@modelcontextprotocol/inspector 2.0.0 → 2.2.0

package/clients/web/dist/assets/prism-light-CWdjx3zH.js

@@ -0,0 +1,6 @@
+import{a as e,c as t,d as n,i as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./index-BrCIxo3Q.js";function d(e,n){if(e==null)return{};var r,i,a=t(e,n);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)r=o[i],n.indexOf(r)===-1&&{}.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}function f(e,t){(t==null||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function p(e){if(Array.isArray(e))return f(e)}function m(e){if(typeof Symbol<`u`&&e[Symbol.iterator]!=null||e[`@@iterator`]!=null)return Array.from(e)}function h(e,t){if(e){if(typeof e==`string`)return f(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name),n===`Map`||n===`Set`?Array.from(e):n===`Arguments`||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?f(e,t):void 0}}function g(){throw TypeError(`Invalid attempt to spread non-iterable instance.
+In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function _(e){return p(e)||m(e)||h(e)||g()}function v(e){"@babel/helpers - typeof";return v=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},v(e)}function y(e,t){if(v(e)!=`object`||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t||`default`);if(v(r)!=`object`)return r;throw TypeError(`@@toPrimitive must return a primitive value.`)}return(t===`string`?String:Number)(e)}function b(e){var t=y(e,`string`);return v(t)==`symbol`?t:t+``}function x(e,t,n){return(t=b(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var S=n(u());function C(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function w(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?C(Object(n),!0).forEach(function(t){x(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):C(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function T(e){var t=e.length;if(t===0||t===1)return e;if(t===2)return[e[0],e[1],`${e[0]}.${e[1]}`,`${e[1]}.${e[0]}`];if(t===3)return[e[0],e[1],e[2],`${e[0]}.${e[1]}`,`${e[0]}.${e[2]}`,`${e[1]}.${e[0]}`,`${e[1]}.${e[2]}`,`${e[2]}.${e[0]}`,`${e[2]}.${e[1]}`,`${e[0]}.${e[1]}.${e[2]}`,`${e[0]}.${e[2]}.${e[1]}`,`${e[1]}.${e[0]}.${e[2]}`,`${e[1]}.${e[2]}.${e[0]}`,`${e[2]}.${e[0]}.${e[1]}`,`${e[2]}.${e[1]}.${e[0]}`];if(t>=4)return[e[0],e[1],e[2],e[3],`${e[0]}.${e[1]}`,`${e[0]}.${e[2]}`,`${e[0]}.${e[3]}`,`${e[1]}.${e[0]}`,`${e[1]}.${e[2]}`,`${e[1]}.${e[3]}`,`${e[2]}.${e[0]}`,`${e[2]}.${e[1]}`,`${e[2]}.${e[3]}`,`${e[3]}.${e[0]}`,`${e[3]}.${e[1]}`,`${e[3]}.${e[2]}`,`${e[0]}.${e[1]}.${e[2]}`,`${e[0]}.${e[1]}.${e[3]}`,`${e[0]}.${e[2]}.${e[1]}`,`${e[0]}.${e[2]}.${e[3]}`,`${e[0]}.${e[3]}.${e[1]}`,`${e[0]}.${e[3]}.${e[2]}`,`${e[1]}.${e[0]}.${e[2]}`,`${e[1]}.${e[0]}.${e[3]}`,`${e[1]}.${e[2]}.${e[0]}`,`${e[1]}.${e[2]}.${e[3]}`,`${e[1]}.${e[3]}.${e[0]}`,`${e[1]}.${e[3]}.${e[2]}`,`${e[2]}.${e[0]}.${e[1]}`,`${e[2]}.${e[0]}.${e[3]}`,`${e[2]}.${e[1]}.${e[0]}`,`${e[2]}.${e[1]}.${e[3]}`,`${e[2]}.${e[3]}.${e[0]}`,`${e[2]}.${e[3]}.${e[1]}`,`${e[3]}.${e[0]}.${e[1]}`,`${e[3]}.${e[0]}.${e[2]}`,`${e[3]}.${e[1]}.${e[0]}`,`${e[3]}.${e[1]}.${e[2]}`,`${e[3]}.${e[2]}.${e[0]}`,`${e[3]}.${e[2]}.${e[1]}`,`${e[0]}.${e[1]}.${e[2]}.${e[3]}`,`${e[0]}.${e[1]}.${e[3]}.${e[2]}`,`${e[0]}.${e[2]}.${e[1]}.${e[3]}`,`${e[0]}.${e[2]}.${e[3]}.${e[1]}`,`${e[0]}.${e[3]}.${e[1]}.${e[2]}`,`${e[0]}.${e[3]}.${e[2]}.${e[1]}`,`${e[1]}.${e[0]}.${e[2]}.${e[3]}`,`${e[1]}.${e[0]}.${e[3]}.${e[2]}`,`${e[1]}.${e[2]}.${e[0]}.${e[3]}`,`${e[1]}.${e[2]}.${e[3]}.${e[0]}`,`${e[1]}.${e[3]}.${e[0]}.${e[2]}`,`${e[1]}.${e[3]}.${e[2]}.${e[0]}`,`${e[2]}.${e[0]}.${e[1]}.${e[3]}`,`${e[2]}.${e[0]}.${e[3]}.${e[1]}`,`${e[2]}.${e[1]}.${e[0]}.${e[3]}`,`${e[2]}.${e[1]}.${e[3]}.${e[0]}`,`${e[2]}.${e[3]}.${e[0]}.${e[1]}`,`${e[2]}.${e[3]}.${e[1]}.${e[0]}`,`${e[3]}.${e[0]}.${e[1]}.${e[2]}`,`${e[3]}.${e[0]}.${e[2]}.${e[1]}`,`${e[3]}.${e[1]}.${e[0]}.${e[2]}`,`${e[3]}.${e[1]}.${e[2]}.${e[0]}`,`${e[3]}.${e[2]}.${e[0]}.${e[1]}`,`${e[3]}.${e[2]}.${e[1]}.${e[0]}`]}var E={};function D(e){if(e.length===0||e.length===1)return e;var t=e.join(`.`);return E[t]||(E[t]=T(e)),E[t]}function O(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},n=arguments.length>2?arguments[2]:void 0;return D(e.filter(function(e){return e!==`token`})).reduce(function(e,t){return w(w({},e),n[t])},t)}function k(e){return e.join(` `)}function A(e,t){var n=0;return function(r){return n+=1,r.map(function(r,i){return j({node:r,stylesheet:e,useInlineStyles:t,key:`code-segment-${n}-${i}`})})}}function j(e){var t=e.node,n=e.stylesheet,r=e.style,a=r===void 0?