@modelcontextprotocol/inspector 0.16.4 → 0.16.6

package/README.md

@@ -29,6 +29,14 @@ npx @modelcontextprotocol/inspector
 
 The server will start up and the UI will be accessible at `http://localhost:6274`.
 
+### Docker Container
+
+You can also start it in a Docker container with the following command:
+
+```bash
+docker run --rm --network host -p 6274:6274 -p 6277:6277 ghcr.io/modelcontextprotocol/inspector:latest
+```
+
 ### From an MCP server repository
 
 To inspect an MCP server implementation, there's no need to clone this repo. Instead, use `npx`. For example, if your server is built at `build/index.js`:
@@ -166,6 +174,16 @@ If you need to disable authentication (NOT RECOMMENDED), you can set the `DANGER
 DANGEROUSLY_OMIT_AUTH=true npm start
 ```
 
+---
+
+**🚨 WARNING 🚨**
+
+Disabling authentication with `DANGEROUSLY_OMIT_AUTH` is incredibly dangerous! Disabling auth leaves your machine open to attack not just when exposed to the public internet, but also **via your web browser**. Meaning, visiting a malicious website OR viewing a malicious advertizement could allow an attacker to remotely compromise your computer. Do not disable this feature unless you truly understand the risks.
+
+Read more about the risks of this vulnerability on Oligo's blog: [Critical RCE Vulnerability in Anthropic MCP Inspector - CVE-2025-49596](https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596)
+
+---
+
 You can also set the token via the `MCP_PROXY_AUTH_TOKEN` environment variable when starting the server:
 
 ```bash
@@ -377,6 +395,9 @@ npx @modelcontextprotocol/inspector --cli node build/index.js --method tools/lis
 # Call a specific tool
 npx @modelcontextprotocol/inspector --cli node build/index.js --method tools/call --tool-name mytool --tool-arg key=value --tool-arg another=value2
 
+# Call a tool with JSON arguments
+npx @modelcontextprotocol/inspector --cli node build/index.js --method tools/call --tool-name mytool --tool-arg 'options={"format": "json", "max_tokens": 100}'
+
 # List available resources
 npx @modelcontextprotocol/inspector --cli node build/index.js --method resources/list
 
@@ -389,6 +410,9 @@ npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com
 # Connect to a remote MCP server (with Streamable HTTP transport)
 npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com --transport http --method tools/list
 
+# Connect to a remote MCP server (with custom headers)
+npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com --transport http --method tools/list --header "X-API-Key: your-api-key"
+
 # Call a tool on a remote server
 npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com --method tools/call --tool-name remotetool --tool-arg param=value
 

package/cli/build/cli.js

@@ -54,6 +54,10 @@ async function runWebClient(args) {
         await spawnPromise("node", [inspectorClientPath, ...startArgs], {
             signal: abort.signal,
             echoOutput: true,
+            // pipe the stdout through here, prevents issues with buffering and
+            // dropping the end of console.out after 8192 chars due to node
+            // closing the stdout pipe before the output has finished flushing
+            stdio: "inherit",
         });
     }
     catch (e) {
@@ -73,18 +77,28 @@ async function runCli(args) {
     try {
         // Build CLI arguments
         const cliArgs = [cliPath];
+        // Add target URL/command first
+        cliArgs.push(args.command, ...args.args);
         // Add transport flag if specified
         if (args.transport && args.transport !== "stdio") {
             // Convert streamable-http back to http for CLI mode
             const cliTransport = args.transport === "streamable-http" ? "http" : args.transport;
             cliArgs.push("--transport", cliTransport);
         }
-        // Add command and remaining args
-        cliArgs.push(args.command, ...args.args);
+        // Add headers if specified
+        if (args.headers) {
+            for (const [key, value] of Object.entries(args.headers)) {
+                cliArgs.push("--header", `${key}: ${value}`);
+            }
+        }
         await spawnPromise("node", cliArgs, {
             env: { ...process.env, ...args.envArgs },
             signal: abort.signal,
             echoOutput: true,
+            // pipe the stdout through here, prevents issues with buffering and
+            // dropping the end of console.out after 8192 chars due to node
+            // closing the stdout pipe before the output has finished flushing
+            stdio: "inherit",
         });
     }
     catch (e) {
@@ -126,6 +140,18 @@ function parseKeyValuePair(value, previous = {}) {
     }
     return { ...previous, [key]: val };
 }
+function parseHeaderPair(value, previous = {}) {
+    const colonIndex = value.indexOf(":");
+    if (colonIndex === -1) {
+        throw new Error(`Invalid header format: ${value}. Use "HeaderName: Value" format.`);
+    }
+    const key = value.slice(0, colonIndex).trim();
+    const val = value.slice(colonIndex + 1).trim();
+    if (key === "" || val === "") {
+        throw new Error(`Invalid header format: ${value}. Use "HeaderName: Value" format.`);
+    }
+    return { ...previous, [key]: val };
+}
 function parseArgs() {
     const program = new Command();
     const argSeparatorIndex = process.argv.indexOf("--");
@@ -144,7 +170,8 @@ function parseArgs() {
         .option("--server <n>", "server name from config file")
         .option("--cli", "enable CLI mode")
         .option("--transport <type>", "transport type (stdio, sse, http)")
-        .option("--server-url <url>", "server URL for SSE/HTTP transport");
+        .option("--server-url <url>", "server URL for SSE/HTTP transport")
+        .option("--header <headers...>", 'HTTP headers as "HeaderName: Value" pairs (for HTTP/SSE transports)', parseHeaderPair, {});
     // Parse only the arguments before --
     program.parse(preArgs);
     const options = program.opts();
@@ -186,6 +213,7 @@ function parseArgs() {
                 envArgs: { ...(config.env || {}), ...(options.e || {}) },
                 cli: options.cli || false,
                 transport: "stdio",
+                headers: options.header,
             };
         }
         else if (config.type === "sse" || config.type === "streamable-http") {
@@ -196,6 +224,7 @@ function parseArgs() {
                 cli: options.cli || false,
                 transport: config.type,
                 serverUrl: config.url,
+                headers: options.header,
             };
         }
         else {
@@ -206,6 +235,7 @@ function parseArgs() {
                 envArgs: { ...(config.env || {}), ...(options.e || {}) },
                 cli: options.cli || false,
                 transport: "stdio",
+                headers: options.header,
             };
         }
     }
@@ -224,6 +254,7 @@ function parseArgs() {
         cli: options.cli || false,
         transport: transport,
         serverUrl: options.serverUrl,
+        headers: options.header,
     };
 }
 async function main() {

