@modelcontextprotocol/inspector 1.0.4 → 1.0.5

package/client/dist/assets/{OAuthCallback-Cb6VJMaq.js → OAuthCallback-HH7qRC_N.js}

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, c as clearOAuthConnectionSnapshot, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-Bvgm3HOZ.js";
+import { u as useToast, r as reactExports, c as clearOAuthConnectionSnapshot, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-BA98C07j.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();
   const hasProcessedRef = reactExports.useRef(false);

package/client/dist/assets/{OAuthDebugCallback-CgAV2c_T.js → OAuthDebugCallback-CEN7EFMg.js}

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-Bvgm3HOZ.js";
+import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-BA98C07j.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {
     let isProcessed = false;

package/client/dist/assets/{index-Bvgm3HOZ.js → index-BA98C07j.js}

@@ -17366,7 +17366,7 @@ object({
   token_type_hint: string().optional()
 }).strip();
 const name = "@modelcontextprotocol/inspector-client";
-const version$1 = "1.0.4";
+const version$1 = "1.0.5";
 const packageJson = {
   name,
   version: version$1
@@ -57479,7 +57479,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "1.0.4";
+const version = "1.0.5";
 var __defProp$2 = Object.defineProperty;
 var __name$2 = (target, value) => __defProp$2(target, "name", { value, configurable: true });
 var [createTooltipContext, createTooltipScope] = /* @__PURE__ */ createContextScope("Tooltip", [
@@ -68413,13 +68413,13 @@ const App = () => {
   ) });
   if (window.location.pathname === OAUTH_CALLBACK_PATH) {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-Cb6VJMaq.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-HH7qRC_N.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === OAUTH_DEBUG_CALLBACK_PATH) {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-CgAV2c_T.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-CEN7EFMg.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }

package/client/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-Bvgm3HOZ.js"></script>
+    <script type="module" crossorigin src="/assets/index-BA98C07j.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-D-iperlR.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -53,13 +53,13 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^1.0.4",
-    "@modelcontextprotocol/inspector-client": "^1.0.4",
-    "@modelcontextprotocol/inspector-server": "^1.0.4",
+    "@modelcontextprotocol/inspector-cli": "^1.0.5",
+    "@modelcontextprotocol/inspector-client": "^1.0.5",
+    "@modelcontextprotocol/inspector-server": "^1.0.5",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
-    "open": "^10.2.0",
+    "open": "^11.0.4",
     "shell-quote": "^1.8.4",
     "spawn-rx": "^5.1.2",
     "ts-node": "^10.9.2",

package/server/build/proxy-security.js

@@ -24,21 +24,42 @@ import { lookup as dnsLookup } from "node:dns/promises";
 // ---------------------------------------------------------------------------
 // Block-list
 // ---------------------------------------------------------------------------
+/**
+ * Cloud instance-metadata services reachable at a fixed IPv4 address outside
+ * 169.254.0.0/16. Matched exactly, against the dotted-quad form `isIP`
+ * accepts (which has no leading zeros, so each address has one spelling).
+ *
+ *  - 100.100.100.200  (Alibaba Cloud ECS metadata service)
+ *  - 192.0.0.192  (Oracle Cloud Infrastructure Classic metadata service)
+ */
+const METADATA_IPV4_ADDRESSES = new Set([
+    "100.100.100.200",
+    "192.0.0.192",
+]);
 /**
  * Returns true if `ip` is a link-local or cloud-metadata address that must
  * never be reachable through the proxy.
  *
- * Blocked ranges:
- *  - 169.254.0.0/16  (IPv4 link-local; includes 169.254.169.254 IMDS)
- *  - ::ffff:169.254.x.x  (IPv4-mapped IPv6 variants of the above)
+ * Blocked:
+ *  - 169.254.0.0/16  (IPv4 link-local; includes the 169.254.169.254 metadata
+ *    service of AWS, GCP, Azure, Oracle Cloud and most others)
+ *  - METADATA_IPV4_ADDRESSES  (metadata services at a fixed address outside
+ *    link-local, which the range above misses)
+ *  - ::ffff: IPv4-mapped IPv6 variants of every IPv4 address above, in both
+ *    the dotted and the hex serialization
  *  - fe80::/10  (IPv6 link-local)
  *  - fd00:ec2::254  (AWS IPv6 instance-metadata)
+ *
+ * The out-of-range metadata addresses are blocked exactly, never by their
+ * enclosing range: 100.100.100.200 sits in 100.64.0.0/10, the CGNAT block
+ * Tailscale also uses (its MagicDNS resolver is 100.100.100.100), and a
+ * tailnet MCP server is as legitimate a target as a LAN one.
  */
 export function isBlockedProxyAddress(ip) {
     const kind = isIP(ip);
     if (kind === 4) {
         const parts = ip.split(".").map(Number);
-        return parts[0] === 169 && parts[1] === 254;
+        return ((parts[0] === 169 && parts[1] === 254) || METADATA_IPV4_ADDRESSES.has(ip));
     }
     if (kind === 6) {
         const addr = ip.toLowerCase();