@modelcontextprotocol/inspector 2.12.0 → 2.14.0

package/clients/web/dist/assets/{prism-light-DfUe_Xlh.js → prism-light-CoVRM9R2.js}

@@ -1,4 +1,4 @@
-import{a as e,c as t,d as n,i as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./index-qtX15-Bz.js";function d(e,n){if(e==null)return{};var r,i,a=t(e,n);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)r=o[i],n.indexOf(r)===-1&&{}.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}function f(e,t){(t==null||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function p(e){if(Array.isArray(e))return f(e)}function m(e){if(typeof Symbol<`u`&&e[Symbol.iterator]!=null||e[`@@iterator`]!=null)return Array.from(e)}function h(e,t){if(e){if(typeof e==`string`)return f(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name),n===`Map`||n===`Set`?Array.from(e):n===`Arguments`||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?f(e,t):void 0}}function g(){throw TypeError(`Invalid attempt to spread non-iterable instance.
+import{a as e,c as t,d as n,i as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./index-BCud2uMC.js";function d(e,n){if(e==null)return{};var r,i,a=t(e,n);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)r=o[i],n.indexOf(r)===-1&&{}.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}function f(e,t){(t==null||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function p(e){if(Array.isArray(e))return f(e)}function m(e){if(typeof Symbol<`u`&&e[Symbol.iterator]!=null||e[`@@iterator`]!=null)return Array.from(e)}function h(e,t){if(e){if(typeof e==`string`)return f(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name),n===`Map`||n===`Set`?Array.from(e):n===`Arguments`||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?f(e,t):void 0}}function g(){throw TypeError(`Invalid attempt to spread non-iterable instance.
 In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function _(e){return p(e)||m(e)||h(e)||g()}function v(e){"@babel/helpers - typeof";return v=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},v(e)}function y(e,t){if(v(e)!=`object`||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t||`default`);if(v(r)!=`object`)return r;throw TypeError(`@@toPrimitive must return a primitive value.`)}return(t===`string`?String:Number)(e)}function b(e){var t=y(e,`string`);return v(t)==`symbol`?t:t+``}function x(e,t,n){return(t=b(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var S=n(u());function C(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function w(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?C(Object(n),!0).forEach(function(t){x(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):C(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function T(e){var t=e.length;if(t===0||t===1)return e;if(t===2)return[e[0],e[1],`${e[0]}.${e[1]}`,`${e[1]}.${e[0]}`];if(t===3)return[e[0],e[1],e[2],`${e[0]}.${e[1]}`,`${e[0]}.${e[2]}`,`${e[1]}.${e[0]}`,`${e[1]}.${e[2]}`,`${e[2]}.${e[0]}`,`${e[2]}.${e[1]}`,`${e[0]}.${e[1]}.${e[2]}`,`${e[0]}.${e[2]}.${e[1]}`,`${e[1]}.${e[0]}.${e[2]}`,`${e[1]}.${e[2]}.${e[0]}`,`${e[2]}.${e[0]}.${e[1]}`,`${e[2]}.${e[1]}.${e[0]}`];if(t>=4)return[e[0],e[1],e[2],e[3],`${e[0]}.${e[1]}`,`${e[0]}.${e[2]}`,`${e[0]}.${e[3]}`,`${e[1]}.${e[0]}`,`${e[1]}.${e[2]}`,`${e[1]}.${e[3]}`,`${e[2]}.${e[0]}`,`${e[2]}.${e[1]}`,`${e[2]}.${e[3]}`,`${e[3]}.${e[0]}`,`${e[3]}.${e[1]}`,`${e[3]}.${e[2]}`,`${e[0]}.${e[1]}.${e[2]}`,`${e[0]}.${e[1]}.${e[3]}`,`${e[0]}.${e[2]}.${e[1]}`,`${e[0]}.${e[2]}.${e[3]}`,`${e[0]}.${e[3]}.${e[1]}`,`${e[0]}.${e[3]}.