package/cli/build/client/prompts.js

@@ -11,9 +11,24 @@ export async function listPrompts(client) {
 // Get a prompt
 export async function getPrompt(client, name, args) {
     try {
+        // Convert all arguments to strings for prompt arguments
+        const stringArgs = {};
+        if (args) {
+            for (const [key, value] of Object.entries(args)) {
+                if (typeof value === "string") {
+                    stringArgs[key] = value;
+                }
+                else if (value === null || value === undefined) {
+                    stringArgs[key] = String(value);
+                }
+                else {
+                    stringArgs[key] = JSON.stringify(value);
+                }
+            }
+        }
         const response = await client.getPrompt({
             name,
-            arguments: args || {},
+            arguments: stringArgs,
         });
         return response;
     }

package/cli/build/client/tools.js

@@ -49,8 +49,18 @@ export async function callTool(client, name, args) {
         const tool = tools.find((t) => t.name === name);
         let convertedArgs = args;
         if (tool) {
-            // Convert parameters based on the tool's schema
-            convertedArgs = convertParameters(tool, args);
+            // Convert parameters based on the tool's schema, but only for string values
+            // since we now accept pre-parsed values from the CLI
+            const stringArgs = {};
+            for (const [key, value] of Object.entries(args)) {
+                if (typeof value === "string") {
+                    stringArgs[key] = value;
+                }
+            }
+            if (Object.keys(stringArgs).length > 0) {
+                const convertedStringArgs = convertParameters(tool, stringArgs);
+                convertedArgs = { ...args, ...convertedStringArgs };
+            }
         }
         const response = await client.callTool({
             name: name,

package/cli/build/index.js

@@ -4,7 +4,8 @@ import { Command } from "commander";
 import { callTool, connect, disconnect, getPrompt, listPrompts, listResources, listResourceTemplates, listTools, readResource, setLoggingLevel, validLogLevels, } from "./client/index.js";
 import { handleError } from "./error-handler.js";
 import { createTransport } from "./transport.js";
-function createTransportOptions(target, transport) {
+import { awaitableLog } from "./utils/awaitable-log.js";
+function createTransportOptions(target, transport, headers) {
     if (target.length === 0) {
         throw new Error("Target is required. Specify a URL or a command to execute.");
     }
@@ -46,10 +47,11 @@ function createTransportOptions(target, transport) {
         command: isUrl ? undefined : command,
         args: isUrl ? undefined : commandArgs,
         url: isUrl ? command : undefined,
+        headers,
     };
 }
 async function callMethod(args) {
-    const transportOptions = createTransportOptions(args.target, args.transport);
+    const transportOptions = createTransportOptions(args.target, args.transport, args.headers);
     const transport = createTransport(transportOptions);
     const client = new Client({
         name: "inspector-cli",
@@ -101,7 +103,7 @@ async function callMethod(args) {
         else {
             throw new Error(`Unsupported method: ${args.method}. Supported methods include: tools/list, tools/call, resources/list, resources/read, resources/templates/list, prompts/list, prompts/get, logging/setLevel`);
         }
-        console.log(JSON.stringify(result, null, 2));
+        await awaitableLog(JSON.stringify(result, null, 2));
     }
     finally {
         try {
@@ -119,6 +121,27 @@ function parseKeyValuePair(value, previous = {}) {
     if (val === undefined || val === "") {
         throw new Error(`Invalid parameter format: ${value}. Use key=value format.`);
     }
+    // Try to parse as JSON first
+    let parsedValue;
+    try {
+        parsedValue = JSON.parse(val);
+    }
+    catch {
+        // If JSON parsing fails, keep as string
+        parsedValue = val;
+    }
+    return { ...previous, [key]: parsedValue };
+}
+function parseHeaderPair(value, previous = {}) {
+    const colonIndex = value.indexOf(":");
+    if (colonIndex === -1) {
+        throw new Error(`Invalid header format: ${value}. Use "HeaderName: Value" format.`);
+    }
+    const key = value.slice(0, colonIndex).trim();
+    const val = value.slice(colonIndex + 1).trim();
+    if (key === "" || val === "") {
+        throw new Error(`Invalid header format: ${value}. Use "HeaderName: Value" format.`);
+    }
     return { ...previous, [key]: val };
 }
 function parseArgs() {
@@ -171,7 +194,11 @@ function parseArgs() {
             throw new Error(`Invalid transport type: ${value}. Valid types are: ${validTransports.join(", ")}`);
         }
         return value;
-    });
+    })
+        //
+        // HTTP headers
+        //
+        .option("--header <headers...>", 'HTTP headers as "HeaderName: Value" pairs (for HTTP/SSE transports)', parseHeaderPair, {});
     // Parse only the arguments before --
     program.parse(preArgs);
     const options = program.opts();
@@ -184,6 +211,7 @@ function parseArgs() {
     return {
         target: finalArgs,
         ...options,
+        headers: options.header, // commander.js uses 'header' field, map to 'headers'
     };
 }
 async function main() {

