@modelcontextprotocol/inspector 2.3.0 → 2.4.0

package/clients/web/dist/index.html

@@ -8,8 +8,8 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Fredoka:wght@300..700&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap" rel="stylesheet" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-CwhDusR3.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CiUpWldH.css">
+    <script type="module" crossorigin src="/assets/index-JCsLrWVa.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DQVN73FG.css">
   </head>
   <body>
     <div id="root"></div>

package/clients/web/static/sandbox_proxy.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8" />
     <meta name="color-scheme" content="light dark" />
-    <!-- Isolation model: the inner iframe is sandboxed WITHOUT
+    <!-- Isolation model: by default the inner iframe is sandboxed WITHOUT
          `allow-same-origin`, so the untrusted app runs under an opaque
          ("null") origin. That is the structural boundary — the app cannot
          touch this proxy's DOM, window, or cookies, so it cannot bypass its
@@ -15,6 +15,18 @@
          resource-ready message's `sandbox` field; `allow-same-origin` is
          always stripped from a server-supplied value.
 
+         Dedicated-origin exception (#2056): an app whose UI resource declares
+         `_meta.ui.domain` is instead served from the host's own app-origin
+         listener, handed to us as the resource-ready message's `src`. That
+         frame IS granted `allow-same-origin` — an opaque origin sends
+         `Origin: null`, which defeats the CORS / OAuth-callback / API-key
+         allowlists the field exists to support. The boundary is preserved by
+         the origin itself rather than by opacity: the listener is on its own
+         port, so the app is cross-origin to this proxy and to the host, and
+         the grant is refused outright if the URL's origin equals this page's.
+         The grant is host-driven — it is never reachable from the server's
+         own `sandbox` string, which is still stripped.
+
          Network/resource egress from the inner document is constrained by a
          Content-Security-Policy that the HOST builds and bakes into the
          delivered HTML before it reaches this proxy (see
@@ -85,13 +97,21 @@
       // This is the origin we expect all parent messages to come from.
       const EXPECTED_HOST_ORIGIN = new URL(document.referrer).origin;
 
-      // The inner iframe is sandboxed without allow-same-origin, so its
-      // document has an opaque origin and every postMessage from it arrives
+      // The inner iframe is sandboxed without allow-same-origin by default, so
+      // its document has an opaque origin and every postMessage from it arrives
       // with event.origin === "null" (the literal string). That value is
       // checked below as a defense-in-depth assertion; the actual identity
       // proof is `event.source === inner.contentWindow`, which a sibling
       // frame cannot forge.
-      const INNER_ORIGIN = "null";
+      //
+      // The dedicated-origin path (#2056) is the one exception: when the host
+      // supplies a `src` on its own app-origin listener, the frame is granted
+      // allow-same-origin so the app has a REAL origin — which is the entire
+      // point, since an opaque origin sends `Origin: null` and defeats any
+      // CORS / OAuth-callback / API-key allowlist the app's backend applies.
+      // `innerOrigin` is then that URL's origin, and the assertion above still
+      // holds against it.
+      let innerOrigin = "null";
 
       // Security self-test: verify iframe isolation is working correctly.
       // This MUST throw a SecurityError -- if `window.top` is accessible, the sandbox
@@ -158,7 +178,47 @@
           }
 
