@modelcontextprotocol/inspector 0.16.5 → 0.16.7

package/client/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-BIvDs4Sc.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BWZfLo5E.css">
+    <script type="module" crossorigin src="/assets/index-Dg7mXHRE.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DZ1A0VH0.css">
   </head>
   <body>
     <div id="root" class="w-full"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.16.5",
+  "version": "0.16.7",
   "description": "Model Context Protocol inspector",
   "license": "MIT",
   "author": "Anthropic, PBC (https://anthropic.com)",
@@ -41,16 +41,16 @@
     "prettier-fix": "prettier --write .",
     "prettier-check": "prettier --check .",
     "lint": "prettier --check . && cd client && npm run lint",
-    "prepare": "npm run build",
+    "prepare": "husky && npm run build",
     "publish-all": "npm publish --workspaces --access public && npm publish --access public",
     "update-version": "node scripts/update-version.js",
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.16.5",
-    "@modelcontextprotocol/inspector-client": "^0.16.5",
-    "@modelcontextprotocol/inspector-server": "^0.16.5",
-    "@modelcontextprotocol/sdk": "^1.17.3",
+    "@modelcontextprotocol/inspector-cli": "^0.16.7",
+    "@modelcontextprotocol/inspector-client": "^0.16.7",
+    "@modelcontextprotocol/inspector-server": "^0.16.7",
+    "@modelcontextprotocol/sdk": "^1.18.0",
     "concurrently": "^9.2.0",
     "open": "^10.2.0",
     "shell-quote": "^1.8.3",
@@ -63,12 +63,19 @@
     "@types/jest": "^29.5.14",
     "@types/node": "^22.17.0",
     "@types/shell-quote": "^1.7.5",
+    "husky": "^9.1.7",
     "jest-fixed-jsdom": "^0.0.9",
+    "lint-staged": "^16.1.5",
     "prettier": "^3.6.2",
     "rimraf": "^6.0.1",
     "typescript": "^5.4.2"
   },
   "engines": {
     "node": ">=22.7.5"
+  },
+  "lint-staged": {
+    "**/*.{js,ts,jsx,tsx,json,md}": [
+      "prettier --write"
+    ]
   }
 }

package/server/build/index.js

@@ -12,12 +12,6 @@ import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
 const DEFAULT_MCP_PROXY_LISTEN_PORT = "6277";
-const SSE_HEADERS_PASSTHROUGH = ["authorization"];
-const STREAMABLE_HTTP_HEADERS_PASSTHROUGH = [
-    "authorization",
-    "mcp-session-id",
-    "last-event-id",
-];
 const defaultEnvironment = {
     ...getDefaultEnvironment(),
     ...(process.env.MCP_ENV_VARS ? JSON.parse(process.env.MCP_ENV_VARS) : {}),
@@ -33,34 +27,71 @@ const { values } = parseArgs({
     },
 });
 // Function to get HTTP headers.
-// Supports only "sse" and "streamable-http" transport types.
-const getHttpHeaders = (req, transportType) => {
-    const headers = {
-        Accept: transportType === "sse"
-            ? "text/event-stream"
-            : "text/event-stream, application/json",
-    };
-    const defaultHeaders = transportType === "sse"
-        ? SSE_HEADERS_PASSTHROUGH
-        : STREAMABLE_HTTP_HEADERS_PASSTHROUGH;
-    for (const key of defaultHeaders) {
-        if (req.headers[key] === undefined) {
-            continue;
+const getHttpHeaders = (req) => {
+    const headers = {};
+    // Iterate over all headers in the request
+    for (const key in req.headers) {
+        const lowerKey = key.toLowerCase();
+        // Check if the header is one we want to forward
+        if (lowerKey.startsWith("mcp-") ||
+            lowerKey === "authorization" ||
+            lowerKey === "last-event-id") {
+            // Exclude the proxy's own authentication header
+            if (lowerKey !== "x-mcp-proxy-auth") {
+                const value = req.headers[key];
+                if (typeof value === "string") {
+                    // If the value is a string, use it directly
+                    headers[key] = value;
+                }
+                else if (Array.isArray(value)) {
+                    // If the value is an array, use the last element
+                    const lastValue = value.at(-1);
+                    if (lastValue !== undefined) {
+                        headers[key] = lastValue;
+                    }
+                }
+                // If value is undefined, it's skipped, which is correct.
