@modelcontextprotocol/inspector 0.16.1 → 0.16.2

package/client/dist/assets/{index-CPgI0-gs.js → index-DLtnCiTW.js}

@@ -1,4 +1,4 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/OAuthCallback-CaDIOg8Q.js","assets/oauthUtils-DTcoXpSP.js","assets/OAuthDebugCallback-Ccjj44Wa.js"])))=>i.map(i=>d[i]);
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/OAuthCallback-CC1cu0Zx.js","assets/oauthUtils-DTcoXpSP.js","assets/OAuthDebugCallback-_4BLxVDe.js"])))=>i.map(i=>d[i]);
 function _mergeNamespaces(n, m2) {
   for (var i = 0; i < m2.length; i++) {
     const e = m2[i];
@@ -15408,11 +15408,19 @@ const TextResourceContentsSchema = ResourceContentsSchema.extend({
    */
   text: stringType()
 });
+const Base64Schema = stringType().refine((val) => {
+  try {
+    atob(val);
+    return true;
+  } catch (_a) {
+    return false;
+  }
+}, { message: "Invalid Base64 string" });
 const BlobResourceContentsSchema = ResourceContentsSchema.extend({
   /**
    * A base64-encoded string representing the binary data of the item.
    */
-  blob: stringType().base64()
+  blob: Base64Schema
 });
 const ResourceSchema = BaseMetadataSchema.extend({
   /**
@@ -15575,7 +15583,7 @@ const ImageContentSchema = objectType({
   /**
    * The base64-encoded image data.
    */
-  data: stringType().base64(),
+  data: Base64Schema,
   /**
    * The MIME type of the image. Different providers may support different image types.
    */
@@ -15591,7 +15599,7 @@ const AudioContentSchema = objectType({
   /**
    * The base64-encoded audio data.
    */
-  data: stringType().base64(),
+  data: Base64Schema,
   /**
    * The MIME type of the audio. Different providers may support different audio types.
    */
@@ -16101,14 +16109,56 @@ const OAuthMetadataSchema = objectType({
   introspection_endpoint_auth_signing_alg_values_supported: arrayType(stringType()).optional(),
   code_challenge_methods_supported: arrayType(stringType()).optional()
 }).passthrough();
+const OpenIdProviderMetadataSchema = objectType({
+  issuer: stringType(),
+  authorization_endpoint: stringType(),
+  token_endpoint: stringType(),
+  userinfo_endpoint: stringType().optional(),
+  jwks_uri: stringType(),
+  registration_endpoint: stringType().optional(),
+  scopes_supported: arrayType(stringType()).optional(),
+  response_types_supported: arrayType(stringType()),
+  response_modes_supported: arrayType(stringType()).optional(),
+  grant_types_supported: arrayType(stringType()).optional(),
+  acr_values_supported: arrayType(stringType()).optional(),
+  subject_types_supported: arrayType(stringType()),
+  id_token_signing_alg_values_supported: arrayType(stringType()),
+  id_token_encryption_alg_values_supported: arrayType(stringType()).optional(),
+  id_token_encryption_enc_values_supported: arrayType(stringType()).optional(),
+  userinfo_signing_alg_values_supported: arrayType(stringType()).optional(),
+  userinfo_encryption_alg_values_supported: arrayType(stringType()).optional(),
+  userinfo_encryption_enc_values_supported: arrayType(stringType()).optional(),
+  request_object_signing_alg_values_supported: arrayType(stringType()).optional(),
+  request_object_encryption_alg_values_supported: arrayType(stringType()).optional(),
+  request_object_encryption_enc_values_supported: arrayType(stringType()).optional(),
+  token_endpoint_auth_methods_supported: arrayType(stringType()).optional(),
+  token_endpoint_auth_signing_alg_values_supported: arrayType(stringType()).optional(),
+  display_values_supported: arrayType(stringType()).optional(),
+  claim_types_supported: arrayType(stringType()).optional(),
+  claims_supported: arrayType(stringType()).optional(),
+  service_documentation: stringType().optional(),
+  claims_locales_supported: arrayType(stringType()).optional(),
+  ui_locales_supported: arrayType(stringType()).optional(),
+  claims_parameter_supported: booleanType().optional(),
+  request_parameter_supported: booleanType().optional(),
+  request_uri_parameter_supported: booleanType().optional(),
+  require_request_uri_registration: booleanType().optional(),
+  op_policy_uri: stringType().optional(),
+  op_tos_uri: stringType().optional()
+}).passthrough();
+const OpenIdProviderDiscoveryMetadataSchema = OpenIdProviderMetadataSchema.merge(OAuthMetadataSchema.pick({
+  code_challenge_methods_supported: true
+}));
 const OAuthTokensSchema = objectType({
   access_token: stringType(),
+  id_token: stringType().optional(),
+  // Optional for OAuth 2.1, but necessary in OpenID Connect
   token_type: stringType(),
   expires_in: numberType().optional(),
   scope: stringType().optional(),
   refresh_token: stringType().optional()
 }).strip();
-objectType({
+const OAuthErrorResponseSchema = objectType({
   error: stringType(),
   error_description: stringType().optional(),
   error_uri: stringType().optional()
@@ -16151,6 +16201,7 @@ const SESSION_KEYS = {
   SERVER_URL: "mcp_server_url",
   TOKENS: "mcp_tokens",
   CLIENT_INFORMATION: "mcp_client_information",
+  PREREGISTERED_CLIENT_INFORMATION: "mcp_preregistered_client_information",
   SERVER_METADATA: "mcp_server_metadata",
   AUTH_DEBUGGER_STATE: "mcp_auth_debugger_state"
 };
@@ -16207,6 +16258,41 @@ const EMPTY_DEBUGGER_STATE = {
   statusMessage: null,
   validationError: null
 };
+const getClientInformationFromSessionStorage = async ({
+  serverUrl,
+  isPreregistered
+}) => {
+  const key = getServerSpecificKey(
+    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
+    serverUrl
+  );
+  const value = sessionStorage.getItem(key);
+  if (!value) {
+    return void 0;
+  }
+  return await OAuthClientInformationSchema.parseAsync(JSON.parse(value));
+};
+const saveClientInformationToSessionStorage = ({
+  serverUrl,
+  clientInformation,
+  isPreregistered
+}) => {
+  const key = getServerSpecificKey(
+    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
+    serverUrl
+  );
+  sessionStorage.setItem(key, JSON.stringify(clientInformation));
+};
+const clearClientInformationFromSessionStorage = ({
+  serverUrl,
+  isPreregistered
+}) => {
+  const key = getServerSpecificKey(
+    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
+    serverUrl
+  );
+  sessionStorage.removeItem(key);
+};
 class InspectorOAuthClientProvider {
   constructor(serverUrl) {
     this.serverUrl = serverUrl;
@@ -16226,22 +16312,21 @@ class InspectorOAuthClientProvider {
     };
   }
   async clientInformation() {
-    const key = getServerSpecificKey(
-      SESSION_KEYS.CLIENT_INFORMATION,
-      this.serverUrl
-    );
-    const value = sessionStorage.getItem(key);
-    if (!value) {
-      return void 0;
-    }
-    return await OAuthClientInformationSchema.parseAsync(JSON.parse(value));
+    const preregisteredClientInformation = await getClientInformationFromSessionStorage({
+      serverUrl: this.serverUrl,
+      isPreregistered: true
+    });
+    return preregisteredClientInformation ?? await getClientInformationFromSessionStorage({
+      serverUrl: this.serverUrl,
+      isPreregistered: false
+    });
   }
   saveClientInformation(clientInformation) {
-    const key = getServerSpecificKey(
-      SESSION_KEYS.CLIENT_INFORMATION,
-      this.serverUrl
-    );
-    sessionStorage.setItem(key, JSON.stringify(clientInformation));
+    saveClientInformationToSessionStorage({
+      serverUrl: this.serverUrl,
+      clientInformation,
+      isPreregistered: false
+    });
   }
   async tokens() {
     const key = getServerSpecificKey(SESSION_KEYS.TOKENS, this.serverUrl);
@@ -16277,9 +16362,10 @@ class InspectorOAuthClientProvider {
     return verifier;
   }
   clear() {
-    sessionStorage.removeItem(
-      getServerSpecificKey(SESSION_KEYS.CLIENT_INFORMATION, this.serverUrl)
-    );
+    clearClientInformationFromSessionStorage({
+      serverUrl: this.serverUrl,
+      isPreregistered: false
+    });
     sessionStorage.removeItem(
       getServerSpecificKey(SESSION_KEYS.TOKENS, this.serverUrl)
     );
@@ -16370,6 +16456,95 @@ function checkResourceAllowed({ requestedResource, configuredResource }) {
   const configuredPath = configured.pathname.endsWith("/") ? configured.pathname : configured.pathname + "/";
   return requestedPath.startsWith(configuredPath);
 }
+class OAuthError extends Error {
+  constructor(message, errorUri) {
+    super(message);
+    this.errorUri = errorUri;
+    this.name = this.constructor.name;
+  }
+  /**
+   * Converts the error to a standard OAuth error response object
+   */
+  toResponseObject() {
+    const response = {
+      error: this.errorCode,
+      error_description: this.message
+    };
+    if (this.errorUri) {
+      response.error_uri = this.errorUri;
+    }
+    return response;
+  }
+  get errorCode() {
+    return this.constructor.errorCode;
+  }
+}
+class InvalidRequestError extends OAuthError {
+}