package/cli/build/transport.js

@@ -15,8 +15,8 @@ function createStdioTransport(options) {
     }
     const defaultEnv = getDefaultEnvironment();
     const env = {
-        ...processEnv,
         ...defaultEnv,
+        ...processEnv,
     };
     const { cmd: actualCommand, args: actualArgs } = findActualExecutable(options.command ?? "", args);
     return new StdioClientTransport({
@@ -38,10 +38,24 @@ export function createTransport(options) {
         }
         const url = new URL(options.url);
         if (transportType === "sse") {
-            return new SSEClientTransport(url);
+            const transportOptions = options.headers
+                ? {
+                    requestInit: {
+                        headers: options.headers,
+                    },
+                }
+                : undefined;
+            return new SSEClientTransport(url, transportOptions);
         }
         if (transportType === "http") {
-            return new StreamableHTTPClientTransport(url);
+            const transportOptions = options.headers
+                ? {
+                    requestInit: {
+                        headers: options.headers,
+                    },
+                }
+                : undefined;
+            return new StreamableHTTPClientTransport(url, transportOptions);
         }
         throw new Error(`Unsupported transport type: ${transportType}`);
     }

package/cli/build/utils/awaitable-log.js

@@ -0,0 +1,7 @@
+export function awaitableLog(logValue) {
+    return new Promise((resolve) => {
+        process.stdout.write(logValue, () => {
+            resolve();
+        });
+    });
+}

package/client/dist/assets/{OAuthCallback-DyaAiF-O.js → OAuthCallback-Cmffn8om.js}

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-MFoeZZBS.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-B_qh-Btq.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();
   const hasProcessedRef = reactExports.useRef(false);

package/client/dist/assets/{OAuthDebugCallback-BD-zJllm.js → OAuthDebugCallback-BhzcPtuF.js}

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-MFoeZZBS.js";
+import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-B_qh-Btq.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {
     let isProcessed = false;
@@ -21,6 +21,14 @@ const OAuthDebugCallback = ({ onConnect }) => {
       if (storedState) {
         try {
           restoredState = JSON.parse(storedState);
+          if (restoredState && typeof restoredState.resource === "string") {
+            restoredState.resource = new URL(restoredState.resource);
+          }
+          if (restoredState && typeof restoredState.authorizationUrl === "string") {
+            restoredState.authorizationUrl = new URL(
+              restoredState.authorizationUrl
+            );
+          }
           sessionStorage.removeItem(SESSION_KEYS.AUTH_DEBUGGER_STATE);
         } catch (e) {
           console.error("Failed to parse stored auth state:", e);

