@modelcontextprotocol/inspector 0.16.3 → 0.16.4

package/client/dist/assets/{OAuthCallback-DCwiUoWl.js → OAuthCallback-DyaAiF-O.js}

@@ -1,5 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-CHDvjhl9.js";
-import { p as parseOAuthCallbackParams, g as generateOAuthErrorDescription } from "./oauthUtils-DTcoXpSP.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-MFoeZZBS.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();
   const hasProcessedRef = reactExports.useRef(false);

package/client/dist/assets/{OAuthDebugCallback-BNuktUej.js → OAuthDebugCallback-BD-zJllm.js}

@@ -1,5 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, j as jsxRuntimeExports } from "./index-CHDvjhl9.js";
-import { p as parseOAuthCallbackParams, g as generateOAuthErrorDescription } from "./oauthUtils-DTcoXpSP.js";
+import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-MFoeZZBS.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {
     let isProcessed = false;

package/client/dist/assets/{index-CHDvjhl9.js → index-MFoeZZBS.js}

@@ -1,4 +1,3 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/OAuthCallback-DCwiUoWl.js","assets/oauthUtils-DTcoXpSP.js","assets/OAuthDebugCallback-BNuktUej.js"])))=>i.map(i=>d[i]);
 function _mergeNamespaces(n, m2) {
   for (var i = 0; i < m2.length; i++) {
     const e = m2[i];
@@ -1123,13 +1122,13 @@ function requireReactDom_production_min() {
   function lb(a, b) {
     return null == a || "http://www.w3.org/1999/xhtml" === a ? kb(b) : "http://www.w3.org/2000/svg" === a && "foreignObject" === b ? "http://www.w3.org/1999/xhtml" : a;
   }
-  var mb, nb = function(a) {
+  var mb, nb = (function(a) {
     return "undefined" !== typeof MSApp && MSApp.execUnsafeLocalFunction ? function(b, c, d, e) {
       MSApp.execUnsafeLocalFunction(function() {
         return a(b, c, d, e);
       });
     } : a;
-  }(function(a, b) {
+  })(function(a, b) {
     if ("http://www.w3.org/2000/svg" !== a.namespaceURI || "innerHTML" in a) a.innerHTML = b;
     else {
       mb = mb || document.createElement("div");
@@ -7809,7 +7808,7 @@ function usePresence(present) {
       const ownerWindow = node.ownerDocument.defaultView ?? window;
       const handleAnimationEnd = (event) => {
         const currentAnimationName = getAnimationName(stylesRef.current);
-        const isCurrentAnimation = currentAnimationName.includes(event.animationName);
+        const isCurrentAnimation = currentAnimationName.includes(CSS.escape(event.animationName));
         if (event.target === node && isCurrentAnimation) {
           send("ANIMATION_END");
           if (!prevPresentRef.current) {
@@ -8163,7 +8162,6 @@ var FocusProxy = reactExports.forwardRef(
     return /* @__PURE__ */ jsxRuntimeExports.jsx(
       VisuallyHidden,
       {
-        "aria-hidden": true,
         tabIndex: 0,
         ...proxyProps,
         ref: forwardedRef,
@@ -8317,7 +8315,6 @@ var ToastImpl = reactExports.forwardRef(
           __scopeToast,
           role: "status",
           "aria-live": type2 === "foreground" ? "assertive" : "polite",
-          "aria-atomic": true,
           children: announceTextContent
         }
       ),
@@ -8333,9 +8330,6 @@ var ToastImpl = reactExports.forwardRef(
             children: /* @__PURE__ */ jsxRuntimeExports.jsx(
               Primitive.li,
               {
-                role: "status",
-                "aria-live": "off",
-                "aria-atomic": true,
                 tabIndex: 0,
                 "data-state": open ? "open" : "closed",
                 "data-swipe-direction": context.swipeDirection,
@@ -16258,151 +16252,6 @@ const EMPTY_DEBUGGER_STATE = {
   statusMessage: null,
   validationError: null
 };
-const getClientInformationFromSessionStorage = async ({
-  serverUrl,
-  isPreregistered
-}) => {
-  const key = getServerSpecificKey(
-    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
-    serverUrl
-  );
-  const value = sessionStorage.getItem(key);
-  if (!value) {
-    return void 0;
-  }
-  return await OAuthClientInformationSchema.parseAsync(JSON.parse(value));
-};
-const saveClientInformationToSessionStorage = ({
-  serverUrl,
-  clientInformation,
-  isPreregistered
-}) => {
-  const key = getServerSpecificKey(
