@modelcontextprotocol/inspector 2.4.0 → 2.6.0

package/clients/web/build/index.js

@@ -348,6 +348,9 @@ function storedFieldsToInspectorSettings(stored) {
   if (stored.oauth?.requestRefreshToken === false) {
     settings.oauthRequestRefreshToken = false;
   }
+  if (stored.oauth?.revokeOnClear === false) {
+    settings.oauthRevokeOnClear = false;
+  }
   if (stored.cwd) settings.cwd = stored.cwd;
   return settings;
 }
@@ -417,6 +420,9 @@ function inspectorSettingsToStoredFields(settings) {
   if (settings.oauthRequestRefreshToken === false) {
     oauthFields.requestRefreshToken = false;
   }
+  if (settings.oauthRevokeOnClear === false) {
+    oauthFields.revokeOnClear = false;
+  }
   if (Object.keys(oauthFields).length > 0) {
     out.oauth = oauthFields;
   }
@@ -511,6 +517,7 @@ function expectedSecretFields(stored) {
   }
   return fields;
 }
+var EXAMPLE_SERVER_URL = "https://example-server.modelcontextprotocol.io/mcp";
 var DEFAULT_SEED_CONFIG = {
   mcpServers: {
     "filesystem-server-default": {
@@ -522,6 +529,10 @@ var DEFAULT_SEED_CONFIG = {
       type: "stdio",
       command: "npx",
       args: ["-y", "@modelcontextprotocol/server-everything"]
+    },
+    "example-server-default": {
+      type: "streamable-http",
+      url: EXAMPLE_SERVER_URL
     }
   }
 };
@@ -4489,11 +4500,27 @@ function createRemoteApp(options) {
       void responseWait.catch(() => {
       });
     }
+    const upstreamAbort = new AbortController();
+    const clientSignal = c.req.raw.signal;
+    const onClientDisconnect = () => {
+      upstreamAbort.abort(clientSignal.reason);
+      if (requestId !== void 0) {
+        session.cancelRequestWait(requestId);
+      }
+    };
+    if (clientSignal.aborted) {
+      onClientDisconnect();
+    } else {
+      clientSignal.addEventListener("abort", onClientDisconnect, {
+        once: true
+      });
+    }
     try {
       const paramHeaders = mcpParamHeadersOnly(headers);
       await session.transport.send(message, {
         relatedRequestId,
-        ...paramHeaders && { headers: paramHeaders }
+        ...paramHeaders && { headers: paramHeaders },
+        requestSignal: upstreamAbort.signal
       });
       if (responseWait) {
         await responseWait;
@@ -4514,6 +4541,7 @@ function createRemoteApp(options) {
       const msg = err instanceof Error ? err.message : String(err);
       return c.json({ ok: false, kind: "transport_error", error: msg });
     } finally {
+      clientSignal.removeEventListener("abort", onClientDisconnect);
       session.endSend();
     }
   });
@@ -4755,6 +4783,9 @@ function createRemoteApp(options) {
     if (o.requestRefreshToken !== void 0 && typeof o.requestRefreshToken !== "boolean") {
       return false;
     }
+    if (o.revokeOnClear !== void 0 && typeof o.revokeOnClear !== "boolean") {
+      return false;
+    }
     return true;
   };
   const isRootArray = (v) => {
@@ -4826,7 +4857,7 @@ function createRemoteApp(options) {
       if ("oauth" in valObj && !isOauthObject(valObj.oauth)) {
         logWarn(
           { route: "/api/servers", id, droppedKey: "oauth" },
-          "Dropping malformed `oauth` field \u2014 expected `{ clientId?, clientSecret?, scopes?, authorizationParams?, authorizationUrl?, tokenUrl?, enterpriseManaged?, onInsufficientScope?, requestRefreshToken? }`."
+          "Dropping malformed `oauth` field \u2014 expected `{ clientId?, clientSecret?, scopes?, authorizationParams?, authorizationUrl?, tokenUrl?, enterpriseManaged?, onInsufficientScope?, requestRefreshToken?, revokeOnClear? }`."
