@modelcontextprotocol/inspector 2.6.0 → 2.7.0

package/clients/web/dist/assets/{prism-light-9SaQe5zv.js → prism-light-CoQfbOXL.js}

@@ -1,4 +1,4 @@
-import{a as e,c as t,d as n,i as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./index-30pI79Cf.js";function d(e,n){if(e==null)return{};var r,i,a=t(e,n);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)r=o[i],n.indexOf(r)===-1&&{}.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}function f(e,t){(t==null||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function p(e){if(Array.isArray(e))return f(e)}function m(e){if(typeof Symbol<`u`&&e[Symbol.iterator]!=null||e[`@@iterator`]!=null)return Array.from(e)}function h(e,t){if(e){if(typeof e==`string`)return f(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name),n===`Map`||n===`Set`?Array.from(e):n===`Arguments`||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?f(e,t):void 0}}function g(){throw TypeError(`Invalid attempt to spread non-iterable instance.
+import{a as e,c as t,d as n,i as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./index-DZkZ6KYt.js";function d(e,n){if(e==null)return{};var r,i,a=t(e,n);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(i=0;i<o.length;i++)r=o[i],n.indexOf(r)===-1&&{}.propertyIsEnumerable.call(e,r)&&(a[r]=e[r])}return a}function f(e,t){(t==null||t>e.length)&&(t=e.length);for(var n=0,r=Array(t);n<t;n++)r[n]=e[n];return r}function p(e){if(Array.isArray(e))return f(e)}function m(e){if(typeof Symbol<`u`&&e[Symbol.iterator]!=null||e[`@@iterator`]!=null)return Array.from(e)}function h(e,t){if(e){if(typeof e==`string`)return f(e,t);var n={}.toString.call(e).slice(8,-1);return n===`Object`&&e.constructor&&(n=e.constructor.name),n===`Map`||n===`Set`?Array.from(e):n===`Arguments`||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?f(e,t):void 0}}function g(){throw TypeError(`Invalid attempt to spread non-iterable instance.
 In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)}function _(e){return p(e)||m(e)||h(e)||g()}function v(e){"@babel/helpers - typeof";return v=typeof Symbol==`function`&&typeof Symbol.iterator==`symbol`?function(e){return typeof e}:function(e){return e&&typeof Symbol==`function`&&e.constructor===Symbol&&e!==Symbol.prototype?`symbol`:typeof e},v(e)}function y(e,t){if(v(e)!=`object`||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t||`default`);if(v(r)!=`object`)return r;throw TypeError(`@@toPrimitive must return a primitive value.`)}return(t===`string`?String:Number)(e)}function b(e){var t=y(e,`string`);return v(t)==`symbol`?t:t+``}function x(e,t,n){return(t=b(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var S=n(u());function C(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function w(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?C(Object(n),!0).forEach(function(t){x(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):C(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}function T(e){var t=e.length;if(t===0||t===1)return e;if(t===2)return[e[0],e[1],`${e[0]}.${e[1]}`,`${e[1]}.${e[0]}`];if(t===3)return[e[0],e[1],e[2],`${e[0]}.${e[1]}`,`${e[0]}.${e[2]}`,`${e[1]}.${e[0]}`,`${e[1]}.${e[2]}`,`${e[2]}.${e[0]}`,`${e[2]}.${e[1]}`,`${e[0]}.${e[1]}.${e[2]}`,`${e[0]}.${e[2]}.${e[1]}`,`${e[1]}.${e[0]}.${e[2]}`,`${e[1]}.${e[2]}.${e[0]}`,`${e[2]}.${e[0]}.${e[1]}`,`${e[2]}.${e[1]}.${e[0]}`];if(t>=4)return[e[0],e[1],e[2],e[3],`${e[0]}.${e[1]}`,`${e[0]}.${e[2]}`,`${e[0]}.${e[3]}`,`${e[1]}.${e[0]}`,`${e[1]}.${e[2]}`,`${e[1]}.${e[3]}`,`${e[2]}.${e[0]}`,`${e[2]}.${e[1]}`,`${e[2]}.${e[3]}`,`${e[3]}.${e[0]}`,`${e[3]}.${e[1]}`,`${e[3]}.${e[2]}`,`${e[0]}.${e[1]}.${e[2]}`,`${e[0]}.${e[1]}.${e[3]}`,`${e[0]}.${e[2]}.${e[1]}`,`${e[0]}.${e[2]}.${e[3]}`,`${e[0]}.${e[3]}.${e[1]}`,`${e[0]}.${e[3]}.${e[2]}`,`${e[1]}.${e[0]}.${e[2]}`,`${e[1]}.${e[0]}.${e[3]}`,`${e[1]}.${e[2]}.${e[0]}`,`${e[1]}.${e[2]}.${e[3]}`,`${e[1]}.${e[3]}.${e[0]}`,`${e[1]}.${e[3]}.${e[2]}`,`${e[2]}.${e[0]}.${e[1]}`,`${e[2]}.${e[0]}.${e[3]}`,`${e[2]}.${e[1]}.${e[0]}`,`${e[2]}.${e[1]}.${e[3]}`,`${e[2]}.${e[3]}.${e[0]}`,`${e[2]}.${e[3]}.${e[1]}`,`${e[3]}.${e[0]}.${e[1]}`,`${e[3]}.