+InvalidRequestError.errorCode = "invalid_request";
+class InvalidClientError extends OAuthError {
+}
+InvalidClientError.errorCode = "invalid_client";
+class InvalidGrantError extends OAuthError {
+}
+InvalidGrantError.errorCode = "invalid_grant";
+class UnauthorizedClientError extends OAuthError {
+}
+UnauthorizedClientError.errorCode = "unauthorized_client";
+class UnsupportedGrantTypeError extends OAuthError {
+}
+UnsupportedGrantTypeError.errorCode = "unsupported_grant_type";
+class InvalidScopeError extends OAuthError {
+}
+InvalidScopeError.errorCode = "invalid_scope";
+class AccessDeniedError extends OAuthError {
+}
+AccessDeniedError.errorCode = "access_denied";
+class ServerError extends OAuthError {
+}
+ServerError.errorCode = "server_error";
+class TemporarilyUnavailableError extends OAuthError {
+}
+TemporarilyUnavailableError.errorCode = "temporarily_unavailable";
+class UnsupportedResponseTypeError extends OAuthError {
+}
+UnsupportedResponseTypeError.errorCode = "unsupported_response_type";
+class UnsupportedTokenTypeError extends OAuthError {
+}
+UnsupportedTokenTypeError.errorCode = "unsupported_token_type";
+class InvalidTokenError extends OAuthError {
+}
+InvalidTokenError.errorCode = "invalid_token";
+class MethodNotAllowedError extends OAuthError {
+}
+MethodNotAllowedError.errorCode = "method_not_allowed";
+class TooManyRequestsError extends OAuthError {
+}
+TooManyRequestsError.errorCode = "too_many_requests";
+class InvalidClientMetadataError extends OAuthError {
+}
+InvalidClientMetadataError.errorCode = "invalid_client_metadata";
+class InsufficientScopeError extends OAuthError {
+}
+InsufficientScopeError.errorCode = "insufficient_scope";
+const OAUTH_ERRORS = {
+  [InvalidRequestError.errorCode]: InvalidRequestError,
+  [InvalidClientError.errorCode]: InvalidClientError,
+  [InvalidGrantError.errorCode]: InvalidGrantError,
+  [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
+  [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
+  [InvalidScopeError.errorCode]: InvalidScopeError,
+  [AccessDeniedError.errorCode]: AccessDeniedError,
+  [ServerError.errorCode]: ServerError,
+  [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
+  [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
+  [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
+  [InvalidTokenError.errorCode]: InvalidTokenError,
+  [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
+  [TooManyRequestsError.errorCode]: TooManyRequestsError,
+  [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
+  [InsufficientScopeError.errorCode]: InsufficientScopeError
+};
 class UnauthorizedError extends Error {
   constructor(message) {
     super(message !== null && message !== void 0 ? message : "Unauthorized");
@@ -16423,19 +16598,50 @@ function applyPostAuth(clientId, clientSecret, params) {
 function applyPublicAuth(clientId, params) {
   params.set("client_id", clientId);
 }
-async function auth(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl }) {
+async function parseErrorResponse(input) {
+  const statusCode = input instanceof Response ? input.status : void 0;
+  const body = input instanceof Response ? await input.text() : input;
+  try {
+    const result = OAuthErrorResponseSchema.parse(JSON.parse(body));
+    const { error, error_description, error_uri } = result;
+    const errorClass = OAUTH_ERRORS[error] || ServerError;
+    return new errorClass(error_description || "", error_uri);
+  } catch (error) {
+    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+    return new ServerError(errorMessage);
+  }
+}
+async function auth(provider, options) {
+  var _a, _b;
+  try {
+    return await authInternal(provider, options);
+  } catch (error) {
+    if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError) {
+      await ((_a = provider.invalidateCredentials) === null || _a === void 0 ? void 0 : _a.call(provider, "all"));
+      return await authInternal(provider, options);
+    } else if (error instanceof InvalidGrantError) {
+      await ((_b = provider.invalidateCredentials) === null || _b === void 0 ? void 0 : _b.call(provider, "tokens"));
+      return await authInternal(provider, options);
+    }
+    throw error;
+  }
+}
+async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
   let resourceMetadata;
-  let authorizationServerUrl = serverUrl;
+  let authorizationServerUrl;
   try {
-    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl });
+    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl }, fetchFn);
     if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
       authorizationServerUrl = resourceMetadata.authorization_servers[0];
     }
   } catch (_a) {
   }
+  if (!authorizationServerUrl) {
+    authorizationServerUrl = serverUrl;
+  }
   const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-  const metadata = await discoverOAuthMetadata(serverUrl, {
-    authorizationServerUrl
+  const metadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, {
+    fetchFn
   });
   let clientInformation = await Promise.resolve(provider.clientInformation());
   if (!clientInformation) {
@@ -16461,7 +16667,8 @@ async function auth(provider, { serverUrl, authorizationCode, scope, resourceMet
       codeVerifier: codeVerifier2,
       redirectUri: provider.redirectUrl,
       resource,
-      addClientAuthentication: provider.addClientAuthentication
+      addClientAuthentication: provider.addClientAuthentication,
+      fetchFn
     });
     await provider.saveTokens(tokens2);
     return "AUTHORIZED";
@@ -16478,7 +16685,11 @@ async function auth(provider, { serverUrl, authorizationCode, scope, resourceMet
       });
       await provider.saveTokens(newTokens);
       return "AUTHORIZED";
-    } catch (_b) {
+    } catch (error) {
+      if (!(error instanceof OAuthError) || error instanceof ServerError) ;
+      else {
+        throw error;
+      }
     }
   }
   const state = provider.state ? await provider.state() : void 0;
@@ -16527,8 +16738,8 @@ function extractResourceMetadataUrl(res) {
     return void 0;
   }
 }
-async function discoverOAuthProtectedResourceMetadata(serverUrl, opts) {
-  const response = await discoverMetadataWithFallback(serverUrl, "oauth-protected-resource", {
+async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
+  const response = await discoverMetadataWithFallback(serverUrl, "oauth-protected-resource", fetchFn, {
     protocolVersion: opts === null || opts === void 0 ? void 0 : opts.protocolVersion,
     metadataUrl: opts === null || opts === void 0 ? void 0 : opts.resourceMetadataUrl
   });
@@ -16540,13 +16751,13 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts) {
   }
   return OAuthProtectedResourceMetadataSchema.parse(await response.json());
 }
-async function fetchWithCorsRetry(url, headers) {
+async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
   try {
-    return await fetch(url, { headers });
+    return await fetchFn(url, { headers });
   } catch (error) {
     if (error instanceof TypeError) {
       if (headers) {
-        return fetchWithCorsRetry(url);
+        return fetchWithCorsRetry(url, void 0, fetchFn);
       } else {
         return void 0;
       }
@@ -16554,23 +16765,22 @@ async function fetchWithCorsRetry(url, headers) {
     throw error;
   }
 }
-function buildWellKnownPath(wellKnownPrefix, pathname) {
-  let wellKnownPath = `/.well-known/${wellKnownPrefix}${pathname}`;
+function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
   if (pathname.endsWith("/")) {
-    wellKnownPath = wellKnownPath.slice(0, -1);
+    pathname = pathname.slice(0, -1);
   }
-  return wellKnownPath;
+  return options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
 }
-async function tryMetadataDiscovery(url, protocolVersion) {
+async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
   const headers = {
     "MCP-Protocol-Version": protocolVersion
   };
-  return await fetchWithCorsRetry(url, headers);
+  return await fetchWithCorsRetry(url, headers, fetchFn);
 }
 function shouldAttemptFallback(response, pathname) {
   return !response || response.status === 404 && pathname !== "/";
 }
-async function discoverMetadataWithFallback(serverUrl, wellKnownType, opts) {
+async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
   var _a, _b;
   const issuer = new URL(serverUrl);
   const protocolVersion = (_a = opts === null || opts === void 0 ? void 0 : opts.protocolVersion) !== null && _a !== void 0 ? _a : LATEST_PROTOCOL_VERSION;
@@ -16582,14 +16792,14 @@ async function discoverMetadataWithFallback(serverUrl, wellKnownType, opts) {
     url = new URL(wellKnownPath, (_b = opts === null || opts === void 0 ? void 0 : opts.metadataServerUrl) !== null && _b !== void 0 ? _b : issuer);
     url.search = issuer.search;
   }