-    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
-    serverUrl
-  );
-  sessionStorage.setItem(key, JSON.stringify(clientInformation));
-};
-const clearClientInformationFromSessionStorage = ({
-  serverUrl,
-  isPreregistered
-}) => {
-  const key = getServerSpecificKey(
-    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
-    serverUrl
-  );
-  sessionStorage.removeItem(key);
-};
-class InspectorOAuthClientProvider {
-  constructor(serverUrl) {
-    this.serverUrl = serverUrl;
-    sessionStorage.setItem(SESSION_KEYS.SERVER_URL, serverUrl);
-  }
-  get redirectUrl() {
-    return window.location.origin + "/oauth/callback";
-  }
-  get clientMetadata() {
-    return {
-      redirect_uris: [this.redirectUrl],
-      token_endpoint_auth_method: "none",
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      client_name: "MCP Inspector",
-      client_uri: "https://github.com/modelcontextprotocol/inspector"
-    };
-  }
-  async clientInformation() {
-    const preregisteredClientInformation = await getClientInformationFromSessionStorage({
-      serverUrl: this.serverUrl,
-      isPreregistered: true
-    });
-    return preregisteredClientInformation ?? await getClientInformationFromSessionStorage({
-      serverUrl: this.serverUrl,
-      isPreregistered: false
-    });
-  }
-  saveClientInformation(clientInformation) {
-    saveClientInformationToSessionStorage({
-      serverUrl: this.serverUrl,
-      clientInformation,
-      isPreregistered: false
-    });
-  }
-  async tokens() {
-    const key = getServerSpecificKey(SESSION_KEYS.TOKENS, this.serverUrl);
-    const tokens = sessionStorage.getItem(key);
-    if (!tokens) {
-      return void 0;
-    }
-    return await OAuthTokensSchema.parseAsync(JSON.parse(tokens));
-  }
-  saveTokens(tokens) {
-    const key = getServerSpecificKey(SESSION_KEYS.TOKENS, this.serverUrl);
-    sessionStorage.setItem(key, JSON.stringify(tokens));
-  }
-  redirectToAuthorization(authorizationUrl) {
-    window.location.href = authorizationUrl.href;
-  }
-  saveCodeVerifier(codeVerifier) {
-    const key = getServerSpecificKey(
-      SESSION_KEYS.CODE_VERIFIER,
-      this.serverUrl
-    );
-    sessionStorage.setItem(key, codeVerifier);
-  }
-  codeVerifier() {
-    const key = getServerSpecificKey(
-      SESSION_KEYS.CODE_VERIFIER,
-      this.serverUrl
-    );
-    const verifier = sessionStorage.getItem(key);
-    if (!verifier) {
-      throw new Error("No code verifier saved for session");
-    }
-    return verifier;
-  }
-  clear() {
-    clearClientInformationFromSessionStorage({
-      serverUrl: this.serverUrl,
-      isPreregistered: false
-    });
-    sessionStorage.removeItem(
-      getServerSpecificKey(SESSION_KEYS.TOKENS, this.serverUrl)
-    );
-    sessionStorage.removeItem(
-      getServerSpecificKey(SESSION_KEYS.CODE_VERIFIER, this.serverUrl)
-    );
-  }
-}
-class DebugInspectorOAuthClientProvider extends InspectorOAuthClientProvider {
-  get redirectUrl() {
-    return `${window.location.origin}/oauth/callback/debug`;
-  }
-  saveServerMetadata(metadata) {
-    const key = getServerSpecificKey(
-      SESSION_KEYS.SERVER_METADATA,
-      this.serverUrl
-    );
-    sessionStorage.setItem(key, JSON.stringify(metadata));
-  }
-  getServerMetadata() {
-    const key = getServerSpecificKey(
-      SESSION_KEYS.SERVER_METADATA,
-      this.serverUrl
-    );
-    const metadata = sessionStorage.getItem(key);
-    if (!metadata) {
-      return null;
-    }
-    return JSON.parse(metadata);
-  }
-  clear() {
-    super.clear();
-    sessionStorage.removeItem(
-      getServerSpecificKey(SESSION_KEYS.SERVER_METADATA, this.serverUrl)
-    );
-  }
-}
 let crypto$1;
 crypto$1 = globalThis.crypto;
 async function getRandomValues(size2) {
@@ -16653,7 +16502,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
     }
     const fullInformation = await registerClient(authorizationServerUrl, {
       metadata,
-      clientMetadata: provider.clientMetadata
+      clientMetadata: provider.clientMetadata,
+      fetchFn
     });
     await provider.saveClientInformation(fullInformation);
     clientInformation = fullInformation;
