@modelcontextprotocol/inspector 0.16.0 → 0.16.1

package/README.md

@@ -254,6 +254,12 @@ Development mode:
 
 ```bash
 npm run dev
+
+# To co-develop with the typescript-sdk package (assuming it's cloned in ../typescript-sdk; set MCP_SDK otherwise):
+npm run dev:sdk "cd sdk && npm run examples:simple-server:w"
+# then open http://localhost:3000/mcp as SHTTP in the inspector.
+# To go back to the deployed SDK version:
+#   npm run unlink:sdk && npm i
 ```
 
 > **Note for Windows users:**

package/cli/build/cli.js

@@ -24,50 +24,23 @@ function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms, true));
 }
 async function runWebClient(args) {
-    const inspectorServerPath = resolve(__dirname, "../../", "server", "build", "index.js");
     // Path to the client entry point
-    const inspectorClientPath = resolve(__dirname, "../../", "client", "bin", "client.js");
-    const CLIENT_PORT = process.env.CLIENT_PORT ?? "6274";
-    const SERVER_PORT = process.env.SERVER_PORT ?? "6277";
-    console.log("Starting MCP inspector...");
+    const inspectorClientPath = resolve(__dirname, "../../", "client", "bin", "start.js");
     const abort = new AbortController();
     let cancelled = false;
     process.on("SIGINT", () => {
         cancelled = true;
         abort.abort();
     });
-    let server;
-    let serverOk;
     try {
-        server = spawnPromise("node", [
-            inspectorServerPath,
-            ...(args.command ? [`--env`, args.command] : []),
-            ...(args.args ? [`--args=${args.args.join(" ")}`] : []),
-        ], {
-            env: {
-                ...process.env,
-                PORT: SERVER_PORT,
-                MCP_ENV_VARS: JSON.stringify(args.envArgs),
-            },
+        await spawnPromise("node", [inspectorClientPath], {
             signal: abort.signal,
             echoOutput: true,
         });
-        // Make sure server started before starting client
-        serverOk = await Promise.race([server, delay(2 * 1000)]);
     }
-    catch (error) { }
-    if (serverOk) {
-        try {
-            await spawnPromise("node", [inspectorClientPath], {
-                env: { ...process.env, PORT: CLIENT_PORT },
-                signal: abort.signal,
-                echoOutput: true,
-            });
-        }
-        catch (e) {
-            if (!cancelled || process.env.DEBUG)
-                throw e;
-        }
+    catch (e) {
+        if (!cancelled || process.env.DEBUG)
+            throw e;
     }
 }
 async function runCli(args) {

package/client/dist/assets/{OAuthCallback-DMQy4ibj.js → OAuthCallback-CaDIOg8Q.js}

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-DI7JCTeu.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-CPgI0-gs.js";
 import { p as parseOAuthCallbackParams, g as generateOAuthErrorDescription } from "./oauthUtils-DTcoXpSP.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();

package/client/dist/assets/{OAuthDebugCallback-9JxBAysc.js → OAuthDebugCallback-Ccjj44Wa.js}

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, j as jsxRuntimeExports } from "./index-DI7JCTeu.js";
+import { r as reactExports, S as SESSION_KEYS, j as jsxRuntimeExports } from "./index-CPgI0-gs.js";
 import { p as parseOAuthCallbackParams, g as generateOAuthErrorDescription } from "./oauthUtils-DTcoXpSP.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {

package/client/dist/assets/{index-DI7JCTeu.js → index-CPgI0-gs.js}

@@ -1,4 +1,4 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/OAuthCallback-DMQy4ibj.js","assets/oauthUtils-DTcoXpSP.js","assets/OAuthDebugCallback-9JxBAysc.js"])))=>i.map(i=>d[i]);
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/OAuthCallback-CaDIOg8Q.js","assets/oauthUtils-DTcoXpSP.js","assets/OAuthDebugCallback-Ccjj44Wa.js"])))=>i.map(i=>d[i]);
 function _mergeNamespaces(n, m2) {
   for (var i = 0; i < m2.length; i++) {
     const e = m2[i];
@@ -16375,6 +16375,54 @@ class UnauthorizedError extends Error {
     super(message !== null && message !== void 0 ? message : "Unauthorized");
   }
 }
+function selectClientAuthMethod(clientInformation, supportedMethods) {
+  const hasClientSecret = clientInformation.client_secret !== void 0;
+  if (supportedMethods.length === 0) {
+    return hasClientSecret ? "client_secret_post" : "none";
+  }
+  if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
+    return "client_secret_basic";
+  }
+  if (hasClientSecret && supportedMethods.includes("client_secret_post")) {
+    return "client_secret_post";
+  }
+  if (supportedMethods.includes("none")) {
+    return "none";
+  }
+  return hasClientSecret ? "client_secret_post" : "none";
+}
+function applyClientAuthentication(method, clientInformation, headers, params) {
+  const { client_id, client_secret } = clientInformation;
+  switch (method) {
+    case "client_secret_basic":
+      applyBasicAuth(client_id, client_secret, headers);
+      return;
+    case "client_secret_post":
+      applyPostAuth(client_id, client_secret, params);
+      return;
+    case "none":
+      applyPublicAuth(client_id, params);
+      return;
+    default:
+      throw new Error(`Unsupported client authentication method: ${method}`);
+  }
+}
+function applyBasicAuth(clientId, clientSecret, headers) {
+  if (!clientSecret) {
+    throw new Error("client_secret_basic authentication requires a client_secret");
+  }
+  const credentials = btoa(`${clientId}:${clientSecret}`);
+  headers.set("Authorization", `Basic ${credentials}`);
+}
+function applyPostAuth(clientId, clientSecret, params) {
+  params.set("client_id", clientId);
+  if (clientSecret) {
+    params.set("client_secret", clientSecret);
+  }
+}
+function applyPublicAuth(clientId, params) {
+  params.set("client_id", clientId);
+}
 async function auth(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl }) {
   let resourceMetadata;
   let authorizationServerUrl = serverUrl;
@@ -16386,7 +16434,9 @@ async function auth(provider, { serverUrl, authorizationCode, scope, resourceMet
   } catch (_a) {
   }
   const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-  const metadata = await discoverOAuthMetadata(authorizationServerUrl);
+  const metadata = await discoverOAuthMetadata(serverUrl, {
+    authorizationServerUrl
+  });
   let clientInformation = await Promise.resolve(provider.clientInformation());
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
@@ -16410,7 +16460,8 @@ async function auth(provider, { serverUrl, authorizationCode, scope, resourceMet
       authorizationCode,
       codeVerifier: codeVerifier2,
       redirectUri: provider.redirectUrl,
-      resource
+      resource,
+      addClientAuthentication: provider.addClientAuthentication
     });
     await provider.saveTokens(tokens2);
     return "AUTHORIZED";
@@ -16422,7 +16473,8 @@ async function auth(provider, { serverUrl, authorizationCode, scope, resourceMet
         metadata,
         clientInformation,
         refreshToken: tokens.refresh_token,
-        resource
+        resource,
+        addClientAuthentication: provider.addClientAuthentication
       });
       await provider.saveTokens(newTokens);
       return "AUTHORIZED";
@@ -16476,28 +16528,11 @@ function extractResourceMetadataUrl(res) {
   }
 }
 async function discoverOAuthProtectedResourceMetadata(serverUrl, opts) {
-  var _a;
-  let url;
-  if (opts === null || opts === void 0 ? void 0 : opts.resourceMetadataUrl) {
-    url = new URL(opts === null || opts === void 0 ? void 0 : opts.resourceMetadataUrl);
-  } else {
-    url = new URL("/.well-known/oauth-protected-resource", serverUrl);
-  }
-  let response;
-  try {
-    response = await fetch(url, {
-      headers: {
-        "MCP-Protocol-Version": (_a = opts === null || opts === void 0 ? void 0 : opts.protocolVersion) !== null && _a !== void 0 ? _a : LATEST_PROTOCOL_VERSION
-      }
-    });
-  } catch (error) {
-    if (error instanceof TypeError) {
-      response = await fetch(url);
-    } else {
-      throw error;
-    }
-  }
-  if (response.status === 404) {
+  const response = await discoverMetadataWithFallback(serverUrl, "oauth-protected-resource", {
+    protocolVersion: opts === null || opts === void 0 ? void 0 : opts.protocolVersion,