-  let response = await tryMetadataDiscovery(url, protocolVersion);
+  let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn);
   if (!(opts === null || opts === void 0 ? void 0 : opts.metadataUrl) && shouldAttemptFallback(response, issuer.pathname)) {
     const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
-    response = await tryMetadataDiscovery(rootUrl, protocolVersion);
+    response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
   }
   return response;
 }
-async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolVersion } = {}) {
+async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolVersion } = {}, fetchFn = fetch) {
   if (typeof issuer === "string") {
     issuer = new URL(issuer);
   }
@@ -16600,7 +16810,7 @@ async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolV
     authorizationServerUrl = new URL(authorizationServerUrl);
   }
   protocolVersion !== null && protocolVersion !== void 0 ? protocolVersion : protocolVersion = LATEST_PROTOCOL_VERSION;
-  const response = await discoverMetadataWithFallback(issuer, "oauth-authorization-server", {
+  const response = await discoverMetadataWithFallback(authorizationServerUrl, "oauth-authorization-server", fetchFn, {
     protocolVersion,
     metadataServerUrl: authorizationServerUrl
   });
@@ -16612,6 +16822,70 @@ async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolV
   }
   return OAuthMetadataSchema.parse(await response.json());
 }
+function buildDiscoveryUrls(authorizationServerUrl) {
+  const url = typeof authorizationServerUrl === "string" ? new URL(authorizationServerUrl) : authorizationServerUrl;
+  const hasPath = url.pathname !== "/";
+  const urlsToTry = [];
+  if (!hasPath) {
+    urlsToTry.push({
+      url: new URL("/.well-known/oauth-authorization-server", url.origin),
+      type: "oauth"
+    });
+    urlsToTry.push({
+      url: new URL(`/.well-known/openid-configuration`, url.origin),
+      type: "oidc"
+    });
+    return urlsToTry;
+  }
+  let pathname = url.pathname;
+  if (pathname.endsWith("/")) {
+    pathname = pathname.slice(0, -1);
+  }
+  urlsToTry.push({
+    url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url.origin),
+    type: "oauth"
+  });
+  urlsToTry.push({
+    url: new URL("/.well-known/oauth-authorization-server", url.origin),
+    type: "oauth"
+  });
+  urlsToTry.push({
+    url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),
+    type: "oidc"
+  });
+  urlsToTry.push({
+    url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
+    type: "oidc"
+  });
+  return urlsToTry;
+}
+async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = LATEST_PROTOCOL_VERSION } = {}) {
+  var _a;
+  const headers = { "MCP-Protocol-Version": protocolVersion };
+  const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
+  for (const { url: endpointUrl, type: type2 } of urlsToTry) {
+    const response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
+    if (!response) {
+      throw new Error(`CORS error trying to load ${type2 === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
+    }
+    if (!response.ok) {
+      if (response.status >= 400 && response.status < 500) {
+        continue;
+      }
+      throw new Error(`HTTP ${response.status} trying to load ${type2 === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
+    }
+    if (type2 === "oauth") {
+      return OAuthMetadataSchema.parse(await response.json());
+    } else {
+      const metadata = OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
+      if (!((_a = metadata.code_challenge_methods_supported) === null || _a === void 0 ? void 0 : _a.includes("S256"))) {
+        throw new Error(`Incompatible OIDC provider at ${endpointUrl}: does not support S256 code challenge method required by MCP specification`);
+      }
+      return metadata;
+    }
+  }
+  return void 0;
+}
 async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
   const responseType = "code";
   const codeChallengeMethod = "S256";
@@ -16641,12 +16915,15 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
   if (scope) {
     authorizationUrl.searchParams.set("scope", scope);
   }
+  if (scope === null || scope === void 0 ? void 0 : scope.includes("offline_access")) {
+    authorizationUrl.searchParams.append("prompt", "consent");
+  }
   if (resource) {
     authorizationUrl.searchParams.set("resource", resource.href);
   }
   return { authorizationUrl, codeVerifier };
 }
-async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, codeVerifier, redirectUri, resource, addClientAuthentication }) {
+async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, codeVerifier, redirectUri, resource, addClientAuthentication, fetchFn }) {
   var _a;
   const grantType = "authorization_code";
   const tokenUrl = (metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint) ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl);
@@ -16654,7 +16931,8 @@ async function exchangeAuthorization(authorizationServerUrl, { metadata, clientI
     throw new Error(`Incompatible auth server: does not support grant type ${grantType}`);
   }
   const headers = new Headers({
-    "Content-Type": "application/x-www-form-urlencoded"
+    "Content-Type": "application/x-www-form-urlencoded",
+    "Accept": "application/json"
   });
   const params = new URLSearchParams({
     grant_type: grantType,
@@ -16672,17 +16950,17 @@ async function exchangeAuthorization(authorizationServerUrl, { metadata, clientI
   if (resource) {
     params.set("resource", resource.href);
   }
-  const response = await fetch(tokenUrl, {
+  const response = await (fetchFn !== null && fetchFn !== void 0 ? fetchFn : fetch)(tokenUrl, {
     method: "POST",
     headers,
     body: params
   });
   if (!response.ok) {
-    throw new Error(`Token exchange failed: HTTP ${response.status}`);
+    throw await parseErrorResponse(response);
   }
   return OAuthTokensSchema.parse(await response.json());
 }
-async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication }) {
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
   var _a;
   const grantType = "refresh_token";
   let tokenUrl;
@@ -16711,17 +16989,17 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
   if (resource) {
     params.set("resource", resource.href);
   }
-  const response = await fetch(tokenUrl, {
+  const response = await (fetchFn !== null && fetchFn !== void 0 ? fetchFn : fetch)(tokenUrl, {
     method: "POST",
     headers,
     body: params
   });
   if (!response.ok) {
-    throw new Error(`Token refresh failed: HTTP ${response.status}`);
+    throw await parseErrorResponse(response);
   }
   return OAuthTokensSchema.parse({ refresh_token: refreshToken, ...await response.json() });
 }
-async function registerClient(authorizationServerUrl, { metadata, clientMetadata }) {
+async function registerClient(authorizationServerUrl, { metadata, clientMetadata, fetchFn }) {
   let registrationUrl;
   if (metadata) {
     if (!metadata.registration_endpoint) {
@@ -16731,7 +17009,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
   } else {
     registrationUrl = new URL("/register", authorizationServerUrl);
   }
-  const response = await fetch(registrationUrl, {
+  const response = await (fetchFn !== null && fetchFn !== void 0 ? fetchFn : fetch)(registrationUrl, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
@@ -16739,7 +17017,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     body: JSON.stringify(clientMetadata)
   });
   if (!response.ok) {
-    throw new Error(`Dynamic client registration failed: HTTP ${response.status}`);
+    throw await parseErrorResponse(response);
   }
   return OAuthClientInformationFullSchema.parse(await response.json());
 }
@@ -23023,6 +23301,7 @@ class Protocol {
     this._responseHandlers = /* @__PURE__ */ new Map();
     this._progressHandlers = /* @__PURE__ */ new Map();
     this._timeoutInfo = /* @__PURE__ */ new Map();
+    this._pendingDebouncedNotifications = /* @__PURE__ */ new Set();
     this.setNotificationHandler(CancelledNotificationSchema, (notification) => {
       const controller = this._requestHandlerAbortControllers.get(notification.params.requestId);
       controller === null || controller === void 0 ? void 0 : controller.abort(notification.params.reason);
@@ -23104,6 +23383,7 @@ class Protocol {
     const responseHandlers = this._responseHandlers;
     this._responseHandlers = /* @__PURE__ */ new Map();
     this._progressHandlers.clear();
+    this._pendingDebouncedNotifications.clear();
     this._transport = void 0;
     (_a = this.onclose) === null || _a === void 0 ? void 0 : _a.call(this);
     const error = new McpError(ErrorCode.ConnectionClosed, "Connection closed");
@@ -23303,10 +23583,32 @@ class Protocol {
    * Emits a notification, which is a one-way message that does not expect a response.