@@ -16681,7 +16531,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         clientInformation,
         refreshToken: tokens.refresh_token,
         resource,
-        addClientAuthentication: provider.addClientAuthentication
+        addClientAuthentication: provider.addClientAuthentication,
+        fetchFn
       });
       await provider.saveTokens(newTokens);
       return "AUTHORIZED";
@@ -16799,29 +16650,6 @@ async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, o
   }
   return response;
 }
-async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolVersion } = {}, fetchFn = fetch) {
-  if (typeof issuer === "string") {
-    issuer = new URL(issuer);
-  }
-  if (!authorizationServerUrl) {
-    authorizationServerUrl = issuer;
-  }
-  if (typeof authorizationServerUrl === "string") {
-    authorizationServerUrl = new URL(authorizationServerUrl);
-  }
-  protocolVersion !== null && protocolVersion !== void 0 ? protocolVersion : protocolVersion = LATEST_PROTOCOL_VERSION;
-  const response = await discoverMetadataWithFallback(authorizationServerUrl, "oauth-authorization-server", fetchFn, {
-    protocolVersion,
-    metadataServerUrl: authorizationServerUrl
-  });
-  if (!response || response.status === 404) {
-    return void 0;
-  }
-  if (!response.ok) {
-    throw new Error(`HTTP ${response.status} trying to load well-known OAuth metadata`);
-  }
-  return OAuthMetadataSchema.parse(await response.json());
-}
 function buildDiscoveryUrls(authorizationServerUrl) {
   const url = typeof authorizationServerUrl === "string" ? new URL(authorizationServerUrl) : authorizationServerUrl;
   const hasPath = url.pathname !== "/";
@@ -17021,6 +16849,212 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
   }
   return OAuthClientInformationFullSchema.parse(await response.json());
 }
+const parseOAuthCallbackParams = (location) => {
+  const params = new URLSearchParams(location);
+  const code = params.get("code");
+  if (code) {
+    return { successful: true, code };
+  }
+  const error = params.get("error");
+  const error_description = params.get("error_description");
+  const error_uri = params.get("error_uri");
+  if (error) {
+    return { successful: false, error, error_description, error_uri };
+  }
+  return {
+    successful: false,
+    error: "invalid_request",
+    error_description: "Missing code or error in response",
+    error_uri: null
+  };
+};
+const generateOAuthState = () => {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  return Array.from(array, (byte) => byte.toString(16).padStart(2, "0")).join(
+    ""
+  );
+};
+const generateOAuthErrorDescription = (params) => {
+  const error = params.error;
+  const errorDescription = params.error_description;
+  const errorUri = params.error_uri;
+  return [
+    `Error: ${error}.`,
+    errorDescription ? `Details: ${errorDescription}.` : "",
+    errorUri ? `More info: ${errorUri}.` : ""
+  ].filter(Boolean).join("\n");
+};
+const discoverScopes = async (serverUrl, resourceMetadata) => {
+  try {
+    const metadata = await discoverAuthorizationServerMetadata(
+      new URL("/", serverUrl)
+    );
+    const resourceScopes = resourceMetadata == null ? void 0 : resourceMetadata.scopes_supported;
+    const oauthScopes = metadata == null ? void 0 : metadata.scopes_supported;
+    const scopesSupported = resourceScopes && resourceScopes.length > 0 ? resourceScopes : oauthScopes;
+    return scopesSupported && scopesSupported.length > 0 ? scopesSupported.join(" ") : void 0;
+  } catch (error) {
+    console.debug("OAuth scope discovery failed:", error);
+    return void 0;
+  }
+};
+const getClientInformationFromSessionStorage = async ({
+  serverUrl,
+  isPreregistered
+}) => {
+  const key = getServerSpecificKey(
+    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
+    serverUrl
+  );
+  const value = sessionStorage.getItem(key);
+  if (!value) {
+    return void 0;
+  }
+  return await OAuthClientInformationSchema.parseAsync(JSON.parse(value));
+};
+const saveClientInformationToSessionStorage = ({
+  serverUrl,
+  clientInformation,
+  isPreregistered
+}) => {
+  const key = getServerSpecificKey(
+    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
+    serverUrl
+  );