${e[2]}`,`${e[1]}.${e[0]}.${e[2]}`,`${e[1]}.${e[0]}.${e[3]}`,`${e[1]}.${e[2]}.${e[0]}`,`${e[1]}.${e[2]}.${e[3]}`,`${e[1]}.${e[3]}.${e[0]}`,`${e[1]}.${e[3]}.${e[2]}`,`${e[2]}.${e[0]}.${e[1]}`,`${e[2]}.${e[0]}.${e[3]}`,`${e[2]}.${e[1]}.${e[0]}`,`${e[2]}.${e[1]}.${e[3]}`,`${e[2]}.${e[3]}.${e[0]}`,`${e[2]}.${e[3]}.${e[1]}`,`${e[3]}.${e[0]}.${e[1]}`,`${e[3]}.${e[0]}.${e[2]}`,`${e[3]}.${e[1]}.${e[0]}`,`${e[3]}.${e[1]}.${e[2]}`,`${e[3]}.${e[2]}.${e[0]}`,`${e[3]}.${e[2]}.${e[1]}`,`${e[0]}.${e[1]}.${e[2]}.${e[3]}`,`${e[0]}.${e[1]}.${e[3]}.${e[2]}`,`${e[0]}.${e[2]}.${e[1]}.${e[3]}`,`${e[0]}.${e[2]}.${e[3]}.${e[1]}`,`${e[0]}.${e[3]}.${e[1]}.${e[2]}`,`${e[0]}.${e[3]}.${e[2]}.${e[1]}`,`${e[1]}.${e[0]}.${e[2]}.${e[3]}`,`${e[1]}.${e[0]}.${e[3]}.${e[2]}`,`${e[1]}.${e[2]}.${e[0]}.${e[3]}`,`${e[1]}.${e[2]}.${e[3]}.${e[0]}`,`${e[1]}.${e[3]}.${e[0]}.${e[2]}`,`${e[1]}.${e[3]}.${e[2]}.${e[0]}`,`${e[2]}.${e[0]}.${e[1]}.${e[3]}`,`${e[2]}.${e[0]}.${e[3]}.${e[1]}`,`${e[2]}.${e[1]}.${e[0]}.${e[3]}`,`${e[2]}.${e[1]}.${e[3]}.${e[0]}`,`${e[2]}.${e[3]}.${e[0]}.${e[1]}`,`${e[2]}.${e[3]}.${e[1]}.${e[0]}`,`${e[3]}.${e[0]}.${e[1]}.${e[2]}`,`${e[3]}.${e[0]}.${e[2]}.${e[1]}`,`${e[3]}.${e[1]}.${e[0]}.${e[2]}`,`${e[3]}.${e[1]}.${e[2]}.${e[0]}`,`${e[3]}.${e[2]}.${e[0]}.${e[1]}`,`${e[3]}.${e[2]}.${e[1]}.${e[0]}`]}var E={};function D(e){if(e.length===0||e.length===1)return e;var t=e.join(`.`);return E[t]||(E[t]=T(e)),E[t]}function O(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},n=arguments.length>2?arguments[2]:void 0;return D(e.filter(function(e){return e!==`token`})).reduce(function(e,t){return w(w({},e),n[t])},t)}function k(e){return e.join(` `)}function A(e,t){var n=0;return function(r){return n+=1,r.map(function(r,i){return j({node:r,stylesheet:e,useInlineStyles:t,key:`code-segment-${n}-${i}`})})}}function j(e){var t=e.node,n=e.stylesheet,r=e.style,a=r===void 0?{}:r,o=e.useInlineStyles,s=e.key,c=t.properties,l=t.type,u=t.tagName,d=t.value;if(l===`text`)return d;if(u){var f=A(n,o),p;if(!o)p=w(w({},c),{},{className:k(c.className)});else{var m=Object.keys(n).reduce(function(e,t){return t.split(`.`).forEach(function(t){e.includes(t)||e.push(t)}),e},[]),h=c.className&&c.className.includes(`token`)?[`token`]:[],g=c.className&&h.concat(c.className.filter(function(e){return!m.includes(e)}));p=w(w({},c),{},{className:k(g)||void 0,style:O(c.className,Object.assign({},c.style,a),n)})}var _=f(t.children);return S.createElement(u,i({key:s},p),_)}}var M=(function(e,t){return e.listLanguages().indexOf(t)!==-1}),ee=[`language`,`children`,`style`,`customStyle`,`codeTagProps`,`useInlineStyles`,`showLineNumbers`,`showInlineLineNumbers`,`startingLineNumber`,`lineNumberContainerStyle`,`lineNumberStyle`,`wrapLines`,`wrapLongLines`,`lineProps`,`renderer`,`PreTag`,`CodeTag`,`code`,`astGenerator`];function N(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function P(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?N(Object(n),!0).forEach(function(t){x(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):N(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}var F=/\n/g;function I(e){return e.match(F)}function L(e){var t=e.lines,n=e.startingLineNumber,r=e.style;return t.map(function(e,t){var i=t+n;return S.createElement(`span`,{key:`line-${t}`,className:`react-syntax-highlighter-line-number`,style:typeof r==`function`?r(i):r},`${i}
 `)})}function te(e){var t=e.codeString,n=e.codeStyle,r=e.containerStyle,i=r===void 0?{float:`left`,paddingRight:`10px`}:r,a=e.numberStyle,o=a===void 0?{}:a,s=e.startingLineNumber;return S.createElement(`code`,{style:Object.assign({},n,i)},L({lines:t.replace(/\n$/,``).split(`