{}:r,o=e.useInlineStyles,s=e.key,c=t.properties,l=t.type,u=t.tagName,d=t.value;if(l===`text`)return d;if(u){var f=A(n,o),p;if(!o)p=w(w({},c),{},{className:k(c.className)});else{var m=Object.keys(n).reduce(function(e,t){return t.split(`.`).forEach(function(t){e.includes(t)||e.push(t)}),e},[]),h=c.className&&c.className.includes(`token`)?[`token`]:[],g=c.className&&h.concat(c.className.filter(function(e){return!m.includes(e)}));p=w(w({},c),{},{className:k(g)||void 0,style:O(c.className,Object.assign({},c.style,a),n)})}var _=f(t.children);return S.createElement(u,i({key:s},p),_)}}var M=(function(e,t){return e.listLanguages().indexOf(t)!==-1}),ee=[`language`,`children`,`style`,`customStyle`,`codeTagProps`,`useInlineStyles`,`showLineNumbers`,`showInlineLineNumbers`,`startingLineNumber`,`lineNumberContainerStyle`,`lineNumberStyle`,`wrapLines`,`wrapLongLines`,`lineProps`,`renderer`,`PreTag`,`CodeTag`,`code`,`astGenerator`];function N(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function P(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?N(Object(n),!0).forEach(function(t){x(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):N(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}var F=/\n/g;function I(e){return e.match(F)}function L(e){var t=e.lines,n=e.startingLineNumber,r=e.style;return t.map(function(e,t){var i=t+n;return S.createElement(`span`,{key:`line-${t}`,className:`react-syntax-highlighter-line-number`,style:typeof r==`function`?r(i):r},`${i}
+`)})}function te(e){var t=e.codeString,n=e.codeStyle,r=e.containerStyle,i=r===void 0?{float:`left`,paddingRight:`10px`}:r,a=e.numberStyle,o=a===void 0?{}:a,s=e.startingLineNumber;return S.createElement(`code`,{style:Object.assign({},n,i)},L({lines:t.replace(/\n$/,``).split(`
+`),style:o,startingLineNumber:s}))}function R(e){return`${e.toString().length}.25em`}function z(e,t){return{type:`element`,tagName:`span`,properties:{key:`line-number--${e}`,className:[`comment`,`linenumber`,`react-syntax-highlighter-line-number`],style:t},children:[{type:`text`,value:e}]}}function B(e,t,n){var r={display:`inline-block`,minWidth:R(n),paddingRight:`1em`,textAlign:`right`,userSelect:`none`},i=typeof e==`function`?e(t):e;return P(P({},r),i)}function V(e){var t=e.children,n=e.lineNumber,r=e.lineNumberStyle,i=e.largestLineNumber,a=e.showInlineLineNumbers,o=e.lineProps,s=o===void 0?{}:o,c=e.className,l=c===void 0?[]:c,u=e.showLineNumbers,d=e.wrapLongLines,f=e.wrapLines,p=f!==void 0&&f?P({},typeof s==`function`?s(n):s):{};if(p.className=p.className?[].concat(_(p.className.trim().split(/\s+/)),_(l)):l,n&&a){var m=B(r,n,i);t.unshift(z(n,m))}return d&u&&(p.style=P({display:`flex`},p.style)),{type:`element`,tagName:`span`,properties:p,children:t}}function H(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:[],n=arguments.length>2&&arguments[2]!==void 0?arguments[2]:[];e.length===void 0&&(e=[e]);for(var r=0;r<e.length;r++){var i=e[r];if(i.type===`text`)n.push(V({children:[i],className:_(new Set(t))}));else if(i.children){var a=t.concat(i.properties?.className||[]);H(i.children,a).forEach(function(e){return n.push(e)})}}return n}function ne(e,t,n,r,i,a,o,s,c){var l,u=H(e.value),d=[],f=-1,p=0;function m(e,a){return V({children:e,lineNumber:a,lineNumberStyle:s,largestLineNumber:o,showInlineLineNumbers:i,lineProps:n,className:arguments.length>2&&arguments[2]!==void 0?arguments[2]:[],showLineNumbers:r,wrapLongLines:c,wrapLines:t})}function h(e,t){if(r&&t&&i){var n=B(s,t,o);e.unshift(z(t,n))}return e}function g(e,n){var r=arguments.length>2&&arguments[2]!==void 0?arguments[2]:[];return t||r.length>0?m(e,n,r):h(e,n)}for(var _=function(){var e=u[p],t=e.children[0].value;if(I(t)){var n=t.split(`
+`);n.forEach(function(t,i){var o=r&&d.length+a,s={type:`text`,value:`${t}
