@modelcontextprotocol/inspector 2.13.0 → 2.15.0

package/clients/web/build/index.js

@@ -22,7 +22,7 @@ import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypt
 import { createSecureContext } from "node:tls";
 import { createServer as createServer$1 } from "vite";
 import react from "@vitejs/plugin-react";
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { bodyLimit } from "hono/body-limit";
@@ -37,20 +37,18 @@ import { createServer as createServer$2 } from "node:https";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { spawnSync } from "node:child_process";
-//#region ../../core/storage/store-id.ts
+// ../../core/storage/store-id.ts
 function validateStoreId(storeId) {
 	return /^[a-zA-Z0-9_-]+$/.test(storeId) && storeId !== "__proto__";
 }
-//#endregion
-//#region ../../core/storage/store-serialize.ts
+// ../../core/storage/store-serialize.ts
 function serializeStore(data) {
 	return JSON.stringify(data, null, 2);
 }
 function parseStore(raw) {
 	return JSON.parse(raw);
 }
-//#endregion
-//#region ../../core/storage/store-io.ts
+// ../../core/storage/store-io.ts
 function getDefaultStorageDir() {
 	const homeDir = process.env.HOME || process.env.USERPROFILE || ".";
 	return path$1.join(homeDir, ".mcp-inspector", "storage");
@@ -96,8 +94,7 @@ async function deleteStoreFile(filePath) {
 		if (error.code !== "ENOENT") throw error;
 	}
 }
-//#endregion
-//#region ../../core/mcp/types.ts
+// ../../core/mcp/types.ts
 const DEFAULT_TASK_TTL_MS = 6e4;
 const DEFAULT_MAX_FETCH_REQUESTS = 1e3;
 const MODERN_LOG_LEVELS = [
@@ -114,8 +111,7 @@ const MODERN_LOG_LEVELS = [
 function isModernLogLevel(value) {
 	return typeof value === "string" && MODERN_LOG_LEVELS.includes(value);
 }
-//#endregion
-//#region ../../core/extension/skills/schemas.ts
+// ../../core/extension/skills/schemas.ts
 const CACHE_FIELDS = {
 	ttlMs: ReadResourceDirectoryResultSchema.shape.ttlMs,
 	cacheScope: SkillCacheScopeSchema
@@ -227,13 +223,11 @@ SKILL_LIMITS.bytes;
 function isSkillCatalogLimit(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
 }
-//#endregion
-//#region ../../core/auth/secret-fields.ts
+// ../../core/auth/secret-fields.ts
 const SECRET_FIELD_OAUTH_CLIENT_SECRET = "oauth-client-secret";
 const SECRET_FIELD_IDP_CLIENT_SECRET = "idp-client-secret";
 const envSecretField = (envKey) => `env:${envKey}`;
-//#endregion
-//#region ../../core/json/jsonUtils.ts
+// ../../core/json/jsonUtils.ts
 function isSerializableJson(value) {
 	if (value === null) return true;
 	switch (typeof value) {
@@ -247,8 +241,7 @@ function isSerializableJson(value) {
 function toRecord(value) {
 	return value;
 }
-//#endregion
-//#region ../../core/mcp/serverList.ts
+// ../../core/mcp/serverList.ts
 const VALID_SERVER_TYPES = /* @__PURE__ */ new Set([
 	"stdio",
 	"sse",
@@ -556,28 +549,38 @@ function expectedSecretFields(stored) {
 	if (isStdioStored(stored) && stored.env) for (const k of Object.keys(stored.env)) fields.push(envSecretField(k));
 	return fields;
 }
-const DEFAULT_SEED_CONFIG = { mcpServers: {
-	"filesystem-server-default": {
-		type: "stdio",
-		command: "npx",
-		args: [
-			"-y",
-			"@modelcontextprotocol/server-filesystem",
-			"/tmp"
-		]
-	},
-	"everything-server-default": {
-		type: "stdio",
-		command: "npx",
-		args: ["-y", "@modelcontextprotocol/server-everything"]
-	},
-	"example-server-default": {
-		type: "streamable-http",
-		url: "https://example-server.modelcontextprotocol.io/mcp"
+const EXAMPLE_SERVER_URL = "https://example-server.modelcontextprotocol.io/mcp";
+function adHocServerName(config) {
+	if (config.type === "sse" || config.type === "streamable-http") try {
+		return new URL(config.url).host || "server";
+	} catch {
+		return "server";
 	}
-} };
-//#endregion
-//#region ../../core/storage/own-entry.ts
+	return config.command?.split(/[\\/]/).pop() || "server";
+}
+function defaultSeedConfig(tempDir) {
+	return { mcpServers: {
+		"filesystem-server-default": {
+			type: "stdio",
+			command: "npx",
+			args: [
+				"-y",
+				"@modelcontextprotocol/server-filesystem",
+				tempDir
+			]
+		},
+		"everything-server-default": {
+			type: "stdio",
+			command: "npx",
+			args: ["-y", "@modelcontextprotocol/server-everything"]
+		},
+		"example-server-default": {
+			type: "streamable-http",
+			url: EXAMPLE_SERVER_URL
+		}
+	} };
+}
+// ../../core/storage/own-entry.ts
 function setOwnEntry(map, key, value) {
 	Object.defineProperty(map, key, {
 		value,
@@ -589,8 +592,7 @@ function setOwnEntry(map, key, value) {
 function getOwnEntry(map, key) {
 	return map !== void 0 && Object.hasOwn(map, key) ? map[key] : void 0;
 }
-//#endregion
-//#region ../../core/mcp/node/config.ts
+// ../../core/mcp/node/config.ts
 function parseKeyValuePair(value, previous = {}) {
 	const parts = value.split("=");
 	const key = parts[0] ?? "";
@@ -759,8 +761,7 @@ function resolveServerConfigs(options, mode) {
 }
 const API_SERVER_ENV_VARS = { AUTH_TOKEN: "MCP_INSPECTOR_API_TOKEN" };
 const INSPECTOR_API_TOKEN_GLOBAL = "__INSPECTOR_API_TOKEN__";
-//#endregion
-//#region ../../core/auth/secret-storage-info.ts
+// ../../core/auth/secret-storage-info.ts
 function secretStorageLabel(info) {
 	switch (info.kind) {
 		case "keyring": return "OS keychain";
@@ -787,8 +788,7 @@ function secretStorageSummary(info) {
 	if (info.reason === "fallback") parts.push("— fell back from the OS keychain");
 	return parts.join(" ");
 }
-//#endregion
-//#region ../../core/node/version.ts
+// ../../core/node/version.ts
 const ROOT_PACKAGE_NAME = "@modelcontextprotocol/inspector";
 function readInspectorVersion(callerUrl) {
 	const startDir = dirname(fileURLToPath(callerUrl));
@@ -812,8 +812,7 @@ function readInspectorVersionSafe(callerUrl) {
 		return;
 	}
 }
-//#endregion
-//#region ../../core/node/openUrl.ts
+// ../../core/node/openUrl.ts
 const OPEN_URL_TIMEOUT_MS = 5e3;
 const OPENABLE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
 function toOpenableHref(href) {
@@ -841,8 +840,7 @@ async function openUrl(url, timeoutMs = OPEN_URL_TIMEOUT_MS) {
 		clearTimeout(timer);
 	}
 }
-//#endregion
-//#region ../../core/node/hostUrl.ts
+// ../../core/node/hostUrl.ts
 function stripBrackets(host) {
 	return host.replace(/^\[(.*)\]$/, "$1");
 }
@@ -895,8 +893,7 @@ function isLoopbackHost(host) {
 	const h = canonicalUrlHost(host).replace(/\.$/, "");
 	return h === "localhost" || h === "[::1]" || /^127(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}$/.test(h);
 }
-//#endregion
-//#region server/resolve-bind-host.ts
+// server/resolve-bind-host.ts
 const BIND_ALL_INTERFACES_ENV = "DANGEROUSLY_BIND_ALL_INTERFACES";