    */
   async notification(notification, options) {
+    var _a, _b;
     if (!this._transport) {
       throw new Error("Not connected");
     }
     this.assertNotificationCapability(notification.method);
+    const debouncedMethods = (_b = (_a = this._options) === null || _a === void 0 ? void 0 : _a.debouncedNotificationMethods) !== null && _b !== void 0 ? _b : [];
+    const canDebounce = debouncedMethods.includes(notification.method) && !notification.params && !(options === null || options === void 0 ? void 0 : options.relatedRequestId);
+    if (canDebounce) {
+      if (this._pendingDebouncedNotifications.has(notification.method)) {
+        return;
+      }
+      this._pendingDebouncedNotifications.add(notification.method);
+      Promise.resolve().then(() => {
+        var _a2;
+        this._pendingDebouncedNotifications.delete(notification.method);
+        if (!this._transport) {
+          return;
+        }
+        const jsonrpcNotification2 = {
+          ...notification,
+          jsonrpc: "2.0"
+        };
+        (_a2 = this._transport) === null || _a2 === void 0 ? void 0 : _a2.send(jsonrpcNotification2, options).catch((error) => this._onerror(error));
+      });
+      return;
+    }
     const jsonrpcNotification = {
       ...notification,
       jsonrpc: "2.0"
@@ -23981,7 +24283,7 @@ class SSEClientTransport {
     }
     let result;
     try {
-      result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
+      result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl, fetchFn: this._fetch });
     } catch (error) {
       (_a = this.onerror) === null || _a === void 0 ? void 0 : _a.call(this, error);
       throw error;
@@ -24080,7 +24382,7 @@ class SSEClientTransport {
     if (!this._authProvider) {
       throw new UnauthorizedError("No auth provider");
     }
-    const result = await auth(this._authProvider, { serverUrl: this._url, authorizationCode, resourceMetadataUrl: this._resourceMetadataUrl });
+    const result = await auth(this._authProvider, { serverUrl: this._url, authorizationCode, resourceMetadataUrl: this._resourceMetadataUrl, fetchFn: this._fetch });
     if (result !== "AUTHORIZED") {
       throw new UnauthorizedError("Failed to authorize");
     }
@@ -24110,7 +24412,7 @@ class SSEClientTransport {
       if (!response.ok) {
         if (response.status === 401 && this._authProvider) {
           this._resourceMetadataUrl = extractResourceMetadataUrl(response);
-          const result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
+          const result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl, fetchFn: this._fetch });
           if (result !== "AUTHORIZED") {
             throw new UnauthorizedError();
           }
@@ -24180,7 +24482,7 @@ class StreamableHTTPClientTransport {
     }
     let result;
     try {
-      result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
+      result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl, fetchFn: this._fetch });
     } catch (error) {
       (_a = this.onerror) === null || _a === void 0 ? void 0 : _a.call(this, error);
       throw error;
@@ -24234,7 +24536,7 @@ class StreamableHTTPClientTransport {
         }
         throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
       }
-      this._handleSseStream(response.body, options);
+      this._handleSseStream(response.body, options, true);
     } catch (error) {
       (_c = this.onerror) === null || _c === void 0 ? void 0 : _c.call(this, error);
       throw error;
@@ -24285,7 +24587,7 @@ class StreamableHTTPClientTransport {
       });
     }, delay);
   }
-  _handleSseStream(stream, options) {
+  _handleSseStream(stream, options, isReconnectable) {
     if (!stream) {
       return;
     }
@@ -24318,17 +24620,15 @@ class StreamableHTTPClientTransport {
         }
       } catch (error) {
         (_c = this.onerror) === null || _c === void 0 ? void 0 : _c.call(this, new Error(`SSE stream disconnected: ${error}`));
-        if (this._abortController && !this._abortController.signal.aborted) {
-          if (lastEventId !== void 0) {
-            try {
-              this._scheduleReconnection({
-                resumptionToken: lastEventId,
-                onresumptiontoken,
-                replayMessageId
-              }, 0);
-            } catch (error2) {
-              (_d = this.onerror) === null || _d === void 0 ? void 0 : _d.call(this, new Error(`Failed to reconnect: ${error2 instanceof Error ? error2.message : String(error2)}`));
-            }
+        if (isReconnectable && this._abortController && !this._abortController.signal.aborted) {
+          try {
+            this._scheduleReconnection({
+              resumptionToken: lastEventId,
+              onresumptiontoken,
+              replayMessageId
+            }, 0);
+          } catch (error2) {
+            (_d = this.onerror) === null || _d === void 0 ? void 0 : _d.call(this, new Error(`Failed to reconnect: ${error2 instanceof Error ? error2.message : String(error2)}`));
           }
         }
       }
@@ -24348,7 +24648,7 @@ class StreamableHTTPClientTransport {
     if (!this._authProvider) {
       throw new UnauthorizedError("No auth provider");
     }
-    const result = await auth(this._authProvider, { serverUrl: this._url, authorizationCode, resourceMetadataUrl: this._resourceMetadataUrl });
+    const result = await auth(this._authProvider, { serverUrl: this._url, authorizationCode, resourceMetadataUrl: this._resourceMetadataUrl, fetchFn: this._fetch });
     if (result !== "AUTHORIZED") {
       throw new UnauthorizedError("Failed to authorize");
     }
@@ -24387,7 +24687,7 @@ class StreamableHTTPClientTransport {
       if (!response.ok) {
         if (response.status === 401 && this._authProvider) {
           this._resourceMetadataUrl = extractResourceMetadataUrl(response);
-          const result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
+          const result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl, fetchFn: this._fetch });
           if (result !== "AUTHORIZED") {
             throw new UnauthorizedError();
           }
@@ -24410,7 +24710,7 @@ class StreamableHTTPClientTransport {
       const contentType = response.headers.get("content-type");
       if (hasRequests) {
         if (contentType === null || contentType === void 0 ? void 0 : contentType.includes("text/event-stream")) {
-          this._handleSseStream(response.body, { onresumptiontoken });
+          this._handleSseStream(response.body, { onresumptiontoken }, false);
         } else if (contentType === null || contentType === void 0 ? void 0 : contentType.includes("application/json")) {
           const data2 = await response.json();
           const responseMessages = Array.isArray(data2) ? data2.map((msg) => JSONRPCMessageSchema.parse(msg)) : [JSONRPCMessageSchema.parse(data2)];
@@ -24479,7 +24779,7 @@ const StdErrNotificationSchema = NotificationSchema.extend({
 ClientNotificationSchema.or(
   StdErrNotificationSchema
 ).or(ServerNotificationSchema).or(NotificationSchema);
-const version$1 = "0.16.1";
+const version$1 = "0.16.2";
 const packageJson = {
   version: version$1
 };
@@ -24607,10 +24907,13 @@ function useConnection({
   env,
   bearerToken,
   headerName,
+  oauthClientId,
+  oauthScope,
   config,
   onNotification,
   onStdErrNotification,
   onPendingRequest,
+  onElicitationRequest,
   getRoots
 }) {
   const [connectionStatus, setConnectionStatus] = reactExports.useState("disconnected");
@@ -24621,7 +24924,21 @@ function useConnection({
     null
   );
   const [requestHistory, setRequestHistory] = reactExports.useState([]);
-  const [completionsSupported, setCompletionsSupported] = reactExports.useState(true);
+  const [completionsSupported, setCompletionsSupported] = reactExports.useState(false);
+  reactExports.useEffect(() => {
+    if (!oauthClientId) {
+      clearClientInformationFromSessionStorage({
+        serverUrl: sseUrl,
+        isPreregistered: true
+      });
+      return;
+    }
+    saveClientInformationToSessionStorage({
+      serverUrl: sseUrl,
+      clientInformation: { client_id: oauthClientId },
+      isPreregistered: true
+    });
+  }, [oauthClientId, sseUrl]);
   const pushHistory = (request, response) => {
     setRequestHistory((prev) => [
       ...prev,
@@ -24760,7 +25077,10 @@ function useConnection({
   const handleAuthError = async (error) => {
     if (is401Error(error)) {
       const serverAuthProvider = new InspectorOAuthClientProvider(sseUrl);
-      const result = await auth(serverAuthProvider, { serverUrl: sseUrl });
+      const result = await auth(serverAuthProvider, {
+        serverUrl: sseUrl,
+        scope: oauthScope
+      });
       return result === "AUTHORIZED";
     }
     return false;
@@ -24775,6 +25095,7 @@ function useConnection({
       {
         capabilities: {
           sampling: {},
+          elicitation: {},
           roots: {
             listChanged: true
           }
@@ -24934,7 +25255,7 @@ function useConnection({
         throw error;
       }
       setServerCapabilities(capabilities ?? null);
-      setCompletionsSupported(true);
+      setCompletionsSupported((capabilities == null ? void 0 : capabilities.completions) !== void 0);
       if (onPendingRequest) {
         client2.setRequestHandler(CreateMessageRequestSchema, (request) => {
           return new Promise((resolve, reject) => {
@@ -24947,6 +25268,13 @@ function useConnection({
           return { roots: getRoots() };
         });
       }
+      if (onElicitationRequest) {
+        client2.setRequestHandler(ElicitRequestSchema, async (request) => {
+          return new Promise((resolve) => {
+            onElicitationRequest(request, resolve);
+          });
+        });
+      }
       setMcpClient(client2);
       setConnectionStatus("connected");
     } catch (e) {
@@ -34003,10 +34331,10 @@ const JsonEditor = ({
 };
 const isSimpleObject = (schema) => {
   const supportedTypes = ["string", "number", "integer", "boolean", "null"];
-  if (supportedTypes.includes(schema.type)) return true;
+  if (schema.type && supportedTypes.includes(schema.type)) return true;