+`};if(i===0){var c=g(u.slice(f+1,p).concat(V({children:[s],className:e.properties.className})),o);d.push(c)}else if(i===n.length-1){var l=u[p+1]&&u[p+1].children&&u[p+1].children[0],m={type:`text`,value:`${t}`};if(l){var h=V({children:[m],className:e.properties.className});u.splice(p+1,0,h)}else{var _=g([m],o,e.properties.className);d.push(_)}}else{var v=g([s],o,e.properties.className);d.push(v)}}),f=p}p++};p<u.length;)_();if(f!==u.length-1){var v=u.slice(f+1,u.length);if(v&&v.length){var y=g(v,r&&d.length+a);d.push(y)}}return t?d:(l=[]).concat.apply(l,d)}function re(e){var t=e.rows,n=e.stylesheet,r=e.useInlineStyles;return t.map(function(e,t){return j({node:e,stylesheet:n,useInlineStyles:r,key:`code-segment-${t}`})})}function ie(e){return e&&e.highlightAuto!==void 0}function ae(e){var t=e.astGenerator,n=e.language,r=e.code,i=e.defaultCodeValue;if(ie(t)){var a=M(t,n);return n===`text`?{value:i,language:`text`}:a?t.highlight(n,r):t.highlightAuto(r)}try{return n&&n!==`text`?{value:t.highlight(r,n)}:{value:i}}catch{return{value:i}}}function U(e,t){return function(n){var r=n.language,i=n.children,a=n.style,o=a===void 0?t:a,s=n.customStyle,c=s===void 0?{}:s,l=n.codeTagProps,u=l===void 0?{className:r?`language-${r}`:void 0,style:P(P({},o[`code[class*="language-"]`]),o[`code[class*="language-${r}"]`])}:l,f=n.useInlineStyles,p=f===void 0||f,m=n.showLineNumbers,h=m!==void 0&&m,g=n.showInlineLineNumbers,_=g===void 0||g,v=n.startingLineNumber,y=v===void 0?1:v,b=n.lineNumberContainerStyle,x=n.lineNumberStyle,C=x===void 0?{}:x,w=n.wrapLines,T=n.wrapLongLines,E=T!==void 0&&T,D=n.lineProps,O=D===void 0?{}:D,k=n.renderer,A=n.PreTag,j=A===void 0?`pre`:A,M=n.CodeTag,N=M===void 0?`code`:M,F=n.code,I=F===void 0?(Array.isArray(i)?i[0]:i)||``:F,L=n.astGenerator,R=d(n,ee);L||=e;var z=h?S.createElement(te,{containerStyle:b,codeStyle:u.style||{},numberStyle:C,startingLineNumber:y,codeString:I}):null,B=o.hljs||o[`pre[class*="language-"]`]||{backgroundColor:`#fff`},V=ie(L)?`hljs`:`prismjs`,H=p?Object.assign({},R,{style:Object.assign({},B,c)}):Object.assign({},R,{className:R.className?`${V} ${R.className}`:V,style:Object.assign({},c)});if(u.style=P(E?{whiteSpace:`pre-wrap`}:{whiteSpace:`pre`},u.style),!L)return S.createElement(j,H,z,S.createElement(N,u,I));(w===void 0&&k||E)&&(w=!0),k||=re;var U=[{type:`text`,value:I}],W=ae({astGenerator:L,language:r,code:I,defaultCodeValue:U});W.language===null&&(W.value=U);var oe=y+(I.match(/\n/g)?.length??0),G=ne(W,w,O,h,_,y,oe,C,E);return S.createElement(j,H,S.createElement(N,u,!_&&z,k({rows:G,stylesheet:o,useInlineStyles:p})))}}var W=/[#.]/g;function oe(e,t){let n=e||``,r={},i=0,a,o;for(;i<n.length;){W.lastIndex=i;let e=W.exec(n),t=n.slice(i,e?e.index:n.length);t&&(a?a===`#`?r.id=t:Array.isArray(r.className)?r.className.push(t):r.className=[t]:o=t,i+=t.length),e&&(a=e[0],i++)}return{type:`element`,tagName:o||t||`div`,properties:r,children:[]}}function G(e,t,n){let r=n?de(n):void 0;function i(n,i,...a){let o;if(n==null){o={type:`root`,children:[]};let e=i;a.unshift(e)}else{o=oe(n,t);let s=o.tagName.toLowerCase(),c=r?r.get(s):void 0;if(o.tagName=c||s,se(i))a.unshift(i);else for(let[t,n]of Object.entries(i))ce(e,o.properties,t,n)}for(let e of a)K(o.children,e);return o.type===`element`&&o.tagName===`template`&&(o.content={type:`root`,children:o.children},o.children=[]),o}return i}function se(e){if(typeof e!=`object`||!e||Array.isArray(e))return!0;if(typeof e.type!=`string`)return!1;let t=e,n=Object.keys(e);for(let e of n){let n=t[e];if(n&&typeof n==`object`){if(!Array.isArray(n))return!0;let e=n;for(let t of e)if(typeof t!=`number`&&typeof t!=`string`)return!0}}return!!(`children`in e&&Array.isArray(e.children))}function ce(t,n,r,i){let o=e(t,r),s;if(i!=null){if(typeof i==`number`){if(Number.isNaN(i))return;s=i}else s=typeof i==`boolean`?i:typeof i==`string`?o.spaceSeparated?a(i):o.commaSeparated?c(i):o.commaOrSpaceSeparated?a(c(i).join(` `)):le(o,o.property,i):Array.isArray(i)?[...i]:o.property===`style`?ue(i):String(i);if(Array.isArray(s)){let e=[];for(let t of s)e.push(le(o,o.property,t));s=e}o.property===`className`&&Array.isArray(n.className)&&(s=n.className.concat(s)),n[o.property]=s}}function K(e,t){if(t!=null)if(typeof t==`number`||typeof t==`string`)e.push({type:`text`,value:String(t)});else if(Array.isArray(t))for(let n of t)K(e,n);else if(typeof t==`object`&&`type`in t)t.type===`root`?K(e,t.children):e.push(t);else throw Error("Expected node, nodes, or string, got `"+t+"`")}function le(e,t,n){if(typeof n==`string`){if(e.number&&n&&!Number.isNaN(Number(n)))return Number(n);if((e.boolean||e.overloadedBoolean)&&(n===``||o(n)===o(t)))return!0}return n}function ue(e){let t=[];for(let[n,r]of Object.entries(e))t.push([n,r].join(`: `));return t.join(`; `)}function de(e){let t=new Map;for(let n of e)t.set(n.toLowerCase(),n);return t}var fe=`altGlyph.altGlyphDef.altGlyphItem.animateColor.animateMotion.animateTransform.clipPath.feBlend.feColorMatrix.feComponentTransfer.feComposite.feConvolveMatrix.feDiffuseLighting.feDisplacementMap.feDistantLight.feDropShadow.feFlood.feFuncA.feFuncB.feFuncG.feFuncR.feGaussianBlur.feImage.feMerge.feMergeNode.feMorphology.feOffset.fePointLight.feSpecularLighting.feSpotLight.feTile.feTurbulence.foreignObject.glyphRef.linearGradient.radialGradient.solidColor.textArea.textPath`.split(`.