@modelcontextprotocol/inspector 0.16.6 → 0.16.8

package/server/build/index.js

@@ -2,6 +2,10 @@
 import cors from "cors";
 import { parseArgs } from "node:util";
 import { parse as shellParseArgs } from "shell-quote";
+import nodeFetch, { Headers as NodeHeaders } from "node-fetch";
+// Type-compatible wrappers for node-fetch to work with browser-style types
+const fetch = nodeFetch;
+const Headers = NodeHeaders;
 import { SSEClientTransport, SseError, } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StdioClientTransport, getDefaultEnvironment, } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
@@ -12,12 +16,6 @@ import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
 const DEFAULT_MCP_PROXY_LISTEN_PORT = "6277";
-const SSE_HEADERS_PASSTHROUGH = ["authorization"];
-const STREAMABLE_HTTP_HEADERS_PASSTHROUGH = [
-    "authorization",
-    "mcp-session-id",
-    "last-event-id",
-];
 const defaultEnvironment = {
     ...getDefaultEnvironment(),
     ...(process.env.MCP_ENV_VARS ? JSON.parse(process.env.MCP_ENV_VARS) : {}),
@@ -33,34 +31,91 @@ const { values } = parseArgs({
     },
 });
 // Function to get HTTP headers.
-// Supports only "sse" and "streamable-http" transport types.
-const getHttpHeaders = (req, transportType) => {
-    const headers = {
-        Accept: transportType === "sse"
-            ? "text/event-stream"
-            : "text/event-stream, application/json",
-    };
-    const defaultHeaders = transportType === "sse"
-        ? SSE_HEADERS_PASSTHROUGH
-        : STREAMABLE_HTTP_HEADERS_PASSTHROUGH;
-    for (const key of defaultHeaders) {
-        if (req.headers[key] === undefined) {
-            continue;
+const getHttpHeaders = (req) => {
+    const headers = {};
+    // Iterate over all headers in the request
+    for (const key in req.headers) {
+        const lowerKey = key.toLowerCase();
+        // Check if the header is one we want to forward
+        if (lowerKey.startsWith("mcp-") ||
+            lowerKey === "authorization" ||
+            lowerKey === "last-event-id") {
+            // Exclude the proxy's own authentication header and the Client <-> Proxy session ID header
+            if (lowerKey !== "x-mcp-proxy-auth" && lowerKey !== "mcp-session-id") {
+                const value = req.headers[key];
+                if (typeof value === "string") {
+                    // If the value is a string, use it directly
+                    headers[key] = value;
+                }
+                else if (Array.isArray(value)) {
+                    // If the value is an array, use the last element
+                    const lastValue = value.at(-1);
+                    if (lastValue !== undefined) {
+                        headers[key] = lastValue;
+                    }
+                }
+                // If value is undefined, it's skipped, which is correct.
+            }
         }
-        const value = req.headers[key];
-        headers[key] = Array.isArray(value) ? value[value.length - 1] : value;
     }
-    // If the header "x-custom-auth-header" is present, use its value as the custom header name.
-    if (req.headers["x-custom-auth-header"] !== undefined) {
-        const customHeaderName = req.headers["x-custom-auth-header"];
-        const lowerCaseHeaderName = customHeaderName.toLowerCase();
-        if (req.headers[lowerCaseHeaderName] !== undefined) {
-            const value = req.headers[lowerCaseHeaderName];
-            headers[customHeaderName] = value;
+    // Handle the custom auth header separately. We expect `x-custom-auth-header`
+    // to be a string containing the name of the actual authentication header.
+    const customAuthHeaderName = req.headers["x-custom-auth-header"];
+    if (typeof customAuthHeaderName === "string") {
+        const lowerCaseHeaderName = customAuthHeaderName.toLowerCase();
+        const value = req.headers[lowerCaseHeaderName];
+        if (typeof value === "string") {
+            headers[customAuthHeaderName] = value;
+        }
+        else if (Array.isArray(value)) {
+            // If the actual auth header was sent multiple times, use the last value.