 `),style:o,startingLineNumber:s}))}function R(e){return`${e.toString().length}.25em`}function z(e,t){return{type:`element`,tagName:`span`,properties:{key:`line-number--${e}`,className:[`comment`,`linenumber`,`react-syntax-highlighter-line-number`],style:t},children:[{type:`text`,value:e}]}}function B(e,t,n){var r={display:`inline-block`,minWidth:R(n),paddingRight:`1em`,textAlign:`right`,userSelect:`none`},i=typeof e==`function`?e(t):e;return P(P({},r),i)}function V(e){var t=e.children,n=e.lineNumber,r=e.lineNumberStyle,i=e.largestLineNumber,a=e.showInlineLineNumbers,o=e.lineProps,s=o===void 0?{}:o,c=e.className,l=c===void 0?[]:c,u=e.showLineNumbers,d=e.wrapLongLines,f=e.wrapLines,p=f!==void 0&&f?P({},typeof s==`function`?s(n):s):{};if(p.className=p.className?[].concat(_(p.className.trim().split(/\s+/)),_(l)):l,n&&a){var m=B(r,n,i);t.unshift(z(n,m))}return d&u&&(p.style=P({display:`flex`},p.style)),{type:`element`,tagName:`span`,properties:p,children:t}}function H(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:[],n=arguments.length>2&&arguments[2]!==void 0?arguments[2]:[];e.length===void 0&&(e=[e]);for(var r=0;r<e.length;r++){var i=e[r];if(i.type===`text`)n.push(V({children:[i],className:_(new Set(t))}));else if(i.children){var a=t.concat(i.properties?.className||[]);H(i.children,a).forEach(function(e){return n.push(e)})}}return n}function ne(e,t,n,r,i,a,o,s,c){var l,u=H(e.value),d=[],f=-1,p=0;function m(e,a){return V({children:e,lineNumber:a,lineNumberStyle:s,largestLineNumber:o,showInlineLineNumbers:i,lineProps:n,className:arguments.length>2&&arguments[2]!==void 0?arguments[2]:[],showLineNumbers:r,wrapLongLines:c,wrapLines:t})}function h(e,t){if(r&&t&&i){var n=B(s,t,o);e.unshift(z(t,n))}return e}function g(e,n){var r=arguments.length>2&&arguments[2]!==void 0?arguments[2]:[];return t||r.length>0?m(e,n,r):h(e,n)}for(var _=function(){var e=u[p],t=e.children[0].value;if(I(t)){var n=t.split(`

package/clients/web/dist/fonts/Fredoka-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2016 The Fredoka Project Authors (https://github.com/hafontia/Fredoka-One)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/clients/web/dist/fonts/RobotoMono-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2015 The Roboto Mono Project Authors (https://github.com/googlefonts/robotomono)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/clients/web/dist/index.html

@@ -4,12 +4,9 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/assets/MCP-CWGQJYyH.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link href="https://fonts.googleapis.com/css2?family=Fredoka:wght@300..700&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap" rel="stylesheet" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-qtX15-Bz.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-dqp8Sd8W.css">
+    <script type="module" crossorigin src="/assets/index-BCud2uMC.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-Dval2a7I.css">
   </head>
   <body>
     <div id="root"></div>

package/clients/web/static/sandbox_proxy.html

@@ -33,7 +33,31 @@
          src/utils/sandbox-csp.ts). The proxy assigns that pre-wrapped document
          to `srcdoc` verbatim — it never parses or injects into the untrusted
          bytes — so the CSP `<meta>` is guaranteed to be the first `<head>`
-         child of the inner document. -->
+         child of the inner document.