           if (event.data && event.data.method === RESOURCE_READY_NOTIFICATION) {
-            const { html, sandbox, permissions } = event.data.params;
+            const { html, sandbox, permissions, src } = event.data.params;
+            // The host asked for the dedicated-origin path: it published the
+            // wrapped document to its own app-origin listener and is handing
+            // us the URL. Only an absolute http(s) URL is honored — anything
+            // else (a relative path, a `javascript:` or `data:` URL) falls
+            // through to the srcdoc path below rather than being navigated to.
+            let srcUrl = null;
+            if (typeof src === "string") {
+              try {
+                const parsed = new URL(src);
+                if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+                  srcUrl = parsed;
+                } else {
+                  console.warn("[Sandbox] ignoring non-http(s) src:", src);
+                }
+              } catch (e) {
+                console.warn("[Sandbox] ignoring unparseable src:", src);
+              }
+            }
+            // The app origin MUST differ from BOTH trusted origins — this
+            // proxy's own and the Inspector page above it. Granting
+            // allow-same-origin below is what makes the app's origin real, and
+            // an app sharing the proxy's origin would land in this realm
+            // outright; one sharing the HOST's origin is no better, since
+            // same-origin with the top document means direct access to
+            // `window.top`, its DOM and its storage — the cross-origin frame in
+            // between buys nothing once the inner document is same-origin with
+            // the thing it is trying to reach. Either is a host
+            // misconfiguration, not app input, so refuse rather than degrade
+            // quietly.
+            if (
+              srcUrl &&
+              (srcUrl.origin === window.location.origin ||
+                srcUrl.origin === EXPECTED_HOST_ORIGIN)
+            ) {
+              console.error(
+                "[Sandbox] refusing a src on a trusted origin:",
+                srcUrl.origin,
+              );
+              srcUrl = null;
+            }
             if (typeof sandbox === "string") {
               // Never grant allow-same-origin even if the server asks for it —
               // that would let the untrusted app reach this proxy's DOM and
@@ -179,13 +239,42 @@
               }
               inner.setAttribute("sandbox", safeTokens.join(" "));
             }
+            if (srcUrl) {
+              // Re-grant what the strip above removes unconditionally. Safe
+              // here and only here: the document is served from a DIFFERENT
+              // origin than this proxy (asserted above), so same-origin policy
+              // still denies it this realm's DOM — it gains its own origin,
+              // not ours.
+              const tokens = (inner.getAttribute("sandbox") || "")
+                .split(/\s+/)
+                .filter(Boolean);
+              if (!tokens.some((t) => t.toLowerCase() === "allow-same-origin")) {
+                tokens.push("allow-same-origin");
+              }
+              inner.setAttribute("sandbox", tokens.join(" "));
+            }
             // Set Permission Policy allow attribute if permissions are requested
             const allowAttribute = buildAllowAttribute(permissions);
             if (allowAttribute) {
               console.log("[Sandbox] Setting allow attribute:", allowAttribute);
               inner.setAttribute("allow", allowAttribute);
             }
-            if (typeof html === "string") {
+            if (srcUrl) {
+              // Navigate to the host's app-origin URL. The per-app CSP is
+              // delivered as a real response header there (stronger than the
+              // <meta> the srcdoc path relies on), so no wrapping applies here
+              // — this proxy still never parses the untrusted bytes.
+              //
+              // Drop any `srcdoc` a previous render left behind first: it takes
+              // precedence over `src`, so a frame that had rendered an opaque
+              // document would keep showing it and never load this URL. Not
+              // reachable today (each render remounts the iframe, which reloads
+              // this document), but the cost of being wrong about that later is
+              // an app silently rendering the wrong bytes.
+              inner.removeAttribute("srcdoc");
+              innerOrigin = srcUrl.origin;
+              inner.src = srcUrl.href;
+            } else if (typeof html === "string") {
               // The host has already wrapped the app's HTML in a fixed shell
               // whose first <head> child is the CSP <meta>; assign it verbatim.
               // srcdoc is the only delivery path that works without
@@ -194,11 +283,34 @@
               // boundary). Known trade-off: a small set of libraries (e.g.
               // CesiumJS Map) don't initialise correctly under srcdoc — that
               // is accepted in exchange for the isolation guarantee.
+              //
+              // Restore the opaque-origin posture first. A frame that
+              // previously took the dedicated-origin path still carries
+              // `allow-same-origin`, and `innerOrigin` still names that origin;
+              // assigning `srcdoc` under those would put the untrusted document
+              // in THIS proxy's realm — the exact escape the double-iframe
+              // model exists to prevent. The sandbox attribute is read at
+              // navigation time and assigning `srcdoc` is the navigation, so
+              // stripping it here takes effect for the document being loaded.