 function isEnvFlagEnabled(value) {
 	const v = value?.trim().toLowerCase();
@@ -912,9 +909,102 @@ function resolveBindHostname(env = process.env) {
 	}
 	return stripBrackets(host);
 }
-//#endregion
-//#region server/sandbox-controller.ts
+// server/host-allow-list.ts
+const ALLOWED_HOSTS_ENV = "MCP_INSPECTOR_ALLOWED_HOSTS";
+const HOSTNAME_RE = /^[a-z0-9._-]+$/;
+function normalizeHostname(hostname) {
+	return hostname.trim().toLowerCase().replace(/\.$/, "");
+}
+function parseHostHeader(value) {
+	const raw = value.trim().toLowerCase();
+	let hostname;
+	let port;
+	if (raw.startsWith("[")) {
+		const end = raw.indexOf("]");
+		if (end < 0) return null;
+		hostname = raw.slice(0, end + 1);
+		if (!isIPv6(hostname.slice(1, -1))) return null;
+		const rest = raw.slice(end + 1);
+		if (rest !== "") {
+			if (!rest.startsWith(":")) return null;
+			port = rest.slice(1);
+		}
+	} else {
+		const colon = raw.indexOf(":");
+		hostname = colon < 0 ? raw : raw.slice(0, colon);
+		port = colon < 0 ? void 0 : raw.slice(colon + 1);
+	}
+	if (port !== void 0) {
+		if (!/^\d{1,5}$/.test(port) || Number(port) > 65535) return null;
+	}
+	if (hostname.startsWith("[")) return hostname;
+	const name = normalizeHostname(hostname);
+	return HOSTNAME_RE.test(name) ? name : null;
+}
+function parseAllowedHostsEnv(value) {
+	if (!value) return [];
+	const out = [];
+	for (const entry of value.split(",")) {
+		const trimmed = entry.trim();
+		if (trimmed === "") continue;
+		const domain = trimmed.startsWith(".") ? "." : "";
+		const ascii = /[\s/:*@]/.test(trimmed) ? "" : domainToASCII(normalizeHostname(trimmed.slice(domain.length)));
+		if (!HOSTNAME_RE.test(ascii)) {
+			console.warn(`Ignoring invalid ${ALLOWED_HOSTS_ENV} entry: ${trimmed} (list bare hostnames, e.g. inspector.example.com or .example.com)`);
+			continue;
+		}
+		out.push(domain + ascii);
+	}
+	return out;
+}
+function configuredAllowedHosts(options) {
+	const hosts = /* @__PURE__ */ new Set();
+	if (!isAllInterfacesHost(options.bindHost)) hosts.add(normalizeHostname(canonicalUrlHost(options.bindHost)));
+	for (const origin of options.allowedOrigins) try {
+		const { hostname } = new URL(origin);
+		if (hostname !== "") hosts.add(normalizeHostname(hostname));
+	} catch {}
+	for (const extra of options.extraHosts ?? []) hosts.add(normalizeHostname(extra));
+	return [...hosts];
+}
+function createHostAllowList(options) {
+	const configured = configuredAllowedHosts(options);
+	return (hostHeader) => {
+		if (hostHeader === void 0) return false;
+		const hostname = parseHostHeader(hostHeader);
+		if (hostname === null) return false;
+		if (hostname.startsWith("[")) return true;
+		if (isIPv4(hostname)) return true;
+		if (hostname === "localhost" || hostname.endsWith(".localhost")) return true;
+		for (const allowed of configured) {
+			if (allowed === hostname) return true;
+			if (allowed.startsWith(".") && (allowed.slice(1) === hostname || hostname.endsWith(allowed))) return true;
+		}
+		return false;
+	};
+}
+function hostAllowListMiddleware(options) {
+	const isAllowed = createHostAllowList(options);
+	return async (c, next) => {
+		const host = c.req.header("host");
+		if (!isAllowed(host)) return c.text(`Forbidden: Host "${host ?? ""}" is not allowed. To serve the Inspector under this name, add it to ${ALLOWED_HOSTS_ENV} (or to ALLOWED_ORIGINS).`, 403);
+		await next();
+	};
+}
+// server/sandbox-controller.ts
 const __dirname$3 = dirname(fileURLToPath(import.meta.url));
+function isSandboxPath(url) {
+	const path = (url ?? "").split("?", 1)[0];
+	return path === "/sandbox" || path === "/sandbox/";
+}
+function publicUrlHosts(publicUrl) {
+	if (!publicUrl) return [];
+	try {
+		return [new URL(publicUrl).hostname];
+	} catch {
+		return [];
+	}
+}
 const LOOPBACK_FRAME_ANCESTORS = ["http://127.0.0.1:*", "http://localhost:*"];
 const CSP_HOST_SOURCE = /^[a-z][a-z0-9+.-]*:\/\/[^\s;,'"[\]*]+$/i;
 function sandboxFrameAncestors(allowedOrigins) {
@@ -948,7 +1038,12 @@ function resolveSandboxPort() {
 	return fromSandbox ?? parseListenPort$1(process.env.SERVER_PORT) ?? 6275;
 }
 function createSandboxController(options) {
-	const { port, host = DEFAULT_BIND_HOST, allowedOrigins, publicUrl } = options;
+	const { port, host = DEFAULT_BIND_HOST, allowedOrigins, publicUrl, allowedHosts } = options;
+	const isAllowedHost = createHostAllowList({
+		bindHost: host,
+		allowedOrigins: allowedOrigins ?? [],
+		extraHosts: [...allowedHosts ?? [], ...publicUrlHosts(publicUrl)]
+	});
 	let server = null;
 	let sandboxUrl = null;
 	let boundPort = 0;
@@ -977,18 +1072,25 @@ function createSandboxController(options) {
 					resolve(value);
 				};
 				server = createServer((req, res) => {
-					if (req.method !== "GET" || req.url !== "/sandbox" && req.url !== "/sandbox/") {
+					if (!isAllowedHost(req.headers.host)) {
+						res.writeHead(403, { "Content-Type": "text/plain" });
+						res.end(`Forbidden: Host "${req.headers.host ?? ""}" is not allowed. To serve the sandbox under this name, add it to ${ALLOWED_HOSTS_ENV} (or to ALLOWED_ORIGINS).`);
+						return;
+					}
+					const isHead = req.method === "HEAD";
+					if (req.method !== "GET" && !isHead || !isSandboxPath(req.url)) {
 						res.writeHead(404, { "Content-Type": "text/plain" });
 						res.end("Not Found");
 						return;
 					}
 					res.writeHead(200, {
 						"Content-Type": "text/html; charset=utf-8",
+						"Content-Length": Buffer.byteLength(sandboxHtml),
 						"Cache-Control": "no-store, no-cache, must-revalidate",
 						Pragma: "no-cache",
 						"Content-Security-Policy": SANDBOX_PROXY_CSP
 					});
-					res.end(sandboxHtml);
+					res.end(isHead ? void 0 : sandboxHtml);
 				});
 				let retriedDynamic = false;
 				server.on("error", (err) => {
@@ -1210,8 +1312,7 @@ function createAppOriginController(options) {
 		}
 	};
 }
-//#endregion
-//#region server/public-address.ts
+// server/public-address.ts
 const SANDBOX_FULL_ADDRESS_ENV = "MCP_SANDBOX_FULL_ADDRESS";
 const APP_ORIGIN_FULL_ADDRESS_ENV = "MCP_APP_ORIGIN_FULL_ADDRESS";
 const SANDBOX_PATH = "/sandbox";
@@ -1280,8 +1381,7 @@ function resolveAppOriginPublicOrigin(raw, allowedOrigins, sandboxUrl) {
 	warnMixedContent(APP_ORIGIN_FULL_ADDRESS_ENV, url, allowedOrigins);
 	return url.origin;
 }
-//#endregion
-//#region server/tls.ts
+// server/tls.ts
 const TLS_KEY_PATH_ENV = "INSPECTOR_TLS_KEY_PATH";
 const TLS_CERT_PATH_ENV = "INSPECTOR_TLS_CERT_PATH";
 function webScheme(tls) {
@@ -1317,91 +1417,7 @@ function resolveTlsConfig(env = process.env) {
 		cert
 	};
 }
-//#endregion
-//#region server/host-allow-list.ts