+
+         Self-navigation: a sandboxed frame may always navigate ITSELF —
+         `allow-top-navigation` governs other frames, not its own — and the
+         sandbox flags follow it, so a page the app navigates to is still
+         opaque ("null") and still `inner.contentWindow`. Nothing in the app's
+         own CSP can stop that (CSP has no shipped navigation directive), so
+         two controls here do instead:
+           1. A `frame-src` / `child-src` policy on THIS document, installed
+              per render before the inner frame is loaded (see
+              `installFramePolicy`). A parent's `frame-src` governs every
+              navigation of its child frame, including one the child starts,
+              so the inner frame can load only the srcdoc (not a fetch, so not
+              subject to it), the dedicated app origin, or the app's approved
+              `frameDomains`. It is a <meta> rather than a header because the
+              sources are only known once the resource-ready message arrives.
+           2. Navigation detection (see `closeNavigatedFrame` and its
+              callers): a navigation 1. refuses raises a policy violation on
+              this document, and on the srcdoc path the frame leaving its
+              document anyway (a navigation 1. allowed, such as to a declared
+              frame domain) is reported by the host wrapper's departure
+              script, and also shows as a second `load`. Any of them closes
+              the relay, removes the frame and tells the host. This half is
+              defense in depth, not the boundary: a navigated page's scripts
+              can run before either signal arrives. -->
     <title>MCP-UI Proxy</title>
     <style>
       html,
@@ -76,6 +100,38 @@
         return allowList.join("; ");
       }
 
+      // The approved `frameDomains` from the resource-ready message's `csp`
+      // (the host has already filtered them; see approveCspSources in
+      // src/utils/sandbox-csp.ts). Re-screened here because they become CSP
+      // source expressions on THIS document: anything carrying whitespace, a
+      // directive or list separator, or a quote (a keyword such as 'self',
+      // which would name this proxy's own origin) is dropped.
+      function approvedFrameSources(csp) {
+        const list = csp && Array.isArray(csp.frameDomains) ? csp.frameDomains : [];
+        return list.filter(
+          (s) => typeof s === "string" && s !== "" && !/[\s;,'"]/.test(s),
+        );
+      }
+
+      // Restrict what the inner frame may be navigated to, by installing a
+      // `frame-src` / `child-src` policy on this document (see the head
+      // comment for why a parent's policy is the control that works). Must run
+      // BEFORE the inner frame starts its navigation. Policies only ever
+      // intersect, so a second call can narrow but never widen what an
+      // earlier one allowed — a re-render in the same proxy document fails
+      // closed. `child-src` is set alongside so the restriction holds even in
+      // a browser that falls back to it for frames; the srcdoc document
+      // inherits this policy too, which is harmless because its own policy
+      // already limits frames to the same `frameDomains` and workers to
+      // 'none'.