+            const lastValue = value.at(-1);
+            if (lastValue !== undefined) {
+                headers[customAuthHeaderName] = lastValue;
+            }
+        }
+    }
+    // Handle multiple custom headers (new approach)
+    if (req.headers["x-custom-auth-headers"] !== undefined) {
+        try {
+            const customHeaderNames = JSON.parse(req.headers["x-custom-auth-headers"]);
+            if (Array.isArray(customHeaderNames)) {
+                customHeaderNames.forEach((headerName) => {
+                    const lowerCaseHeaderName = headerName.toLowerCase();
+                    if (req.headers[lowerCaseHeaderName] !== undefined) {
+                        const value = req.headers[lowerCaseHeaderName];
+                        headers[headerName] = Array.isArray(value)
+                            ? value[value.length - 1]
+                            : value;
+                    }
+                });
+            }
+        }
+        catch (error) {
+            console.warn("Failed to parse x-custom-auth-headers:", error);
         }
     }
     return headers;
 };
+/**
+ * Updates a headers object in-place, preserving the original Accept header.
+ * This is necessary to ensure that transports holding a reference to the headers
+ * object see the updates.
+ * @param currentHeaders The headers object to update.
+ * @param newHeaders The new headers to apply.
+ */
+const updateHeadersInPlace = (currentHeaders, newHeaders) => {
+    // Preserve the Accept header, which is set at transport creation and
+    // is not present in subsequent client requests.
+    const accept = currentHeaders["Accept"];
+    // Clear the old headers and apply the new ones.
+    Object.keys(currentHeaders).forEach((key) => delete currentHeaders[key]);
+    Object.assign(currentHeaders, newHeaders);
+    // Restore the Accept header.
+    if (accept) {
+        currentHeaders["Accept"] = accept;
+    }
+};
 const app = express();
 app.use(cors());
 app.use((req, res, next) => {
@@ -69,6 +124,7 @@ app.use((req, res, next) => {
 });
 const webAppTransports = new Map(); // Web app transports by web app sessionId
 const serverTransports = new Map(); // Server Transports by web app sessionId
+const sessionHeaderHolders = new Map(); // For dynamic header updates
 // Use provided token from environment or generate a new one
 const sessionToken = process.env.MCP_PROXY_AUTH_TOKEN || randomBytes(32).toString("hex");
 const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
@@ -126,6 +182,73 @@ const authMiddleware = (req, res, next) => {
     }
     next();
 };
+/**
+ * Converts a Node.js ReadableStream to a web-compatible ReadableStream
+ * This is necessary for the EventSource polyfill which expects web streams
+ */
+const createWebReadableStream = (nodeStream) => {
+    return new ReadableStream({
+        start(controller) {
+            nodeStream.on("data", (chunk) => {
+                controller.enqueue(chunk);
+            });
+            nodeStream.on("end", () => {
+                controller.close();
+            });
+            nodeStream.on("error", (err) => {
+                controller.error(err);
+            });
+        },
+    });
+};
+/**
+ * Creates a `fetch` function that merges dynamic session headers with the
+ * headers from the actual request, ensuring that request-specific headers like
+ * `Content-Type` are preserved. For SSE requests, it also converts Node.js
+ * streams to web-compatible streams.
+ */
+const createCustomFetch = (headerHolder) => {
+    return async (input, init) => {
+        // Determine the headers from the original request/init.
+        // The SDK may pass a Request object or a URL and an init object.
+        const originalHeaders = input instanceof Request ? input.headers : init?.headers;
+        // Start with our dynamic session headers.
+        const finalHeaders = new Headers(headerHolder.headers);
+        // Merge the SDK's request-specific headers, letting them overwrite.
+        // This is crucial for preserving Content-Type on POST requests.