         );
         delete valObj.oauth;
       }
@@ -5010,6 +5041,12 @@ function createRemoteApp(options) {
         error: "settings.oauthRequestRefreshToken must be a boolean"
       };
     }
+    if (obj.oauthRevokeOnClear !== void 0 && typeof obj.oauthRevokeOnClear !== "boolean") {
+      return {
+        ok: false,
+        error: "settings.oauthRevokeOnClear must be a boolean"
+      };
+    }
     if (obj.oauthOnInsufficientScope !== void 0 && obj.oauthOnInsufficientScope !== "reauthorize" && obj.oauthOnInsufficientScope !== "throw") {
       return {
         ok: false,
@@ -5092,6 +5129,9 @@ function createRemoteApp(options) {
     if (obj.oauthRequestRefreshToken === false) {
       value.oauthRequestRefreshToken = false;
     }
+    if (obj.oauthRevokeOnClear === false) {
+      value.oauthRevokeOnClear = false;
+    }
     if (obj.oauthOnInsufficientScope === "reauthorize" || obj.oauthOnInsufficientScope === "throw") {
       value.oauthOnInsufficientScope = obj.oauthOnInsufficientScope;
     }
@@ -5864,7 +5904,11 @@ function vitestSharedPaths(clientDir) {
     "react",
     "react-dom",
     "@modelcontextprotocol/client",
-    "@modelcontextprotocol/core"
+    "@modelcontextprotocol/core",
+    // Every SDK schema is a zod type, so a second copy breaks `instanceof`
+    // across the whole surface. The alias below picks the install; this keeps
+    // it to one copy within it.
+    "zod"
   ];
   const nodeModulesAliases = [
     {
@@ -5890,67 +5934,123 @@ function vitestSharedPaths(clientDir) {
       find: /^react-dom\/client$/,
       replacement: path5.resolve(dirname10, "node_modules/react-dom/client.js")
     },
-    { find: /^pino$/, replacement: path5.resolve(dirname10, "node_modules/pino") },
+    // Everything below is **root-owned** and resolves from the repo root,
+    // unlike the `react` / `react-dom` pins above. What they have in common is
+    // that no client declares them, so the root install is the only place a
+    // client's resolution chain is guaranteed to find one — not that they are
+    // all root `dependencies`: `express` is test-only and sits in the root
+    // `devDependencies`. Nor is this the complete root runtime set; a package
+    // no client install carries a copy of (`ajv`, `commander`, `undici`)
+    // resolves to the root on its own and needs no pin. Absence from this list
+    // is a statement about the installed tree, not about the manifests — check
+    // the tree before adding or removing an entry.
+    //
+    // `express` is reached only through `test-servers/src` (the http/oauth
+    // servers), which is root-owned code with no manifest of its own.
+    //
+    // `yaml` was too — `load-config.ts` — but is now also a `core/` runtime
+    // import: `core/mcp/skillFile.ts` parses a served SKILL.md's frontmatter
+    // for the SEP-2640 cross-check (#2248). That matters to anyone revisiting
+    // this pin: it is no longer removable by retiring a test-server path, and
+    // as a dependency `core/` imports it is additionally named in all three
+    // bundler `external` lists.
+    //
+    // Pointing these at `<client>/node_modules` is what broke when the MCP
+    // packages moved to the root (#1970): express was never declared by a client
+    // at all, it arrived in `clients/cli` as a peer of `express-rate-limit`
+    // under `@modelcontextprotocol/server-legacy`, so removing that manifest
+    // entry took express with it and every cli test that spawns a test server
+    // failed to resolve it.
+    {
+      find: /^express$/,
+      replacement: path5.resolve(repoRoot, "node_modules/express")
+    },
+    {
+      find: /^yaml$/,
+      replacement: path5.resolve(repoRoot, "node_modules/yaml")
+    },
+    // Same reasoning, one layer in: `proper-lockfile` is reached only through
+    // `core/` (the secrets file's cross-process lock, #2082), which is the
+    // other root-owned tree with no manifest of its own. Resolution finds the
+    // root copy on its own today — nothing declares it in a client — and this
+    // pin is what keeps that from depending on nothing ever arriving as some
+    // client's transitive dependency, which would otherwise give a test two
+    // copies of a module whose whole job is a single registry of held locks.
+    {
+      find: /^proper-lockfile$/,
+      replacement: path5.resolve(repoRoot, "node_modules/proper-lockfile")
+    },
+    // The rest of the root-owned aliases, consolidated into the root manifest
+    // by #2195. Mostly `core/`'s runtime dependencies, but not only —
+    // `@hono/node-server` is reached from web client code alone and is here for
+    // the same resolution reason rather than because `core/` imports it. Each
+    // used to be declared by the clients that reached it and was pinned to
+    // `<client>/node_modules` accordingly; once the declarations went away
+    // those paths stopped existing, so the pin has to follow the package to
+    // the root. Left un-repointed they would resolve
+    // to a directory that is not there — or, worse, to a transitive copy some
+    // unrelated dependency happened to drag in, which is the duplicate this
+    // whole pin list exists to prevent.