-const ALLOWED_HOSTS_ENV = "MCP_INSPECTOR_ALLOWED_HOSTS";
-const HOSTNAME_RE = /^[a-z0-9._-]+$/;
-function normalizeHostname(hostname) {
-	return hostname.trim().toLowerCase().replace(/\.$/, "");
-}
-function parseHostHeader(value) {
-	const raw = value.trim().toLowerCase();
-	let hostname;
-	let port;
-	if (raw.startsWith("[")) {
-		const end = raw.indexOf("]");
-		if (end < 0) return null;
-		hostname = raw.slice(0, end + 1);
-		if (!isIPv6(hostname.slice(1, -1))) return null;
-		const rest = raw.slice(end + 1);
-		if (rest !== "") {
-			if (!rest.startsWith(":")) return null;
-			port = rest.slice(1);
-		}
-	} else {
-		const colon = raw.indexOf(":");
-		hostname = colon < 0 ? raw : raw.slice(0, colon);
-		port = colon < 0 ? void 0 : raw.slice(colon + 1);
-	}
-	if (port !== void 0) {
-		if (!/^\d{1,5}$/.test(port) || Number(port) > 65535) return null;
-	}
-	if (hostname.startsWith("[")) return hostname;
-	const name = normalizeHostname(hostname);
-	return HOSTNAME_RE.test(name) ? name : null;
-}
-function parseAllowedHostsEnv(value) {
-	if (!value) return [];
-	const out = [];
-	for (const entry of value.split(",")) {
-		const trimmed = entry.trim();
-		if (trimmed === "") continue;
-		const domain = trimmed.startsWith(".") ? "." : "";
-		const ascii = /[\s/:*@]/.test(trimmed) ? "" : domainToASCII(normalizeHostname(trimmed.slice(domain.length)));
-		if (!HOSTNAME_RE.test(ascii)) {
-			console.warn(`Ignoring invalid ${ALLOWED_HOSTS_ENV} entry: ${trimmed} (list bare hostnames, e.g. inspector.example.com or .example.com)`);
-			continue;
-		}
-		out.push(domain + ascii);
-	}
-	return out;
-}
-function configuredAllowedHosts(options) {
-	const hosts = /* @__PURE__ */ new Set();
-	if (!isAllInterfacesHost(options.bindHost)) hosts.add(normalizeHostname(canonicalUrlHost(options.bindHost)));
-	for (const origin of options.allowedOrigins) try {
-		const { hostname } = new URL(origin);
-		if (hostname !== "") hosts.add(normalizeHostname(hostname));
-	} catch {}
-	for (const extra of options.extraHosts ?? []) hosts.add(normalizeHostname(extra));
-	return [...hosts];
-}
-function createHostAllowList(options) {
-	const configured = configuredAllowedHosts(options);
-	return (hostHeader) => {
-		if (hostHeader === void 0) return false;
-		const hostname = parseHostHeader(hostHeader);
-		if (hostname === null) return false;
-		if (hostname.startsWith("[")) return true;
-		if (isIPv4(hostname)) return true;
-		if (hostname === "localhost" || hostname.endsWith(".localhost")) return true;
-		for (const allowed of configured) {
-			if (allowed === hostname) return true;
-			if (allowed.startsWith(".") && (allowed.slice(1) === hostname || hostname.endsWith(allowed))) return true;
-		}
-		return false;
-	};
-}
-function hostAllowListMiddleware(options) {
-	const isAllowed = createHostAllowList(options);
-	return async (c, next) => {
-		const host = c.req.header("host");
-		if (!isAllowed(host)) return c.text(`Forbidden: Host "${host ?? ""}" is not allowed. To serve the Inspector under this name, add it to ${ALLOWED_HOSTS_ENV} (or to ALLOWED_ORIGINS).`, 403);
-		await next();
-	};
-}
-//#endregion
-//#region server/web-server-config.ts
+// server/web-server-config.ts
 const inspectorVersion = readInspectorVersionSafe(import.meta.url);
 function defaultEnvironmentFromProcess(extra) {
 	const keys = process.platform === "win32" ? [
@@ -1522,6 +1538,10 @@ function defaultAllowedOrigins(hostname, port, scheme = "http") {
 	];
 	return [webOrigin(scheme, h, port)];
 }
+function weakAuthTokenWarning(token) {
+	if (token === "" || token.length >= 32) return null;
+	return `Warning: the custom API token (${API_SERVER_ENV_VARS.AUTH_TOKEN}) is ${token.length} character${token.length === 1 ? "" : "s"} long; use at least 32 random characters (e.g. \`openssl rand -hex 32\`), or unset it to have one generated.`;
+}
 function buildWebServerConfig(options = {}) {
 	const { initialMcpConfig = null, mcpConfigPath, writable = true, initialServers = null } = options;
 	const rawPort = process.env.CLIENT_PORT?.trim() || "6274";
@@ -1531,6 +1551,8 @@ function buildWebServerConfig(options = {}) {
 	const tls = resolveTlsConfig();
 	const dangerouslyOmitAuth = isEnvFlagEnabled(process.env.DANGEROUSLY_OMIT_AUTH);
 	const authToken = dangerouslyOmitAuth ? "" : process.env[API_SERVER_ENV_VARS.AUTH_TOKEN] ?? process.env["MCP_PROXY_AUTH_TOKEN"] ?? "";
+	const weakToken = weakAuthTokenWarning(authToken);
+	if (weakToken) console.warn(weakToken);
 	const sandboxPort = resolveSandboxPort();
 	const requestedAppOriginPort = resolveAppOriginPort();
 	const appOriginCollidesWith = requestedAppOriginPort !== 0 && (requestedAppOriginPort === port ? "the web server (CLIENT_PORT)" : requestedAppOriginPort === sandboxPort ? "the MCP Apps sandbox (MCP_SANDBOX_PORT)" : null);
@@ -1584,8 +1606,7 @@ function resolveAutoOpen() {
 	if (flag === "false") return false;
 	return !process.env.VITEST;
 }
-//#endregion
-//#region ../../core/mcp/config.ts
+// ../../core/mcp/config.ts
 function getServerType(config) {
 	if (!("type" in config) || config.type === void 0) return "stdio";
 	const type = config.type;
@@ -1594,8 +1615,7 @@ function getServerType(config) {
 	if (type === "streamable-http") return "streamable-http";
 	throw new Error(`Invalid server type: ${type}. Valid types are: stdio, sse, streamable-http`);
 }
-//#endregion
-//#region ../../core/mcp/fetchTracking.ts
+// ../../core/mcp/fetchTracking.ts
 const SENSITIVE_HEADERS = /* @__PURE__ */ new Set([
 	"authorization",
 	"cookie",
@@ -1704,14 +1724,15 @@ function isLongLivedStreamResponse(method, contentType) {
 }
 const CHALLENGE_BODY_MAX_BYTES = 65536;
 const CHALLENGE_BODY_READ_MS = 2e3;
+const TRACKED_BODY_MAX_BYTES = 1048576;
 const TRUNCATED_BODY_SUFFIX = "\n[truncated]";
 const WITHHELD_TRUNCATED_JSON_BODY = "[truncated JSON body withheld: an incomplete body cannot be redacted]";
-function recordableChallengeBody(read, contentType) {
+function recordableBody(read, contentType) {
 	if (!read.truncated) return redactBody(read.text, contentType);
 	if ((contentType ?? "").toLowerCase().includes("json") || /^\s*[{[]/.test(read.text)) return WITHHELD_TRUNCATED_JSON_BODY;
 	return redactBody(read.text, contentType) + TRUNCATED_BODY_SUFFIX;
 }
-async function readChallengeBody(response) {
+async function readCappedBody(response, maxBytes, timeoutMs) {
 	let reader;
 	try {
 		const body = response.clone().body;
@@ -1725,20 +1746,23 @@ async function readChallengeBody(response) {
 	let text = "";
 	let bytes = 0;
 	let timer;
-	const deadline = new Promise((resolve) => {
-		timer = setTimeout(() => resolve("timeout"), CHALLENGE_BODY_READ_MS);