+        new Headers(originalHeaders).forEach((value, key) => {
+            finalHeaders.set(key, value);
+        });
+        // Convert Headers to a plain object for node-fetch compatibility
+        const headersObject = {};
+        finalHeaders.forEach((value, key) => {
+            headersObject[key] = value;
+        });
+        // Get the response from node-fetch (cast input and init to handle type differences)
+        const response = await fetch(input, { ...init, headers: headersObject });
+        // Check if this is an SSE request by looking at the Accept header
+        const acceptHeader = finalHeaders.get("Accept");
+        const isSSE = acceptHeader?.includes("text/event-stream");
+        if (isSSE && response.body) {
+            // For SSE requests, we need to convert the Node.js stream to a web ReadableStream
+            // because the EventSource polyfill expects web-compatible streams
+            const webStream = createWebReadableStream(response.body);
+            // Create a new response with the web-compatible stream
+            // Convert node-fetch headers to plain object for web Response compatibility
+            const responseHeaders = {};
+            response.headers.forEach((value, key) => {
+                responseHeaders[key] = value;
+            });
+            return new Response(webStream, {
+                status: response.status,
+                statusText: response.statusText,
+                headers: responseHeaders,
+            });
+        }
+        // For non-SSE requests, return the response as-is (cast to handle type differences)
+        return response;
+    };
+};
 const createTransport = async (req) => {
     const query = req.query;
     console.log("Query parameters:", JSON.stringify(query));
@@ -144,32 +267,35 @@ const createTransport = async (req) => {
             stderr: "pipe",
         });
         await transport.start();
-        return transport;
+        return { transport };
     }
     else if (transportType === "sse") {
         const url = query.url;
-        const headers = getHttpHeaders(req, transportType);
+        const headers = getHttpHeaders(req);
+        headers["Accept"] = "text/event-stream";
+        const headerHolder = { headers };
         console.log(`SSE transport: url=${url}, headers=${JSON.stringify(headers)}`);
         const transport = new SSEClientTransport(new URL(url), {
             eventSourceInit: {
-                fetch: (url, init) => fetch(url, { ...init, headers }),
+                fetch: createCustomFetch(headerHolder),
             },
             requestInit: {
-                headers,
+                headers: headerHolder.headers,
             },
         });
         await transport.start();
-        return transport;
+        return { transport, headerHolder };
     }
     else if (transportType === "streamable-http") {
-        const headers = getHttpHeaders(req, transportType);
+        const headers = getHttpHeaders(req);
+        headers["Accept"] = "text/event-stream, application/json";
+        const headerHolder = { headers };
         const transport = new StreamableHTTPClientTransport(new URL(query.url), {
-            requestInit: {
-                headers,
-            },
+            // Pass a custom fetch to inject the latest headers on each request
+            fetch: createCustomFetch(headerHolder),
         });
         await transport.start();
-        return transport;
+        return { transport, headerHolder };
     }
     else {
         console.error(`Invalid transport type: ${transportType}`);
@@ -179,6 +305,10 @@ const createTransport = async (req) => {
 app.get("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
     console.log(`Received GET message for sessionId ${sessionId}`);
+    const headerHolder = sessionHeaderHolders.get(sessionId);
+    if (headerHolder) {
+        updateHeadersInPlace(headerHolder.headers, getHttpHeaders(req));
+    }
     try {
         const transport = webAppTransports.get(sessionId);
         if (!transport) {
@@ -196,29 +326,45 @@ app.get("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
 });
 app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
-    let serverTransport;
-    if (!sessionId) {
+    if (sessionId) {
+        console.log(`Received POST message for sessionId ${sessionId}`);
+        const headerHolder = sessionHeaderHolders.get(sessionId);
+        if (headerHolder) {
+            updateHeadersInPlace(headerHolder.headers, getHttpHeaders(req));
+        }
         try {
-            console.log("New StreamableHttp connection request");
-            try {
-                serverTransport = await createTransport(req);
+            const transport = webAppTransports.get(sessionId);
+            if (!transport) {
+                res.status(404).end("Transport not found for sessionId " + sessionId);
             }
-            catch (error) {