+  sessionStorage.setItem(key, JSON.stringify(clientInformation));
+};
+const clearClientInformationFromSessionStorage = ({
+  serverUrl,
+  isPreregistered
+}) => {
+  const key = getServerSpecificKey(
+    isPreregistered ? SESSION_KEYS.PREREGISTERED_CLIENT_INFORMATION : SESSION_KEYS.CLIENT_INFORMATION,
+    serverUrl
+  );
+  sessionStorage.removeItem(key);
+};
+class InspectorOAuthClientProvider {
+  constructor(serverUrl) {
+    this.serverUrl = serverUrl;
+    sessionStorage.setItem(SESSION_KEYS.SERVER_URL, serverUrl);
+  }
+  get redirectUrl() {
+    return window.location.origin + "/oauth/callback";
+  }
+  get clientMetadata() {
+    return {
+      redirect_uris: [this.redirectUrl],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_name: "MCP Inspector",
+      client_uri: "https://github.com/modelcontextprotocol/inspector"
+    };
+  }
+  state() {
+    return generateOAuthState();
+  }
+  async clientInformation() {
+    const preregisteredClientInformation = await getClientInformationFromSessionStorage({
+      serverUrl: this.serverUrl,
+      isPreregistered: true
+    });
+    return preregisteredClientInformation ?? await getClientInformationFromSessionStorage({
+      serverUrl: this.serverUrl,
+      isPreregistered: false
+    });
+  }
+  saveClientInformation(clientInformation) {
+    const safeInfo = Object.fromEntries(
+      Object.entries(clientInformation).filter(
+        ([key]) => key !== "client_secret"
+      )
+    );
+    saveClientInformationToSessionStorage({
+      serverUrl: this.serverUrl,
+      clientInformation: safeInfo,
+      isPreregistered: false
+    });
+  }
+  async tokens() {
+    const key = getServerSpecificKey(SESSION_KEYS.TOKENS, this.serverUrl);
+    const tokens = sessionStorage.getItem(key);
+    if (!tokens) {
+      return void 0;
+    }
+    return await OAuthTokensSchema.parseAsync(JSON.parse(tokens));
+  }
+  saveTokens(tokens) {
+    const key = getServerSpecificKey(SESSION_KEYS.TOKENS, this.serverUrl);
+    sessionStorage.setItem(key, JSON.stringify(tokens));
+  }
+  redirectToAuthorization(authorizationUrl) {
+    if (authorizationUrl.protocol !== "http:" && authorizationUrl.protocol !== "https:") {
+      throw new Error("Authorization URL must be HTTP or HTTPS");
+    }
+    window.location.href = authorizationUrl.href;
+  }
+  saveCodeVerifier(codeVerifier) {
+    const key = getServerSpecificKey(
+      SESSION_KEYS.CODE_VERIFIER,
+      this.serverUrl
+    );
+    sessionStorage.setItem(key, codeVerifier);
+  }
+  codeVerifier() {
+    const key = getServerSpecificKey(
+      SESSION_KEYS.CODE_VERIFIER,
+      this.serverUrl
+    );
+    const verifier = sessionStorage.getItem(key);
+    if (!verifier) {
+      throw new Error("No code verifier saved for session");
+    }
+    return verifier;
+  }
+  clear() {
+    clearClientInformationFromSessionStorage({
+      serverUrl: this.serverUrl,
+      isPreregistered: false
+    });
+    sessionStorage.removeItem(
+      getServerSpecificKey(SESSION_KEYS.TOKENS, this.serverUrl)
+    );
+    sessionStorage.removeItem(
+      getServerSpecificKey(SESSION_KEYS.CODE_VERIFIER, this.serverUrl)
+    );
+  }
+}
+class DebugInspectorOAuthClientProvider extends InspectorOAuthClientProvider {
+  get redirectUrl() {
+    return `${window.location.origin}/oauth/callback/debug`;
+  }
+  saveServerMetadata(metadata) {
+    const key = getServerSpecificKey(
+      SESSION_KEYS.SERVER_METADATA,
+      this.serverUrl
+    );
+    sessionStorage.setItem(key, JSON.stringify(metadata));
+  }
+  getServerMetadata() {
+    const key = getServerSpecificKey(
+      SESSION_KEYS.SERVER_METADATA,
+      this.serverUrl
+    );
+    const metadata = sessionStorage.getItem(key);
+    if (!metadata) {
+      return null;
+    }
+    return JSON.parse(metadata);
+  }
+  clear() {
+    super.clear();
+    sessionStorage.removeItem(
+      getServerSpecificKey(SESSION_KEYS.SERVER_METADATA, this.serverUrl)
+    );
+  }
+}
 const oauthTransitions = {
   metadata_discovery: {
     canTransition: async () => true,
@@ -17049,7 +17083,7 @@ const oauthTransitions = {
         // we default to null, so swap it for undefined if not set
         resourceMetadata ?? void 0