`),pe=G(s,`div`);G(r,`g`,fe);var me=`AElig.AMP.Aacute.Acirc.Agrave.Aring.Atilde.Auml.COPY.Ccedil.ETH.Eacute.Ecirc.Egrave.Euml.GT.Iacute.Icirc.Igrave.Iuml.LT.Ntilde.Oacute.Ocirc.Ograve.Oslash.Otilde.Ouml.QUOT.REG.THORN.Uacute.Ucirc.Ugrave.Uuml.Yacute.aacute.acirc.acute.aelig.agrave.amp.aring.atilde.auml.brvbar.ccedil.cedil.cent.copy.curren.deg.divide.eacute.ecirc.egrave.eth.euml.frac12.frac14.frac34.gt.iacute.icirc.iexcl.igrave.iquest.iuml.laquo.lt.macr.micro.middot.nbsp.not.ntilde.oacute.ocirc.ograve.ordf.ordm.oslash.otilde.ouml.para.plusmn.pound.quot.raquo.reg.sect.shy.sup1.sup2.sup3.szlig.thorn.times.uacute.ucirc.ugrave.uml.uuml.yacute.yen.yuml`.split(`.`),he={0:`�`,128:`€`,130:`‚`,131:`ƒ`,132:`„`,133:`…`,134:`†`,135:`‡`,136:`ˆ`,137:`‰`,138:`Š`,139:`‹`,140:`Œ`,142:`Ž`,145:`‘`,146:`’`,147:`“`,148:`”`,149:`•`,150:`–`,151:`—`,152:`˜`,153:`™`,154:`š`,155:`›`,156:`œ`,158:`ž`,159:`Ÿ`};function ge(e){let t=typeof e==`string`?e.charCodeAt(0):e;return t>=48&&t<=57}function _e(e){let t=typeof e==`string`?e.charCodeAt(0):e;return t>=97&&t<=102||t>=65&&t<=70||t>=48&&t<=57}function ve(e){let t=typeof e==`string`?e.charCodeAt(0):e;return t>=97&&t<=122||t>=65&&t<=90}function ye(e){return ve(e)||ge(e)}var be=[``,`Named character references must be terminated by a semicolon`,`Numeric character references must be terminated by a semicolon`,`Named character references cannot be empty`,`Numeric character references cannot be empty`,`Named character references must be known`,`Numeric character references cannot be disallowed`,`Numeric character references cannot be outside the permissible Unicode range`];function xe(e,t){let n=t||{},r=typeof n.additional==`string`?n.additional.charCodeAt(0):n.additional,i=[],a=0,o=-1,s=``,c,u;n.position&&(`start`in n.position||`indent`in n.position?(u=n.position.indent,c=n.position.start):c=n.position);let d=(c?c.line:0)||1,f=(c?c.column:0)||1,p=h(),m;for(a--;++a<=e.length;)if(m===10&&(f=(u?u[o]:0)||1),m=e.charCodeAt(a),m===38){let t=e.charCodeAt(a+1);if(t===9||t===10||t===12||t===32||t===38||t===60||Number.isNaN(t)||r&&t===r){s+=String.fromCharCode(m),f++;continue}let o=a+1,c=o,u=o,d;if(t===35){u=++c;let t=e.charCodeAt(u);t===88||t===120?(d=`hexadecimal`,u=++c):d=`decimal`}else d=`named`;let v=``,y=``,b=``,x=d===`named`?ye:d===`decimal`?ge:_e;for(u--;++u<=e.length;){let t=e.charCodeAt(u);if(!x(t))break;b+=String.fromCharCode(t),d===`named`&&me.includes(b)&&(v=b,y=l(b))}let S=e.charCodeAt(u)===59;if(S){u++;let e=d===`named`&&l(b);e&&(v=b,y=e)}let C=1+u-o,w=``;if(!(!S&&n.nonTerminated===!1))if(!b)d!==`named`&&g(4,C);else if(d===`named`){if(S&&!y)g(5,1);else if(v!==b&&(u=c+v.length,C=1+u-c,S=!1),!S){let t=v?1:3;if(n.attribute){let n=e.charCodeAt(u);n===61?(g(t,C),y=``):ye(n)?y=``:g(t,C)}else g(t,C)}w=y}else{S||g(2,C);let e=Number.parseInt(b,d===`hexadecimal`?16:10);if(Se(e))g(7,C),w=`�`;else if(e in he)g(6,C),w=he[e];else{let t=``;Ce(e)&&g(6,C),e>65535&&(e-=65536,t+=String.fromCharCode(e>>>10|55296),e=56320|e&1023),w=t+String.fromCharCode(e)}}if(w){_(),p=h(),a=u-1,f+=u-o+1,i.push(w);let t=h();t.offset++,n.reference&&n.reference.call(n.referenceContext||void 0,w,{start:p,end:t},e.slice(o-1,u)),p=t}else b=e.slice(o-1,u),s+=b,f+=b.length,a=u-1}else m===10&&(d++,o++,f=0),Number.isNaN(m)?_():(s+=String.fromCharCode(m),f++);return i.join(``);function h(){return{line:d,column:f,offset:a+((c?c.offset:0)||0)}}function g(e,t){let r;n.warning&&(r=h(),r.column+=t,r.offset+=t,n.warning.call(n.warningContext||void 0,be[e],r,e))}function _(){s&&=(i.push(s),n.text&&n.text.call(n.textContext||void 0,s,{start:p,end:h()}),``)}}function Se(e){return e>=55296&&e<=57343||e>1114111}function Ce(e){return e>=1&&e<=8||e===11||e>=13&&e<=31||e>=127&&e<=159||e>=64976&&e<=65007||(e&65535)==65535||(e&65535)==65534}var we=0,q={},J={util:{type:function(e){return Object.prototype.toString.call(e).slice(8,-1)},objId:function(e){return e.__id||Object.defineProperty(e,"__id",{value:++we}),e.