   if (schema.type === "object") {
     return Object.values(schema.properties ?? {}).every(
-      (prop) => supportedTypes.includes(prop.type)
+      (prop) => prop.type && supportedTypes.includes(prop.type)
     );
   }
   if (schema.type === "array") {
@@ -34130,20 +34458,95 @@ const DynamicJsonForm = ({
     }
     const isRequired = ((_a = parentSchema == null ? void 0 : parentSchema.required) == null ? void 0 : _a.includes(propertyName || "")) ?? false;
     switch (propSchema.type) {
-      case "string":
+      case "string": {
+        if (propSchema.oneOf && propSchema.oneOf.every(
+          (option) => typeof option.const === "string" && typeof option.title === "string"
+        )) {
+          return /* @__PURE__ */ jsxRuntimeExports.jsxs(
+            "select",
+            {
+              value: currentValue ?? "",
+              onChange: (e) => {
+                const val = e.target.value;
+                if (!val && !isRequired) {
+                  handleFieldChange(path, void 0);
+                } else {
+                  handleFieldChange(path, val);
+                }
+              },
+              required: isRequired,
+              className: "w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-800",
+              children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "", children: "Select an option..." }),
+                propSchema.oneOf.map((option) => /* @__PURE__ */ jsxRuntimeExports.jsx(
+                  "option",
+                  {
+                    value: option.const,
+                    children: option.title
+                  },
+                  option.const
+                ))
+              ]
+            }
+          );
+        }
+        if (propSchema.enum) {
+          return /* @__PURE__ */ jsxRuntimeExports.jsxs(
+            "select",
+            {
+              value: currentValue ?? "",
+              onChange: (e) => {
+                const val = e.target.value;
+                if (!val && !isRequired) {
+                  handleFieldChange(path, void 0);
+                } else {
+                  handleFieldChange(path, val);
+                }
+              },
+              required: isRequired,
+              className: "w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-800",
+              children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "", children: "Select an option..." }),
+                propSchema.enum.map((option) => /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: option, children: option }, option))
+              ]
+            }
+          );
+        }
+        let inputType = "text";
+        switch (propSchema.format) {
+          case "email":
+            inputType = "email";
+            break;
+          case "uri":
+            inputType = "url";
+            break;
+          case "date":
+            inputType = "date";
+            break;
+          case "date-time":
+            inputType = "datetime-local";
+            break;
+          default:
+            inputType = "text";
+            break;
+        }
         return /* @__PURE__ */ jsxRuntimeExports.jsx(
           Input,
           {
-            type: "text",
+            type: inputType,
             value: currentValue ?? "",
             onChange: (e) => {
               const val = e.target.value;
               handleFieldChange(path, val);
             },
             placeholder: propSchema.description,
-            required: isRequired
+            required: isRequired,
+            minLength: propSchema.minLength,
+            maxLength: propSchema.maxLength,
+            pattern: propSchema.pattern
           }
         );
+      }
       case "number":
         return /* @__PURE__ */ jsxRuntimeExports.jsx(
           Input,
@@ -34162,7 +34565,9 @@ const DynamicJsonForm = ({
               }
             },
             placeholder: propSchema.description,
-            required: isRequired
+            required: isRequired,
+            min: propSchema.minimum,
+            max: propSchema.maximum
           }
         );
       case "integer":
@@ -34184,7 +34589,9 @@ const DynamicJsonForm = ({
               }
             },
             placeholder: propSchema.description,
-            required: isRequired
+            required: isRequired,
+            min: propSchema.minimum,
+            max: propSchema.maximum
           }
         );
       case "boolean":
@@ -35856,7 +36263,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "0.16.1";
+const version = "0.16.2";
 var [createTooltipContext, createTooltipScope] = createContextScope("Tooltip", [
   createPopperScope
 ]);
@@ -36355,6 +36762,10 @@ const Sidebar = ({
   setBearerToken,
   headerName,
   setHeaderName,
+  oauthClientId,
+  setOauthClientId,
+  oauthScope,
+  setOauthScope,
   onConnect,
   onDisconnect,
   stdErrNotifications,
@@ -36367,7 +36778,7 @@ const Sidebar = ({
 }) => {
   const [theme, setTheme] = useTheme();
   const [showEnvVars, setShowEnvVars] = reactExports.useState(false);
-  const [showBearerToken, setShowBearerToken] = reactExports.useState(false);
+  const [showAuthConfig, setShowAuthConfig] = reactExports.useState(false);
   const [showConfig, setShowConfig] = reactExports.useState(false);
   const [shownEnvVars, setShownEnvVars] = reactExports.useState(/* @__PURE__ */ new Set());
   const [copiedServerEntry, setCopiedServerEntry] = reactExports.useState(false);
@@ -36524,22 +36935,10 @@ const Sidebar = ({
             }
           )
         ] })
-      ] }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-sm font-medium", htmlFor: "sse-url-input", children: "URL" }),
-          sseUrl ? /* @__PURE__ */ jsxRuntimeExports.jsxs(Tooltip, { children: [
-            /* @__PURE__ */ jsxRuntimeExports.jsx(TooltipTrigger, { asChild: true, children: /* @__PURE__ */ jsxRuntimeExports.jsx(
-              Input,
-              {
-                id: "sse-url-input",
-                placeholder: "URL",
-                value: sseUrl,
-                onChange: (e) => setSseUrl(e.target.value),
-                className: "font-mono"
-              }
-            ) }),
-            /* @__PURE__ */ jsxRuntimeExports.jsx(TooltipContent, { children: sseUrl })
-          ] }) : /* @__PURE__ */ jsxRuntimeExports.jsx(
+      ] }) : /* @__PURE__ */ jsxRuntimeExports.jsx(jsxRuntimeExports.Fragment, { children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-sm font-medium", htmlFor: "sse-url-input", children: "URL" }),
+        sseUrl ? /* @__PURE__ */ jsxRuntimeExports.jsxs(Tooltip, { children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx(TooltipTrigger, { asChild: true, children: /* @__PURE__ */ jsxRuntimeExports.jsx(
             Input,
             {
               id: "sse-url-input",
@@ -36548,58 +36947,19 @@ const Sidebar = ({
               onChange: (e) => setSseUrl(e.target.value),
               className: "font-mono"
             }
-          )
-        ] }),
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsxs(
-            Button,
-            {
-              variant: "outline",
-              onClick: () => setShowBearerToken(!showBearerToken),
-              className: "flex items-center w-full",
-              "data-testid": "auth-button",
-              "aria-expanded": showBearerToken,
-              children: [
-                showBearerToken ? /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronDown, { className: "w-4 h-4 mr-2" }) : /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronRight, { className: "w-4 h-4 mr-2" }),
-                "Authentication"
-              ]
-            }
-          ),
-          showBearerToken && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
-            /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-sm font-medium", children: "Header Name" }),
-            /* @__PURE__ */ jsxRuntimeExports.jsx(
-              Input,
-              {
-                placeholder: "Authorization",
-                onChange: (e) => setHeaderName && setHeaderName(e.target.value),
-                "data-testid": "header-input",
-                className: "font-mono",
-                value: headerName
-              }
-            ),
-            /* @__PURE__ */ jsxRuntimeExports.jsx(
-              "label",
-              {
-                className: "text-sm font-medium",
-                htmlFor: "bearer-token-input",
-                children: "Bearer Token"
-              }
-            ),
-            /* @__PURE__ */ jsxRuntimeExports.jsx(
-              Input,
-              {
-                id: "bearer-token-input",
-                placeholder: "Bearer Token",
-                value: bearerToken,
-                onChange: (e) => setBearerToken(e.target.value),
-                "data-testid": "bearer-token-input",
-                className: "font-mono",
-                type: "password"
-              }
-            )
-          ] })
-        ] })
-      ] }),
+          ) }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx(TooltipContent, { children: sseUrl })
+        ] }) : /* @__PURE__ */ jsxRuntimeExports.jsx(
+          Input,
+          {
+            id: "sse-url-input",
+            placeholder: "URL",
+            value: sseUrl,
+            onChange: (e) => setSseUrl(e.target.value),
+            className: "font-mono"
+          }
+        )
+      ] }) }),
       transportType === "stdio" && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsxs(
           Button,
@@ -36755,6 +37115,98 @@ const Sidebar = ({
           /* @__PURE__ */ jsxRuntimeExports.jsx(TooltipContent, { children: "Copy Servers File" })
         ] })
       ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs(
+          Button,
+          {
+            variant: "outline",
+            onClick: () => setShowAuthConfig(!showAuthConfig),
+            className: "flex items-center w-full",
+            "data-testid": "auth-button",
+            "aria-expanded": showAuthConfig,
+            children: [
+              showAuthConfig ? /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronDown, { className: "w-4 h-4 mr-2" }) : /* @__PURE__ */ jsxRuntimeExports.jsx(ChevronRight, { className: "w-4 h-4 mr-2" }),