package/client/dist/assets/{index-MFoeZZBS.js → index-B_qh-Btq.js}

@@ -1,3 +1,6 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 function _mergeNamespaces(n, m2) {
   for (var i = 0; i < m2.length; i++) {
     const e = m2[i];
@@ -15118,6 +15121,7 @@ const enumType = ZodEnum.create;
 ZodPromise.create;
 const optionalType = ZodOptional.create;
 ZodNullable.create;
+const NEVER = INVALID;
 const LATEST_PROTOCOL_VERSION = "2025-06-18";
 const SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
@@ -16020,7 +16024,7 @@ unionType([
   CallToolRequestSchema,
   ListToolsRequestSchema
 ]);
-const ClientNotificationSchema = unionType([
+unionType([
   CancelledNotificationSchema,
   ProgressNotificationSchema,
   InitializedNotificationSchema,
@@ -16038,7 +16042,7 @@ unionType([
   ElicitRequestSchema,
   ListRootsRequestSchema
 ]);
-const ServerNotificationSchema = unionType([
+unionType([
   CancelledNotificationSchema,
   ProgressNotificationSchema,
   LoggingMessageNotificationSchema,
@@ -16067,9 +16071,22 @@ class McpError extends Error {
     this.name = "McpError";
   }
 }
+const SafeUrlSchema = stringType().url().superRefine((val, ctx) => {
+  if (!URL.canParse(val)) {
+    ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: "URL must be parseable",
+      fatal: true
+    });
+    return NEVER;
+  }
+}).refine((url) => {
+  const u2 = new URL(url);
+  return u2.protocol !== "javascript:" && u2.protocol !== "data:" && u2.protocol !== "vbscript:";
+}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" });
 const OAuthProtectedResourceMetadataSchema = objectType({
   resource: stringType().url(),
-  authorization_servers: arrayType(stringType().url()).optional(),
+  authorization_servers: arrayType(SafeUrlSchema).optional(),
   jwks_uri: stringType().url().optional(),
   scopes_supported: arrayType(stringType()).optional(),
   bearer_methods_supported: arrayType(stringType()).optional(),
@@ -16085,17 +16102,17 @@ const OAuthProtectedResourceMetadataSchema = objectType({
 }).passthrough();
 const OAuthMetadataSchema = objectType({
   issuer: stringType(),
-  authorization_endpoint: stringType(),
-  token_endpoint: stringType(),
-  registration_endpoint: stringType().optional(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
   scopes_supported: arrayType(stringType()).optional(),
   response_types_supported: arrayType(stringType()),
   response_modes_supported: arrayType(stringType()).optional(),
   grant_types_supported: arrayType(stringType()).optional(),
   token_endpoint_auth_methods_supported: arrayType(stringType()).optional(),
   token_endpoint_auth_signing_alg_values_supported: arrayType(stringType()).optional(),
-  service_documentation: stringType().optional(),
-  revocation_endpoint: stringType().optional(),
+  service_documentation: SafeUrlSchema.optional(),
+  revocation_endpoint: SafeUrlSchema.optional(),
   revocation_endpoint_auth_methods_supported: arrayType(stringType()).optional(),
   revocation_endpoint_auth_signing_alg_values_supported: arrayType(stringType()).optional(),
   introspection_endpoint: stringType().optional(),
@@ -16105,11 +16122,11 @@ const OAuthMetadataSchema = objectType({
 }).passthrough();
 const OpenIdProviderMetadataSchema = objectType({
   issuer: stringType(),
-  authorization_endpoint: stringType(),
-  token_endpoint: stringType(),
-  userinfo_endpoint: stringType().optional(),
-  jwks_uri: stringType(),
-  registration_endpoint: stringType().optional(),
+  authorization_endpoint: SafeUrlSchema,
+  token_endpoint: SafeUrlSchema,
+  userinfo_endpoint: SafeUrlSchema.optional(),
+  jwks_uri: SafeUrlSchema,
+  registration_endpoint: SafeUrlSchema.optional(),
   scopes_supported: arrayType(stringType()).optional(),
   response_types_supported: arrayType(stringType()),
   response_modes_supported: arrayType(stringType()).optional(),
@@ -16137,8 +16154,8 @@ const OpenIdProviderMetadataSchema = objectType({
   request_parameter_supported: booleanType().optional(),
   request_uri_parameter_supported: booleanType().optional(),
   require_request_uri_registration: booleanType().optional(),
-  op_policy_uri: stringType().optional(),
-  op_tos_uri: stringType().optional()
+  op_policy_uri: SafeUrlSchema.optional(),
+  op_tos_uri: SafeUrlSchema.optional()
 }).passthrough();
 const OpenIdProviderDiscoveryMetadataSchema = OpenIdProviderMetadataSchema.merge(OAuthMetadataSchema.pick({
   code_challenge_methods_supported: true
@@ -16158,18 +16175,18 @@ const OAuthErrorResponseSchema = objectType({
   error_uri: stringType().optional()
 });
 const OAuthClientMetadataSchema = objectType({
-  redirect_uris: arrayType(stringType()).refine((uris) => uris.every((uri) => URL.canParse(uri)), { message: "redirect_uris must contain valid URLs" }),
+  redirect_uris: arrayType(SafeUrlSchema),
   token_endpoint_auth_method: stringType().optional(),
   grant_types: arrayType(stringType()).optional(),
   response_types: arrayType(stringType()).optional(),
   client_name: stringType().optional(),
-  client_uri: stringType().optional(),
-  logo_uri: stringType().optional(),
+  client_uri: SafeUrlSchema.optional(),
+  logo_uri: SafeUrlSchema.optional(),
   scope: stringType().optional(),
   contacts: arrayType(stringType()).optional(),
-  tos_uri: stringType().optional(),
+  tos_uri: SafeUrlSchema.optional(),
   policy_uri: stringType().optional(),
-  jwks_uri: stringType().optional(),
+  jwks_uri: SafeUrlSchema.optional(),
   jwks: anyType().optional(),
   software_id: stringType().optional(),
   software_version: stringType().optional(),
@@ -16629,7 +16646,7 @@ async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
   return await fetchWithCorsRetry(url, headers, fetchFn);
 }
 function shouldAttemptFallback(response, pathname) {
-  return !response || response.status === 404 && pathname !== "/";
+  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
 }
 async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
   var _a, _b;
@@ -16885,6 +16902,19 @@ const generateOAuthErrorDescription = (params) => {
     errorUri ? `More info: ${errorUri}.` : ""
   ].filter(Boolean).join("\n");
 };
+function validateRedirectUrl(url) {
+  try {
+    const parsedUrl = new URL(url);
+    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+      throw new Error("Authorization URL must be HTTP or HTTPS");
+    }
+  } catch (error) {
+    if (error instanceof Error && error.message === "Authorization URL must be HTTP or HTTPS") {
+      throw error;
+    }
+    throw new Error(`Invalid URL: ${url}`);
+  }
+}
 const discoverScopes = async (serverUrl, resourceMetadata) => {
   try {
     const metadata = await discoverAuthorizationServerMetadata(
@@ -16935,8 +16965,10 @@ const clearClientInformationFromSessionStorage = ({
   sessionStorage.removeItem(key);
 };
 class InspectorOAuthClientProvider {
-  constructor(serverUrl) {
+  constructor(serverUrl, scope) {
+    __publicField(this, "scope");
     this.serverUrl = serverUrl;
+    this.scope = scope;
     sessionStorage.setItem(SESSION_KEYS.SERVER_URL, serverUrl);
   }
   get redirectUrl() {
@@ -16949,7 +16981,8 @@ class InspectorOAuthClientProvider {
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
       client_name: "MCP Inspector",
-      client_uri: "https://github.com/modelcontextprotocol/inspector"
+      client_uri: "https://github.com/modelcontextprotocol/inspector",
+      scope: this.scope ?? ""
     };
   }
   state() {
@@ -16990,9 +17023,7 @@ class InspectorOAuthClientProvider {
     sessionStorage.setItem(key, JSON.stringify(tokens));
   }
   redirectToAuthorization(authorizationUrl) {
-    if (authorizationUrl.protocol !== "http:" && authorizationUrl.protocol !== "https:") {
-      throw new Error("Authorization URL must be HTTP or HTTPS");
-    }
+    validateRedirectUrl(authorizationUrl.href);