+            }
         }
-        const value = req.headers[key];
-        headers[key] = Array.isArray(value) ? value[value.length - 1] : value;
     }
-    // If the header "x-custom-auth-header" is present, use its value as the custom header name.
-    if (req.headers["x-custom-auth-header"] !== undefined) {
-        const customHeaderName = req.headers["x-custom-auth-header"];
-        const lowerCaseHeaderName = customHeaderName.toLowerCase();
-        if (req.headers[lowerCaseHeaderName] !== undefined) {
-            const value = req.headers[lowerCaseHeaderName];
-            headers[customHeaderName] = value;
+    // Handle the custom auth header separately. We expect `x-custom-auth-header`
+    // to be a string containing the name of the actual authentication header.
+    const customAuthHeaderName = req.headers["x-custom-auth-header"];
+    if (typeof customAuthHeaderName === "string") {
+        const lowerCaseHeaderName = customAuthHeaderName.toLowerCase();
+        const value = req.headers[lowerCaseHeaderName];
+        if (typeof value === "string") {
+            headers[customAuthHeaderName] = value;
+        }
+        else if (Array.isArray(value)) {
+            // If the actual auth header was sent multiple times, use the last value.
+            const lastValue = value.at(-1);
+            if (lastValue !== undefined) {
+                headers[customAuthHeaderName] = lastValue;
+            }
         }
     }
     return headers;
 };
+/**
+ * Updates a headers object in-place, preserving the original Accept header.
+ * This is necessary to ensure that transports holding a reference to the headers
+ * object see the updates.
+ * @param currentHeaders The headers object to update.
+ * @param newHeaders The new headers to apply.
+ */
+const updateHeadersInPlace = (currentHeaders, newHeaders) => {
+    // Preserve the Accept header, which is set at transport creation and
+    // is not present in subsequent client requests.
+    const accept = currentHeaders["Accept"];
+    // Clear the old headers and apply the new ones.
+    Object.keys(currentHeaders).forEach((key) => delete currentHeaders[key]);
+    Object.assign(currentHeaders, newHeaders);
+    // Restore the Accept header.
+    if (accept) {
+        currentHeaders["Accept"] = accept;
+    }
+};
 const app = express();
 app.use(cors());
 app.use((req, res, next) => {
@@ -69,6 +100,7 @@ app.use((req, res, next) => {
 });
 const webAppTransports = new Map(); // Web app transports by web app sessionId
 const serverTransports = new Map(); // Server Transports by web app sessionId
+const sessionHeaderHolders = new Map(); // For dynamic header updates
 // Use provided token from environment or generate a new one
 const sessionToken = process.env.MCP_PROXY_AUTH_TOKEN || randomBytes(32).toString("hex");
 const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
@@ -126,12 +158,33 @@ const authMiddleware = (req, res, next) => {
     }
     next();
 };
+/**
+ * Creates a `fetch` function that merges dynamic session headers with the
+ * headers from the actual request, ensuring that request-specific headers like
+ * `Content-Type` are preserved.
+ */
+const createCustomFetch = (headerHolder) => {
+    return (input, init) => {
+        // Determine the headers from the original request/init.
+        // The SDK may pass a Request object or a URL and an init object.
+        const originalHeaders = input instanceof Request ? input.headers : init?.headers;
+        // Start with our dynamic session headers.
+        const finalHeaders = new Headers(headerHolder.headers);
+        // Merge the SDK's request-specific headers, letting them overwrite.
+        // This is crucial for preserving Content-Type on POST requests.
+        new Headers(originalHeaders).forEach((value, key) => {
+            finalHeaders.set(key, value);
+        });
+        // This works for both `fetch(url, init)` and `fetch(request)` style calls.
