@modelcontextprotocol/inspector 0.21.1 → 0.22.0

package/client/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-uKaJPCZp.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-_5aZhNPC.css">
+    <script type="module" crossorigin src="/assets/index-CngsKvMW.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CfzB1GD8.css">
   </head>
   <body>
     <div id="root" class="w-full"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.21.1",
+  "version": "0.22.0",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -10,6 +10,10 @@
   "bin": {
     "mcp-inspector": "cli/build/cli.js"
   },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/modelcontextprotocol/inspector"
+  },
   "files": [
     "client/bin",
     "client/dist",
@@ -48,9 +52,9 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.21.1",
-    "@modelcontextprotocol/inspector-client": "^0.21.1",
-    "@modelcontextprotocol/inspector-server": "^0.21.1",
+    "@modelcontextprotocol/inspector-cli": "^0.22.0",
+    "@modelcontextprotocol/inspector-client": "^0.22.0",
+    "@modelcontextprotocol/inspector-server": "^0.22.0",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",

package/server/build/index.js

@@ -53,6 +53,33 @@ const is401Error = (error) => {
         return true;
     return false;
 };
+/**
+ * Sends a sanitized JSON error response to the client without exposing
+ * stack traces or internal error details. The full error is expected to
+ * have already been logged server-side via console.error.
+ */
+const sendErrorResponse = (res, status, message) => {
+    res.status(status).json({ error: message });
+};
+/**
+ * Prefer forwarding the upstream MCP 401 (WWW-Authenticate + body) so the browser
+ * matches direct-mode OAuth behavior. Falls back to a generic 401 JSON response
+ * when no upstream details were captured, to avoid leaking stack traces.
+ */
+const sendProxiedUnauthorized = (res, headerHolder) => {
+    const captured = headerHolder?.lastUpstream401;
+    if (captured && headerHolder) {
+        if (captured.wwwAuthenticate) {
+            res.setHeader("WWW-Authenticate", captured.wwwAuthenticate);
+        }
+        res.status(401);
+        res.setHeader("Content-Type", captured.contentType);
+        res.send(captured.body);
+        delete headerHolder.lastUpstream401;
+        return;
+    }
+    sendErrorResponse(res, 401, "Unauthorized");
+};
 // Function to get HTTP headers.
 const getHttpHeaders = (req) => {
     const headers = {};
@@ -142,7 +169,7 @@ const updateHeadersInPlace = (currentHeaders, newHeaders) => {
 const app = express();
 app.use(cors());
 app.use((req, res, next) => {
-    res.header("Access-Control-Expose-Headers", "mcp-session-id");
+    res.header("Access-Control-Expose-Headers", "mcp-session-id, WWW-Authenticate");
     next();
 });
 const webAppTransports = new Map(); // Web app transports by web app sessionId
@@ -262,6 +289,25 @@ const createCustomFetch = (headerHolder) => {
         });
         // Get the response from node-fetch (cast input and init to handle type differences)
         const response = await fetch(input, { ...init, headers: headersObject });
+        if (response.status === 401) {
+            const wwwAuthenticate = response.headers.get("www-authenticate") ?? undefined;
+            const contentType = response.headers.get("content-type") ?? "application/json";
+            const body = await response.text();
+            headerHolder.lastUpstream401 = {
+                wwwAuthenticate,
+                body,
+                contentType,
+            };
+            const responseHeaders = {};
+            response.headers.forEach((value, key) => {
+                responseHeaders[key] = value;
+            });
+            return new Response(body, {
+                status: 401,
+                statusText: response.statusText,
+                headers: responseHeaders,
+            });
+        }
         // Check if this is an SSE request by looking at the Accept header
         const acceptHeader = finalHeaders.get("Accept");
         const isSSE = acceptHeader?.includes("text/event-stream");
@@ -357,7 +403,7 @@ app.get("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
     }
     catch (error) {
         console.error("Error in /mcp route:", error);
-        res.status(500).json(error);
+        sendErrorResponse(res, 500, "Internal server error");
     }
 });
 app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
@@ -379,13 +425,15 @@ app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
         }
         catch (error) {
             console.error("Error in /mcp route:", error);
-            res.status(500).json(error);
+            sendErrorResponse(res, 500, "Internal server error");
         }
     }
     else {
         console.log("New StreamableHttp connection request");
+        let streamableHeaderHolder;
         try {
             const { transport: serverTransport, headerHolder } = await createTransport(req);
+            streamableHeaderHolder = headerHolder;
             const webAppTransport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: randomUUID,
                 onsessioninitialized: (sessionId) => {
@@ -407,17 +455,18 @@ app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) =>
             mcpProxy({
                 transportToClient: webAppTransport,
                 transportToServer: serverTransport,
+                headerHolder,
             });
             await webAppTransport.handleRequest(req, res, req.body);
         }
         catch (error) {
             if (is401Error(error)) {
                 console.error("Received 401 Unauthorized from MCP server:", error instanceof Error ? error.message : error);