__id},clone:function e(t,n){n||={};var r,i;switch(J.util.type(t)){case`Object`:if(i=J.util.objId(t),n[i])return n[i];for(var a in r={},n[i]=r,t)t.hasOwnProperty(a)&&(r[a]=e(t[a],n));return r;case`Array`:return i=J.util.objId(t),n[i]?n[i]:(r=[],n[i]=r,t.forEach(function(t,i){r[i]=e(t,n)}),r);default:return t}}},languages:{plain:q,plaintext:q,text:q,txt:q,extend:function(e,t){var n=J.util.clone(J.languages[e]);for(var r in t)n[r]=t[r];return n},insertBefore:function(e,t,n,r){r||=J.languages;var i=r[e],a={};for(var o in i)if(i.hasOwnProperty(o)){if(o==t)for(var s in n)n.hasOwnProperty(s)&&(a[s]=n[s]);n.hasOwnProperty(o)||(a[o]=i[o])}var c=r[e];return r[e]=a,J.languages.DFS(J.languages,function(t,n){n===c&&t!=e&&(this[t]=a)}),a},DFS:function e(t,n,r,i){i||={};var a=J.util.objId;for(var o in t)if(t.hasOwnProperty(o)){n.call(t,o,t[o],r||o);var s=t[o],c=J.util.type(s);c===`Object`&&!i[a(s)]?(i[a(s)]=!0,e(s,n,null,i)):c===`Array`&&!i[a(s)]&&(i[a(s)]=!0,e(s,n,o,i))}}},plugins:{},highlight:function(e,t,n){var r={code:e,grammar:t,language:n};if(J.hooks.run(`before-tokenize`,r),!r.grammar)throw Error(`The language "`+r.language+`" has no grammar.`);return r.tokens=J.tokenize(r.code,r.grammar),J.hooks.run(`after-tokenize`,r),Y.stringify(J.util.encode(r.tokens),r.language)},tokenize:function(e,t){var n=t.rest;if(n){for(var r in n)t[r]=n[r];delete t.rest}var i=new De;return X(i,i.head,e),Ee(e,i,t,i.head,0),ke(i)},hooks:{all:{},add:function(e,t){var n=J.hooks.all;n[e]=n[e]||[],n[e].push(t)},run:function(e,t){var n=J.hooks.all[e];if(!(!n||!n.length))for(var r=0,i;i=n[r++];)i(t)}},Token:Y};function Y(e,t,n,r){this.type=e,this.content=t,this.alias=n,this.length=(r||``).length|0}function Te(e,t,n,r){e.lastIndex=t;var i=e.exec(n);if(i&&r&&i[1]){var a=i[1].length;i.index+=a,i[0]=i[0].slice(a)}return i}function Ee(e,t,n,r,i,a){for(var o in n)if(!(!n.hasOwnProperty(o)||!n[o])){var s=n[o];s=Array.isArray(s)?s:[s];for(var c=0;c<s.length;++c){if(a&&a.cause==o+`,`+c)return;var l=s[c],u=l.inside,d=!!l.lookbehind,f=!!l.greedy,p=l.alias;if(f&&!l.pattern.global){var m=l.pattern.toString().match(/[imsuy]*$/)[0];l.pattern=RegExp(l.pattern.source,m+`g`)}for(var h=l.pattern||l,g=r.next,_=i;g!==t.tail&&!(a&&_>=a.reach);_+=g.value.length,g=g.next){var v=g.value;if(t.length>e.length)return;if(!(v instanceof Y)){var y=1,b;if(f){if(b=Te(h,_,e,d),!b||b.index>=e.length)break;var x=b.index,S=b.index+b[0].length,C=_;for(C+=g.value.length;x>=C;)g=g.next,C+=g.value.length;if(C-=g.value.length,_=C,g.value instanceof Y)continue;for(var w=g;w!==t.tail&&(C<S||typeof w.value==`string`);w=w.next)y++,C+=w.value.length;y--,v=e.slice(_,C),b.index-=_}else if(b=Te(h,0,v,d),!b)continue;var x=b.index,T=b[0],E=v.slice(0,x),D=v.slice(x+T.length),O=_+v.length;a&&O>a.reach&&(a.reach=O);var k=g.prev;E&&(k=X(t,k,E),_+=E.length),Oe(t,k,y);var A=new Y(o,u?J.tokenize(T,u):T,p,T);if(g=X(t,k,A),D&&X(t,g,D),y>1){var j={cause:o+`,`+c,reach:O};Ee(e,t,n,g.prev,_,j),a&&j.reach>a.reach&&(a.reach=j.reach)}}}}}}function De(){var e={value:null,prev:null,next:null},t={value:null,prev:e,next:null};e.next=t,this.head=e,this.tail=t,this.length=0}function X(e,t,n){var r=t.next,i={value:n,prev:t,next:r};return t.next=i,r.prev=i,e.length++,i}function Oe(e,t,n){for(var r=t.next,i=0;i<n&&r!==e.tail;i++)r=r.next;t.next=r,r.prev=t,e.length-=i}function ke(e){for(var t=[],n=e.head.next;n!==e.tail;)t.push(n.value),n=n.next;return t}var Ae=J;function je(){}je.prototype=Ae;var Z=new je;Z.highlight=Me,Z.register=Ne,Z.alias=Pe,Z.registered=Fe,Z.listLanguages=Ie,Z.util.encode=Le,Z.Token.stringify=Q;function Me(e,t){if(typeof e!=`string`)throw TypeError("Expected `string` for `value`, got `"+e+"`");let n,r;if(t&&typeof t==`object`)n=t;else{if(r=t,typeof r!=`string`)throw TypeError("Expected `string` for `name`, got `"+r+"`");if(Object.hasOwn(Z.languages,r))n=Z.languages[r];else throw Error("Unknown language: `"+r+"` is not registered")}return{type:`root`,children:Ae.highlight.call(Z,e,n,r)}}function Ne(e){if(typeof e!=`function`||!e.displayName)throw Error("Expected `function` for `syntax`, got `"+e+"`");Object.hasOwn(Z.languages,e.displayName)||e(Z)}function Pe(e,t){let n=Z.languages,r={};typeof e==`string`?t&&(r[e]=t):r=e;let i;for(i in r)if(Object.hasOwn(r,i)){let e=r[i],t=typeof e==`string`?[e]:e,a=-1;for(;++a<t.length;)n[t[a]]=n[i]}}function Fe(e){if(typeof e!=`string`)throw TypeError("Expected `string` for `aliasOrLanguage`, got `"+e+"`");return Object.hasOwn(Z.languages,e)}function Ie(){let e=Z.languages,t=[],n;for(n in e)Object.hasOwn(e,n)&&typeof e[n]==`object`&&t.push(n);return t}function Q(e,t){if(typeof e==`string`)return{type:`text`,value:e};if(Array.isArray(e)){let n=[],r=-1;for(;++r<e.length;)e[r]!