+        return fetch(input, { ...init, headers: finalHeaders });
+    };
+};
 const createTransport = async (req) => {
     const query = req.query;
     console.log("Query parameters:", JSON.stringify(query));
     const transportType = query.transportType;
     if (transportType === "stdio") {
-        const command = query.command;
+        const command = query.command.trim();
         const origArgs = shellParseArgs(query.args);
         const queryEnv = query.env ? JSON.parse(query.env) : {};
         const env = { ...defaultEnvironment, ...process.env, ...queryEnv };
@@ -144,32 +197,35 @@ const createTransport = async (req) => {
             stderr: "pipe",
         });
         await transport.start();
-        return transport;
+        return { transport };
     }
     else if (transportType === "sse") {
         const url = query.url;
-        const headers = getHttpHeaders(req, transportType);
+        const headers = getHttpHeaders(req);
+        headers["Accept"] = "text/event-stream";
+        const headerHolder = { headers };
         console.log(`SSE transport: url=${url}, headers=${JSON.stringify(headers)}`);
         const transport = new SSEClientTransport(new URL(url), {
             eventSourceInit: {
-                fetch: (url, init) => fetch(url, { ...init, headers }),
+                fetch: createCustomFetch(headerHolder),
             },
             requestInit: {
-                headers,
+                headers: headerHolder.headers,
             },
         });
         await transport.start();
-        return transport;
+        return { transport, headerHolder };
     }
     else if (transportType === "streamable-http") {
-        const headers = getHttpHeaders(req, transportType);
+        const headers = getHttpHeaders(req);
+        headers["Accept"] = "text/event-stream, application/json";
+        const headerHolder = { headers };
         const transport = new StreamableHTTPClientTransport(new URL(query.url), {
-            requestInit: {
-                headers,
-            },
+            // Pass a custom fetch to inject the latest headers on each request
+            fetch: createCustomFetch(headerHolder),
         });
         await transport.start();
-        return transport;
+        return { transport, headerHolder };
     }
     else {
         console.error(`Invalid transport type: ${transportType}`);
@@ -179,6 +235,10 @@ const createTransport = async (req) => {
 app.get("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
     console.log(`Received GET message for sessionId ${sessionId}`);
+    const headerHolder = sessionHeaderHolders.get(sessionId);
+    if (headerHolder) {
+        updateHeadersInPlace(headerHolder.headers, getHttpHeaders(req));
+    }
     try {
         const transport = webAppTransports.get(sessionId);
         if (!transport) {
@@ -196,29 +256,45 @@ app.get("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
 });
 app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
-    let serverTransport;
-    if (!sessionId) {
+    if (sessionId) {
+        console.log(`Received POST message for sessionId ${sessionId}`);
+        const headerHolder = sessionHeaderHolders.get(sessionId);
+        if (headerHolder) {
+            updateHeadersInPlace(headerHolder.headers, getHttpHeaders(req));
+        }
         try {
-            console.log("New StreamableHttp connection request");
-            try {
-                serverTransport = await createTransport(req);
+            const transport = webAppTransports.get(sessionId);
+            if (!transport) {
+                res.status(404).end("Transport not found for sessionId " + sessionId);
             }
-            catch (error) {
-                if (error instanceof SseError && error.code === 401) {
-                    console.error("Received 401 Unauthorized from MCP server:", error.message);
-                    res.status(401).json(error);
-                    return;
-                }
-                throw error;
+            else {
+                await transport.handleRequest(req, res);
             }
-            console.log("Created StreamableHttp server transport");
+        }
+        catch (error) {
+            console.error("Error in /mcp route:", error);
+            res.status(500).json(error);
+        }
+    }
+    else {
+        console.log("New StreamableHttp connection request");
+        try {
+            const { transport: serverTransport, headerHolder } = await createTransport(req);
             const webAppTransport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: randomUUID,
                 onsessioninitialized: (sessionId) => {
                     webAppTransports.set(sessionId, webAppTransport);
-                    serverTransports.set(sessionId, serverTransport);
+                    serverTransports.set(sessionId, serverTransport); // eslint-disable-line @typescript-eslint/no-non-null-assertion
+                    if (headerHolder) {
+                        sessionHeaderHolders.set(sessionId, headerHolder);
+                    }
                     console.log("Client <-> Proxy  sessionId: " + sessionId);
                 },
+                onsessionclosed: (sessionId) => {
+                    webAppTransports.delete(sessionId);
+                    serverTransports.delete(sessionId);
+                    sessionHeaderHolders.delete(sessionId);
+                },
             });
             console.log("Created StreamableHttp client transport");
             await webAppTransport.start();
@@ -229,23 +305,12 @@ app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
             await webAppTransport.handleRequest(req, res, req.body);