+	const deadline = timeoutMs === void 0 ? void 0 : new Promise((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), timeoutMs);
 	});
 	try {
-		while (bytes < CHALLENGE_BODY_MAX_BYTES) {
-			const next = await Promise.race([reader.read(), deadline]);
+		for (;;) {
+			const next = await (deadline ? Promise.race([reader.read(), deadline]) : reader.read());
 			if (next === "timeout") break;
 			if (next.done) return {
 				text: text + decoder.decode(),
 				truncated: false
 			};
-			const chunk = next.value.subarray(0, CHALLENGE_BODY_MAX_BYTES - bytes);
+			if (next.value.byteLength === 0) continue;
+			if (bytes >= maxBytes) break;
+			const chunk = next.value.subarray(0, maxBytes - bytes);
 			bytes += chunk.byteLength;
 			text += decoder.decode(chunk, { stream: true });
+			if (chunk.byteLength < next.value.byteLength) break;
 		}
 		reader.cancel().catch(() => {});
 		return {
@@ -1751,6 +1775,9 @@ async function readChallengeBody(response) {
 		clearTimeout(timer);
 	}
 }
+function readChallengeBody(response) {
+	return readCappedBody(response, CHALLENGE_BODY_MAX_BYTES, CHALLENGE_BODY_READ_MS);
+}
 function longLivedStreamFraming(contentType) {
 	return contentType?.toLowerCase().includes("application/x-ndjson") ? "ndjson" : "sse";
 }
@@ -1916,7 +1943,7 @@ function createFetchTracker(baseFetch, callbacks) {
 		};
 		if ((responseStatus === 401 || responseStatus === 403) && response.body && !response.bodyUsed) {
 			const read = await readChallengeBody(response);
-			entry.responseBody = read === void 0 ? void 0 : recordableChallengeBody(read, response.headers.get("content-type"));
+			entry.responseBody = read === void 0 ? void 0 : recordableBody(read, response.headers.get("content-type"));
 			callbacks.trackRequest?.(entry);
 			return response;
 		}
@@ -1924,11 +1951,12 @@ function createFetchTracker(baseFetch, callbacks) {
 		if (isLongLivedStream && response.body && !response.bodyUsed) watchLongLivedStream(response, id, longLivedStreamFraming(response.headers.get("content-type")), callbacks);
 		if (!isLongLivedStream && response.body && !response.bodyUsed) {
 			const responseContentType = response.headers.get("content-type");
-			try {
-				response.clone().text().then((body) => {
-					callbacks.updateResponseBody?.(id, redactBody(body, responseContentType) ?? body);
-				}).catch(() => {});
-			} catch {}
+			readCappedBody(response, TRACKED_BODY_MAX_BYTES).then((read) => {
+				if (read === void 0) return;
+				try {
+					callbacks.updateResponseBody?.(id, recordableBody(read, responseContentType));
+				} catch {}
+			});
 		}
 		return response;
 	};
@@ -1994,8 +2022,7 @@ function parseAuthChallengeFromResponse(response, context) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/mcp/node/authChallengeFetch.ts
+// ../../core/mcp/node/authChallengeFetch.ts
 function createAuthChallengeInterceptFetch(baseFetch) {
 	return async (input, init) => {
 		const response = await baseFetch(input, init);
@@ -2016,8 +2043,7 @@ function createAuthChallengeObserverFetch(baseFetch, onChallenge) {
 		return response;
 	};
 }
-//#endregion
-//#region ../../core/mcp/node/proxyFetch.ts
+// ../../core/mcp/node/proxyFetch.ts
 function asUndiciInit(init) {
 	return init;
 }
@@ -2107,8 +2133,7 @@ function createProxyFetch() {
 		return (await loadedProxiedFetch)(input, init);
 	};
 }
-//#endregion
-//#region ../../core/auth/requestTimeout.ts
+// ../../core/auth/requestTimeout.ts
 const OAUTH_TIMEOUT_WIRE_CODE = "oauth_request_timeout";
 function readNegotiatesEndpoint(hint) {
 	if (!hint) return true;
@@ -2155,11 +2180,23 @@ function callerSignalOf(input, init) {
 	if (explicit !== void 0) return explicit ?? void 0;
 	if (typeof input !== "string" && !(input instanceof URL)) return input.signal;
 }
-//#endregion
-//#region ../../core/mcp/node/fetchGuard.ts
+// ../../core/auth/fetchRefusal.ts
 var FetchTargetError = class extends Error {
 	name = "FetchTargetError";
+	url;
+	constructor(message, url) {
+		super(message);
+		if (url !== void 0) this.url = url;
+	}
 };
+function findFetchTargetError(err) {
+	let current = err;
+	for (let depth = 0; depth < 8 && current instanceof Error; depth++) {
+		if (current instanceof FetchTargetError) return current;
+		current = current.cause;
+	}
+}
+const FETCH_TARGET_REFUSED_WIRE_CODE = "fetch_target_refused";
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	301,
 	302,
@@ -2168,11 +2205,12 @@ const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 	308
 ]);
 const resolveWithSystemDns = async (hostname) => (await lookup(hostname, { all: true })).map((r) => r.address);
+const METADATA_IPV4_ADDRESSES = /* @__PURE__ */ new Set(["100.100.100.200", "192.0.0.192"]);
 function isBlockedAddress(ip) {
 	const kind = isIP(ip);
 	if (kind === 4) {
 		const [a, b] = ip.split(".").map(Number);
-		return a === 169 && b === 254;
+		return a === 169 && b === 254 || METADATA_IPV4_ADDRESSES.has(ip);
 	}
 	if (kind !== 6) return false;
 	const addr = ip.toLowerCase();
@@ -2335,27 +2373,35 @@ async function guardedFetch(url, init, options = {}) {
 		headers: init.headers
 	};
 	for (let hop = 0; hop <= 5; hop++) {
-		await assertAllowedTarget(request.url, resolveHost, viaProxy, init.signal);
-		const res = await fetchFn(request.url.href, {
-			method: request.method,
-			headers: new Headers(request.headers),
-			body: request.body,
-			signal: init.signal,
-			redirect: "manual"
-		});
+		let res;
+		try {
+			await assertAllowedTarget(request.url, resolveHost, viaProxy, init.signal);
+			res = await fetchFn(request.url.href, {
+				method: request.method,
+				headers: new Headers(request.headers),
+				body: request.body,
+				signal: init.signal,
+				redirect: "manual"
+			});
+		} catch (err) {
+			stampRefusedUrl(err, request.url);
+			throw err;
+		}
 		const location = res.headers.get("location");
 		if (!REDIRECT_STATUSES.has(res.status) || location === null) return res;
 		res.body?.cancel().catch(() => {});
-		request = nextRedirectRequest(request, res.status, location);
+		try {
+			request = nextRedirectRequest(request, res.status, location);
+		} catch (err) {
+			stampRefusedUrl(err, request.url);
+			throw err;
+		}
 	}
-	throw new FetchTargetError(`Refusing to follow more than 5 redirects`);
+	throw new FetchTargetError(`Refusing to follow more than 5 redirects`, request.url.href);
 }
-function findFetchTargetError(err) {
-	let current = err;
-	for (let depth = 0; depth < 8 && current instanceof Error; depth++) {
-		if (current instanceof FetchTargetError) return current;
-		current = current.cause;
-	}