-                res.status(401).json(error);
+                sendProxiedUnauthorized(res, streamableHeaderHolder);
                 return;
             }
             console.error("Error in /mcp POST route:", error);
-            res.status(500).json(error);
+            sendErrorResponse(res, 500, "Internal server error");
         }
     }
 });
@@ -442,7 +491,7 @@ app.delete("/mcp", originValidationMiddleware, authMiddleware, async (req, res)
         }
         catch (error) {
             console.error("Error in /mcp route:", error);
-            res.status(500).json(error);
+            sendErrorResponse(res, 500, "Internal server error");
         }
     }
 });
@@ -546,17 +595,19 @@ app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) =
     catch (error) {
         if (is401Error(error)) {
             console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
-            res.status(401).json(error);
+            sendProxiedUnauthorized(res, undefined);
             return;
         }
         console.error("Error in /stdio route:", error);
-        res.status(500).json(error);
+        sendErrorResponse(res, 500, "Internal server error");
     }
 });
 app.get("/sse", originValidationMiddleware, authMiddleware, async (req, res) => {
+    let sseHeaderHolder;
     try {
         console.log("New SSE connection request. NOTE: The SSE transport is deprecated and has been replaced by StreamableHttp");
         const { transport: serverTransport, headerHolder } = await createTransport(req);
+        sseHeaderHolder = headerHolder;
         const proxyFullAddress = req.query.proxyFullAddress || "";
         const prefix = proxyFullAddress || "";
         const endpoint = `${prefix}/message`;
@@ -572,25 +623,29 @@ app.get("/sse", originValidationMiddleware, authMiddleware, async (req, res) =>
         mcpProxy({
             transportToClient: webAppTransport,
             transportToServer: serverTransport,
+            headerHolder,
         });
     }
     catch (error) {
         if (is401Error(error)) {
             console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
-            res.status(401).json(error);
+            sendProxiedUnauthorized(res, sseHeaderHolder);
             return;
         }
         else if (error instanceof SseError && error.code === 404) {
             console.error("Received 404 not found from MCP server. Does the MCP server support SSE?");
-            res.status(404).json(error);
+            sendErrorResponse(res, 404, "MCP server returned 404. Does it support SSE?");
             return;
         }
-        else if (JSON.stringify(error).includes("ECONNREFUSED")) {
+        else if (error instanceof Error &&
+            (error.message.includes("ECONNREFUSED") ||
+                (error.cause && String(error.cause).includes("ECONNREFUSED")))) {
             console.error("Connection refused. Is the MCP server running?");
-            res.status(500).json(error);
+            sendErrorResponse(res, 500, "Connection refused. Is the MCP server running?");
+            return;
         }
         console.error("Error in /sse route:", error);
-        res.status(500).json(error);
+        sendErrorResponse(res, 500, "Internal server error");
     }
 });
 app.post("/message", originValidationMiddleware, authMiddleware, async (req, res) => {
@@ -610,7 +665,7 @@ app.post("/message", originValidationMiddleware, authMiddleware, async (req, res
     }
     catch (error) {
         console.error("Error in /message route:", error);
-        res.status(500).json(error);
+        sendErrorResponse(res, 500, "Internal server error");
     }
 });
 app.get("/health", (req, res) => {
@@ -618,6 +673,48 @@ app.get("/health", (req, res) => {
         status: "ok",
     });
 });
+app.post("/fetch", express.json(), originValidationMiddleware, authMiddleware, async (req, res) => {
+    try {
+        const { url, init } = req.body;
+        if (typeof url !== "string" || url.length === 0) {
+            res.status(400).json({ error: "Missing or invalid url" });
+            return;
+        }
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(url);
+        }
+        catch {
+            res.status(400).json({ error: "Invalid URL" });
+            return;
+        }
+        if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+            res.status(400).json({ error: "Only http/https URLs are allowed" });
+            return;
+        }
+        const response = await fetch(url, {
+            method: init?.method ?? "GET",
+            headers: init?.headers ?? {},
+            body: init?.body,
+        });
+        const responseBody = await response.text();
+        const headers = {};
+        response.headers.forEach((value, key) => {
+            headers[key] = value;
+        });
+        res.status(response.status).json({
+            ok: response.ok,
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+            body: responseBody,
+        });
+    }
+    catch (error) {
+        console.error("Error in /fetch route:", error);
+        sendErrorResponse(res, 500, "Internal server error");
+    }
+});
 app.get("/config", originValidationMiddleware, authMiddleware, (req, res) => {
     try {
         res.json({
@@ -630,7 +727,7 @@ app.get("/config", originValidationMiddleware, authMiddleware, (req, res) => {
     }
     catch (error) {
         console.error("Error in /config route:", error);
-        res.status(500).json(error);
+        sendErrorResponse(res, 500, "Internal server error");
     }
 });
 app.get("/sandbox", sandboxRateLimiter, (req, res) => {