         }
         catch (error) {
-            console.error("Error in /mcp POST route:", error);
-            res.status(500).json(error);
-        }
-    }
-    else {
-        console.log(`Received POST message for sessionId ${sessionId}`);
-        try {
-            const transport = webAppTransports.get(sessionId);
-            if (!transport) {
-                res.status(404).end("Transport not found for sessionId " + sessionId);
-            }
-            else {
-                await transport.handleRequest(req, res);
+            if (error instanceof SseError && error.code === 401) {
+                console.error("Received 401 Unauthorized from MCP server:", error.message);
+                res.status(401).json(error);
+                return;
             }
-        }
-        catch (error) {
-            console.error("Error in /mcp route:", error);
+            console.error("Error in /mcp POST route:", error);
             res.status(500).json(error);
         }
     }
@@ -253,10 +318,9 @@ app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
 app.delete("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
     console.log(`Received DELETE message for sessionId ${sessionId}`);
-    let serverTransport;
     if (sessionId) {
         try {
-            serverTransport = serverTransports.get(sessionId);
+            const serverTransport = serverTransports.get(sessionId);
             if (!serverTransport) {
                 res.status(404).end("Transport not found for sessionId " + sessionId);
             }
@@ -264,6 +328,7 @@ app.delete("/mcp", originValidationMiddleware, authMiddleware, async (req, res)
                 await serverTransport.terminateSession();
                 webAppTransports.delete(sessionId);
                 serverTransports.delete(sessionId);
+                sessionHeaderHolders.delete(sessionId);
                 console.log(`Transports removed for sessionId ${sessionId}`);
             }
             res.status(200).end();
@@ -277,45 +342,91 @@ app.delete("/mcp", originValidationMiddleware, authMiddleware, async (req, res)
 app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
         console.log("New STDIO connection request");
-        let serverTransport;
-        try {
-            serverTransport = await createTransport(req);
-            console.log("Created server transport");
-        }
-        catch (error) {
-            if (error instanceof SseError && error.code === 401) {
-                console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
-                res.status(401).json(error);
-                return;
-            }
-            throw error;
-        }
-        const webAppTransport = new SSEServerTransport("/message", res);
-        console.log("Created client transport");
+        const { transport: serverTransport } = await createTransport(req);
+        const proxyFullAddress = req.query.proxyFullAddress || "";
+        const prefix = proxyFullAddress || "";
+        const endpoint = `${prefix}/message`;
+        const webAppTransport = new SSEServerTransport(endpoint, res);
         webAppTransports.set(webAppTransport.sessionId, webAppTransport);
+        console.log("Created client transport");
         serverTransports.set(webAppTransport.sessionId, serverTransport);
+        console.log("Created server transport");
         await webAppTransport.start();
         serverTransport.stderr.on("data", (chunk) => {
             if (chunk.toString().includes("MODULE_NOT_FOUND")) {
+                // Server command not found, remove transports
+                const message = "Command not found, transports removed";
                 webAppTransport.send({
                     jsonrpc: "2.0",
-                    method: "notifications/stderr",
+                    method: "notifications/message",
                     params: {
-                        content: "Command not found, transports removed",
+                        level: "emergency",
+                        logger: "proxy",
+                        data: {
+                            message,
+                        },
                     },
                 });
                 webAppTransport.close();
                 serverTransport.close();
                 webAppTransports.delete(webAppTransport.sessionId);
                 serverTransports.delete(webAppTransport.sessionId);
-                console.error("Command not found, transports removed");
+                sessionHeaderHolders.delete(webAppTransport.sessionId);
+                console.error(message);
             }
             else {
+                // Inspect message and attempt to assign a RFC 5424 Syslog Protocol level
+                let level;
+                let message = chunk.toString().trim();
+                let ucMsg = chunk.toString().toUpperCase();
+                if (ucMsg.includes("DEBUG")) {
+                    level = "debug";
+                }
+                else if (ucMsg.includes("INFO")) {
+                    level = "info";
+                }
+                else if (ucMsg.includes("NOTICE")) {
+                    level = "notice";
+                }
+                else if (ucMsg.includes("WARN")) {
+                    level = "warning";
+                }
+                else if (ucMsg.includes("ERROR")) {
+                    level = "error";
+                }
+                else if (ucMsg.includes("CRITICAL")) {
+                    level = "critical";
+                }
+                else if (ucMsg.includes("ALERT")) {
+                    level = "alert";
+                }
+                else if (ucMsg.includes("EMERGENCY")) {
+                    level = "emergency";