+function stampRefusedUrl(err, url) {
+	const refused = findFetchTargetError(err);
+	if (refused && refused.url === void 0) refused.url = url.href;
 }
 async function bodyText(input, init) {
 	const body = init?.body !== void 0 ? init.body : input instanceof Request && input.body !== null ? await input.clone().text() : void 0;
@@ -2382,8 +2428,7 @@ function createGuardedFetch(options = {}) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/auth/routeOAuthRequests.ts
+// ../../core/auth/routeOAuthRequests.ts
 function isJsonRpcMessage(value) {
 	return typeof value === "object" && value !== null && value.jsonrpc === "2.0";
 }
@@ -2407,8 +2452,7 @@ function isMcpShapedRequest(input, init) {
 function routeOAuthRequests(mcpFetch, oauthFetch, isMcpEndpoint) {
 	return (input, init) => isMcpShapedRequest(input, init) && isMcpEndpoint(requestUrlOf(input), requestHeadersOf(input, init)) ? mcpFetch(input, init) : oauthFetch(input, init);
 }
-//#endregion
-//#region ../../core/mcp/node/notificationHeadersFetch.ts
+// ../../core/mcp/node/notificationHeadersFetch.ts
 function createNotificationHeadersFetch(baseFetch) {
 	return (input, init) => {
 		const method = modernNotificationMethod(init);
@@ -2444,8 +2488,7 @@ function modernNotificationMethod(init) {
 function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-//#endregion
-//#region ../../core/mcp/node/suppressNotificationStreamFetch.ts
+// ../../core/mcp/node/suppressNotificationStreamFetch.ts
 function createSuppressNotificationStreamFetch(baseFetch, endpoint) {
 	return async (input, init) => {
 		if (isStandaloneStreamRequest(input, init, endpoint)) return new Response(null, {
@@ -2471,8 +2514,7 @@ function isStandaloneStreamRequest(input, init, endpoint) {
 	const headers = new Headers(init?.headers ?? request?.headers);
 	return (headers.get("accept")?.toLowerCase() ?? "").includes("text/event-stream") && !headers.has("last-event-id");
 }
-//#endregion
-//#region ../../core/mcp/node/transport.ts
+// ../../core/mcp/node/transport.ts
 function headersFromSettings(settings) {
 	if (!settings || settings.headers.length === 0) return void 0;
 	const out = {};
@@ -2554,8 +2596,7 @@ function createTransportNode(config, options = {}) {
 		}) };
 	}
 }
-//#endregion
-//#region ../../core/mcp/remote/node/cappedBody.ts
+// ../../core/mcp/remote/node/cappedBody.ts
 async function readCappedText(body, maxBytes) {
 	const reader = body.getReader();
 	const decoder = new TextDecoder();
@@ -2624,6 +2665,24 @@ var RateLimitLedger = class {
 function isRateLimitError(err) {
 	return SdkHttpError.isInstance(err) && err.status === 429;
 }
+// ../../core/mcp/sessionTermination.ts
+function canTerminateSession(transport) {
+	return typeof transport === "object" && transport !== null && "terminateSession" in transport && typeof transport.terminateSession === "function";
+}
+const SESSION_TERMINATE_TIMEOUT_MS = 3e3;
+async function terminateSessionBestEffort(transport, timeoutMs = SESSION_TERMINATE_TIMEOUT_MS) {
+	if (!canTerminateSession(transport) || !transport.sessionId) return false;
+	let timer;
+	const timedOut = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(false), timeoutMs);
+	});
+	const terminated = new Promise((resolve) => resolve(transport.terminateSession())).then(() => true, () => false);
+	try {
+		return await Promise.race([terminated, timedOut]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
 function mergeOAuthSections(disk, snapshot, sections) {
 	const merged = {
 		servers: { ...disk?.servers },
@@ -2740,8 +2799,7 @@ function parseOAuthStoreWriteBody(body) {
 	if (!snapshot || !snapshotHasValidSecretPayloads(snapshot)) return null;
 	return { snapshot };
 }
-//#endregion
-//#region ../../core/auth/node/secret-store.ts
+// ../../core/auth/node/secret-store.ts
 const SERVICE_NAME = "mcp-inspector";
 let keyringLoad;
 var KeyringModuleShapeError = class extends Error {
@@ -2961,8 +3019,7 @@ var SessionSecretStore = class extends InMemorySecretStore {
 		return false;
 	}
 };
-//#endregion
-//#region ../../core/auth/node/file-lock.ts
+// ../../core/auth/node/file-lock.ts
 const STALE_MS = 1e4;
 const RETRY = {
 	retries: 20,
@@ -3094,8 +3151,7 @@ async function withSecretFileLock(filePath, fn) {
 		await release();
 	}
 }
-//#endregion
-//#region ../../core/auth/node/file-secret-store.ts
+// ../../core/auth/node/file-secret-store.ts
 const scrypt = (passphrase, salt, keylen, options) => new Promise((resolve, reject) => {
 	crypto$1.scrypt(passphrase, salt, keylen, options, (err, key) => {
 		/* v8 ignore next -- @preserve: node validates the cost parameters
@@ -3503,8 +3559,7 @@ async function readSecretFilePermissions(filePath) {
 		};
 	}
 }
-//#endregion
-//#region ../../core/auth/node/secret-store-selection.ts
+// ../../core/auth/node/secret-store-selection.ts
 const SECRET_STORE_ENV = "MCP_INSPECTOR_SECRET_STORE";
 const SECRET_FILE_ENV = "MCP_INSPECTOR_SECRET_FILE";
 const STORAGE_DIR_ENV = "MCP_STORAGE_DIR";
@@ -3816,8 +3871,7 @@ function defaultSecretStore() {
 async function resolveConcreteSecretStore(store) {
 	return store instanceof DeferredSecretStore ? (await resolveSecretStore()).store : store;
 }
-//#endregion
-//#region ../../core/auth/node/oauth-secrets.ts
+// ../../core/auth/node/oauth-secrets.ts
 const PERSIST_TOKENS_ENV = "MCP_INSPECTOR_PERSIST_TOKENS";
 const warnedPolicyValues = /* @__PURE__ */ new Set();
 function getPersistTokensPolicy(env = process.env) {
@@ -4087,8 +4141,7 @@ function snapshotHasPlaintextSecrets(snapshot) {
 	for (const session of Object.values(snapshot.idpSessions)) if (session.idToken !== void 0 || session.refreshToken !== void 0) return true;
 	return false;
 }
-//#endregion
-//#region ../../core/auth/node/oauth-namespace-ledger.ts
+// ../../core/auth/node/oauth-namespace-ledger.ts
 const namespaceLedgerPath = (stateFilePath) => `${stateFilePath}.namespaces.json`;
 const KEYRING_LOCATION = "keyring";
 const FILE_LOCATION_PREFIX = "file:";
@@ -4346,8 +4399,7 @@ async function purgeSupersededNamespaces(stateFilePath, secretStore, current, ow
 		warnLedgerFailure("update", error);
 	}
 }
-//#endregion
-//#region ../../core/auth/node/oauth-persist-file.ts
+// ../../core/auth/node/oauth-persist-file.ts
 const warnedStoreFailures = /* @__PURE__ */ new Set();
 function warnStoreWriteFailure(error) {
 	const reason = error instanceof Error ? error.message : String(error);
@@ -4879,8 +4931,7 @@ async function removeOAuthStore(filePath, secretStore = defaultSecretStore()) {
 		if (locked) await purgeSupersededNamespaces(filePath, secretStore, void 0);
 	});
 }
-//#endregion
-//#region ../../core/mcp/import/clientConfig.ts