==null&&e[r]!==void 0&&e[r]!==``&&n.push(Q(e[r],t));return n}let n={attributes:{},classes:[`token`,e.type],content:Q(e.content,t),language:t,tag:`span`,type:e.type};return e.alias&&n.classes.push(...typeof e.alias==`string`?[e.alias]:e.alias),Z.hooks.run(`wrap`,n),pe(n.tag+`.`+n.classes.join(`.`),Re(n.attributes),n.content)}function Le(e){return e}function Re(e){let t;for(t in e)Object.hasOwn(e,t)&&(e[t]=xe(e[t]));return e}var $=U(Z,{});$.registerLanguage=function(e,t){return Z.register(t)},$.alias=function(e,t){return Z.alias(e,t)};export{$ as default};

package/clients/web/dist/index.html

@@ -8,7 +8,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Fredoka:wght@300..700&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap" rel="stylesheet" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-wIMJi5MN.js"></script>
+    <script type="module" crossorigin src="/assets/index-BrCIxo3Q.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-CiUpWldH.css">
   </head>
   <body>

package/clients/web/static/sandbox_proxy.html

@@ -0,0 +1,237 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="color-scheme" content="light dark" />
+    <!-- Isolation model: the inner iframe is sandboxed WITHOUT
+         `allow-same-origin`, so the untrusted app runs under an opaque
+         ("null") origin. That is the structural boundary — the app cannot
+         touch this proxy's DOM, window, or cookies, so it cannot bypass its
+         own CSP by executing in the parent's realm. The proxy itself is
+         additionally served with a restrictive CSP header (see
+         server/sandbox-controller.ts) so any future regression that re-grants
+         same-origin still gains nothing. The default sandbox value
+         ("allow-scripts allow-forms") may be narrowed per app via the
+         resource-ready message's `sandbox` field; `allow-same-origin` is
+         always stripped from a server-supplied value.
+
+         Network/resource egress from the inner document is constrained by a
+         Content-Security-Policy that the HOST builds and bakes into the
+         delivered HTML before it reaches this proxy (see
+         src/utils/sandbox-csp.ts). The proxy assigns that pre-wrapped document
+         to `srcdoc` verbatim — it never parses or injects into the untrusted
+         bytes — so the CSP `<meta>` is guaranteed to be the first `<head>`
+         child of the inner document. -->
+    <title>MCP-UI Proxy</title>
+    <style>
+      html,
+      body {
+        margin: 0;
+        height: 100vh;
+        width: 100vw;
+        /* Transparent background allows parent page to show through */
+        background-color: transparent;
+      }
+      body {
+        display: flex;
+        flex-direction: column;
+      }
+      * {
+        box-sizing: border-box;
+      }
+      iframe {
+        background-color: transparent;
+        border: 0px none transparent;
+        padding: 0px;
+        overflow: hidden;
+        flex-grow: 1;
+        /* Inherit color scheme from parent for consistent transparency */
+        color-scheme: inherit;
+      }
+    </style>
+  </head>
+  <body>
+    <script>
+      function buildAllowAttribute(permissions) {
+        if (!permissions) return "";
+
+        const allowList = [];
+        if (permissions["camera"]) allowList.push("camera");
+        if (permissions["microphone"]) allowList.push("microphone");
+        if (permissions["geolocation"]) allowList.push("geolocation");
+        if (permissions["clipboardWrite"]) allowList.push("clipboard-write");
+
+        return allowList.join("; ");
+      }
+
+      const ALLOWED_REFERRER_PATTERN =
+        /^http:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/;
+
+      if (window.self === window.top) {
+        throw new Error("This file is only to be used in an iframe sandbox.");
+      }
+
+      if (!document.referrer) {
+        throw new Error("No referrer, cannot validate embedding site.");
+      }
+
+      if (!document.referrer.match(ALLOWED_REFERRER_PATTERN)) {
+        throw new Error(
+          `Embedding domain not allowed in referrer ${document.referrer}. (Consider updating the validation logic to allow your domain.)`,
+        );
+      }
+
+      // Extract the expected host origin from the referrer for origin validation.