       );
-      const metadata = await discoverOAuthMetadata(authServerUrl);
+      const metadata = await discoverAuthorizationServerMetadata(authServerUrl);
       if (!metadata) {
         throw new Error("Failed to discover OAuth metadata");
       }
@@ -17075,11 +17109,14 @@ const oauthTransitions = {
       if (scopesSupported) {
         clientMetadata.scope = scopesSupported.join(" ");
       }
-      const fullInformation = await registerClient(context.serverUrl, {
-        metadata,
-        clientMetadata
-      });
-      context.provider.saveClientInformation(fullInformation);
+      let fullInformation = await context.provider.clientInformation();
+      if (!fullInformation) {
+        fullInformation = await registerClient(context.serverUrl, {
+          metadata,
+          clientMetadata
+        });
+        context.provider.saveClientInformation(fullInformation);
+      }
       context.updateState({
         oauthClientInfo: fullInformation,
         oauthStep: "authorization_redirect"
@@ -17091,16 +17128,10 @@ const oauthTransitions = {
     execute: async (context) => {
       const metadata = context.state.oauthMetadata;
       const clientInformation = context.state.oauthClientInfo;
-      let scope = void 0;
-      if (metadata.scopes_supported) {
-        scope = metadata.scopes_supported.join(" ");
-      }
-      const array = new Uint8Array(32);
-      crypto.getRandomValues(array);
-      const state = Array.from(
-        array,
-        (byte) => byte.toString(16).padStart(2, "0")
-      ).join("");
+      const scope = await discoverScopes(
+        context.serverUrl,
+        context.state.resourceMetadata ?? void 0
+      );
       const { authorizationUrl, codeVerifier } = await startAuthorization(
         context.serverUrl,
         {
@@ -17108,7 +17139,7 @@ const oauthTransitions = {
           clientInformation,
           redirectUrl: context.provider.redirectUrl,
           scope,
-          state,
+          state: generateOAuthState(),
           resource: context.state.resource ?? void 0
         }
       );
@@ -17193,7 +17224,7 @@ function requireUri_all() {
   (function(module, exports) {
     (function(global2, factory) {
       factory(exports);
-    })(uri_all, function(exports2) {
+    })(uri_all, (function(exports2) {
       function merge() {
         for (var _len = arguments.length, sets = Array(_len), _key = 0; _key < _len; _key++) {
           sets[_key] = arguments[_key];
@@ -17260,7 +17291,7 @@ function requireUri_all() {
       }
       var URI_PROTOCOL = buildExps(false);
       var IRI_PROTOCOL = buildExps(true);
-      var slicedToArray = /* @__PURE__ */ function() {
+      var slicedToArray = /* @__PURE__ */ (function() {
         function sliceIterator(arr, i) {
           var _arr = [];
           var _n = true;
@@ -17292,7 +17323,7 @@ function requireUri_all() {
             throw new TypeError("Invalid attempt to destructure non-iterable instance");
           }
         };
-      }();
+      })();
       var toConsumableArray = function(arr) {
         if (Array.isArray(arr)) {
           for (var i = 0, arr2 = Array(arr.length); i < arr.length; i++) arr2[i] = arr[i];
@@ -18207,7 +18238,7 @@ function requireUri_all() {
       exports2.escapeComponent = escapeComponent;
       exports2.unescapeComponent = unescapeComponent;
       Object.defineProperty(exports2, "__esModule", { value: true });
-    });
+    }));
   })(uri_all$1, uri_all$1.exports);
   return uri_all$1.exports;
 }
@@ -18801,7 +18832,7 @@ function requireFastJsonStableStringify() {
     if (!opts) opts = {};
     if (typeof opts === "function") opts = { cmp: opts };
     var cycles = typeof opts.cycles === "boolean" ? opts.cycles : false;
-    var cmp = opts.cmp && /* @__PURE__ */ function(f) {
+    var cmp = opts.cmp && /* @__PURE__ */ (function(f) {
       return function(node) {
         return function(a, b) {
           var aobj = { key: a, value: node[a] };
@@ -18809,9 +18840,9 @@ function requireFastJsonStableStringify() {
           return f(aobj, bobj);
         };
       };
-    }(opts.cmp);
+    })(opts.cmp);
     var seen2 = [];
-    return function stringify(node) {
+    return (function stringify(node) {