+// ../../core/mcp/import/clientConfig.ts
 function parseJsonObject(raw) {
 	let data;
 	try {
@@ -4910,8 +4961,7 @@ function parseVsCodeConfig(raw) {
 	if (!servers || typeof servers !== "object" || Array.isArray(servers)) throw new Error("No 'servers' object found in VS Code config file");
 	return { mcpServers: normalizeServerMap(servers) };
 }
-//#endregion
-//#region ../../core/mcp/import/strategies.ts
+// ../../core/mcp/import/strategies.ts
 function join$1(...segments) {
 	return segments.map((s, i) => i === 0 ? s.replace(/\/+$/, "") : s.replace(/^\/+|\/+$/g, "")).filter((s) => s.length > 0).join("/");
 }
@@ -4952,8 +5002,7 @@ const IMPORT_STRATEGIES = Object.fromEntries([
 function getImportStrategy(id) {
 	return IMPORT_STRATEGIES[id];
 }
-//#endregion
-//#region ../../core/mcp/import/resolveSource.ts
+// ../../core/mcp/import/resolveSource.ts
 function resolveImportSource(type, platform, homeDir, readFile) {
 	const strategy = getImportStrategy(type);
 	if (!strategy) return null;
@@ -4996,8 +5045,7 @@ function resolveImportSource(type, platform, homeDir, readFile) {
 		searched
 	};
 }
-//#endregion
-//#region ../../core/mcp/remote/progressToken.ts
+// ../../core/mcp/remote/progressToken.ts
 function progressTokenOf(message) {
 	if ("method" in message && message.method === "notifications/progress" && "params" in message && typeof message.params === "object" && message.params !== null) {
 		const parsed = ProgressTokenSchema.safeParse(message.params.progressToken);
@@ -5010,12 +5058,20 @@ function waitForProgressToken(waits, token) {
 	const numeric = Number(token);
 	return Number.isSafeInteger(numeric) ? waits.get(numeric) : void 0;
 }
-//#endregion
-//#region ../../core/mcp/remote/node/remote-session.ts
+// ../../core/mcp/remote/node/remote-session.ts
 var RemoteSession = class RemoteSession {
+	static DEFAULT_DETACH_GRACE_MS = 6e4;
+	static MAX_QUEUED_EVENTS = 1e3;
 	sessionId;
+	serverName;
+	transportType;
+	createdAt;
+	lastConsumerSeenAt = null;
 	transport;
+	terminated = new AbortController();
 	eventQueue = [];
+	droppedEventCount = 0;
+	detachTimer;
 	eventConsumer = null;
 	transportDead = false;
 	transportError = null;
@@ -5027,8 +5083,31 @@ var RemoteSession = class RemoteSession {
 	appliedProtocolVersion;
 	rateLimits = new RateLimitLedger();
 	static PROTOCOL_VERSION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
-	constructor(sessionId) {
+	constructor(sessionId, descriptor = {}) {
 		this.sessionId = sessionId;
+		this.serverName = descriptor.serverName;
+		this.transportType = descriptor.transport ?? "stdio";
+		this.createdAt = /* @__PURE__ */ new Date();
+	}
+	get terminatedSignal() {
+		return this.terminated.signal;
+	}
+	terminate() {
+		this.terminated.abort();
+	}
+	describe() {
+		const attached = this.eventConsumer !== null;
+		const lastSeen = attached ? /* @__PURE__ */ new Date() : this.lastConsumerSeenAt;
+		return {
+			sessionId: this.sessionId,
+			...this.serverName !== void 0 && { serverName: this.serverName },
+			transport: this.transportType,
+			createdAt: this.createdAt.toISOString(),
+			consumerAttached: attached,
+			lastConsumerSeenAt: lastSeen ? lastSeen.toISOString() : null,
+			queuedEvents: this.eventQueue.length,
+			transportDead: this.transportDead
+		};
 	}
 	setAuthProviderHandle(handle) {
 		this.authProviderHandle = handle;
@@ -5046,13 +5125,50 @@ var RemoteSession = class RemoteSession {
 		this.transport.setProtocolVersion?.(version);
 	}
 	setEventConsumer(consumer) {
+		this.cancelDetachGrace();
 		this.eventConsumer = consumer;
+		this.lastConsumerSeenAt = /* @__PURE__ */ new Date();
+		if (this.droppedEventCount > 0) {
+			const dropped = this.droppedEventCount;
+			this.droppedEventCount = 0;
+			consumer({
+				type: "stdio_log",
+				data: {
+					timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+					message: `[inspector] ${dropped} event(s) were dropped while no client was attached (the queue holds at most ${RemoteSession.MAX_QUEUED_EVENTS})`
+				}
+			});
+		}
 		while (this.eventQueue.length > 0) consumer(this.eventQueue.shift());
 	}
 	clearEventConsumer() {
+		if (this.eventConsumer !== null) this.lastConsumerSeenAt = /* @__PURE__ */ new Date();
 		this.eventConsumer = null;
 		return this.transportDead;
 	}
+	detachEventConsumer(consumer) {
+		if (this.eventConsumer !== consumer) return false;
+		this.eventConsumer = null;
+		this.lastConsumerSeenAt = /* @__PURE__ */ new Date();
+		return true;
+	}
+	armDetachGrace(graceMs, onExpire) {
+		this.cancelDetachGrace();
+		this.detachTimer = setTimeout(() => {
+			this.detachTimer = void 0;
+			onExpire();
+		}, graceMs);
+		this.detachTimer.unref();
+	}
+	cancelDetachGrace() {
+		if (this.detachTimer !== void 0) {
+			clearTimeout(this.detachTimer);
+			this.detachTimer = void 0;
+		}
+	}
+	hasPendingDetachGrace() {
+		return this.detachTimer !== void 0;
+	}
 	markTransportDead(error) {
 		this.transportDead = true;
 		this.transportError = error;
@@ -5163,7 +5279,13 @@ var RemoteSession = class RemoteSession {
 	}
 	pushEvent(event) {
 		if (this.eventConsumer) this.eventConsumer(event);
-		else this.eventQueue.push(event);
+		else {
+			if (this.eventQueue.length >= RemoteSession.MAX_QUEUED_EVENTS) {
+				this.eventQueue.shift();
+				this.droppedEventCount++;
+			}
+			this.eventQueue.push(event);
+		}
 	}
 	onMessage(message) {
 		if ("id" in message && message.id !== null && message.id !== void 0 && ("result" in message || "error" in message)) this.settleRequestWait(message.id);
@@ -5216,8 +5338,7 @@ var RemoteSession = class RemoteSession {
 		});
 	}
 };
-//#endregion
-//#region ../../core/mcp/remote/node/tokenAuthProvider.ts
+// ../../core/mcp/remote/node/tokenAuthProvider.ts
 const REMOTE_OAUTH_STUB_METADATA = {
 	redirect_uris: [],
 	scope: ""
@@ -5282,8 +5403,7 @@ function createRemoteAuthProvider(initialAuthState) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/client/config-parse.ts
+// ../../core/client/config-parse.ts
 function isAbsoluteHttpUrl(value) {
 	let url;
 	try {
@@ -5375,8 +5495,7 @@ function formatClientConfigLoadError(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
-//#endregion
-//#region ../../core/client/secrets.ts
+// ../../core/client/secrets.ts
 const CLIENT_KEYCHAIN_ID = "client";
 function hasClientPlaintextSecret(config) {
 	const secret = config.enterpriseManagedAuth?.idp?.clientSecret;
@@ -5417,8 +5536,7 @@ function mergeSecretsIntoClientConfig(config, secrets) {
 		}
 	};
 }
-//#endregion
-//#region ../../core/client/node-persistence.ts
+// ../../core/client/node-persistence.ts