+    metadataUrl: opts === null || opts === void 0 ? void 0 : opts.resourceMetadataUrl
+  });
+  if (!response || response.status === 404) {
     throw new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`);
   }
   if (!response.ok) {
@@ -16519,8 +16554,8 @@ async function fetchWithCorsRetry(url, headers) {
     throw error;
   }
 }
-function buildWellKnownPath(pathname) {
-  let wellKnownPath = `/.well-known/oauth-authorization-server${pathname}`;
+function buildWellKnownPath(wellKnownPrefix, pathname) {
+  let wellKnownPath = `/.well-known/${wellKnownPrefix}${pathname}`;
   if (pathname.endsWith("/")) {
     wellKnownPath = wellKnownPath.slice(0, -1);
   }
@@ -16535,17 +16570,40 @@ async function tryMetadataDiscovery(url, protocolVersion) {
 function shouldAttemptFallback(response, pathname) {
   return !response || response.status === 404 && pathname !== "/";
 }
-async function discoverOAuthMetadata(authorizationServerUrl, opts) {
-  var _a;
-  const issuer = new URL(authorizationServerUrl);
-  const protocolVersion = (_a = void 0) !== null && _a !== void 0 ? _a : LATEST_PROTOCOL_VERSION;
-  const wellKnownPath = buildWellKnownPath(issuer.pathname);
-  const pathAwareUrl = new URL(wellKnownPath, issuer);
-  let response = await tryMetadataDiscovery(pathAwareUrl, protocolVersion);
-  if (shouldAttemptFallback(response, issuer.pathname)) {
-    const rootUrl = new URL("/.well-known/oauth-authorization-server", issuer);
+async function discoverMetadataWithFallback(serverUrl, wellKnownType, opts) {
+  var _a, _b;
+  const issuer = new URL(serverUrl);
+  const protocolVersion = (_a = opts === null || opts === void 0 ? void 0 : opts.protocolVersion) !== null && _a !== void 0 ? _a : LATEST_PROTOCOL_VERSION;
+  let url;
+  if (opts === null || opts === void 0 ? void 0 : opts.metadataUrl) {
+    url = new URL(opts.metadataUrl);
+  } else {
+    const wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
+    url = new URL(wellKnownPath, (_b = opts === null || opts === void 0 ? void 0 : opts.metadataServerUrl) !== null && _b !== void 0 ? _b : issuer);
+    url.search = issuer.search;
+  }
+  let response = await tryMetadataDiscovery(url, protocolVersion);
+  if (!(opts === null || opts === void 0 ? void 0 : opts.metadataUrl) && shouldAttemptFallback(response, issuer.pathname)) {
+    const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
     response = await tryMetadataDiscovery(rootUrl, protocolVersion);
   }
+  return response;
+}
+async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolVersion } = {}) {
+  if (typeof issuer === "string") {
+    issuer = new URL(issuer);
+  }
+  if (!authorizationServerUrl) {
+    authorizationServerUrl = issuer;
+  }
+  if (typeof authorizationServerUrl === "string") {
+    authorizationServerUrl = new URL(authorizationServerUrl);
+  }
+  protocolVersion !== null && protocolVersion !== void 0 ? protocolVersion : protocolVersion = LATEST_PROTOCOL_VERSION;
+  const response = await discoverMetadataWithFallback(issuer, "oauth-authorization-server", {
+    protocolVersion,
+    metadataServerUrl: authorizationServerUrl
+  });
   if (!response || response.status === 404) {
     return void 0;
   }
@@ -16588,35 +16646,35 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
   }
   return { authorizationUrl, codeVerifier };
 }
-async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, codeVerifier, redirectUri, resource }) {
+async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, codeVerifier, redirectUri, resource, addClientAuthentication }) {
+  var _a;
   const grantType = "authorization_code";
-  let tokenUrl;
-  if (metadata) {
-    tokenUrl = new URL(metadata.token_endpoint);
-    if (metadata.grant_types_supported && !metadata.grant_types_supported.includes(grantType)) {
-      throw new Error(`Incompatible auth server: does not support grant type ${grantType}`);
-    }
-  } else {
-    tokenUrl = new URL("/token", authorizationServerUrl);
+  const tokenUrl = (metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint) ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl);
+  if ((metadata === null || metadata === void 0 ? void 0 : metadata.grant_types_supported) && !metadata.grant_types_supported.includes(grantType)) {
+    throw new Error(`Incompatible auth server: does not support grant type ${grantType}`);
   }
+  const headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded"
+  });
   const params = new URLSearchParams({
     grant_type: grantType,
-    client_id: clientInformation.client_id,
     code: authorizationCode,
     code_verifier: codeVerifier,
     redirect_uri: String(redirectUri)
   });
-  if (clientInformation.client_secret) {
-    params.set("client_secret", clientInformation.client_secret);
+  if (addClientAuthentication) {
+    addClientAuthentication(headers, params, authorizationServerUrl, metadata);