package/server/build/mcpProxy.js

@@ -1,4 +1,20 @@
+import { SseError } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { isJSONRPCRequest } from "@modelcontextprotocol/sdk/types.js";
+/**
+ * JSON-RPC error code for failed proxy → upstream transport sends.
+ *
+ * JSON-RPC 2.0 reserves **-32000 .. -32099** for implementation-defined *server* errors.
+ * MCP uses that band for protocol/SDK errors (see `@modelcontextprotocol/sdk` `ErrorCode`, e.g.
+ * `-32000` connection closed, `-32001` request timeout, `-32042` URL elicitation; other codes in
+ * the band are assigned over time — e.g. **-32002** is used for **ResourceNotFound** in parts of
+ * the MCP ecosystem). We use **-32099** so this inspector-only bridge error stays clear of those
+ * registered meanings; the client still keys off `error.data` shape, not the number alone.
+ *
+ * Keep in sync with `client/src/lib/constants.ts`; drift is caught by
+ * `client/src/lib/__tests__/mcpProxyTransportErrorCode.test.ts`.
+ */
+export const MCP_PROXY_TRANSPORT_ERROR_CODE = -32099;
 function onClientError(error) {
     console.error("Error from inspector client:", error);
 }
@@ -13,23 +29,63 @@ function onServerError(error) {
         console.error("Error from MCP server:", error);
     }
 }
-export default function mcpProxy({ transportToClient, transportToServer, }) {
+/** Exported for unit tests; used by the proxy when forwarding transport failures. */
+export function serializeProxyTransportError(error, headerHolder) {
+    const data = {
+        message: error.message,
+        name: error.name,
+    };
+    if (error.cause !== undefined) {
+        data.cause =
+            error.cause instanceof Error ? error.cause.message : String(error.cause);
+    }
+    const attachHttpStatusIfValid = (code) => {
+        if (Number.isInteger(code) && code >= 100 && code <= 599) {
+            data.httpStatus = code;
+        }
+    };
+    if (error instanceof StreamableHTTPError) {
+        if (error.code !== undefined)
+            attachHttpStatusIfValid(error.code);
+    }
+    else if (error instanceof SseError) {
+        if (error.code !== undefined)
+            attachHttpStatusIfValid(error.code);
+    }
+    if (headerHolder?.lastUpstream401) {
+        const u = headerHolder.lastUpstream401;
+        data.upstream401 = {
+            wwwAuthenticate: u.wwwAuthenticate,
+            body: u.body,
+            contentType: u.contentType,
+        };
+        delete headerHolder.lastUpstream401;
+    }
+    return data;
+}
+export default function mcpProxy({ transportToClient, transportToServer, headerHolder, }) {
     let transportToClientClosed = false;
     let transportToServerClosed = false;
     let reportedServerSession = false;
     transportToClient.onmessage = (message) => {
-        transportToServer.send(message).catch((error) => {
+        transportToServer.send(message).catch((err) => {
+            const error = err instanceof Error ? err : new Error(String(err));
             // Send error response back to client if it was a request (has id) and connection is still open
             if (isJSONRPCRequest(message) && !transportToClientClosed) {
+                const causeStr = error.cause !== undefined
+                    ? error.cause instanceof Error
+                        ? error.cause.message
+                        : String(error.cause)
+                    : null;
                 const errorResponse = {
                     jsonrpc: "2.0",
                     id: message.id,
                     error: {
-                        code: -32001,
-                        message: error.cause
-                            ? `${error.message} (cause: ${error.cause})`
+                        code: MCP_PROXY_TRANSPORT_ERROR_CODE,
+                        message: causeStr
+                            ? `${error.message} (cause: ${causeStr})`
                             : error.message,
-                        data: error,
+                        data: serializeProxyTransportError(error, headerHolder),
                     },
                 };
                 transportToClient.send(errorResponse).catch(onClientError);