@modelcontextprotocol/inspector 2.10.1 → 2.11.0

package/clients/web/build/index.js

@@ -821,16 +821,30 @@ function buildConfigFromOptions(options) {
   const target = options.target ?? [];
   const first = target[0];
   const rest = target.slice(1);
+  if (first && options.serverUrl) {
+    throw new Error(
+      `Cannot combine a positional target (${first}) with --server-url (${options.serverUrl}). Pass one or the other.`
+    );
+  }
   const urlFromTarget = first && (first.startsWith("http://") || first.startsWith("https://")) ? first : null;
   const url = urlFromTarget ?? options.serverUrl ?? null;
   if (url) {
-    if (rest.length > 0 && urlFromTarget) {
+    if (rest.length > 0) {
       throw new Error("Arguments cannot be passed to a URL-based MCP server.");
     }
+    if (options.transport === "stdio") {
+      throw new Error(
+        `stdio transport cannot be used with a URL (${url}). Use --transport http or --transport sse, or pass a local command instead.`
+      );
+    }
     let transportType;
     const t = options.transport === "http" ? "streamable-http" : options.transport;
     if (t === "sse" || t === "streamable-http") {
       transportType = t;
+    } else if (t) {
+      throw new Error(
+        `Invalid transport type: ${t}. Valid types are: sse, http, stdio`
+      );
     } else {
       const u = new URL(url);
       if (u.pathname.endsWith("/mcp")) {
@@ -1683,7 +1697,10 @@ MCP Inspector Web is up and running at:
 }
 function openBrowser(url) {
   openUrl(url).catch((err) => {
-    console.warn("Could not open a browser automatically:", err);
+    const reason = err instanceof Error ? err.message : String(err);
+    console.warn(
+      `Could not open a browser automatically (${reason}). Open the URL above manually.`
+    );
   });
 }
 var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
@@ -2291,7 +2308,10 @@ function parseAuthChallengeFromResponse(response, context) {
   if (status !== 401 && status !== 403) {
     return void 0;
   }
-  const wwwAuthenticate = response.headers.get("WWW-Authenticate") ?? void 0;
+  const wwwAuthenticate = response.headers.get("WWW-Authenticate") || void 0;
+  if (status === 403 && !wwwAuthenticate) {
+    return void 0;
+  }
   const bearer = wwwAuthenticate ? parseWwwAuthenticateBearer(wwwAuthenticate) : {};
   const requiredScopes = parseScopeString(bearer.scope);
   return {
@@ -2623,6 +2643,9 @@ function createTransportNode(config, options = {}) {
 // ../../core/auth/requestTimeout.ts
 var OAUTH_TIMEOUT_WIRE_CODE = "oauth_request_timeout";
 
+// ../../core/mcp/remote/node/server.ts
+import { SdkHttpError } from "@modelcontextprotocol/client";
+
 // ../../core/auth/oauth-persist.ts
 import { OAuthTokensSchema } from "@modelcontextprotocol/core";
 var OAUTH_PERSIST_STORE_ID = "oauth";
@@ -4723,6 +4746,17 @@ async function recordNamespaceKeys(stateFilePath, secretStore, namespace, server
     warnLedgerFailure("update", error);
   }
 }
+async function recordedNamespaces(stateFilePath) {
+  try {
+    const ledger = parseLedger(
+      await readStoreFile(namespaceLedgerPath(stateFilePath))
+    );
+    return [...ledger.keys()].reverse();
+  } catch (error) {
+    warnLedgerFailure("read", error);
+    return [];
+  }
+}
 async function purgeSupersededNamespaces(stateFilePath, secretStore, current) {
   let ledger;
   let location;
@@ -4886,24 +4920,13 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
   if (raw !== null && snapshot === null) {
     throw new OAuthStateFileUnrecognizedError(filePath, "save");
   }
-  if (locked) {
-    await purgeSupersededNamespaces(filePath, secretStore, void 0);
-  }
   const namespace = newSecretsNamespace();
-  if (snapshot === null) return namespace;
-  const moves = [
-    ...Object.entries(snapshot.servers).map(([url, state]) => ({
-      legacyId: oauthSecretServerId(url),
-      scopedId: oauthSecretServerId(url, namespace),
-      fields: serverSecretFields(state)
-    })),
-    ...Object.keys(snapshot.idpSessions).map((issuer) => ({
-      legacyId: oauthIdpSecretServerId(issuer),
-      scopedId: oauthIdpSecretServerId(issuer, namespace),
-      fields: [IDP_SESSION_FIELD]
-    }))
-  ];
-  if (moves.length === 0) return namespace;
+  if (snapshot === null || Object.keys(snapshot.servers).length === 0 && Object.keys(snapshot.idpSessions).length === 0) {
+    if (locked) {
+      await purgeSupersededNamespaces(filePath, secretStore, void 0);
+    }
+    return namespace;
+  }
   if (!locked) {
     throw new SecretStoreUnavailableError(