+      function installFramePolicy(sources) {
+        const list = sources.length > 0 ? sources.join(" ") : "'none'";
+        const meta = document.createElement("meta");
+        meta.httpEquiv = "Content-Security-Policy";
+        meta.content = `frame-src ${list}; child-src ${list}`;
+        document.head.appendChild(meta);
+      }
+
       // The exact embedder origins this proxy accepts, injected by the sandbox
       // controller when it serves this page (see `embedderOriginsLiteral` in
       // server/sandbox-controller.ts). It is the same list the served
@@ -166,6 +222,95 @@
       // based on the permissions requested by the app
       document.body.appendChild(inner);
 
+      // Set once the inner frame is seen leaving the document the host loaded.
+      // From then on the relay is closed in both directions and every message
+      // is dropped: whatever the frame holds is no longer the app, even though
+      // it still satisfies `event.source === inner.contentWindow` and still
+      // serialises its origin as "null".
+      let navigatedAway = false;
+
+      // Fail closed on a frame that tried to leave its document: stop
+      // relaying, remove the frame (which destroys whatever document it
+      // holds), and tell the host through the app's own logging channel,
+      // which it already surfaces. Idempotent, because one attempt can be
+      // seen twice (a blocked navigation is both a policy violation and, in
+      // Chromium, a second `load` onto an error page).
+      function closeNavigatedFrame(what) {
+        if (navigatedAway) return;
+        navigatedAway = true;
+        inner.remove();
+        console.error(
+          `[Sandbox] the app ${what}; the frame was removed and the relay closed.`,
+        );
+        window.parent.postMessage(
+          {
+            jsonrpc: "2.0",
+            method: "notifications/message",
+            params: {
+              level: "error",
+              logger: "mcp-inspector-sandbox",
+              data: `The MCP App ${what}. The Inspector removed the frame and stopped relaying messages; reload the app to try again.`,
+            },
+          },
+          EXPECTED_HOST_ORIGIN,
+        );
+      }
+
+      // A navigation the frame policy (installFramePolicy) refuses is
+      // reported HERE, on the policy's own document. Engines differ in what
+      // follows: Chromium commits an error page (a second `load`), while
+      // Firefox leaves the original document in place and fires nothing
+      // further. The violation is the one signal both give, so it is what
+      // makes the attempt visible to the host everywhere. The app's own
+      // nested-frame violations are reported to the app's document, not
+      // this one, so they do not reach this listener.
+      document.addEventListener("securitypolicyviolation", (e) => {
+        if (
+          e.effectiveDirective === "frame-src" ||
+          e.effectiveDirective === "child-src"
+        ) {
+          closeNavigatedFrame(
+            "tried to navigate its frame to an origin it did not declare",
+          );
+        }
+      });
+
+      // Watch a srcdoc load for the frame navigating itself elsewhere. The
+      // srcdoc document fires at most one `load`, so any later one is a
+      // different document — another page (one the frame policy allowed,
+      // such as a declared frame domain), a blocked navigation's error page,
+      // or a reload. All of them close the frame. A navigation started while
+      // the srcdoc is still loading aborts it before its `load`, so the next
+      // document's `load` is the FIRST one; that case is caught by the
+      // departure message instead (see DEPARTURE_MESSAGE_KEY).
+      //
+      // The frame is detached while it is configured and re-attached after
+      // the listener is on, so the only `load` it can fire first is the
+      // srcdoc's: inserting a frame that already carries `srcdoc` skips the
+      // initial about:blank `load` that a bare frame would fire, which is what
+      // makes "the second load" unambiguous across engines.
+      function loadSrcdocWatchingForNavigation(html) {
+        inner.remove();
+        inner.srcdoc = html;
+        let loads = 0;
+        inner.addEventListener("load", function onLoad() {
+          loads += 1;
+          if (loads === 1) return;
+          inner.removeEventListener("load", onLoad);
+          closeNavigatedFrame(
+            "navigated its frame away from the document the host loaded",
+          );
+        });
+        document.body.appendChild(inner);
+      }
+
+      // The host wrapper (wrapSandboxedHtml in src/utils/sandbox-csp.ts)
+      // runs a script ahead of the app's code that posts
+      // `{ mcpInspectorSandbox: "departing" }` when the srcdoc document starts
+      // to leave (`beforeunload` / `pagehide`), whether or not it ever
+      // finished loading. It is consumed here and never relayed.