     window.location.href = authorizationUrl.href;
   }
   saveCodeVerifier(codeVerifier) {
@@ -17179,7 +17210,7 @@ const oauthTransitions = {
         authorizationCode: context.state.authorizationCode,
         codeVerifier,
         redirectUri: context.provider.redirectUrl,
-        resource: context.state.resource ?? void 0
+        resource: context.state.resource ? context.state.resource instanceof URL ? context.state.resource : new URL(context.state.resource) : void 0
       });
       context.provider.saveTokens(tokens);
       context.updateState({
@@ -24047,7 +24078,7 @@ function splitLines(chunk) {
     const crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
 `, searchIndex);
     let lineEnd = -1;
-    if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = Math.min(crIndex, lfIndex) : crIndex !== -1 ? lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1) {
+    if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = Math.min(crIndex, lfIndex) : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1) {
       incompleteLine = chunk.slice(searchIndex);
       break;
     } else {
@@ -24835,16 +24866,7 @@ class StreamableHTTPClientTransport {
     return this._protocolVersion;
   }
 }
-const StdErrNotificationSchema = NotificationSchema.extend({
-  method: literalType("notifications/stderr"),
-  params: objectType({
-    content: stringType()
-  })
-});
-ClientNotificationSchema.or(
-  StdErrNotificationSchema
-).or(ServerNotificationSchema).or(NotificationSchema);
-const version$1 = "0.16.4";
+const version$1 = "0.16.6";
 const packageJson = {
   version: version$1
 };
@@ -24976,7 +24998,6 @@ function useConnection({
   oauthScope,
   config,
   onNotification,
-  onStdErrNotification,
   onPendingRequest,
   onElicitationRequest,
   getRoots,
@@ -25030,7 +25051,7 @@ function useConnection({
         mcpRequestOptions.onprogress = (params) => {
           if (onNotification) {
             onNotification({
-              method: "notification/progress",
+              method: "notifications/progress",
               params
             });
           }
@@ -25147,7 +25168,6 @@ function useConnection({
   };
   const handleAuthError = async (error) => {
     if (is401Error(error)) {
-      const serverAuthProvider = new InspectorOAuthClientProvider(sseUrl);
       let scope = oauthScope == null ? void 0 : oauthScope.trim();
       if (!scope) {
         let resourceMetadata;
@@ -25159,6 +25179,10 @@ function useConnection({
         }
         scope = await discoverScopes(sseUrl, resourceMetadata);
       }
+      const serverAuthProvider = new InspectorOAuthClientProvider(
+        sseUrl,
+        scope
+      );
       const result = await auth(serverAuthProvider, {
         serverUrl: sseUrl,
         scope
@@ -25212,11 +25236,18 @@ function useConnection({
       let transportOptions;
       let mcpProxyServerUrl;
       switch (transportType) {
-        case "stdio":
+        case "stdio": {
           mcpProxyServerUrl = new URL(`${getMCPProxyAddress(config)}/stdio`);
           mcpProxyServerUrl.searchParams.append("command", command);
           mcpProxyServerUrl.searchParams.append("args", args);
           mcpProxyServerUrl.searchParams.append("env", JSON.stringify(env));
+          const proxyFullAddress = config.MCP_PROXY_FULL_ADDRESS.value;
+          if (proxyFullAddress) {
+            mcpProxyServerUrl.searchParams.append(
+              "proxyFullAddress",
+              proxyFullAddress
+            );
+          }
           transportOptions = {
             authProvider: serverAuthProvider,
             eventSourceInit: {
@@ -25230,9 +25261,17 @@ function useConnection({
             }
           };
           break;
-        case "sse":
+        }
+        case "sse": {
           mcpProxyServerUrl = new URL(`${getMCPProxyAddress(config)}/sse`);
           mcpProxyServerUrl.searchParams.append("url", sseUrl);
+          const proxyFullAddressSSE = config.MCP_PROXY_FULL_ADDRESS.value;
+          if (proxyFullAddressSSE) {
+            mcpProxyServerUrl.searchParams.append(
+              "proxyFullAddress",
+              proxyFullAddressSSE
+            );
+          }
           transportOptions = {
             eventSourceInit: {
               fetch: (url, init) => fetch(url, {
@@ -25245,6 +25284,7 @@ function useConnection({
             }
           };
           break;
+        }
         case "streamable-http":
           mcpProxyServerUrl = new URL(`${getMCPProxyAddress(config)}/mcp`);
           mcpProxyServerUrl.searchParams.append("url", sseUrl);
@@ -25288,12 +25328,6 @@ function useConnection({
           return Promise.resolve();
         };
       }
-      if (onStdErrNotification) {
-        client2.setNotificationHandler(
-          StdErrNotificationSchema,
-          onStdErrNotification
-        );
-      }
       let capabilities;
       try {
         const transport = transportType === "streamable-http" ? new StreamableHTTPClientTransport(mcpProxyServerUrl, {
@@ -25354,6 +25388,15 @@ function useConnection({
       if ((capabilities == null ? void 0 : capabilities.logging) && defaultLoggingLevel) {
         lastRequest = "logging/setLevel";
         await client2.setLoggingLevel(defaultLoggingLevel);
+        pushHistory(
+          {
+            method: "logging/setLevel",
+            params: {
+              level: defaultLoggingLevel
+            }
+          },
+          {}
+        );
         lastRequest = "";
       }
       if (onElicitationRequest) {
@@ -26558,6 +26601,7 @@ const OAuthFlowProgress = ({
   updateAuthState,
   proceedToNextStep
 }) => {
+  const { toast: toast2 } = useToast();
   const provider = reactExports.useMemo(
     () => new DebugInspectorOAuthClientProvider(serverUrl),
     [serverUrl]
@@ -26688,11 +26732,24 @@ const OAuthFlowProgress = ({
             /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2", children: [
               /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-xs break-all", children: authState.authorizationUrl }),
               /* @__PURE__ */ jsxRuntimeExports.jsx(
-                "a",
+                "button",
                 {
-                  href: authState.authorizationUrl,
-                  target: "_blank",
-                  rel: "noopener noreferrer",
+                  onClick: () => {
+                    try {
+                      validateRedirectUrl(authState.authorizationUrl);
+                      window.open(
+                        authState.authorizationUrl,
+                        "_blank",
+                        "noopener noreferrer"
+                      );
+                    } catch (error) {
+                      toast2({
+                        title: "Invalid URL",
+                        description: error instanceof Error ? error.message : "The authorization URL is not valid",
+                        variant: "destructive"
+                      });
+                    }
+                  },
                   className: "flex items-center text-blue-500 hover:text-blue-700",
                   "aria-label": "Open authorization URL in new tab",
                   title: "Open authorization URL",
@@ -26778,7 +26835,18 @@ const OAuthFlowProgress = ({
         Button,
         {
           variant: "outline",
-          onClick: () => window.open(authState.authorizationUrl, "_blank"),
+          onClick: () => {
+            try {
+              validateRedirectUrl(authState.authorizationUrl);
+              window.open(authState.authorizationUrl, "_blank");
+            } catch (error) {
+              toast2({
+                title: "Invalid URL",
+                description: error instanceof Error ? error.message : "The authorization URL is not valid",
+                variant: "destructive"