       if (node && node.toJSON && typeof node.toJSON === "function") {
         node = node.toJSON();
       }
@@ -18844,7 +18875,7 @@ function requireFastJsonStableStringify() {
       }
       seen2.splice(seenIndex, 1);
       return "{" + out + "}";
-    }(data2);
+    })(data2);
   };
   return fastJsonStableStringify;
 }
@@ -23297,6 +23328,33 @@ function isPropertyRequired(propertyName, schema) {
   var _a;
   return ((_a = schema.required) == null ? void 0 : _a.includes(propertyName)) ?? false;
 }
+function normalizeUnionType(schema) {
+  if (schema.anyOf && schema.anyOf.length === 2 && schema.anyOf.some((t) => t.type === "string") && schema.anyOf.some((t) => t.type === "null")) {
+    return { ...schema, type: "string", anyOf: void 0 };
+  }
+  if (schema.anyOf && schema.anyOf.length === 2 && schema.anyOf.some((t) => t.type === "boolean") && schema.anyOf.some((t) => t.type === "null")) {
+    return { ...schema, type: "boolean", anyOf: void 0 };
+  }
+  if (schema.anyOf && schema.anyOf.length === 2 && schema.anyOf.some((t) => t.type === "number") && schema.anyOf.some((t) => t.type === "null")) {
+    return { ...schema, type: "number", anyOf: void 0 };
+  }
+  if (schema.anyOf && schema.anyOf.length === 2 && schema.anyOf.some((t) => t.type === "integer") && schema.anyOf.some((t) => t.type === "null")) {
+    return { ...schema, type: "integer", anyOf: void 0 };
+  }
+  if (Array.isArray(schema.type) && schema.type.length === 2 && schema.type.includes("string") && schema.type.includes("null")) {
+    return { ...schema, type: "string" };
+  }
+  if (Array.isArray(schema.type) && schema.type.length === 2 && schema.type.includes("boolean") && schema.type.includes("null")) {
+    return { ...schema, type: "boolean" };
+  }
+  if (Array.isArray(schema.type) && schema.type.length === 2 && schema.type.includes("number") && schema.type.includes("null")) {
+    return { ...schema, type: "number" };
+  }
+  if (Array.isArray(schema.type) && schema.type.length === 2 && schema.type.includes("integer") && schema.type.includes("null")) {
+    return { ...schema, type: "integer" };
+  }
+  return schema;
+}
 const DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 class Protocol {
   constructor(_options) {
@@ -24786,7 +24844,7 @@ const StdErrNotificationSchema = NotificationSchema.extend({
 ClientNotificationSchema.or(
   StdErrNotificationSchema
 ).or(ServerNotificationSchema).or(NotificationSchema);
-const version$1 = "0.16.3";
+const version$1 = "0.16.4";
 const packageJson = {
   version: version$1
 };
@@ -25090,9 +25148,20 @@ function useConnection({
   const handleAuthError = async (error) => {
     if (is401Error(error)) {
       const serverAuthProvider = new InspectorOAuthClientProvider(sseUrl);
+      let scope = oauthScope == null ? void 0 : oauthScope.trim();
+      if (!scope) {
+        let resourceMetadata;
+        try {
+          resourceMetadata = await discoverOAuthProtectedResourceMetadata(
+            new URL("/", sseUrl)
+          );
+        } catch {
+        }
+        scope = await discoverScopes(sseUrl, resourceMetadata);
+      }
       const result = await auth(serverAuthProvider, {
         serverUrl: sseUrl,
-        scope: oauthScope
+        scope
       });
       return result === "AUTHORIZED";
     }
@@ -25121,6 +25190,7 @@ function useConnection({
       setConnectionStatus("error-connecting-to-proxy");
       return;
     }
+    let lastRequest = "";
     try {
       const headers = {};
       const serverAuthProvider = new InspectorOAuthClientProvider(sseUrl);
@@ -25282,7 +25352,9 @@ function useConnection({
         });
       }
       if ((capabilities == null ? void 0 : capabilities.logging) && defaultLoggingLevel) {
+        lastRequest = "logging/setLevel";
         await client2.setLoggingLevel(defaultLoggingLevel);
+        lastRequest = "";
       }
       if (onElicitationRequest) {
         client2.setRequestHandler(ElicitRequestSchema, async (request) => {
@@ -25294,6 +25366,13 @@ function useConnection({
       setMcpClient(client2);
       setConnectionStatus("connected");
     } catch (e) {
+      if (lastRequest === "logging/setLevel" && e instanceof McpError && e.code === ErrorCode.MethodNotFound) {