+              const fallbackTokens = (inner.getAttribute("sandbox") || "")
+                .split(/\s+/)
+                .filter((t) => t && t.toLowerCase() !== "allow-same-origin");
+              inner.setAttribute("sandbox", fallbackTokens.join(" "));
+              innerOrigin = "null";
               inner.srcdoc = html;
             }
           } else {
             if (inner && inner.contentWindow) {
-              inner.contentWindow.postMessage(event.data, "*");
+              // Target the inner frame's real origin on the dedicated-origin
+              // path, so a frame that navigated itself elsewhere stops
+              // receiving host messages. The opaque default has no targetable
+              // origin ("null" is not a valid targetOrigin), so it keeps "*" —
+              // safe there because the frame is `srcdoc` and cannot navigate
+              // to another origin's document without allow-top-navigation.
+              inner.contentWindow.postMessage(
+                event.data,
+                innerOrigin === "null" ? "*" : innerOrigin,
+              );
             }
           }
         } else if (event.source === inner.contentWindow) {
@@ -207,12 +319,12 @@
           // sandbox means its origin serialises as the literal string "null";
           // assert that as defense-in-depth so a future change that
           // accidentally re-grants allow-same-origin is caught here.
-          if (event.origin !== INNER_ORIGIN) {
+          if (event.origin !== innerOrigin) {
             console.error(
               "[Sandbox] Rejecting message from inner iframe with unexpected origin:",
               event.origin,
-              "expected opaque:",
-              INNER_ORIGIN,
+              "expected:",
+              innerOrigin,
             );
             return;
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "The Model Context Protocol Inspector",
   "keywords": [
     "MCP",
@@ -38,17 +38,18 @@
     "build:tui": "cd clients/tui && npm run build",
     "build:web": "cd clients/web && npm run build",
     "build:launcher": "cd clients/launcher && npm run build",
-    "ci": "npm run validate && npm run coverage && npm run verify:build-gate && npm run smoke && npm run ci:storybook",
+    "ci": "npm run validate && npm run coverage && npm run verify:build-gate && npm run verify:bundle-externals && npm run smoke && npm run ci:storybook",
     "ci:storybook": "cd clients/web && npx playwright install chromium && npm run test:storybook",
     "verify:build-gate": "node scripts/verify-build-gate.mjs",
+    "verify:bundle-externals": "node scripts/verify-bundle-externals.mjs",
     "verify:typecheck-coverage": "node scripts/verify-typecheck-coverage.mjs",
     "test:scripts": "node --test \"scripts/**/*.test.mjs\"",
     "validate": "npm run verify:format-coverage && npm run verify:typecheck-coverage && npm run verify:dep-lockstep && npm run test:scripts && npm run validate:core && npm run validate:web && npm run validate:cli && npm run validate:tui && npm run validate:launcher",
     "verify:format-coverage": "node scripts/verify-format-coverage.mjs",
     "verify:dep-lockstep": "node scripts/verify-dep-lockstep.mjs",
     "validate:core": "npm run format:check:core && npm run format:check:scripts && npm run format:check:shared && npm run lint:core && npm run lint:shared",
-    "lint:core": "eslint \"core/**/*.{ts,tsx}\"",
-    "lint:shared": "eslint \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js",
+    "lint:core": "eslint \"core/**/*.{ts,tsx}\" --max-warnings 0",
+    "lint:shared": "eslint \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js --max-warnings 0",
     "format:core": "prettier --write \"core/**/*.{ts,tsx}\"",
     "format:check:core": "prettier --check \"core/**/*.{ts,tsx}\"",
     "format:scripts": "prettier --write \"scripts/**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
@@ -65,14 +66,15 @@
     "coverage:tui": "cd clients/tui && npm run test:coverage",
     "coverage:web": "cd clients/web && npm run test:coverage",
     "coverage:launcher": "cd clients/launcher && npm run test:coverage",
-    "smoke": "npm run smoke:launcher && npm run smoke:cli && npm run smoke:tui && npm run smoke:web && npm run smoke:web:browser && npm run smoke:web:app",
+    "smoke": "npm run smoke:launcher && npm run smoke:cli && npm run smoke:tui && npm run smoke:web && npm run smoke:web:browser && npm run smoke:web:app && npm run smoke:web:elicit",
     "smoke:cli": "node scripts/smoke-cli.mjs",
     "smoke:tui": "node scripts/smoke-tui.mjs",
     "smoke:web": "node scripts/smoke-web.mjs",
     "smoke:web:browser": "cd clients/web && npx playwright install chromium && node ../../scripts/smoke-web-browser.mjs",
     "smoke:web:app": "cd clients/web && npx playwright install chromium && node ../../scripts/smoke-web-app.mjs",
+    "smoke:web:elicit": "cd clients/web && npx playwright install chromium && node ../../scripts/smoke-web-elicitation.mjs",
     "smoke:launcher": "node scripts/smoke-launcher.mjs",
-    "pack:verify": "node scripts/pack-and-verify.mjs",
+    "pack:verify": "cd clients/web && npx playwright install chromium && cd ../.. && node scripts/pack-and-verify.mjs",
     "prepack": "npm run build",
     "postinstall": "node scripts/install-clients.mjs"
   },
@@ -93,6 +95,7 @@
     "ink": "^6.0.0",
     "open": "^10.2.0",
     "pino": "^9.14.0",
+    "proper-lockfile": "^4.1.2",
     "react": "^19.0.0",
     "undici": "^8.5.0",
     "vite": "^8.1.5",
@@ -104,6 +107,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
+    "@types/proper-lockfile": "^4.1.4",
     "eslint": "^10.8.0",
     "express": "^5.2.1",
     "globals": "^17.7.0",

package/clients/tui/build/chunk-MCKGQKYU.js

@@ -1,15 +0,0 @@
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-
-export {
-  __require,
-  __commonJS
-};