+                }
+                else if (ucMsg.includes("SIGINT")) {
+                    message = "SIGINT received. Server shutdown.";
+                    level = "emergency";
+                }
+                else if (ucMsg.includes("SIGHUP")) {
+                    message = "SIGHUP received. Server shutdown.";
+                    level = "emergency";
+                }
+                else if (ucMsg.includes("SIGTERM")) {
+                    message = "SIGTERM received. Server shutdown.";
+                    level = "emergency";
+                }
+                else {
+                    level = "info";
+                }
                 webAppTransport.send({
                     jsonrpc: "2.0",
-                    method: "notifications/stderr",
+                    method: "notifications/message",
                     params: {
-                        content: chunk.toString(),
+                        level,
+                        logger: "stdio",
+                        data: {
+                            message,
+                        },
                     },
                 });
             }
@@ -326,50 +437,51 @@ app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) =
         });
     }
     catch (error) {
+        if (error instanceof SseError && error.code === 401) {
+            console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
+            res.status(401).json(error);
+            return;
+        }
         console.error("Error in /stdio route:", error);
         res.status(500).json(error);
     }
 });
 app.get("/sse", originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
-        console.log("New SSE connection request. NOTE: The sse transport is deprecated and has been replaced by StreamableHttp");
-        let serverTransport;
-        try {
-            serverTransport = await createTransport(req);
-        }
-        catch (error) {
-            if (error instanceof SseError && error.code === 401) {
-                console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
-                res.status(401).json(error);
-                return;
-            }
-            else if (error instanceof SseError && error.code === 404) {
-                console.error("Received 404 not found from MCP server. Does the MCP server support SSE?");
-                res.status(404).json(error);
-                return;
-            }
-            else if (JSON.stringify(error).includes("ECONNREFUSED")) {
-                console.error("Connection refused. Is the MCP server running?");
-                res.status(500).json(error);
-            }
-            else {
-                throw error;
-            }
-        }
-        if (serverTransport) {
-            const webAppTransport = new SSEServerTransport("/message", res);
-            webAppTransports.set(webAppTransport.sessionId, webAppTransport);
-            console.log("Created client transport");
-            serverTransports.set(webAppTransport.sessionId, serverTransport);
-            console.log("Created server transport");
-            await webAppTransport.start();
-            mcpProxy({
-                transportToClient: webAppTransport,
-                transportToServer: serverTransport,
-            });
+        console.log("New SSE connection request. NOTE: The SSE transport is deprecated and has been replaced by StreamableHttp");
+        const { transport: serverTransport, headerHolder } = await createTransport(req);
+        const proxyFullAddress = req.query.proxyFullAddress || "";
+        const prefix = proxyFullAddress || "";
+        const endpoint = `${prefix}/message`;
+        const webAppTransport = new SSEServerTransport(endpoint, res);
+        webAppTransports.set(webAppTransport.sessionId, webAppTransport);
+        console.log("Created client transport");
+        serverTransports.set(webAppTransport.sessionId, serverTransport); // eslint-disable-line @typescript-eslint/no-non-null-assertion
+        if (headerHolder) {
+            sessionHeaderHolders.set(webAppTransport.sessionId, headerHolder);
         }
+        console.log("Created server transport");
+        await webAppTransport.start();
+        mcpProxy({
+            transportToClient: webAppTransport,
+            transportToServer: serverTransport,
+        });
     }
     catch (error) {
+        if (error instanceof SseError && error.code === 401) {
+            console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
+            res.status(401).json(error);
+            return;
+        }
+        else if (error instanceof SseError && error.code === 404) {
+            console.error("Received 404 not found from MCP server. Does the MCP server support SSE?");
+            res.status(404).json(error);
+            return;
+        }
+        else if (JSON.stringify(error).includes("ECONNREFUSED")) {
+            console.error("Connection refused. Is the MCP server running?");
+            res.status(500).json(error);
+        }
         console.error("Error in /sse route:", error);
         res.status(500).json(error);
     }
@@ -378,6 +490,10 @@ app.post("/message", originValidationMiddleware, authMiddleware, async (req, res
     try {
         const sessionId = req.query.sessionId;
         console.log(`Received POST message for sessionId ${sessionId}`);
+        const headerHolder = sessionHeaderHolders.get(sessionId);
+        if (headerHolder) {
+            updateHeadersInPlace(headerHolder.headers, getHttpHeaders(req));
+        }
         const transport = webAppTransports.get(sessionId);
         if (!transport) {
             res.status(404).end("Session not found");