+        toast2({
+          title: "Error",
+          description: `Server declares logging capability but doesn't implement method: "${lastRequest}"`,
+          variant: "destructive"
+        });
+      }
       console.error(e);
       setConnectionStatus("error");
     }
@@ -31058,8 +31137,13 @@ var PopperAnchor = reactExports.forwardRef(
     const context = usePopperContext(ANCHOR_NAME$1, __scopePopper);
     const ref2 = reactExports.useRef(null);
     const composedRefs = useComposedRefs(forwardedRef, ref2);
+    const anchorRef = reactExports.useRef(null);
     reactExports.useEffect(() => {
-      context.onAnchorChange((virtualRef == null ? void 0 : virtualRef.current) || ref2.current);
+      const previousAnchor = anchorRef.current;
+      anchorRef.current = (virtualRef == null ? void 0 : virtualRef.current) || ref2.current;
+      if (previousAnchor !== anchorRef.current) {
+        context.onAnchorChange(anchorRef.current);
+      }
     });
     return virtualRef ? null : /* @__PURE__ */ jsxRuntimeExports.jsx(Primitive.div, { ...anchorProps, ref: composedRefs });
   }
@@ -32435,7 +32519,7 @@ function requireLib() {
     };
     return __assign2.apply(this, arguments);
   };
-  var __createBinding = lib && lib.__createBinding || (Object.create ? function(o, m2, k2, k22) {
+  var __createBinding = lib && lib.__createBinding || (Object.create ? (function(o, m2, k2, k22) {
     if (k22 === void 0) k22 = k2;
     var desc = Object.getOwnPropertyDescriptor(m2, k2);
     if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
@@ -32444,13 +32528,13 @@ function requireLib() {
       } };
     }
     Object.defineProperty(o, k22, desc);
-  } : function(o, m2, k2, k22) {
+  }) : (function(o, m2, k2, k22) {
     if (k22 === void 0) k22 = k2;
     o[k22] = m2[k2];
-  });
-  var __setModuleDefault = lib && lib.__setModuleDefault || (Object.create ? function(o, v) {
+  }));
+  var __setModuleDefault = lib && lib.__setModuleDefault || (Object.create ? (function(o, v) {
     Object.defineProperty(o, "default", { enumerable: true, value: v });
-  } : function(o, v) {
+  }) : function(o, v) {
     o["default"] = v;
   });
   var __importStar = lib && lib.__importStar || function(mod) {
@@ -32836,7 +32920,7 @@ function requirePrism() {
      * @namespace
      * @public
      */
-    var Prism2 = function(_self2) {
+    var Prism2 = (function(_self2) {
       var lang = /(?:^|\s)lang(?:uage)?-([\w-]+)(?=\s|$)/i;
       var uniqueId = 0;
       var plainTextGrammar = {};
@@ -33721,7 +33805,7 @@ function requirePrism() {
         }
       }
       return _;
-    }(_self);
+    })(_self);
     if (module.exports) {
       module.exports = Prism2;
     }
@@ -34352,12 +34436,18 @@ const JsonEditor = ({
     displayError && /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-sm text-red-500 mt-1", children: displayError })
   ] });
 };
+const isTypeSupported = (type2, supportedTypes) => {
+  if (Array.isArray(type2)) {
+    return type2.every((t) => supportedTypes.includes(t));
+  }
+  return typeof type2 === "string" && supportedTypes.includes(type2);
+};
 const isSimpleObject = (schema) => {
   const supportedTypes = ["string", "number", "integer", "boolean", "null"];
-  if (schema.type && supportedTypes.includes(schema.type)) return true;
+  if (schema.type && isTypeSupported(schema.type, supportedTypes)) return true;
   if (schema.type === "object") {
     return Object.values(schema.properties ?? {}).every(
-      (prop) => prop.type && supportedTypes.includes(prop.type)
+      (prop) => prop.type && isTypeSupported(prop.type, supportedTypes)
     );
   }
   if (schema.type === "array") {
@@ -34480,7 +34570,11 @@ const DynamicJsonForm = ({
       );
     }
     const isRequired = ((_a = parentSchema == null ? void 0 : parentSchema.required) == null ? void 0 : _a.includes(propertyName || "")) ?? false;
-    switch (propSchema.type) {
+    let fieldType = propSchema.type;
+    if (Array.isArray(fieldType)) {
+      fieldType = fieldType.find((t) => t !== "null") ?? fieldType[0];
+    }
+    switch (fieldType) {
       case "string": {
         if (propSchema.oneOf && propSchema.oneOf.every(