+      const DEPARTURE_MESSAGE_KEY = "mcpInspectorSandbox";
+
       const RESOURCE_READY_NOTIFICATION =
         "ui/notifications/sandbox-resource-ready";
       const PROXY_READY_NOTIFICATION = "ui/notifications/sandbox-proxy-ready";
@@ -190,6 +335,9 @@
       // never parses or injects into the untrusted bytes.
 
       window.addEventListener("message", async (event) => {
+        // Closed for good once the frame navigated away (see
+        // loadSrcdocWatchingForNavigation): nothing is relayed either way.
+        if (navigatedAway) return;
         if (event.source === window.parent) {
           // Validate that messages from parent come from the expected host origin.
           // This prevents malicious pages from sending messages to this sandbox.
@@ -204,7 +352,7 @@
           }
 
           if (event.data && event.data.method === RESOURCE_READY_NOTIFICATION) {
-            const { html, sandbox, permissions, src } = event.data.params;
+            const { html, sandbox, permissions, src, csp } = event.data.params;
             // The host asked for the dedicated-origin path: it published the
             // wrapped document to its own app-origin listener and is handing
             // us the URL. Only an absolute http(s) URL is honored — anything
@@ -299,6 +447,10 @@
               // an app silently rendering the wrong bytes.
               inner.removeAttribute("srcdoc");
               innerOrigin = srcUrl.origin;
+              // The frame may hold only the app-origin document. That
+              // document's own nested frames are governed by its own header
+              // (it is not srcdoc, so it does not inherit this policy).
+              installFramePolicy([srcUrl.origin]);
               inner.src = srcUrl.href;
             } else if (typeof html === "string") {
               // The host has already wrapped the app's HTML in a fixed shell
@@ -323,16 +475,25 @@
                 .filter((t) => t && t.toLowerCase() !== "allow-same-origin");
               inner.setAttribute("sandbox", fallbackTokens.join(" "));
               innerOrigin = "null";
-              inner.srcdoc = html;
+              // The srcdoc load itself is not a fetch, so `frame-src` does not
+              // apply to it; what it does stop is the frame being navigated to
+              // anything but the app's approved `frameDomains` afterwards.
+              installFramePolicy(approvedFrameSources(csp));
+              loadSrcdocWatchingForNavigation(html);
             }
           } else {
             if (inner && inner.contentWindow) {
               // Target the inner frame's real origin on the dedicated-origin
               // path, so a frame that navigated itself elsewhere stops
               // receiving host messages. The opaque default has no targetable
-              // origin ("null" is not a valid targetOrigin), so it keeps "*" —
-              // safe there because the frame is `srcdoc` and cannot navigate
-              // to another origin's document without allow-top-navigation.
+              // origin ("null" is not a valid targetOrigin), so it has to use
+              // "*" — which on its own would deliver to WHATEVER document the
+              // frame holds: a sandboxed frame can navigate itself to another
+              // origin without allow-top-navigation, and the new page keeps the
+              // opaque origin and the same contentWindow. What keeps "*" from
+              // reaching such a page is the frame policy (installFramePolicy),
+              // which blocks the navigation, and the navigation watch, which
+              // closes this relay if the frame leaves its document anyway.
               inner.contentWindow.postMessage(
                 event.data,
                 innerOrigin === "null" ? "*" : innerOrigin,
@@ -354,6 +515,16 @@
             );
             return;
           }
+          if (event.data && event.data[DEPARTURE_MESSAGE_KEY] === "departing") {
+            // Only the opaque srcdoc path watches for departure: a
+            // dedicated-origin app is targeted by its real origin instead.