 async function withClientConfigLock(filePath, action, body) {
 	let entered = false;
 	try {
@@ -5510,25 +5628,44 @@ async function deleteClientConfigStore(filePath, secretStore) {
 		}
 	});
 }
-//#endregion
-//#region ../../core/mcp/remote/node/server.ts
+// ../../core/mcp/remote/node/server.ts
 const SSE_PRIMING_COMMENT = ":\n\n";
 function closeAbortedStream(stream) {
 	stream.close().catch(() => {});
 }
-async function primeAndHoldSseStream(stream, cleanup) {
+async function primeAndHoldSseStream(stream, cleanup, end) {
 	let done = false;
-	const aborted = new Promise((resolve) => {
-		stream.onAbort(() => {
-			if (done) return;
-			done = true;
-			cleanup();
+	const finish = () => {
+		if (done) return false;
+		done = true;
+		cleanup();
+		return true;
+	};
+	const released = new Promise((resolve) => {
+		let closed = false;
+		const release = () => {
+			if (closed) return;
+			closed = true;
 			closeAbortedStream(stream);
 			resolve();
+		};
+		let detachEnd = () => {};
+		stream.onAbort(() => {
+			if (finish()) detachEnd();
+			release();
 		});
+		if (!end) return;
+		const { signal, flush } = end;
+		const onEnd = () => {
+			if (!finish()) return;
+			flush().catch(() => {}).then(release);
+		};
+		detachEnd = () => signal.removeEventListener("abort", onEnd);
+		if (signal.aborted) onEnd();
+		else signal.addEventListener("abort", onEnd, { once: true });
 	});
 	await stream.write(SSE_PRIMING_COMMENT);
-	await aborted;
+	await released;
 }
 const MAX_APP_DOCUMENT_CHARS = 8388608;
 const MAX_APP_DOCUMENT_BODY_BYTES = 25165824;
@@ -5635,11 +5772,27 @@ function mcpParamHeadersOnly(headers) {
 	for (const [key, value] of Object.entries(headers)) if (typeof value === "string" && key.toLowerCase().startsWith("Mcp-Param-".toLowerCase())) out[key] = value;
 	return Object.keys(out).length > 0 ? out : void 0;
 }
+const SESSION_TERMINATED_MESSAGE = "Session terminated from the Inspector's active session list";
+const MAX_SESSION_SERVER_NAME_CHARS = 256;
+function sessionServerName(value) {
+	if (typeof value !== "string") return void 0;
+	const name = value.trim();
+	return name === "" ? void 0 : name.slice(0, MAX_SESSION_SERVER_NAME_CHARS);
+}
 function createRemoteApp(options) {
 	const dangerouslyOmitAuth = !!options.dangerouslyOmitAuth;
 	const authToken = dangerouslyOmitAuth ? "" : options.authToken || process.env[API_SERVER_ENV_VARS.AUTH_TOKEN] || randomBytes(32).toString("hex");
 	const app = new Hono();
 	const sessions = /* @__PURE__ */ new Map();
+	const sessionDetachGraceMs = options.sessionDetachGraceMs ?? RemoteSession.DEFAULT_DETACH_GRACE_MS;
+	const armSessionReap = (session) => {
+		session.armDetachGrace(sessionDetachGraceMs, () => {
+			sessions.delete(session.sessionId);
+			session.rejectActiveRequestWaits(/* @__PURE__ */ new Error("Session closed: no client attached"));
+			const transport = session.transport;
+			terminateSessionBestEffort(transport).then(() => transport.close().catch(() => {}));
+		});
+	};
 	const { logger: fileLogger, allowedOrigins } = options;
 	const storageDir = options.storageDir ?? getDefaultStorageDir();
 	const mcpConfigPath = options.mcpConfigPath ?? getDefaultMcpConfigPath();
@@ -5753,7 +5906,10 @@ function createRemoteApp(options) {
 		const config = body.config;
 		if (!config) return c.json({ error: "Missing config" }, 400);
 		const sessionId = crypto.randomUUID();
-		const session = new RemoteSession(sessionId);
+		const session = new RemoteSession(sessionId, {
+			serverName: sessionServerName(body.serverName),
+			transport: config.type ?? "stdio"
+		});
 		let transport;
 		let authHandle;
 		try {
@@ -5826,6 +5982,7 @@ function createRemoteApp(options) {
 			return c.json({ error: `Failed to start transport: ${msg}` }, is401 ? 401 : 500);
 		}
 		sessions.set(sessionId, session);
+		armSessionReap(session);
 		return c.json({ sessionId });
 	});
 	app.post("/api/mcp/send", async (c) => {
@@ -5916,13 +6073,15 @@ function createRemoteApp(options) {
 		const session = sessions.get(sessionId);
 		if (!session) return c.json({ error: "Session not found" }, 404);
 		return streamSSE(c, async (stream) => {
-			session.setEventConsumer((event) => {
+			let lastWrite = Promise.resolve();
+			const consumer = (event) => {
 				const data = JSON.stringify(event);
-				stream.writeSSE({
+				lastWrite = stream.writeSSE({
 					event: event.type,
 					data
-				});
-			});
+				}).catch(() => {});
+			};
+			session.setEventConsumer(consumer);
 			if (session.isTransportDead()) {
 				await new Promise((resolve) => setTimeout(resolve, 0));
 				session.clearEventConsumer();
@@ -5930,7 +6089,15 @@ function createRemoteApp(options) {
 				return;
 			}
 			await primeAndHoldSseStream(stream, () => {
-				if (session.clearEventConsumer() || session.isTransportDead()) sessions.delete(sessionId);
+				if (!session.detachEventConsumer(consumer)) return;
+				if (session.isTransportDead()) {
+					sessions.delete(sessionId);
+					return;
+				}
+				armSessionReap(session);
+			}, {
+				signal: session.terminatedSignal,
+				flush: () => lastWrite
 			});
 		});
 	});
@@ -5945,12 +6112,30 @@ function createRemoteApp(options) {
 		if (!sessionId) return c.json({ error: "Missing sessionId" }, 400);
 		const session = sessions.get(sessionId);
 		if (session) {
+			session.cancelDetachGrace();
 			session.clearEventConsumer();
+			await terminateSessionBestEffort(session.transport);
 			await session.transport.close();
 			sessions.delete(sessionId);
 		}
 		return c.json({ ok: true });
 	});
+	app.get("/api/mcp/sessions", (c) => {
+		const list = { sessions: [...sessions.values()].map((session) => session.describe()).sort((a, b) => a.createdAt.localeCompare(b.createdAt)) };
+		return c.json(list);
+	});
+	app.delete("/api/mcp/sessions/:sessionId", async (c) => {
+		const sessionId = c.req.param("sessionId");
+		const session = sessions.get(sessionId);
+		if (!session) return c.json({ error: "Session not found" }, 404);
+		sessions.delete(sessionId);
+		session.cancelDetachGrace();
+		session.markTransportDead(SESSION_TERMINATED_MESSAGE);
+		session.terminate();
+		session.rejectActiveRequestWaits(/* @__PURE__ */ new Error(SESSION_TERMINATED_MESSAGE));
+		await session.transport.close().catch(() => {});
+		return c.json({ ok: true });
+	});
 	app.post("/api/mcp/auth-state", async (c) => {
 		let body;
 		try {
@@ -6042,7 +6227,14 @@ function createRemoteApp(options) {
 				timeoutMs: deadlineMs
 			}, 504);
 			const refused = findFetchTargetError(err);
-			if (refused) return c.json({ error: refused.message }, 403);
+			if (refused) {