       `Could not save OAuth state: ${filePath} predates per-state-file secret namespaces, and migrating its secret-store entries needs the file lock, which is unavailable here (see the lock warning above). Migrating without it could lose credentials if two processes migrate at once. Nothing was changed; make the lock directory writable and retry \u2014 or, if you cannot, clear this file's stored OAuth state and re-authorize (clearing does not migrate, and the fresh state file mints its namespace without the lock).`
@@ -4918,10 +4941,24 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
   );
   const touched = [];
   try {
-    for (const { legacyId, scopedId, fields } of moves) {
-      for (const field of fields) {
-        const value = await secretStoreGetStrict(secretStore, legacyId, field);
-        if (value === null) continue;
+    const values = await readEntrySecrets(
+      snapshot,
+      secretStore,
+      void 0,
+      await recordedNamespaces(filePath)
+    );
+    const copies = [
+      ...[...values.servers].map(([url, secrets]) => ({
+        scopedId: oauthSecretServerId(url, namespace),
+        secrets
+      })),
+      ...[...values.idpSessions].map(([issuer, secrets]) => ({
+        scopedId: oauthIdpSecretServerId(issuer, namespace),
+        secrets
+      }))
+    ];
+    for (const { scopedId, secrets } of copies) {
+      for (const [field, value] of Object.entries(secrets)) {
         touched.push({ serverId: scopedId, field, value: null });
         await secretStore.set(scopedId, field, value);
       }
@@ -4931,7 +4968,14 @@ async function adoptSecretsNamespace(filePath, secretStore, locked) {
     await restoreSecretFields(secretStore, touched, warnRestoreFailure);
     throw error;
   }
-  for (const { legacyId } of moves) {
+  await purgeSupersededNamespaces(filePath, secretStore, namespace);
+  const legacyIds = [
+    ...Object.keys(snapshot.servers).map((url) => oauthSecretServerId(url)),
+    ...Object.keys(snapshot.idpSessions).map(
+      (issuer) => oauthIdpSecretServerId(issuer)
+    )
+  ];
+  for (const legacyId of legacyIds) {
     try {
       await secretStore.deleteAllForServer(legacyId);
     } catch (error) {
@@ -4984,6 +5028,14 @@ function preserveNonDurableSecrets(diskSecrets, secrets) {
   return keep;
 }
 async function writeOAuthSections(filePath, snapshot, sections, secretStore = defaultSecretStore()) {
+  await writeOAuthSectionsFrom(
+    filePath,
+    async () => snapshot,
+    sections,
+    secretStore
+  );
+}
+async function writeOAuthSectionsFrom(filePath, resolveSnapshot, sections, secretStore) {
   const policy = getPersistTokensPolicy();
   const durable = await secretStoreIsDurable(secretStore);
   await withOAuthStateLock(filePath, "save", async (locked) => {
@@ -5067,6 +5119,7 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           unconfirmed = null;
           namespace = diskNamespace;
         }
+        const snapshot = await resolveSnapshot(disk, namespace);
         const effective = sections ? {
           servers: sections.servers && [...new Set(sections.servers)],
           idpSessions: sections.idpSessions && [
@@ -5100,7 +5153,8 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           const candidates = [
             .../* @__PURE__ */ new Set([
               ...serverSecretFields(getOwnEntry(disk?.servers, url)),
-              ...serverSecretFields(next)
+              ...serverSecretFields(next),
+              ...[...restoreBaseline.values()].filter((prior) => prior.serverId === serverId).map(({ field }) => field)
             ])
           ];
           const entryPrior = await snapshotSecretFields(
@@ -5109,8 +5163,12 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
             candidates
           );
           priorSecrets.push(...entryPrior);
+          const entryPriorValue = new Map(
+            entryPrior.map(({ field, value }) => [field, value])
+          );
           if (next === void 0) {
             for (const field of candidates) {
+              if (entryPriorValue.get(field) === null) continue;
               ourWrites.set(priorKey({ serverId, field }), null);
             }
             await secretStore.deleteAllForServer(serverId);
@@ -5125,10 +5183,9 @@ async function writeOAuthSections(filePath, snapshot, sections, secretStore = de
           }
           const { residue, secrets } = splitServerOAuthState(next, policy);
           for (const field of candidates) {
-            ourWrites.set(
-              priorKey({ serverId, field }),