+            if (innerOrigin === "null") {
+              closeNavigatedFrame(
+                "navigated its frame away from the document the host loaded",
+              );
+            }
+            return;
+          }
           // Relay messages from inner frame to parent window.
           // Use specific origin instead of "*" to prevent message interception.
           window.parent.postMessage(event.data, EXPECTED_HOST_ORIGIN);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "2.12.0",
+  "version": "2.14.0",
   "description": "The Model Context Protocol Inspector",
   "keywords": [
     "MCP",
@@ -111,6 +111,7 @@
     "smoke:web:browser": "node scripts/install-smoke-browser.mjs && node scripts/smoke-web-browser.mjs",
     "smoke:web:app": "node scripts/install-smoke-browser.mjs && node scripts/smoke-web-app.mjs",
     "smoke:web:elicit": "node scripts/install-smoke-browser.mjs && node scripts/smoke-web-elicitation.mjs",
+    "smoke:web:sandbox": "node scripts/install-smoke-browser.mjs && node scripts/smoke-web-sandbox-navigation.mjs",
     "smoke:web:tabs": "node scripts/install-smoke-browser.mjs chromium && node scripts/smoke-web-tabs.mjs chromium",
     "smoke:web:engine": "node scripts/run-engine-smokes.mjs",
     "smoke:web:chromium": "node scripts/run-engine-smokes.mjs chromium",
@@ -125,11 +126,11 @@
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "@modelcontextprotocol/client": "2.3.1",
-    "@modelcontextprotocol/core": "2.3.1",
+    "@modelcontextprotocol/client": "2.4.0",
+    "@modelcontextprotocol/core": "2.4.0",
     "@modelcontextprotocol/ext-apps": "^2.0.0",
     "@modelcontextprotocol/ext-tasks": "^0.2.2",
-    "@modelcontextprotocol/server": "2.3.1",
+    "@modelcontextprotocol/server": "2.4.0",
     "@napi-rs/keyring": "^2.1.1",
     "@vitejs/plugin-react": "^6.0.0",
     "ajv": "^8.17.1",
@@ -142,23 +143,23 @@
     "pino": "^9.14.0",
     "proper-lockfile": "^4.1.2",
     "react": "^19.0.0",
-    "undici": "^8.11.2",
+    "undici": "^8.12.3",
     "vite": "^8.1.5",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
   "engines": {
-    "node": ">=22.19.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "allowScripts": {
     "fsevents": false
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@modelcontextprotocol/server-legacy": "2.3.1",
+    "@modelcontextprotocol/server-legacy": "2.4.0",
     "@types/node": "^24.12.4",
     "@types/proper-lockfile": "^4.1.4",
-    "@vitest/coverage-v8": "4.1.11",
+    "@vitest/coverage-v8": "4.1.12",
     "eslint": "^10.8.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "express": "^5.2.1",
@@ -167,6 +168,6 @@
     "semver": "^7.8.5",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.65.0",
-    "vitest": "4.1.11"
+    "vitest": "4.1.12"
   }
 }

package/skills/mcpdo/SKILL.md

@@ -163,3 +163,17 @@ more).
 - Parked calls expire after 10 minutes; one parked call per connection. Pass
   `--elicit off` on `connect` to have well-behaved servers fall back to their
   own defaults instead of asking.
+
+## Load runs (`tools/call --load`)
+
+- The summary's `latencyMs` and `okThroughput` cover **successful** calls
+  only; failures are timed in `errorLatencyMs`, and `isError` results' text
+  is tallied in `toolErrorMessages` (thrown ones in `errorMessages`). Judge a
+  run on these, not on `throughput`, which counts failures too.
+- With `--load-rate`, compare `achievedRate` to `rate` and read
+  `droppedSlots`: slots nobody was free to take are dropped, so a server too
+  slow for the target can still report healthy latency. A shortfall under 90%
+  also prints a warning on stderr.
+- `stoppedEarly` (`reason` + `detail`) means the run ended before its bounds:
+  `consecutive_errors` (the server stopped answering), `connection_lost`, or
+  `interrupted`. The counts cover only what completed.