+              });
+            }
+          },
           children: "Open in New Tab"
         }
       )
@@ -26906,6 +26974,20 @@ const AuthDebugger = ({
       while (currentState.oauthStep !== "complete") {
         await oauthMachine.executeStep(currentState);
         if (currentState.oauthStep === "authorization_code" && currentState.authorizationUrl) {
+          try {
+            validateRedirectUrl(currentState.authorizationUrl);
+          } catch (error) {
+            updateAuthState({
+              ...currentState,
+              isInitiatingAuth: false,
+              latestError: error instanceof Error ? error : new Error(String(error)),
+              statusMessage: {
+                type: "error",
+                message: `Invalid authorization URL: ${error instanceof Error ? error.message : String(error)}`
+              }
+            });
+            return;
+          }
           sessionStorage.setItem(
             SESSION_KEYS.AUTH_DEBUGGER_STATE,
             JSON.stringify(currentState)
@@ -30313,15 +30395,9 @@ function getWindowScrollBarX(element, rect) {
   }
   return rect.left + leftScroll;
 }
-function getHTMLOffset(documentElement, scroll, ignoreScrollbarX) {
-  if (ignoreScrollbarX === void 0) {
-    ignoreScrollbarX = false;
-  }
+function getHTMLOffset(documentElement, scroll) {
   const htmlRect = documentElement.getBoundingClientRect();
-  const x = htmlRect.left + scroll.scrollLeft - (ignoreScrollbarX ? 0 : (
-    // RTL <body> scrollbar.
-    getWindowScrollBarX(documentElement, htmlRect)
-  ));
+  const x = htmlRect.left + scroll.scrollLeft - getWindowScrollBarX(documentElement, htmlRect);
   const y = htmlRect.top + scroll.scrollTop;
   return {
     x,
@@ -30359,7 +30435,7 @@ function convertOffsetParentRelativeRectToViewportRelativeRect(_ref) {
       offsets.y = offsetRect.y + offsetParent.clientTop;
     }
   }
-  const htmlOffset = documentElement && !isOffsetParentAnElement && !isFixed ? getHTMLOffset(documentElement, scroll, true) : createCoords(0);
+  const htmlOffset = documentElement && !isOffsetParentAnElement && !isFixed ? getHTMLOffset(documentElement, scroll) : createCoords(0);
   return {
     width: rect.width * scale.x,
     height: rect.height * scale.y,
@@ -30388,6 +30464,7 @@ function getDocumentRect(element) {
     y
   };
 }
+const SCROLLBAR_MAX = 25;
 function getViewportRect(element, strategy) {
   const win = getWindow(element);
   const html = getDocumentElement(element);
@@ -30405,6 +30482,19 @@ function getViewportRect(element, strategy) {
       y = visualViewport.offsetTop;
     }
   }
+  const windowScrollbarX = getWindowScrollBarX(html);
+  if (windowScrollbarX <= 0) {
+    const doc = html.ownerDocument;
+    const body = doc.body;
+    const bodyStyles = getComputedStyle(body);
+    const bodyMarginInline = doc.compatMode === "CSS1Compat" ? parseFloat(bodyStyles.marginLeft) + parseFloat(bodyStyles.marginRight) || 0 : 0;
+    const clippingStableScrollbarWidth = Math.abs(html.clientWidth - body.clientWidth - bodyMarginInline);
+    if (clippingStableScrollbarWidth <= SCROLLBAR_MAX) {
+      width -= clippingStableScrollbarWidth;
+    }
+  } else if (windowScrollbarX <= SCROLLBAR_MAX) {
+    width += windowScrollbarX;
+  }
   return {
     width,
     height,
@@ -36382,7 +36472,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "0.16.4";
+const version = "0.16.6";
 var [createTooltipContext, createTooltipScope] = createContextScope("Tooltip", [
   createPopperScope
 ]);
@@ -36887,8 +36977,6 @@ const Sidebar = ({
   setOauthScope,
   onConnect,
   onDisconnect,
-  stdErrNotifications,
-  clearStdErrNotifications,
   logLevel,
   sendLogLevelRequest,
   loggingSupported,
@@ -37030,6 +37118,7 @@ const Sidebar = ({
               placeholder: "Command",
               value: command,
               onChange: (e) => setCommand(e.target.value),
+              onBlur: (e) => setCommand(e.target.value.trim()),
               className: "font-mono"
             }
           )
@@ -37499,30 +37588,7 @@ const Sidebar = ({
               ]
             }
           )
-        ] }),
-        stdErrNotifications.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx(jsxRuntimeExports.Fragment, { children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mt-4 border-t border-gray-200 pt-4", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex justify-between items-center", children: [
-            /* @__PURE__ */ jsxRuntimeExports.jsx("h3", { className: "text-sm font-medium", children: "Error output from MCP server" }),
-            /* @__PURE__ */ jsxRuntimeExports.jsx(
-              Button,
-              {
-                variant: "outline",
-                size: "sm",
-                onClick: clearStdErrNotifications,
-                className: "h-8 px-2",
-                children: "Clear"
-              }
-            )
-          ] }),
-          /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "mt-2 max-h-80 overflow-y-auto", children: stdErrNotifications.map((notification, index2) => /* @__PURE__ */ jsxRuntimeExports.jsx(
-            "div",
-            {
-              className: "text-sm text-red-500 font-mono py-2 border-b border-gray-200 last:border-b-0",
-              children: notification.params.content
-            },
-            index2
-          )) })
-        ] }) })
+        ] })
       ] })
     ] }) }),
     /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "p-4 border-t", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between", children: [
@@ -38512,7 +38578,6 @@ const App = () => {
   const [transportType, setTransportType] = reactExports.useState(getInitialTransportType);
   const [logLevel, setLogLevel] = reactExports.useState("debug");
   const [notifications, setNotifications] = reactExports.useState([]);
-  const [stdErrNotifications, setStdErrNotifications] = reactExports.useState([]);
   const [roots, setRoots] = reactExports.useState([]);
   const [env, setEnv] = reactExports.useState({});
   const [config, setConfig] = reactExports.useState(
@@ -38591,12 +38656,6 @@ const App = () => {
     onNotification: (notification) => {
       setNotifications((prev) => [...prev, notification]);
     },
-    onStdErrNotification: (notification) => {
-      setStdErrNotifications((prev) => [
-        ...prev,
-        notification
-      ]);
-    },
     onPendingRequest: (request, resolve, reject) => {
       setPendingSampleRequests((prev) => [
         ...prev,
@@ -39034,9 +39093,6 @@ const App = () => {
     );
     setLogLevel(level);
   };
-  const clearStdErrNotifications = () => {
-    setStdErrNotifications([]);
-  };
   const AuthDebuggerWrapper = () => /* @__PURE__ */ jsxRuntimeExports.jsx(TabsContent, { value: "auth", children: /* @__PURE__ */ jsxRuntimeExports.jsx(
     AuthDebugger,
     {
@@ -39048,13 +39104,13 @@ const App = () => {
   ) });
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-DyaAiF-O.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-Cmffn8om.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-BD-zJllm.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-BhzcPtuF.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }
@@ -39096,11 +39152,9 @@ const App = () => {
               setOauthScope,
               onConnect: connectMcpServer,
               onDisconnect: disconnectMcpServer,
-              stdErrNotifications,
               logLevel,
               sendLogLevelRequest,
-              loggingSupported: !!(serverCapabilities == null ? void 0 : serverCapabilities.logging) || false,
-              clearStdErrNotifications
+              loggingSupported: !!(serverCapabilities == null ? void 0 : serverCapabilities.logging) || false
             }
           ),
           /* @__PURE__ */ jsxRuntimeExports.jsx(