+              "Authentication"
+            ]
+          }
+        ),
+        showAuthConfig && /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2 p-3 rounded border", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("h4", { className: "text-sm font-semibold flex items-center", children: "API Token Authentication" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-sm font-medium", children: "Header Name" }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                Input,
+                {
+                  placeholder: "Authorization",
+                  onChange: (e) => setHeaderName && setHeaderName(e.target.value),
+                  "data-testid": "header-input",
+                  className: "font-mono",
+                  value: headerName
+                }
+              ),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                "label",
+                {
+                  className: "text-sm font-medium",
+                  htmlFor: "bearer-token-input",
+                  children: "Bearer Token"
+                }
+              ),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                Input,
+                {
+                  id: "bearer-token-input",
+                  placeholder: "Bearer Token",
+                  value: bearerToken,
+                  onChange: (e) => setBearerToken(e.target.value),
+                  "data-testid": "bearer-token-input",
+                  className: "font-mono",
+                  type: "password"
+                }
+              )
+            ] })
+          ] }),
+          transportType !== "stdio" && // OAuth Configuration
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2 p-3  rounded border", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("h4", { className: "text-sm font-semibold flex items-center", children: "OAuth 2.0 Flow" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-sm font-medium", children: "Client ID" }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                Input,
+                {
+                  placeholder: "Client ID",
+                  onChange: (e) => setOauthClientId(e.target.value),
+                  value: oauthClientId,
+                  "data-testid": "oauth-client-id-input",
+                  className: "font-mono"
+                }
+              ),
+              /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-sm font-medium", children: "Redirect URL" }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                Input,
+                {
+                  readOnly: true,
+                  placeholder: "Redirect URL",
+                  value: window.location.origin + "/oauth/callback",
+                  className: "font-mono"
+                }
+              ),
+              /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-sm font-medium", children: "Scope" }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                Input,
+                {
+                  placeholder: "Scope (space-separated)",
+                  onChange: (e) => setOauthScope(e.target.value),
+                  value: oauthScope,
+                  "data-testid": "oauth-scope-input",
+                  className: "font-mono"
+                }
+              )
+            ] })
+          ] })
+        ] })
+      ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsxs(
           Button,
@@ -37302,42 +37754,112 @@ const Textarea = reactExports.forwardRef(
   }
 );
 Textarea.displayName = "Textarea";
-const checkContentCompatibility = (structuredContent, unstructuredContent) => {
-  if (unstructuredContent.length !== 1 || unstructuredContent[0].type !== "text") {
-    return {
-      isCompatible: false,
-      message: "Unstructured content is not a single text block"
-    };
+const ResourceLinkView = reactExports.memo(
+  ({
+    uri,
+    name,
+    description: description2,
+    mimeType,
+    resourceContent,
+    onReadResource
+  }) => {
+    const [{ expanded, loading }, setState] = reactExports.useState({
+      expanded: false,
+      loading: false
+    });
+    const expandedContent = reactExports.useMemo(
+      () => expanded && resourceContent ? /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mt-2", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex justify-between items-center mb-1", children: /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-semibold text-green-600", children: "Resource:" }) }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(JsonView, { data: resourceContent, className: "bg-background" })
+      ] }) : null,
+      [expanded, resourceContent]
+    );
+    const handleClick = reactExports.useCallback(() => {
+      if (!onReadResource) return;
+      if (!expanded) {
+        setState((prev) => ({ ...prev, expanded: true, loading: true }));
+        onReadResource(uri);
+        setState((prev) => ({ ...prev, loading: false }));
+      } else {
+        setState((prev) => ({ ...prev, expanded: false }));
+      }
+    }, [expanded, onReadResource, uri]);
+    const handleKeyDown = reactExports.useCallback(
+      (e) => {
+        if ((e.key === "Enter" || e.key === " ") && onReadResource) {
+          e.preventDefault();
+          handleClick();
+        }
+      },
+      [handleClick, onReadResource]
+    );
+    return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-sm text-foreground bg-secondary py-2 px-3 rounded", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsx(
+        "div",
+        {
+          className: "flex justify-between items-center cursor-pointer focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-500 focus-visible:ring-offset-1 rounded",
+          onClick: onReadResource ? handleClick : void 0,
+          onKeyDown: onReadResource ? handleKeyDown : void 0,
+          tabIndex: onReadResource ? 0 : -1,
+          role: "button",
+          "aria-expanded": expanded,
+          "aria-label": `${expanded ? "Collapse" : "Expand"} resource ${uri}`,
+          children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1 min-w-0", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-start justify-between gap-2 mb-1", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-sm text-blue-600 dark:text-blue-400 hover:text-blue-800 dark:hover:text-blue-300 hover:underline px-1 py-0.5 break-all font-mono flex-1 min-w-0", children: uri }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2 flex-shrink-0", children: [
+                mimeType && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-blue-100 text-blue-800 dark:bg-blue-900 dark:text-blue-200", children: mimeType }),
+                onReadResource && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "ml-2 flex-shrink-0", "aria-hidden": "true", children: loading ? /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "w-4 h-4 border-2 border-blue-500 border-t-transparent rounded-full animate-spin" }) : /* @__PURE__ */ jsxRuntimeExports.jsx("span", { children: expanded ? "▼" : "▶" }) })
+              ] })
+            ] }),
+            name && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "font-semibold text-sm text-gray-900 dark:text-gray-100 mb-1", children: name }),
+            description2 && /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-sm text-gray-600 dark:text-gray-300 leading-relaxed", children: description2 })
+          ] })
+        }
+      ),
+      expandedContent
+    ] });
   }
-  const textContent = unstructuredContent[0].text;
-  if (!textContent) {
+);
+const checkContentCompatibility = (structuredContent, unstructuredContent) => {
+  const textBlocks = unstructuredContent.filter(
+    (block) => block.type === "text"
+  );
+  if (textBlocks.length === 0) {
     return {
       isCompatible: false,
-      message: "Text content is empty"
+      message: "No text blocks to match structured content"
     };
   }
-  try {
-    const parsedContent = JSON.parse(textContent);
-    const isEqual = JSON.stringify(parsedContent) === JSON.stringify(structuredContent);
-    if (isEqual) {
-      return {
-        isCompatible: true,
-        message: "Unstructured content matches structured content"
-      };
-    } else {
-      return {
-        isCompatible: false,
-        message: "Parsed JSON does not match structured content"
-      };
+  for (const textBlock of textBlocks) {
+    const textContent = textBlock.text;
+    if (!textContent) {
+      continue;
+    }
+    try {
+      const parsedContent = JSON.parse(textContent);
+      const isEqual = JSON.stringify(parsedContent) === JSON.stringify(structuredContent);
+      if (isEqual) {
+        return {
+          isCompatible: true,
+          message: `Structured content matches text block${textBlocks.length > 1 ? " (multiple blocks)" : ""}${unstructuredContent.length > textBlocks.length ? " + other content" : ""}`
+        };
+      }
+    } catch {
+      continue;
     }
-  } catch {
-    return {
-      isCompatible: false,
-      message: "Unstructured content is not valid JSON"
-    };
   }
+  return {
+    isCompatible: false,
+    message: "No text block matches structured content"
+  };
 };
-const ToolResults = ({ toolResult, selectedTool }) => {
+const ToolResults = ({
+  toolResult,
+  selectedTool,
+  resourceContent,
+  onReadResource
+}) => {
   if (!toolResult) return null;
   if ("content" in toolResult) {
     const parsedResult = CallToolResultSchema.safeParse(toolResult);
@@ -37434,7 +37956,18 @@ const ToolResults = ({ toolResult, selectedTool }) => {
                 className: "w-full",
                 children: /* @__PURE__ */ jsxRuntimeExports.jsx("p", { children: "Your browser does not support audio playback" })
               }
-            ) : /* @__PURE__ */ jsxRuntimeExports.jsx(JsonView, { data: item.resource }))
+            ) : /* @__PURE__ */ jsxRuntimeExports.jsx(JsonView, { data: item.resource })),
+            item.type === "resource_link" && /* @__PURE__ */ jsxRuntimeExports.jsx(
+              ResourceLinkView,
+              {
+                uri: item.uri,