+      // This is the origin we expect all parent messages to come from.
+      const EXPECTED_HOST_ORIGIN = new URL(document.referrer).origin;
+
+      // The inner iframe is sandboxed without allow-same-origin, so its
+      // document has an opaque origin and every postMessage from it arrives
+      // with event.origin === "null" (the literal string). That value is
+      // checked below as a defense-in-depth assertion; the actual identity
+      // proof is `event.source === inner.contentWindow`, which a sibling
+      // frame cannot forge.
+      const INNER_ORIGIN = "null";
+
+      // Security self-test: verify iframe isolation is working correctly.
+      // This MUST throw a SecurityError -- if `window.top` is accessible, the sandbox
+      // configuration is dangerously broken and untrusted content could escape.
+      try {
+        window.top?.alert(
+          "If you see this, the sandbox is not setup securely.",
+        );
+        throw "FAIL";
+      } catch (e) {
+        if (e === "FAIL") {
+          throw new Error("The sandbox is not setup securely.");
+        }
+
+        // Expected: SecurityError confirms proper sandboxing.
+      }
+
+      // Double-iframe sandbox architecture: THIS file is the outer sandbox proxy
+      // iframe on a separate origin. It creates an inner iframe for untrusted HTML
+      // content. Per the specification, the Host and the Sandbox MUST have different
+      // origins.
+      const inner = document.createElement("iframe");
+      inner.style = "width:100%; height:100%; border:none;";
+      inner.setAttribute("sandbox", "allow-scripts allow-forms");
+      // Note: allow attribute is set later when receiving sandbox-resource-ready notification
+      // based on the permissions requested by the app
+      document.body.appendChild(inner);
+
+      const RESOURCE_READY_NOTIFICATION =
+        "ui/notifications/sandbox-resource-ready";
+      const PROXY_READY_NOTIFICATION = "ui/notifications/sandbox-proxy-ready";
+
+      // Message relay: This Sandbox (outer iframe) acts as a bidirectional bridge,
+      // forwarding messages between:
+      //
+      //   Host (parent window) ↔ Sandbox (outer frame) ↔ View (inner iframe)
+      //
+      // Reason: the parent window and inner iframe have different origins and can't
+      // communicate directly, so the outer iframe forwards messages in both
+      // directions to connect them.
+      //
+      // Special case: The "ui/notifications/sandbox-proxy-ready" message is
+      // intercepted here (not relayed) because the Sandbox uses it to configure and
+      // load the inner iframe with the view HTML content.
+      //
+      // Security: isolation comes from the iframe `sandbox` attribute and the
+      // origin allowlist above. The CSP for the inner document is built and
+      // wrapped by the host before the HTML reaches this proxy (see head
+      // comment); this script writes that pre-wrapped document verbatim and
+      // never parses or injects into the untrusted bytes.
+
+      window.addEventListener("message", async (event) => {
+        if (event.source === window.parent) {
+          // Validate that messages from parent come from the expected host origin.
+          // This prevents malicious pages from sending messages to this sandbox.
+          if (event.origin !== EXPECTED_HOST_ORIGIN) {
+            console.error(
+              "[Sandbox] Rejecting message from unexpected origin:",
+              event.origin,
+              "expected:",
+              EXPECTED_HOST_ORIGIN,
+            );
+            return;
+          }
+
+          if (event.data && event.data.method === RESOURCE_READY_NOTIFICATION) {
+            const { html, sandbox, permissions } = event.data.params;
+            if (typeof sandbox === "string") {
+              // Never grant allow-same-origin even if the server asks for it —
+              // that would let the untrusted app reach this proxy's DOM and
+              // bypass its own CSP via window.parent. Sandbox tokens are
+              // ASCII case-insensitive, so compare lowercased.
+              const safeTokens = sandbox
+                .split(/\s+/)
+                .filter((t) => t && t.toLowerCase() !== "allow-same-origin");
+              // Fail-closed but noisy: a server-supplied sandbox that omits
+              // allow-scripts leaves the inner frame unable to run the app.
+              // That's safe, but silently bricks the widget — log it so a
+              // developer can see why their app never started.
+              if (!safeTokens.some((t) => t.toLowerCase() === "allow-scripts")) {
+                console.warn(
+                  "[Sandbox] server-supplied sandbox has no allow-scripts; the app will not execute:",
+                  safeTokens.join(" "),
+                );
+              }
+              inner.setAttribute("sandbox", safeTokens.join(" "));
+            }
+            // Set Permission Policy allow attribute if permissions are requested
+            const allowAttribute = buildAllowAttribute(permissions);
+            if (allowAttribute) {
+              console.log("[Sandbox] Setting allow attribute:", allowAttribute);
+              inner.setAttribute("allow", allowAttribute);
+            }
+            if (typeof html === "string") {
+              // The host has already wrapped the app's HTML in a fixed shell
+              // whose first <head> child is the CSP <meta>; assign it verbatim.
+              // srcdoc is the only delivery path that works without
+              // allow-same-origin (document.open/write would require reaching
+              // into the inner contentDocument across the opaque-origin
+              // boundary). Known trade-off: a small set of libraries (e.g.
