers.getSetCookie();if(r.length>0&&t.setHeader("set-cookie",r),!e.body){t.end();return}let n=e.body.getReader();for(;;){let{done:o,value:s}=await n.read();if(o)break;t.write(s)}t.end()}function mn(t){return!t||typeof t!="object"&&typeof t!="function"?!1:typeof t.use=="function"||Wt(t)}function Wt(t){return!!t&&typeof t=="object"&&typeof t.fetch=="function"&&typeof t.route=="function"}function Ft(t){if(t===void 0)return"/mcp";let e=t.trim(),r=[],n=!1;for(let s of e)s==="/"?(n||r.push(s),n=!0):(r.push(s),n=!1);for(;r.length>0&&r[r.length-1]==="/";)r.pop();let o=r.join("");return o===""||o==="/"?"":(o.startsWith("/")||(o=`/${o}`),o)}export{ln as mountInspector,Te as registerInspectorProxyRoutes};