+  } else {
+    const supportedMethods = (_a = metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint_auth_methods_supported) !== null && _a !== void 0 ? _a : [];
+    const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
+    applyClientAuthentication(authMethod, clientInformation, headers, params);
   }
   if (resource) {
     params.set("resource", resource.href);
   }
   const response = await fetch(tokenUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
+    headers,
     body: params
   });
   if (!response.ok) {
@@ -16624,7 +16682,8 @@ async function exchangeAuthorization(authorizationServerUrl, { metadata, clientI
   }
   return OAuthTokensSchema.parse(await response.json());
 }
-async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource }) {
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication }) {
+  var _a;
   const grantType = "refresh_token";
   let tokenUrl;
   if (metadata) {
@@ -16635,22 +16694,26 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
   } else {
     tokenUrl = new URL("/token", authorizationServerUrl);
   }
+  const headers = new Headers({
+    "Content-Type": "application/x-www-form-urlencoded"
+  });
   const params = new URLSearchParams({
     grant_type: grantType,
-    client_id: clientInformation.client_id,
     refresh_token: refreshToken
   });
-  if (clientInformation.client_secret) {
-    params.set("client_secret", clientInformation.client_secret);
+  if (addClientAuthentication) {
+    addClientAuthentication(headers, params, authorizationServerUrl, metadata);
+  } else {
+    const supportedMethods = (_a = metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint_auth_methods_supported) !== null && _a !== void 0 ? _a : [];
+    const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
+    applyClientAuthentication(authMethod, clientInformation, headers, params);
   }
   if (resource) {
     params.set("resource", resource.href);
   }
   const response = await fetch(tokenUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
+    headers,
     body: params
   });
   if (!response.ok) {
@@ -23930,9 +23993,7 @@ class SSEClientTransport {
   }
   async _commonHeaders() {
     var _a;
-    const headers = {
-      ...(_a = this._requestInit) === null || _a === void 0 ? void 0 : _a.headers
-    };
+    const headers = {};
     if (this._authProvider) {
       const tokens = await this._authProvider.tokens();
       if (tokens) {
@@ -23942,7 +24003,7 @@ class SSEClientTransport {
     if (this._protocolVersion) {
       headers["mcp-protocol-version"] = this._protocolVersion;
     }
-    return headers;
+    return new Headers({ ...headers, ...(_a = this._requestInit) === null || _a === void 0 ? void 0 : _a.headers });
   }
   _startOrAuth() {
     var _a, _b, _c;
@@ -23952,12 +24013,10 @@ class SSEClientTransport {
         ...this._eventSourceInit,
         fetch: async (url, init) => {
           const headers = await this._commonHeaders();
+          headers.set("Accept", "text/event-stream");
           const response = await fetchImpl(url, {
             ...init,
-            headers: new Headers({
-              ...headers,
-              Accept: "text/event-stream"
-            })
+            headers
           });
           if (response.status === 401 && response.headers.has("www-authenticate")) {
             this._resourceMetadataUrl = extractResourceMetadataUrl(response);
@@ -24038,8 +24097,7 @@ class SSEClientTransport {
       throw new Error("Not connected");
     }
     try {
-      const commonHeaders = await this._commonHeaders();
-      const headers = new Headers(commonHeaders);
+      const headers = await this._commonHeaders();
       headers.set("content-type", "application/json");
       const init = {
         ...this._requestInit,
@@ -24421,7 +24479,7 @@ const StdErrNotificationSchema = NotificationSchema.extend({
 ClientNotificationSchema.or(
   StdErrNotificationSchema
 ).or(ServerNotificationSchema).or(NotificationSchema);
-const version$1 = "0.16.0";
+const version$1 = "0.16.1";
 const packageJson = {
   version: version$1
 };
@@ -35798,7 +35856,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "0.16.0";
+const version = "0.16.1";
 var [createTooltipContext, createTooltipScope] = createContextScope("Tooltip", [
   createPopperScope
 ]);
@@ -38031,13 +38089,13 @@ const App = () => {
   ) });
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-DMQy4ibj.js"), true ? __vite__mapDeps([0,1]) : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-CaDIOg8Q.js"), true ? __vite__mapDeps([0,1]) : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-9JxBAysc.js"), true ? __vite__mapDeps([2,1]) : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-Ccjj44Wa.js"), true ? __vite__mapDeps([2,1]) : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }

package/client/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-DI7JCTeu.js"></script>
+    <script type="module" crossorigin src="/assets/index-CPgI0-gs.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-BwWj6LL9.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Model Context Protocol inspector",
   "license": "MIT",
   "author": "Anthropic, PBC (https://anthropic.com)",
@@ -29,6 +29,9 @@
     "clean": "rimraf ./node_modules ./client/node_modules ./cli/node_modules ./build ./client/dist ./server/build ./cli/build ./package-lock.json && npm install",
     "dev": "node client/bin/start.js --dev",
     "dev:windows": "node client/bin/start.js --dev",
+    "dev:sdk": "npm run link:sdk && concurrently \"npm run dev\" \"cd sdk && npm run build:esm:w\"",
+    "link:sdk": "(test -d sdk || ln -sf ${MCP_SDK:-$PWD/../typescript-sdk} sdk) && (cd sdk && npm link && (test -d node_modules || npm i)) && npm link @modelcontextprotocol/sdk",
+    "unlink:sdk": "(cd sdk && npm unlink -g) && rm sdk && npm unlink @modelcontextprotocol/sdk",
     "start": "node client/bin/start.js",
     "start-server": "cd server && npm run start",
     "start-client": "cd client && npm run preview",
@@ -44,9 +47,9 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.16.0",
-    "@modelcontextprotocol/inspector-client": "^0.16.0",
-    "@modelcontextprotocol/inspector-server": "^0.16.0",
+    "@modelcontextprotocol/inspector-cli": "^0.16.1",
+    "@modelcontextprotocol/inspector-client": "^0.16.1",
+    "@modelcontextprotocol/inspector-server": "^0.16.1",
     "@modelcontextprotocol/sdk": "^1.13.1",
     "concurrently": "^9.0.1",
     "open": "^10.1.0",