+				const body = {
+					error: refused.message,
+					code: FETCH_TARGET_REFUSED_WIRE_CODE,
+					url: redactUrlQuery(refused.url ?? url)
+				};
+				return c.json(body, 403);
+			}
 			return c.json({ error: msg }, 500);
 		} finally {
 			if (timer !== void 0) clearTimeout(timer);
@@ -6608,8 +6800,9 @@ function createRemoteApp(options) {
 			const settled = await withWriteLock(async () => {
 				const rawInside = await readStoreFile(mcpConfigPath);
 				if (rawInside === null) {
-					await writeMcpAndTrackMtime(serializeStore(DEFAULT_SEED_CONFIG));
-					return DEFAULT_SEED_CONFIG;
+					const seed = defaultSeedConfig(tmpdir());
+					await writeMcpAndTrackMtime(serializeStore(seed));
+					return seed;
 				}
 				const parsedInside = parseStore(rawInside);
 				const inside = { mcpServers: normalizeMcpServers(parsedInside?.mcpServers) };
@@ -6887,8 +7080,7 @@ function createRemoteApp(options) {
 		}
 	};
 }
-//#endregion
-//#region server/inject-auth-token.ts
+// server/inject-auth-token.ts
 function serializeTokenForScript(token) {
 	return JSON.stringify(token).replace(/</g, "\\u003c");
 }
@@ -6901,8 +7093,7 @@ function injectAuthToken(html, token) {
 	if (bodyClose !== -1) return html.slice(0, bodyClose) + script + html.slice(bodyClose);
 	return script + html;
 }
-//#endregion
-//#region server/health.ts
+// server/health.ts
 const HEALTH_PATH = "/healthz";
 const HEALTH_BODY = Object.freeze({ status: "ok" });
 const HEALTH_HEADERS = Object.freeze({
@@ -6932,8 +7123,7 @@ function handleNodeHealthRequest(req, res) {
 	else res.end(body);
 	return true;
 }
-//#endregion
-//#region server/node-request-bridge.ts
+// server/node-request-bridge.ts
 function fetchUrlForNodeRequest(headers, pathname, scheme) {
 	return `${scheme}://${headers.host ?? headers[":authority"]}${pathname}`;
 }
@@ -6955,8 +7145,7 @@ const CONNECTION_SPECIFIC_HEADERS = /* @__PURE__ */ new Set([
 function isResponseHeaderAllowed(name, httpVersionMajor) {
 	return httpVersionMajor < 2 || !CONNECTION_SPECIFIC_HEADERS.has(name.toLowerCase());
 }
-//#endregion
-//#region server/vite-hono-plugin.ts
+// server/vite-hono-plugin.ts
 function honoMiddlewarePlugin(config) {
 	let resolvedAuthToken = "";
 	return {
@@ -6972,7 +7161,8 @@ function honoMiddlewarePlugin(config) {
 				port: config.sandboxPort,
 				host: config.sandboxHost,
 				allowedOrigins: config.allowedOrigins,
-				publicUrl: config.sandboxPublicUrl
+				publicUrl: config.sandboxPublicUrl,
+				allowedHosts: config.allowedHosts
 			});
 			await sandboxController.start();
 			const appOriginController = createAppOriginController({
@@ -7097,8 +7287,7 @@ function honoMiddlewarePlugin(config) {
 		}
 	};
 }
-//#endregion
-//#region server/vite-base-config.ts
+// server/vite-base-config.ts
 const NODE_ONLY_OPTIMIZE_DEPS_EXCLUDE = [
 	"@modelcontextprotocol/client/stdio",
 	"atomically",
@@ -7241,8 +7430,7 @@ function vitestSharedPaths(clientDir) {
 		}
 	};
 }
-//#endregion
-//#region server/start-vite-dev-server.ts
+// server/start-vite-dev-server.ts
 const __dirname$2 = dirname(fileURLToPath(import.meta.url));
 async function startViteDevServer(config) {
 	const root = resolve(join(__dirname$2, ".."));
@@ -7275,8 +7463,10 @@ async function startViteDevServer(config) {
 		await server.close();
 	} };
 }
-//#endregion
-//#region server/server.ts
+// server/server.ts
+function isApiPath(path) {
+	return path === "/api" || path.startsWith("/api/");
+}
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = dirname(__filename$1);
 async function startHonoServer(config) {
@@ -7284,7 +7474,8 @@ async function startHonoServer(config) {
 		port: config.sandboxPort,
 		host: config.sandboxHost,
 		allowedOrigins: config.allowedOrigins,
-		publicUrl: config.sandboxPublicUrl
+		publicUrl: config.sandboxPublicUrl,
+		allowedHosts: config.allowedHosts
 	});
 	await sandboxController.start();
 	const appOriginController = createAppOriginController({
@@ -7337,7 +7528,7 @@ async function startHonoServer(config) {
 	});
 	app.use("/*", serveStatic({ root: rootPath }));
 	app.get("*", async (c) => {
-		if (c.req.path.startsWith("/api")) return c.notFound();
+		if (isApiPath(c.req.path)) return c.notFound();
 		try {
 			return serveIndexHtml(c);
 		} catch (error) {
@@ -7374,8 +7565,7 @@ async function startHonoServer(config) {
 		});
 	} };
 }
-//#endregion
-//#region server/ensure-web-build.ts
+// server/ensure-web-build.ts
 function runViteBuild(webRoot, log) {
 	const result = spawnSync("npm", ["run", "build:client"], {
 		cwd: webRoot,
@@ -7394,8 +7584,7 @@ function ensureWebBuild(webRoot, distRoot, deps = {}) {
 	log("No production web build found at clients/web/dist. Building the web UI now (first run only; this can take a minute)...");
 	if (build(webRoot, log) !== 0 || !exists(indexHtml)) throw new Error("Could not build the web UI automatically. Build it manually with `npm run build` (run from clients/web), or launch with `--dev` to use the Vite dev server.");
 }
-//#endregion
-//#region server/run-web.ts
+// server/run-web.ts
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function ensureStdioCwd(config) {
 	if ((config.type === "stdio" || config.type === void 0) && config.command && !config.cwd) return {
@@ -7404,14 +7593,6 @@ function ensureStdioCwd(config) {
 	};
 	return config;
 }
-function deriveSeedServerId(config) {
-	if (config.type === "sse" || config.type === "streamable-http") try {
-		return new URL(config.url).host || "server";
-	} catch {
-		return "server";
-	}
-	return config.command?.split(/[\\/]/).pop() || "server";
-}
 async function runWeb(argv) {
 	const program = new Command();
 	const argSeparatorIndex = argv.indexOf("--");
@@ -7487,7 +7668,7 @@ async function runWeb(argv) {
 			headers: opts.header
 		} : { ...config };
 		if (opts.protocolEra !== void 0) entry.protocolEra = opts.protocolEra;
-		initialServers = { mcpServers: { [deriveSeedServerId(config)]: entry } };
+		initialServers = { mcpServers: { [adHocServerName(config)]: entry } };
 		writable = false;
 	} else if (hasHeaders) {
 		console.error("Error: --header requires an ad-hoc --server-url or command target.");
@@ -7532,12 +7713,10 @@ async function runWeb(argv) {
 	process.on("SIGTERM", shutdown);
 	return new Promise(() => {});
 }
-//#endregion
-//#region src/index.ts
+// src/index.ts
 const __filename = fileURLToPath(import.meta.url);
 if (process.argv[1] !== void 0 && resolve(process.argv[1]) === resolve(__filename)) runWeb(process.argv).then((code) => process.exit(code ?? 0)).catch((e) => {
 	console.error(e);
 	process.exit(1);
 });
-//#endregion
 export { runWeb };