-                if (error instanceof SseError && error.code === 401) {
-                    console.error("Received 401 Unauthorized from MCP server:", error.message);
-                    res.status(401).json(error);
-                    return;
-                }
-                throw error;
+            else {
+                await transport.handleRequest(req, res);
             }
-            console.log("Created StreamableHttp server transport");
+        }
+        catch (error) {
+            console.error("Error in /mcp route:", error);
+            res.status(500).json(error);
+        }
+    }
+    else {
+        console.log("New StreamableHttp connection request");
+        try {
+            const { transport: serverTransport, headerHolder } = await createTransport(req);
             const webAppTransport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: randomUUID,
                 onsessioninitialized: (sessionId) => {
                     webAppTransports.set(sessionId, webAppTransport);
-                    serverTransports.set(sessionId, serverTransport);
+                    serverTransports.set(sessionId, serverTransport); // eslint-disable-line @typescript-eslint/no-non-null-assertion
+                    if (headerHolder) {
+                        sessionHeaderHolders.set(sessionId, headerHolder);
+                    }
                     console.log("Client <-> Proxy  sessionId: " + sessionId);
                 },
+                onsessionclosed: (sessionId) => {
+                    webAppTransports.delete(sessionId);
+                    serverTransports.delete(sessionId);
+                    sessionHeaderHolders.delete(sessionId);
+                },
             });
             console.log("Created StreamableHttp client transport");
             await webAppTransport.start();
@@ -229,23 +375,12 @@ app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
             await webAppTransport.handleRequest(req, res, req.body);
         }
         catch (error) {
-            console.error("Error in /mcp POST route:", error);
-            res.status(500).json(error);
-        }
-    }
-    else {
-        console.log(`Received POST message for sessionId ${sessionId}`);
-        try {
-            const transport = webAppTransports.get(sessionId);
-            if (!transport) {
-                res.status(404).end("Transport not found for sessionId " + sessionId);
-            }
-            else {
-                await transport.handleRequest(req, res);
+            if (error instanceof SseError && error.code === 401) {
+                console.error("Received 401 Unauthorized from MCP server:", error.message);
+                res.status(401).json(error);
+                return;
             }
-        }
-        catch (error) {
-            console.error("Error in /mcp route:", error);
+            console.error("Error in /mcp POST route:", error);
             res.status(500).json(error);
         }
     }
@@ -253,10 +388,9 @@ app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
 app.delete("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
     console.log(`Received DELETE message for sessionId ${sessionId}`);
-    let serverTransport;
     if (sessionId) {
         try {
-            serverTransport = serverTransports.get(sessionId);
+            const serverTransport = serverTransports.get(sessionId);
             if (!serverTransport) {
                 res.status(404).end("Transport not found for sessionId " + sessionId);
             }
@@ -264,6 +398,7 @@ app.delete("/mcp", originValidationMiddleware, authMiddleware, async (req, res)
                 await serverTransport.terminateSession();
                 webAppTransports.delete(sessionId);
                 serverTransports.delete(sessionId);
+                sessionHeaderHolders.delete(sessionId);
                 console.log(`Transports removed for sessionId ${sessionId}`);
             }
             res.status(200).end();
@@ -277,18 +412,7 @@ app.delete("/mcp", originValidationMiddleware, authMiddleware, async (req, res)
 app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
         console.log("New STDIO connection request");
-        let serverTransport;
-        try {
-            serverTransport = await createTransport(req);
-        }
-        catch (error) {
-            if (error instanceof SseError && error.code === 401) {
-                console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
-                res.status(401).json(error);
-                return;
-            }
-            throw error;
-        }
+        const { transport: serverTransport } = await createTransport(req);
         const proxyFullAddress = req.query.proxyFullAddress || "";
         const prefix = proxyFullAddress || "";
         const endpoint = `${prefix}/message`;
@@ -317,6 +441,7 @@ app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) =
                 serverTransport.close();