+              // CesiumJS Map) don't initialise correctly under srcdoc — that
+              // is accepted in exchange for the isolation guarantee.
+              inner.srcdoc = html;
+            }
+          } else {
+            if (inner && inner.contentWindow) {
+              inner.contentWindow.postMessage(event.data, "*");
+            }
+          }
+        } else if (event.source === inner.contentWindow) {
+          // `event.source === inner.contentWindow` is the unforgeable identity
+          // check — only the actual inner frame can satisfy it. The opaque
+          // sandbox means its origin serialises as the literal string "null";
+          // assert that as defense-in-depth so a future change that
+          // accidentally re-grants allow-same-origin is caught here.
+          if (event.origin !== INNER_ORIGIN) {
+            console.error(
+              "[Sandbox] Rejecting message from inner iframe with unexpected origin:",
+              event.origin,
+              "expected opaque:",
+              INNER_ORIGIN,
+            );
+            return;
+          }
+          // Relay messages from inner frame to parent window.
+          // Use specific origin instead of "*" to prevent message interception.
+          window.parent.postMessage(event.data, EXPECTED_HOST_ORIGIN);
+        }
+      });
+
+      // Notify the Host that the Sandbox is ready to receive view HTML.
+      // Use specific origin instead of "*" to ensure only the expected host receives this.
+      window.parent.postMessage(
+        {
+          jsonrpc: "2.0",
+          method: PROXY_READY_NOTIFICATION,
+          params: {},
+        },
+        EXPECTED_HOST_ORIGIN,
+      );
+    </script>
+  </body>
+</html>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "The Model Context Protocol Inspector",
   "keywords": [
     "MCP",
@@ -24,6 +24,7 @@
     "clients/launcher/build",
     "clients/web/build",
     "clients/web/dist",
+    "clients/web/static",
     "clients/cli/build",
     "clients/tui/build",
     "scripts/install-clients.mjs"
@@ -42,8 +43,9 @@
     "verify:build-gate": "node scripts/verify-build-gate.mjs",
     "verify:typecheck-coverage": "node scripts/verify-typecheck-coverage.mjs",
     "test:scripts": "node --test \"scripts/**/*.test.mjs\"",
-    "validate": "npm run verify:format-coverage && npm run verify:typecheck-coverage && npm run test:scripts && npm run validate:core && npm run validate:web && npm run validate:cli && npm run validate:tui && npm run validate:launcher",
+    "validate": "npm run verify:format-coverage && npm run verify:typecheck-coverage && npm run verify:dep-lockstep && npm run test:scripts && npm run validate:core && npm run validate:web && npm run validate:cli && npm run validate:tui && npm run validate:launcher",
     "verify:format-coverage": "node scripts/verify-format-coverage.mjs",
+    "verify:dep-lockstep": "node scripts/verify-dep-lockstep.mjs",
     "validate:core": "npm run format:check:core && npm run format:check:scripts && npm run format:check:shared && npm run lint:core && npm run lint:shared",
     "lint:core": "eslint \"core/**/*.{ts,tsx}\"",
     "lint:shared": "eslint \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js",
@@ -63,11 +65,12 @@
     "coverage:tui": "cd clients/tui && npm run test:coverage",
     "coverage:web": "cd clients/web && npm run test:coverage",
     "coverage:launcher": "cd clients/launcher && npm run test:coverage",
-    "smoke": "npm run smoke:launcher && npm run smoke:cli && npm run smoke:tui && npm run smoke:web && npm run smoke:web:browser",
+    "smoke": "npm run smoke:launcher && npm run smoke:cli && npm run smoke:tui && npm run smoke:web && npm run smoke:web:browser && npm run smoke:web:app",
     "smoke:cli": "node scripts/smoke-cli.mjs",
     "smoke:tui": "node scripts/smoke-tui.mjs",
     "smoke:web": "node scripts/smoke-web.mjs",
     "smoke:web:browser": "cd clients/web && npx playwright install chromium && node ../../scripts/smoke-web-browser.mjs",
+    "smoke:web:app": "cd clients/web && npx playwright install chromium && node ../../scripts/smoke-web-app.mjs",
     "smoke:launcher": "node scripts/smoke-launcher.mjs",
     "pack:verify": "node scripts/pack-and-verify.mjs",
     "prepack": "npm run build",
@@ -75,11 +78,11 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "@modelcontextprotocol/client": "2.0.0-beta.5",
-    "@modelcontextprotocol/core": "2.0.0-beta.5",
+    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/core": "2.0.0",
     "@modelcontextprotocol/ext-apps": "^1.7.4",
-    "@modelcontextprotocol/server": "2.0.0-beta.5",
-    "@modelcontextprotocol/server-legacy": "2.0.0-beta.5",
+    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/server-legacy": "2.0.0",
     "@napi-rs/keyring": "^1.3.0",
     "@vitejs/plugin-react": "^6.0.0",
     "ajv": "^8.17.1",
@@ -88,25 +91,21 @@
     "commander": "^13.1.0",
     "hono": "^4.12.18",
     "ink": "^6.0.0",
-    "ink-form": "^2.0.1",
-    "ink-scroll-view": "^0.3.6",
     "open": "^10.2.0",
     "pino": "^9.14.0",
-    "react": "^19.2.4",
+    "react": "^19.0.0",
     "undici": "^8.5.0",
     "vite": "^8.1.5",
     "yaml": "^2.9.0",
-    "zod": "^4.3.6"
-  },
-  "overrides": {
-    "ink-select-input": "^6.2.0"
+    "zod": "^4.4.3"
   },
   "engines": {
     "node": ">=22.19.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.5",
-    "eslint": "^9.39.5",
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.8.0",
+    "express": "^5.2.1",
     "globals": "^17.7.0",
     "prettier": "3.8.4",
     "typescript": "~5.9.3",