package/client/dist/assets/{index-BWZfLo5E.css → index-C217Ot8c.css}

@@ -944,9 +944,6 @@ video {
 .h-screen {
   height: 100vh;
 }
-.max-h-80 {
-  max-height: 20rem;
-}
 .max-h-96 {
   max-height: 24rem;
 }
@@ -1407,9 +1404,6 @@ video {
 .pr-8 {
   padding-right: 2rem;
 }
-.pt-4 {
-  padding-top: 1rem;
-}
 .text-left {
   text-align: left;
 }
@@ -1625,6 +1619,10 @@ video {
 .ring-offset-background {
   --tw-ring-offset-color: hsl(var(--background));
 }
+.blur {
+  --tw-blur: blur(8px);
+  filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow);
+}
 .filter {
   filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow);
 }
@@ -1768,10 +1766,6 @@ h1 {
   color: hsl(var(--muted-foreground));
 }
 
-.last\:border-b-0:last-child {
-  border-bottom-width: 0px;
-}
-
 .hover\:border-\[\#646cff\]:hover {
   --tw-border-opacity: 1;
   border-color: rgb(100 108 255 / var(--tw-border-opacity, 1));

package/client/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-MFoeZZBS.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BWZfLo5E.css">
+    <script type="module" crossorigin src="/assets/index-B_qh-Btq.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-C217Ot8c.css">
   </head>
   <body>
     <div id="root" class="w-full"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.16.4",
+  "version": "0.16.6",
   "description": "Model Context Protocol inspector",
   "license": "MIT",
   "author": "Anthropic, PBC (https://anthropic.com)",
@@ -41,16 +41,16 @@
     "prettier-fix": "prettier --write .",
     "prettier-check": "prettier --check .",
     "lint": "prettier --check . && cd client && npm run lint",
-    "prepare": "npm run build",
+    "prepare": "husky && npm run build",
     "publish-all": "npm publish --workspaces --access public && npm publish --access public",
     "update-version": "node scripts/update-version.js",
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.16.4",
-    "@modelcontextprotocol/inspector-client": "^0.16.4",
-    "@modelcontextprotocol/inspector-server": "^0.16.4",
-    "@modelcontextprotocol/sdk": "^1.17.2",
+    "@modelcontextprotocol/inspector-cli": "^0.16.6",
+    "@modelcontextprotocol/inspector-client": "^0.16.6",
+    "@modelcontextprotocol/inspector-server": "^0.16.6",
+    "@modelcontextprotocol/sdk": "^1.17.5",
     "concurrently": "^9.2.0",
     "open": "^10.2.0",
     "shell-quote": "^1.8.3",
@@ -63,12 +63,19 @@
     "@types/jest": "^29.5.14",
     "@types/node": "^22.17.0",
     "@types/shell-quote": "^1.7.5",
+    "husky": "^9.1.7",
     "jest-fixed-jsdom": "^0.0.9",
+    "lint-staged": "^16.1.5",
     "prettier": "^3.6.2",
     "rimraf": "^6.0.1",
     "typescript": "^5.4.2"
   },
   "engines": {
     "node": ">=22.7.5"
+  },
+  "lint-staged": {
+    "**/*.{js,ts,jsx,tsx,json,md}": [
+      "prettier --write"
+    ]
   }
 }