-              secrets[field] ?? null
-            );
+            const value = secrets[field] ?? null;
+            if (value === entryPriorValue.get(field)) continue;
+            ourWrites.set(priorKey({ serverId, field }), value);
           }
           setOwnEntry(merged.servers, url, residue);
           if (!durable) {
@@ -5271,26 +5328,52 @@ function secretRequestsFor(snapshot, namespace) {
   }
   return requests;
 }
-async function joinSnapshot(snapshot, secretStore, namespace) {
-  const requests = secretRequestsFor(snapshot, namespace);
-  const values = requests.length > 0 ? await secretStoreGetManyStrict(secretStore, requests) : {};
+function fillMissingSecrets(target, source) {
+  for (const [field, value] of Object.entries(source ?? {})) {
+    if (!Object.hasOwn(target, field)) setOwnEntry(target, field, value);
+  }
+}
+async function readEntrySecrets(snapshot, secretStore, namespace, fallbacks) {
+  const servers = /* @__PURE__ */ new Map();
+  const idpSessions = /* @__PURE__ */ new Map();
+  for (const url of Object.keys(snapshot.servers)) servers.set(url, {});
+  for (const issuer of Object.keys(snapshot.idpSessions)) {
+    idpSessions.set(issuer, {});
+  }
+  for (const source of [namespace, ...fallbacks]) {
+    const requests = secretRequestsFor(snapshot, source);
+    if (requests.length === 0) break;
+    const values = await secretStoreGetManyStrict(secretStore, requests);
+    for (const [url, target] of servers) {
+      fillMissingSecrets(target, values[oauthSecretServerId(url, source)]);
+    }
+    for (const [issuer, target] of idpSessions) {
+      fillMissingSecrets(
+        target,
+        values[oauthIdpSecretServerId(issuer, source)]
+      );
+    }
+  }
+  return { servers, idpSessions };
+}
+async function joinSnapshot(snapshot, secretStore, namespace, fallbacks) {
+  const values = await readEntrySecrets(
+    snapshot,
+    secretStore,
+    namespace,
+    fallbacks
+  );
   return {
     servers: Object.fromEntries(
       Object.entries(snapshot.servers).map(([url, state]) => [
         url,
-        joinServerOAuthState(
-          state,
-          values[oauthSecretServerId(url, namespace)] ?? {}
-        )
+        joinServerOAuthState(state, values.servers.get(url) ?? {})
       ])
     ),
     idpSessions: Object.fromEntries(
       Object.entries(snapshot.idpSessions).map(([issuer, session]) => [
         issuer,
-        joinIdpSession(
-          session,
-          values[oauthIdpSecretServerId(issuer, namespace)] ?? {}
-        )
+        joinIdpSession(session, values.idpSessions.get(issuer) ?? {})
       ])
     )
   };
@@ -5357,7 +5440,9 @@ async function readOAuthStore(filePath, secretStore = defaultSecretStore()) {
         warnMigrationFailure(error);
       }
     }
-    return joinSnapshot(snapshot, secretStore, parseSecretsNamespace(raw));
+    const namespace = parseSecretsNamespace(raw);
+    const fallbacks = namespace === void 0 ? await recordedNamespaces(filePath) : [];
+    return joinSnapshot(snapshot, secretStore, namespace, fallbacks);
   });
 }
 async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
@@ -6714,6 +6799,22 @@ function createRemoteApp(options) {
         });
       }
       const msg = err instanceof Error ? err.message : String(err);
+      if (err instanceof SdkHttpError) {
+        const text = err.data.text;
+        return c.json({
+          ok: false,
+          kind: "transport_error",
+          error: msg,
+          http: {
+            code: err.code,
+            status: err.status,
+            ...err.statusText !== void 0 && {
+              statusText: err.statusText
+            },
+            ...typeof text === "string" && { text }
+          }
+        });
+      }
       return c.json({ ok: false, kind: "transport_error", error: msg });
     } finally {
       clientSignal.removeEventListener("abort", onClientDisconnect);
@@ -8768,7 +8869,11 @@ async function runWeb(argv) {
     preArgs = argv.slice(0, argSeparatorIndex);
     postArgs = argv.slice(argSeparatorIndex + 1);
   }
-  program.name("mcp-inspector-web").description("Web UI for MCP Inspector").allowExcessArguments().allowUnknownOption().option(
+  program.name("mcp-inspector-web").description("Web UI for MCP Inspector").version(
+    readInspectorVersionSafe(import.meta.url) ?? "unknown",
+    "-V, --version",
+    "Print the Inspector version"
+  ).allowExcessArguments().allowUnknownOption().option(
     "-e <env>",
     "environment variables in KEY=VALUE format",
     parseKeyValuePair,