                 webAppTransports.delete(webAppTransport.sessionId);
                 serverTransports.delete(webAppTransport.sessionId);
+                sessionHeaderHolders.delete(webAppTransport.sessionId);
                 console.error(message);
             }
             else {
@@ -382,6 +507,11 @@ app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) =
         });
     }
     catch (error) {
+        if (error instanceof SseError && error.code === 401) {
+            console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
+            res.status(401).json(error);
+            return;
+        }
         console.error("Error in /stdio route:", error);
         res.status(500).json(error);
     }
@@ -389,46 +519,39 @@ app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) =
 app.get("/sse", originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
         console.log("New SSE connection request. NOTE: The SSE transport is deprecated and has been replaced by StreamableHttp");
-        let serverTransport;
-        try {
-            serverTransport = await createTransport(req);
-        }
-        catch (error) {
-            if (error instanceof SseError && error.code === 401) {
-                console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
-                res.status(401).json(error);
-                return;
-            }
-            else if (error instanceof SseError && error.code === 404) {
-                console.error("Received 404 not found from MCP server. Does the MCP server support SSE?");
-                res.status(404).json(error);
-                return;
-            }
-            else if (JSON.stringify(error).includes("ECONNREFUSED")) {
-                console.error("Connection refused. Is the MCP server running?");
-                res.status(500).json(error);
-            }
-            else {
-                throw error;
-            }
-        }
-        if (serverTransport) {
-            const proxyFullAddress = req.query.proxyFullAddress || "";
-            const prefix = proxyFullAddress || "";
-            const endpoint = `${prefix}/message`;
-            const webAppTransport = new SSEServerTransport(endpoint, res);
-            webAppTransports.set(webAppTransport.sessionId, webAppTransport);
-            console.log("Created client transport");
-            serverTransports.set(webAppTransport.sessionId, serverTransport);
-            console.log("Created server transport");
-            await webAppTransport.start();
-            mcpProxy({
-                transportToClient: webAppTransport,
-                transportToServer: serverTransport,
-            });
+        const { transport: serverTransport, headerHolder } = await createTransport(req);
+        const proxyFullAddress = req.query.proxyFullAddress || "";
+        const prefix = proxyFullAddress || "";
+        const endpoint = `${prefix}/message`;
+        const webAppTransport = new SSEServerTransport(endpoint, res);
+        webAppTransports.set(webAppTransport.sessionId, webAppTransport);
+        console.log("Created client transport");
+        serverTransports.set(webAppTransport.sessionId, serverTransport); // eslint-disable-line @typescript-eslint/no-non-null-assertion
+        if (headerHolder) {
+            sessionHeaderHolders.set(webAppTransport.sessionId, headerHolder);
         }
+        console.log("Created server transport");
+        await webAppTransport.start();
+        mcpProxy({
+            transportToClient: webAppTransport,
+            transportToServer: serverTransport,
+        });
     }
     catch (error) {
+        if (error instanceof SseError && error.code === 401) {
+            console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
+            res.status(401).json(error);
+            return;
+        }
+        else if (error instanceof SseError && error.code === 404) {
+            console.error("Received 404 not found from MCP server. Does the MCP server support SSE?");
+            res.status(404).json(error);
+            return;
+        }
+        else if (JSON.stringify(error).includes("ECONNREFUSED")) {
+            console.error("Connection refused. Is the MCP server running?");
+            res.status(500).json(error);
+        }
         console.error("Error in /sse route:", error);
         res.status(500).json(error);
     }
@@ -437,6 +560,10 @@ app.post("/message", originValidationMiddleware, authMiddleware, async (req, res
     try {
         const sessionId = req.query.sessionId;
         console.log(`Received POST message for sessionId ${sessionId}`);
+        const headerHolder = sessionHeaderHolders.get(sessionId);
+        if (headerHolder) {
+            updateHeadersInPlace(headerHolder.headers, getHttpHeaders(req));
+        }
         const transport = webAppTransports.get(sessionId);
         if (!transport) {
             res.status(404).end("Session not found");