+                name: item.name,
+                description: item.description,
+                mimeType: item.mimeType,
+                resourceContent: resourceContent[item.uri] || "",
+                onReadResource
+              }
+            )
           ] }, index2);
         })
       ] })
@@ -37455,7 +37988,9 @@ const ToolsTab = ({
   selectedTool,
   setSelectedTool,
   toolResult,
-  nextCursor
+  nextCursor,
+  resourceContent,
+  onReadResource
 }) => {
   const [params, setParams] = reactExports.useState({});
   const [isToolRunning, setIsToolRunning] = reactExports.useState(false);
@@ -37656,19 +38191,159 @@ const ToolsTab = ({
           ToolResults,
           {
             toolResult,
-            selectedTool
+            selectedTool,
+            resourceContent,
+            onReadResource
           }
         )
       ] }) : /* @__PURE__ */ jsxRuntimeExports.jsx(Alert, { children: /* @__PURE__ */ jsxRuntimeExports.jsx(AlertDescription, { children: "Select a tool from the list to view its details and run it" }) }) })
     ] })
   ] }) });
 };
+const ElicitationRequest = ({
+  request,
+  onResolve
+}) => {
+  const [formData, setFormData] = reactExports.useState({});
+  const [validationError, setValidationError] = reactExports.useState(null);
+  reactExports.useEffect(() => {
+    const defaultValue = generateDefaultValue(request.request.requestedSchema);
+    setFormData(defaultValue);
+    setValidationError(null);
+  }, [request.request.requestedSchema]);
+  const validateEmailFormat = (email) => {
+    const emailRegex2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    return emailRegex2.test(email);
+  };
+  const validateFormData = (data2, schema) => {
+    if (schema.type === "object" && schema.properties && typeof data2 === "object" && data2 !== null) {
+      const dataObj = data2;
+      if (Array.isArray(schema.required)) {
+        for (const field of schema.required) {
+          const value = dataObj[field];
+          if (value === void 0 || value === null || value === "") {
+            setValidationError(`Required field missing: ${field}`);
+            return false;
+          }
+        }
+      }
+      for (const [fieldName, fieldValue] of Object.entries(dataObj)) {
+        const fieldSchema = schema.properties[fieldName];
+        if (fieldSchema && fieldSchema.format === "email" && typeof fieldValue === "string") {
+          if (!validateEmailFormat(fieldValue)) {
+            setValidationError(`Invalid email format: ${fieldName}`);
+            return false;
+          }
+        }
+      }
+    }
+    return true;
+  };
+  const handleAccept = () => {
+    try {
+      if (!validateFormData(formData, request.request.requestedSchema)) {
+        return;
+      }
+      const ajv2 = new Ajv();
+      const validate2 = ajv2.compile(request.request.requestedSchema);
+      const isValid2 = validate2(formData);
+      if (!isValid2) {
+        const errorMessage = ajv2.errorsText(validate2.errors);
+        setValidationError(errorMessage);
+        return;
+      }
+      onResolve(request.id, {
+        action: "accept",
+        content: formData
+      });
+    } catch (error) {
+      setValidationError(
+        error instanceof Error ? error.message : "Validation failed"
+      );
+    }
+  };
+  const handleDecline = () => {
+    onResolve(request.id, { action: "decline" });
+  };
+  const handleCancel = () => {
+    onResolve(request.id, { action: "cancel" });
+  };
+  const schemaTitle = request.request.requestedSchema.title || "Information Request";
+  const schemaDescription = request.request.requestedSchema.description;
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs(
+    "div",
+    {
+      "data-testid": "elicitation-request",
+      className: "flex gap-4 p-4 border rounded-lg space-y-4",
+      children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex-1 bg-gray-50 dark:bg-gray-800 dark:text-gray-100 p-2 rounded", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("h4", { className: "font-semibold", children: schemaTitle }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-sm", children: request.request.message }),
+          schemaDescription && /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-xs text-muted-foreground", children: schemaDescription }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mt-2", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("h5", { className: "text-xs font-medium mb-1", children: "Request Schema:" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(
+              JsonView,
+              {
+                data: JSON.stringify(request.request.requestedSchema, null, 2)
+              }
+            )
+          ] })
+        ] }) }),
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1 space-y-4", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "space-y-2", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("h4", { className: "font-medium", children: "Response Form" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(
+              DynamicJsonForm,
+              {
+                schema: request.request.requestedSchema,
+                value: formData,
+                onChange: (newValue) => {
+                  setFormData(newValue);
+                  setValidationError(null);
+                }
+              }
+            ),
+            validationError && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "mt-4 p-3 bg-red-50 dark:bg-red-900/20 border border-red-200 dark:border-red-800 rounded-md", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-sm text-red-600 dark:text-red-400", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("strong", { children: "Validation Error:" }),
+              " ",
+              validationError
+            ] }) })
+          ] }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex space-x-2 mt-1", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx(Button, { type: "button", onClick: handleAccept, children: "Submit" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(Button, { type: "button", variant: "outline", onClick: handleDecline, children: "Decline" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(Button, { type: "button", variant: "outline", onClick: handleCancel, children: "Cancel" })
+          ] })
+        ] })
+      ]
+    }
+  );
+};
+const ElicitationTab = ({ pendingRequests, onResolve }) => {
+  return /* @__PURE__ */ jsxRuntimeExports.jsx(TabsContent, { value: "elicitations", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "h-96", children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsx(Alert, { children: /* @__PURE__ */ jsxRuntimeExports.jsx(AlertDescription, { children: "When the server requests information from the user, requests will appear here for response." }) }),
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mt-4 space-y-4", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsx("h3", { className: "text-lg font-semibold", children: "Recent Requests" }),
+      pendingRequests.map((request) => /* @__PURE__ */ jsxRuntimeExports.jsx(
+        ElicitationRequest,
+        {
+          request,
+          onResolve
+        },
+        request.id
+      )),
+      pendingRequests.length === 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-gray-500", children: "No pending requests" })
+    ] })
+  ] }) });
+};
 const CONFIG_LOCAL_STORAGE_KEY = "inspectorConfig_v1";
 const App = () => {
   var _a;
   const [resources, setResources] = reactExports.useState([]);
   const [resourceTemplates, setResourceTemplates] = reactExports.useState([]);
   const [resourceContent, setResourceContent] = reactExports.useState("");
+  const [resourceContentMap, setResourceContentMap] = reactExports.useState({});
   const [prompts, setPrompts] = reactExports.useState([]);
   const [promptContent, setPromptContent] = reactExports.useState("");
   const [tools, setTools] = reactExports.useState([]);
@@ -37696,7 +38371,14 @@ const App = () => {
   const [headerName, setHeaderName] = reactExports.useState(() => {
     return localStorage.getItem("lastHeaderName") || "";
   });
+  const [oauthClientId, setOauthClientId] = reactExports.useState(() => {
+    return localStorage.getItem("lastOauthClientId") || "";
+  });
+  const [oauthScope, setOauthScope] = reactExports.useState(() => {
+    return localStorage.getItem("lastOauthScope") || "";
+  });
   const [pendingSampleRequests, setPendingSampleRequests] = reactExports.useState([]);
+  const [pendingElicitationRequests, setPendingElicitationRequests] = reactExports.useState([]);
   const [isAuthDebuggerVisible, setIsAuthDebuggerVisible] = reactExports.useState(false);
   const [authState, setAuthState] = reactExports.useState(EMPTY_DEBUGGER_STATE);
   const updateAuthState = (updates) => {
@@ -37715,6 +38397,16 @@ const App = () => {
   const [nextPromptCursor, setNextPromptCursor] = reactExports.useState();
   const [nextToolCursor, setNextToolCursor] = reactExports.useState();
   const progressTokenRef = reactExports.useRef(0);
+  const [activeTab, setActiveTab] = reactExports.useState(() => {
+    const hash = window.location.hash.slice(1);
+    const initialTab = hash || "resources";
+    return initialTab;
+  });
+  const currentTabRef = reactExports.useRef(activeTab);
+  const lastToolCallOriginTabRef = reactExports.useRef(activeTab);
+  reactExports.useEffect(() => {
+    currentTabRef.current = activeTab;
+  }, [activeTab]);
   const { height: historyPaneHeight, handleDragStart } = useDraggablePane(300);
   const {
     width: sidebarWidth,
@@ -37740,6 +38432,8 @@ const App = () => {
     env,
     bearerToken,
     headerName,
+    oauthClientId,
+    oauthScope,
     config,
     onNotification: (notification) => {
       setNotifications((prev) => [...prev, notification]);
@@ -37756,8 +38450,50 @@ const App = () => {
         { id: nextRequestId.current++, request, resolve, reject }
       ]);
     },
+    onElicitationRequest: (request, resolve) => {
+      const currentTab = lastToolCallOriginTabRef.current;
+      setPendingElicitationRequests((prev) => [
+        ...prev,
+        {