package/server/build/index.js

@@ -131,10 +131,10 @@ const createTransport = async (req) => {
     console.log("Query parameters:", JSON.stringify(query));
     const transportType = query.transportType;
     if (transportType === "stdio") {
-        const command = query.command;
+        const command = query.command.trim();
         const origArgs = shellParseArgs(query.args);
         const queryEnv = query.env ? JSON.parse(query.env) : {};
-        const env = { ...process.env, ...defaultEnvironment, ...queryEnv };
+        const env = { ...defaultEnvironment, ...process.env, ...queryEnv };
         const { cmd, args } = findActualExecutable(command, origArgs);
         console.log(`STDIO transport: command=${cmd}, args=${args}`);
         const transport = new StdioClientTransport({
@@ -280,7 +280,6 @@ app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) =
         let serverTransport;
         try {
             serverTransport = await createTransport(req);
-            console.log("Created server transport");
         }
         catch (error) {
             if (error instanceof SseError && error.code === 401) {
@@ -290,32 +289,89 @@ app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) =
             }
             throw error;
         }
-        const webAppTransport = new SSEServerTransport("/message", res);
-        console.log("Created client transport");
+        const proxyFullAddress = req.query.proxyFullAddress || "";
+        const prefix = proxyFullAddress || "";
+        const endpoint = `${prefix}/message`;
+        const webAppTransport = new SSEServerTransport(endpoint, res);
         webAppTransports.set(webAppTransport.sessionId, webAppTransport);
+        console.log("Created client transport");
         serverTransports.set(webAppTransport.sessionId, serverTransport);
+        console.log("Created server transport");
         await webAppTransport.start();
         serverTransport.stderr.on("data", (chunk) => {
             if (chunk.toString().includes("MODULE_NOT_FOUND")) {
+                // Server command not found, remove transports
+                const message = "Command not found, transports removed";
                 webAppTransport.send({
                     jsonrpc: "2.0",
-                    method: "notifications/stderr",
+                    method: "notifications/message",
                     params: {
-                        content: "Command not found, transports removed",
+                        level: "emergency",
+                        logger: "proxy",
+                        data: {
+                            message,
+                        },
                     },
                 });
                 webAppTransport.close();
                 serverTransport.close();
                 webAppTransports.delete(webAppTransport.sessionId);
                 serverTransports.delete(webAppTransport.sessionId);
-                console.error("Command not found, transports removed");
+                console.error(message);
             }
             else {
+                // Inspect message and attempt to assign a RFC 5424 Syslog Protocol level
+                let level;
+                let message = chunk.toString().trim();
+                let ucMsg = chunk.toString().toUpperCase();
+                if (ucMsg.includes("DEBUG")) {
+                    level = "debug";
+                }
+                else if (ucMsg.includes("INFO")) {
+                    level = "info";
+                }
+                else if (ucMsg.includes("NOTICE")) {
+                    level = "notice";
+                }
+                else if (ucMsg.includes("WARN")) {
+                    level = "warning";
+                }
+                else if (ucMsg.includes("ERROR")) {
+                    level = "error";
+                }
+                else if (ucMsg.includes("CRITICAL")) {
+                    level = "critical";
+                }
+                else if (ucMsg.includes("ALERT")) {
+                    level = "alert";
+                }
+                else if (ucMsg.includes("EMERGENCY")) {
+                    level = "emergency";
+                }
+                else if (ucMsg.includes("SIGINT")) {
+                    message = "SIGINT received. Server shutdown.";
+                    level = "emergency";
+                }
+                else if (ucMsg.includes("SIGHUP")) {
+                    message = "SIGHUP received. Server shutdown.";
+                    level = "emergency";
+                }
+                else if (ucMsg.includes("SIGTERM")) {
+                    message = "SIGTERM received. Server shutdown.";
+                    level = "emergency";
+                }
+                else {
+                    level = "info";
+                }
                 webAppTransport.send({
                     jsonrpc: "2.0",
-                    method: "notifications/stderr",
+                    method: "notifications/message",
                     params: {
-                        content: chunk.toString(),
+                        level,
+                        logger: "stdio",
+                        data: {
+                            message,
+                        },
                     },
                 });
             }
@@ -332,7 +388,7 @@ app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) =
 });
 app.get("/sse", originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
-        console.log("New SSE connection request. NOTE: The sse transport is deprecated and has been replaced by StreamableHttp");
+        console.log("New SSE connection request. NOTE: The SSE transport is deprecated and has been replaced by StreamableHttp");
         let serverTransport;
         try {
             serverTransport = await createTransport(req);
@@ -357,7 +413,10 @@ app.get("/sse", originValidationMiddleware, authMiddleware, async (req, res) =>
             }
         }
         if (serverTransport) {
-            const webAppTransport = new SSEServerTransport("/message", res);
+            const proxyFullAddress = req.query.proxyFullAddress || "";
+            const prefix = proxyFullAddress || "";
+            const endpoint = `${prefix}/message`;
+            const webAppTransport = new SSEServerTransport(endpoint, res);
             webAppTransports.set(webAppTransport.sessionId, webAppTransport);
             console.log("Created client transport");
             serverTransports.set(webAppTransport.sessionId, serverTransport);