+    {
+      find: /^pino$/,
+      replacement: path5.resolve(repoRoot, "node_modules/pino")
+    },
     {
       find: /^pino\/browser\.js$/,
-      replacement: path5.resolve(dirname10, "node_modules/pino/browser.js")
+      replacement: path5.resolve(repoRoot, "node_modules/pino/browser.js")
     },
     {
       find: /^hono$/,
-      replacement: path5.resolve(dirname10, "node_modules/hono/dist/index.js")
+      replacement: path5.resolve(repoRoot, "node_modules/hono/dist/index.js")
     },
     {
       find: /^hono\/streaming$/,
       replacement: path5.resolve(
-        dirname10,
+        repoRoot,
         "node_modules/hono/dist/helper/streaming/index.js"
       )
     },
     {
       find: /^@hono\/node-server$/,
-      replacement: path5.resolve(dirname10, "node_modules/@hono/node-server")
+      replacement: path5.resolve(repoRoot, "node_modules/@hono/node-server")
     },
     {
       find: /^atomically$/,
-      replacement: path5.resolve(dirname10, "node_modules/atomically")
+      replacement: path5.resolve(repoRoot, "node_modules/atomically")
     },
     {
       find: /^chokidar$/,
-      replacement: path5.resolve(dirname10, "node_modules/chokidar")
+      replacement: path5.resolve(repoRoot, "node_modules/chokidar")
     },
     {
       find: /^@napi-rs\/keyring$/,
-      replacement: path5.resolve(dirname10, "node_modules/@napi-rs/keyring")
-    },
-    // `express` and `yaml` resolve from the **repo root**, unlike every pin
-    // above. Both are reached only through `test-servers/src` — express by the
-    // http/oauth servers, yaml by `load-config.ts` — which is root-owned code
-    // with no manifest of its own, so the root is where they are declared and
-    // the only place a client's resolution chain is guaranteed to find them.
-    // Pointing these at `<client>/node_modules` is what broke when the MCP
-    // packages moved to the root (#1970): express was never declared by a client
-    // at all, it arrived in `clients/cli` as a peer of `express-rate-limit`
-    // under `@modelcontextprotocol/server-legacy`, so removing that manifest
-    // entry took express with it and every cli test that spawns a test server
-    // failed to resolve it.
-    {
-      find: /^express$/,
-      replacement: path5.resolve(repoRoot, "node_modules/express")
+      replacement: path5.resolve(repoRoot, "node_modules/@napi-rs/keyring")
     },
+    // `zod` and `open` are pinned for a different reason from everything above:
+    // they resolve *somewhere* without help, and the somewhere is wrong. Both
+    // still sit at the top level of `clients/web/node_modules` as transitive
+    // copies — zod under `eslint-plugin-react-hooks`, open under Storybook —
+    // so an unpinned bare import from a web test resolves the client copy while
+    // `core/` and the SDK packages resolve the root's (Copilot).
+    //
+    // For `open` that is merely wasteful. For `zod` it is the hazard this file
+    // exists for: two copies in one process means a schema built by one and an
+    // `instanceof` check made by the other, across the entire
+    // `@modelcontextprotocol/*` surface. The versions are identical today and
+    // `verify:dep-lockstep` is what keeps them that way, but identical is not
+    // the same as single, and only a pin makes it single.
+    //
+    // `zod/v4` needs its own entry — first-party code imports both specifiers,
+    // and pinning only the bare one would split the package across two installs
+    // rather than collapse it.
+    { find: /^zod$/, replacement: path5.resolve(repoRoot, "node_modules/zod") },
     {
-      find: /^yaml$/,
-      replacement: path5.resolve(repoRoot, "node_modules/yaml")
+      find: /^zod\/v4$/,
+      replacement: path5.resolve(repoRoot, "node_modules/zod/v4/index.js")
     },
-    // Same reasoning, one layer in: `proper-lockfile` is reached only through
-    // `core/` (the secrets file's cross-process lock, #2082), which is the
-    // other root-owned tree with no manifest of its own. Resolution finds the
-    // root copy on its own today — nothing declares it in a client — and this
-    // pin is what keeps that from depending on nothing ever arriving as some
-    // client's transitive dependency, which would otherwise give a test two
-    // copies of a module whose whole job is a single registry of held locks.
     {
-      find: /^proper-lockfile$/,
-      replacement: path5.resolve(repoRoot, "node_modules/proper-lockfile")
+      find: /^open$/,
+      replacement: path5.resolve(repoRoot, "node_modules/open")
     }
   ];
   const projectResolve = {