+          id: nextRequestId.current++,
+          request: {
+            id: nextRequestId.current,
+            message: request.params.message,
+            requestedSchema: request.params.requestedSchema
+          },
+          originatingTab: currentTab,
+          resolve,
+          decline: (error) => {
+            console.error("Elicitation request rejected:", error);
+          }
+        }
+      ]);
+      setActiveTab("elicitations");
+      window.location.hash = "elicitations";
+    },
     getRoots: () => rootsRef.current
   });
+  reactExports.useEffect(() => {
+    if (serverCapabilities) {
+      const hash = window.location.hash.slice(1);
+      const validTabs = [
+        ...(serverCapabilities == null ? void 0 : serverCapabilities.resources) ? ["resources"] : [],
+        ...(serverCapabilities == null ? void 0 : serverCapabilities.prompts) ? ["prompts"] : [],
+        ...(serverCapabilities == null ? void 0 : serverCapabilities.tools) ? ["tools"] : [],
+        "ping",
+        "sampling",
+        "elicitations",
+        "roots",
+        "auth"
+      ];
+      const isValidTab = validTabs.includes(hash);
+      if (!isValidTab) {
+        const defaultTab = (serverCapabilities == null ? void 0 : serverCapabilities.resources) ? "resources" : (serverCapabilities == null ? void 0 : serverCapabilities.prompts) ? "prompts" : (serverCapabilities == null ? void 0 : serverCapabilities.tools) ? "tools" : "ping";
+        setActiveTab(defaultTab);
+        window.location.hash = defaultTab;
+      }
+    }
+  }, [serverCapabilities]);
   reactExports.useEffect(() => {
     localStorage.setItem("lastCommand", command);
   }, [command]);
@@ -37776,6 +38512,12 @@ const App = () => {
   reactExports.useEffect(() => {
     localStorage.setItem("lastHeaderName", headerName);
   }, [headerName]);
+  reactExports.useEffect(() => {
+    localStorage.setItem("lastOauthClientId", oauthClientId);
+  }, [oauthClientId]);
+  reactExports.useEffect(() => {
+    localStorage.setItem("lastOauthScope", oauthScope);
+  }, [oauthScope]);
   reactExports.useEffect(() => {
     saveInspectorConfig(CONFIG_LOCAL_STORAGE_KEY, config);
   }, [config]);
@@ -37894,6 +38636,16 @@ const App = () => {
       window.location.hash = "resources";
     }
   }, []);
+  reactExports.useEffect(() => {
+    const handleHashChange = () => {
+      const hash = window.location.hash.slice(1);
+      if (hash && hash !== activeTab) {
+        setActiveTab(hash);
+      }
+    };
+    window.addEventListener("hashchange", handleHashChange);
+    return () => window.removeEventListener("hashchange", handleHashChange);
+  }, [activeTab]);
   const handleApproveSampling = (id, result) => {
     setPendingSampleRequests((prev) => {
       const request = prev.find((r2) => r2.id === id);
@@ -37908,6 +38660,36 @@ const App = () => {
       return prev.filter((r2) => r2.id !== id);
     });
   };
+  const handleResolveElicitation = (id, response) => {
+    setPendingElicitationRequests((prev) => {
+      const request = prev.find((r2) => r2.id === id);
+      if (request) {
+        request.resolve(response);
+        if (request.originatingTab) {
+          const originatingTab = request.originatingTab;
+          const validTabs = [
+            ...(serverCapabilities == null ? void 0 : serverCapabilities.resources) ? ["resources"] : [],
+            ...(serverCapabilities == null ? void 0 : serverCapabilities.prompts) ? ["prompts"] : [],
+            ...(serverCapabilities == null ? void 0 : serverCapabilities.tools) ? ["tools"] : [],
+            "ping",
+            "sampling",
+            "elicitations",
+            "roots",
+            "auth"
+          ];
+          if (validTabs.includes(originatingTab)) {
+            setActiveTab(originatingTab);
+            window.location.hash = originatingTab;
+            setTimeout(() => {
+              setActiveTab(originatingTab);
+              window.location.hash = originatingTab;
+            }, 100);
+          }
+        }
+      }
+      return prev.filter((r2) => r2.id !== id);
+    });
+  };
   const clearError = (tabKey) => {
     setErrors((prev) => ({ ...prev, [tabKey]: null }));
   };
@@ -37955,7 +38737,20 @@ const App = () => {
     );
     setNextResourceTemplateCursor(response.nextCursor);
   };
+  const getPrompt = async (name, args2 = {}) => {
+    lastToolCallOriginTabRef.current = currentTabRef.current;
+    const response = await sendMCPRequest(
+      {
+        method: "prompts/get",
+        params: { name, arguments: args2 }
+      },
+      GetPromptResultSchema,
+      "prompts"
+    );
+    setPromptContent(JSON.stringify(response, null, 2));
+  };
   const readResource = async (uri) => {
+    lastToolCallOriginTabRef.current = currentTabRef.current;
     const response = await sendMCPRequest(
       {
         method: "resources/read",
@@ -37964,7 +38759,12 @@ const App = () => {
       ReadResourceResultSchema,
       "resources"
     );
-    setResourceContent(JSON.stringify(response, null, 2));
+    const content = JSON.stringify(response, null, 2);
+    setResourceContent(content);
+    setResourceContentMap((prev) => ({
+      ...prev,
+      [uri]: content
+    }));
   };
   const subscribeToResource = async (uri) => {
     if (!resourceSubscriptions.has(uri)) {
@@ -38008,17 +38808,6 @@ const App = () => {
     setPrompts(response.prompts);
     setNextPromptCursor(response.nextCursor);
   };
-  const getPrompt = async (name, args2 = {}) => {
-    const response = await sendMCPRequest(
-      {
-        method: "prompts/get",
-        params: { name, arguments: args2 }
-      },
-      GetPromptResultSchema,
-      "prompts"
-    );
-    setPromptContent(JSON.stringify(response, null, 2));
-  };
   const listTools = async () => {
     const response = await sendMCPRequest(
       {
@@ -38033,6 +38822,7 @@ const App = () => {
     cacheToolOutputSchemas(response.tools);
   };
   const callTool = async (name, params) => {
+    lastToolCallOriginTabRef.current = currentTabRef.current;
     try {
       const response = await sendMCPRequest(
         {
@@ -38089,13 +38879,13 @@ const App = () => {
   ) });
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-CaDIOg8Q.js"), true ? __vite__mapDeps([0,1]) : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-CC1cu0Zx.js"), true ? __vite__mapDeps([0,1]) : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-Ccjj44Wa.js"), true ? __vite__mapDeps([2,1]) : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-_4BLxVDe.js"), true ? __vite__mapDeps([2,1]) : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }
@@ -38131,6 +38921,10 @@ const App = () => {
               setBearerToken,
               headerName,
               setHeaderName,
+              oauthClientId,
+              setOauthClientId,
+              oauthScope,
+              setOauthScope,
               onConnect: connectMcpServer,
               onDisconnect: disconnectMcpServer,
               stdErrNotifications,
@@ -38165,11 +38959,12 @@ const App = () => {
       /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex-1 overflow-auto", children: mcpClient ? /* @__PURE__ */ jsxRuntimeExports.jsxs(
         Tabs,
         {
-          defaultValue: Object.keys(serverCapabilities ?? {}).includes(
-            window.location.hash.slice(1)
-          ) ? window.location.hash.slice(1) : (serverCapabilities == null ? void 0 : serverCapabilities.resources) ? "resources" : (serverCapabilities == null ? void 0 : serverCapabilities.prompts) ? "prompts" : (serverCapabilities == null ? void 0 : serverCapabilities.tools) ? "tools" : "ping",
+          value: activeTab,
           className: "w-full p-4",
-          onValueChange: (value) => window.location.hash = value,
+          onValueChange: (value) => {
+            setActiveTab(value);
+            window.location.hash = value;
+          },
           children: [
             /* @__PURE__ */ jsxRuntimeExports.jsxs(TabsList, { className: "mb-4 py-0", children: [
               /* @__PURE__ */ jsxRuntimeExports.jsxs(
@@ -38214,6 +39009,11 @@ const App = () => {
                 "Sampling",
                 pendingSampleRequests.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "absolute -top-1 -right-1 bg-red-500 text-white text-xs rounded-full h-4 w-4 flex items-center justify-center", children: pendingSampleRequests.length })
               ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs(TabsTrigger, { value: "elicitations", className: "relative", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx(MessageSquare, { className: "w-4 h-4 mr-2" }),
+                "Elicitations",
+                pendingElicitationRequests.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "absolute -top-1 -right-1 bg-red-500 text-white text-xs rounded-full h-4 w-4 flex items-center justify-center", children: pendingElicitationRequests.length })
+              ] }),
               /* @__PURE__ */ jsxRuntimeExports.jsxs(TabsTrigger, { value: "roots", children: [
                 /* @__PURE__ */ jsxRuntimeExports.jsx(FolderTree, { className: "w-4 h-4 mr-2" }),
                 "Roots"
@@ -38342,7 +39142,12 @@ const App = () => {
                   },
                   toolResult,
                   nextCursor: nextToolCursor,
-                  error: errors.tools
+                  error: errors.tools,
+                  resourceContent: resourceContentMap,
+                  onReadResource: (uri) => {
+                    clearError("resources");
+                    readResource(uri);
+                  }
                 }
               ),
               /* @__PURE__ */ jsxRuntimeExports.jsx(ConsoleTab, {}),
@@ -38367,6 +39172,13 @@ const App = () => {
                   onReject: handleRejectSampling
                 }
               ),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                ElicitationTab,
+                {
+                  pendingRequests: pendingElicitationRequests,
+                  onResolve: handleResolveElicitation
+                }
+              ),
               /* @__PURE__ */ jsxRuntimeExports.jsx(
                 RootsTab,
                 {