           (option) => typeof option.const === "string" && typeof option.title === "string"
@@ -34628,6 +34722,8 @@ const DynamicJsonForm = ({
             required: isRequired
           }
         );
+      case "null":
+        return null;
       case "object":
         if (!propSchema.properties) {
           return /* @__PURE__ */ jsxRuntimeExports.jsx(
@@ -36286,7 +36382,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "0.16.3";
+const version = "0.16.4";
 var [createTooltipContext, createTooltipScope] = createContextScope("Tooltip", [
   createPopperScope
 ]);
@@ -38063,7 +38159,7 @@ const ToolsTab = ({
         /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-sm text-gray-600 dark:text-gray-400", children: selectedTool.description }),
         Object.entries(selectedTool.inputSchema.properties ?? []).map(
           ([key, value]) => {
-            const prop = value;
+            const prop = normalizeUnionType(value);
             const inputSchema = selectedTool.inputSchema;
             const required2 = isPropertyRequired(key, inputSchema);
             return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
@@ -38108,7 +38204,7 @@ const ToolsTab = ({
                   value: params[key] ?? "",
                   onChange: (e) => setParams({
                     ...params,
-                    [key]: e.target.value
+                    [key]: e.target.value === "" ? void 0 : e.target.value
                   }),
                   className: "mt-1"
                 }
@@ -38952,13 +39048,13 @@ const App = () => {
   ) });
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-DCwiUoWl.js"), true ? __vite__mapDeps([0,1]) : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-DyaAiF-O.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-BNuktUej.js"), true ? __vite__mapDeps([2,1]) : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-BD-zJllm.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }
@@ -39326,7 +39422,9 @@ export {
   InspectorOAuthClientProvider as I,
   SESSION_KEYS as S,
   auth as a,
+  generateOAuthErrorDescription as g,
   jsxRuntimeExports as j,
+  parseOAuthCallbackParams as p,
   reactExports as r,
   useToast as u
 };

package/client/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-CHDvjhl9.js"></script>
+    <script type="module" crossorigin src="/assets/index-MFoeZZBS.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-BWZfLo5E.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "Model Context Protocol inspector",
   "license": "MIT",
   "author": "Anthropic, PBC (https://anthropic.com)",
@@ -47,10 +47,10 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.16.3",
-    "@modelcontextprotocol/inspector-client": "^0.16.3",
-    "@modelcontextprotocol/inspector-server": "^0.16.3",
-    "@modelcontextprotocol/sdk": "^1.17.0",
+    "@modelcontextprotocol/inspector-cli": "^0.16.4",
+    "@modelcontextprotocol/inspector-client": "^0.16.4",
+    "@modelcontextprotocol/inspector-server": "^0.16.4",
+    "@modelcontextprotocol/sdk": "^1.17.2",
     "concurrently": "^9.2.0",
     "open": "^10.2.0",
     "shell-quote": "^1.8.3",

package/client/dist/assets/oauthUtils-DTcoXpSP.js

@@ -1,33 +0,0 @@
-const parseOAuthCallbackParams = (location) => {
-  const params = new URLSearchParams(location);
-  const code = params.get("code");
-  if (code) {
-    return { successful: true, code };
-  }
-  const error = params.get("error");
-  const error_description = params.get("error_description");
-  const error_uri = params.get("error_uri");
-  if (error) {
-    return { successful: false, error, error_description, error_uri };
-  }
-  return {
-    successful: false,
-    error: "invalid_request",
-    error_description: "Missing code or error in response",
-    error_uri: null
-  };
-};
-const generateOAuthErrorDescription = (params) => {
-  const error = params.error;
-  const errorDescription = params.error_description;
-  const errorUri = params.error_uri;
-  return [
-    `Error: ${error}.`,
-    errorDescription ? `Details: ${errorDescription}.` : "",
-    errorUri ? `More info: ${errorUri}.` : ""
-  ].filter(Boolean).join("\n");
-};
-export {
-  generateOAuthErrorDescription as g,
-  parseOAuthCallbackParams as p
-};