@mcpjam/inspector 3.5.0 → 3.5.1

package/dist/server/index.js

@@ -34,7 +34,7 @@ import {
   supportsOwnershipProof,
   terminateOwnedProcess,
   terminateOwnedProcessGroup
-} from "./chunk-IIQQS3FK.js";
+} from "./chunk-E6KBPJPA.js";
 import {
   ALLOWED_HOSTS,
   BROWSER_CONSENT_HEADER,
@@ -100880,50 +100880,6 @@ function mapInternalToRequestContext(ctx) {
   };
 }
 
-// server/utils/secret-origin-binding.ts
-function originForCredentialBinding(url) {
-  if (typeof url !== "string" || !url.trim()) return null;
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return null;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return null;
-  }
-  const host = parsed.hostname.toLowerCase().replace(/\.+$/, "");
-  if (!host) return null;
-  parsed.protocol = parsed.protocol.toLowerCase();
-  parsed.hostname = host;
-  return parsed.origin;
-}
-function sameCredentialBindingOrigin(a, b) {
-  const left = originForCredentialBinding(a);
-  const right = originForCredentialBinding(b);
-  if (left === null || right === null) return false;
-  return left === right;
-}
-function assertSecretsOriginMatches(check) {
-  if (sameCredentialBindingOrigin(check.boundOrigin, check.targetUrl)) {
-    return;
-  }
-  const targetOrigin = originForCredentialBinding(check.targetUrl);
-  const named2 = check.serverName ? ` "${check.serverName}"` : "";
-  const boundOrigin = originForCredentialBinding(check.boundOrigin);
-  const boundTo = boundOrigin ? `saved for ${boundOrigin}` : "not recorded against any origin";
-  throw new WebRouteError(
-    403,
-    ErrorCode.FORBIDDEN,
-    `Server${named2} now points at ${targetOrigin ?? "an unusable URL"}, but its saved credentials were ${boundTo}. They were not sent. Re-enter this server's credentials for the new URL.`,
-    {
-      secretOriginMismatch: true,
-      boundOrigin,
-      targetOrigin
-    }
-  );
-}
-
 // server/utils/server-secrets.ts
 var warnedMissingServiceTokenForIp = false;
 function parseRecord(value) {
@@ -105288,13 +105244,6 @@ function toMCPServerConfig(authResult, options) {
 async function applyLocalRuntimeResolution(result, args) {
   const { bearerToken, projectId, serverId } = args;
   const needsRuntimeSecrets = result.serverConfig.transportType === "stdio" && result.serverConfig.hasEnv === true && !hasNonEmptyStringRecord(result.serverConfig.env) || result.serverConfig.transportType === "http" && result.serverConfig.hasHeaders === true && !hasNonEmptyStringRecord(result.serverConfig.headers);
-  if (result.serverConfig.transportType === "http" && result.serverConfig.hasHeaders === true) {
-    assertSecretsOriginMatches({
-      boundOrigin: result.serverConfig.secretsBoundOrigin,
-      targetUrl: result.serverConfig.url,
-      serverName: args.serverDisplayName ?? args.managerKey
-    });
-  }
   if (needsRuntimeSecrets) {
     const secrets2 = await fetchRuntimeServerSecrets({
       bearerToken,
@@ -105464,18 +105413,6 @@ async function resolveLocalServerForConnect(c, bearerToken, projectId, serverId,
     );
   }
   const useOAuth = effectiveAuth === "oauth";
-  if (result.serverConfig.transportType === "http") {
-    const httpConfig = result.serverConfig;
-    const willMintXaa = effectiveAuth === "xaa";
-    const xaaMintSendsRowSecret = willMintXaa && resolveXaaConnectRegistrationMode(httpConfig.registrationMode) !== "cimd";
-    if (xaaMintSendsRowSecret || !willMintXaa && (useOAuth || result.oauthAccessToken != null)) {
-      assertSecretsOriginMatches({
-        boundOrigin: httpConfig.secretsBoundOrigin,
-        targetUrl: httpConfig.url,
-        serverName: options?.serverDisplayName ?? serverId
-      });
-    }
-  }
   let resolvedOauthAccessToken = result.oauthAccessToken ?? void 0;
   if (useOAuth && !resolvedOauthAccessToken) {
     const displayName = options?.serverDisplayName ?? serverId;
@@ -105524,13 +105461,6 @@ async function resolveLocalServerForConnect(c, bearerToken, projectId, serverId,
         }
       );
     }
-    if (resolvedOauthAccessToken && result.serverConfig.transportType === "http") {
-      assertSecretsOriginMatches({
-        boundOrigin: result.serverConfig.secretsBoundOrigin,
-        targetUrl: result.serverConfig.url,
-        serverName: options?.serverDisplayName ?? serverId
-      });
-    }
   }
   const useXaa = effectiveAuth === "xaa";
   let xaaUnauthorizedHandler;
@@ -207306,19 +207236,7 @@ async function createAuthorizedManager(caller, bearerToken, projectId, serverIds
       }
       let connectToken = oauthToken;
       let connectOnUnauthorized = onUnauthorized;
-      const oauthTokenIsRowDerived = recoveredOAuthTokens[serverId] != null || auth.oauthAccessToken != null;
-      const willMintXaa = auth.serverConfig.transportType === "http" && effectiveAuth === "xaa";
-      const xaaMintSendsRowSecret = willMintXaa && resolveXaaConnectRegistrationMode(
-        auth.serverConfig.registrationMode
-      ) !== "cimd";
-      if (xaaMintSendsRowSecret || !willMintXaa && oauthToken && oauthTokenIsRowDerived) {
-        assertSecretsOriginMatches({
-          boundOrigin: auth.serverConfig.secretsBoundOrigin,
-          targetUrl: auth.serverConfig.url,
-          serverName: displayServerName
-        });
-      }
-      const useXaa = willMintXaa;
+      const useXaa = auth.serverConfig.transportType === "http" && effectiveAuth === "xaa";
       if (useXaa) {
         if (!options?.xaaIssuer) {
           throw new WebRouteError(
@@ -207417,13 +207335,6 @@ async function createAuthorizedManager(caller, bearerToken, projectId, serverIds
           );
         };
       }
-      if (auth.serverConfig.hasHeaders === true) {
-        assertSecretsOriginMatches({
-          boundOrigin: auth.serverConfig.secretsBoundOrigin,
-          targetUrl: auth.serverConfig.url,
-          serverName: displayServerName
-        });
-      }
       const authForConfig = auth.serverConfig.hasHeaders === true && !hasNonEmptyStringRecord2(auth.serverConfig.headers) ? {
         ...auth,
         serverConfig: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcpjam/inspector",
   "productName": "MCPJam Inspector",
-  "version": "3.5.0",
+  "version": "3.5.1",
   "type": "module",
   "engines": {
     "node": ">=22.0.0"