${e[0]}.${e[2]}`,`${e[3]}.${e[1]}.${e[0]}`,`${e[3]}.${e[1]}.${e[2]}`,`${e[3]}.${e[2]}.${e[0]}`,`${e[3]}.${e[2]}.${e[1]}`,`${e[0]}.${e[1]}.${e[2]}.${e[3]}`,`${e[0]}.${e[1]}.${e[3]}.${e[2]}`,`${e[0]}.${e[2]}.${e[1]}.${e[3]}`,`${e[0]}.${e[2]}.${e[3]}.${e[1]}`,`${e[0]}.${e[3]}.${e[1]}.${e[2]}`,`${e[0]}.${e[3]}.${e[2]}.${e[1]}`,`${e[1]}.${e[0]}.${e[2]}.${e[3]}`,`${e[1]}.${e[0]}.${e[3]}.${e[2]}`,`${e[1]}.${e[2]}.${e[0]}.${e[3]}`,`${e[1]}.${e[2]}.${e[3]}.${e[0]}`,`${e[1]}.${e[3]}.${e[0]}.${e[2]}`,`${e[1]}.${e[3]}.${e[2]}.${e[0]}`,`${e[2]}.${e[0]}.${e[1]}.${e[3]}`,`${e[2]}.${e[0]}.${e[3]}.${e[1]}`,`${e[2]}.${e[1]}.${e[0]}.${e[3]}`,`${e[2]}.${e[1]}.${e[3]}.${e[0]}`,`${e[2]}.${e[3]}.${e[0]}.${e[1]}`,`${e[2]}.${e[3]}.${e[1]}.${e[0]}`,`${e[3]}.${e[0]}.${e[1]}.${e[2]}`,`${e[3]}.${e[0]}.${e[2]}.${e[1]}`,`${e[3]}.${e[1]}.${e[0]}.${e[2]}`,`${e[3]}.${e[1]}.${e[2]}.${e[0]}`,`${e[3]}.${e[2]}.${e[0]}.${e[1]}`,`${e[3]}.${e[2]}.${e[1]}.${e[0]}`]}var E={};function D(e){if(e.length===0||e.length===1)return e;var t=e.join(`.`);return E[t]||(E[t]=T(e)),E[t]}function O(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},n=arguments.length>2?arguments[2]:void 0;return D(e.filter(function(e){return e!==`token`})).reduce(function(e,t){return w(w({},e),n[t])},t)}function k(e){return e.join(` `)}function A(e,t){var n=0;return function(r){return n+=1,r.map(function(r,i){return j({node:r,stylesheet:e,useInlineStyles:t,key:`code-segment-${n}-${i}`})})}}function j(e){var t=e.node,n=e.stylesheet,r=e.style,a=r===void 0?{}:r,o=e.useInlineStyles,s=e.key,c=t.properties,l=t.type,u=t.tagName,d=t.value;if(l===`text`)return d;if(u){var f=A(n,o),p;if(!o)p=w(w({},c),{},{className:k(c.className)});else{var m=Object.keys(n).reduce(function(e,t){return t.split(`.`).forEach(function(t){e.includes(t)||e.push(t)}),e},[]),h=c.className&&c.className.includes(`token`)?[`token`]:[],g=c.className&&h.concat(c.className.filter(function(e){return!m.includes(e)}));p=w(w({},c),{},{className:k(g)||void 0,style:O(c.className,Object.assign({},c.style,a),n)})}var _=f(t.children);return S.createElement(u,i({key:s},p),_)}}var M=(function(e,t){return e.listLanguages().indexOf(t)!==-1}),ee=[`language`,`children`,`style`,`customStyle`,`codeTagProps`,`useInlineStyles`,`showLineNumbers`,`showInlineLineNumbers`,`startingLineNumber`,`lineNumberContainerStyle`,`lineNumberStyle`,`wrapLines`,`wrapLongLines`,`lineProps`,`renderer`,`PreTag`,`CodeTag`,`code`,`astGenerator`];function N(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter(function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable})),n.push.apply(n,r)}return n}function P(e){for(var t=1;t<arguments.length;t++){var n=arguments[t]==null?{}:arguments[t];t%2?N(Object(n),!0).forEach(function(t){x(e,t,n[t])}):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):N(Object(n)).forEach(function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))})}return e}var F=/\n/g;function I(e){return e.match(F)}function L(e){var t=e.lines,n=e.startingLineNumber,r=e.style;return t.map(function(e,t){var i=t+n;return S.createElement(`span`,{key:`line-${t}`,className:`react-syntax-highlighter-line-number`,style:typeof r==`function`?r(i):r},`${i}
 `)})}function te(e){var t=e.codeString,n=e.codeStyle,r=e.containerStyle,i=r===void 0?{float:`left`,paddingRight:`10px`}:r,a=e.numberStyle,o=a===void 0?{}:a,s=e.startingLineNumber;return S.createElement(`code`,{style:Object.assign({},n,i)},L({lines:t.replace(/\n$/,``).split(`
 `),style:o,startingLineNumber:s}))}function R(e){return`${e.toString().length}.25em`}function z(e,t){return{type:`element`,tagName:`span`,properties:{key:`line-number--${e}`,className:[`comment`,`linenumber`,`react-syntax-highlighter-line-number`],style:t},children:[{type:`text`,value:e}]}}function B(e,t,n){var r={display:`inline-block`,minWidth:R(n),paddingRight:`1em`,textAlign:`right`,userSelect:`none`},i=typeof e==`function`?e(t):e;return P(P({},r),i)}function V(e){var t=e.children,n=e.lineNumber,r=e.lineNumberStyle,i=e.largestLineNumber,a=e.showInlineLineNumbers,o=e.lineProps,s=o===void 0?{}:o,c=e.className,l=c===void 0?[]:c,u=e.showLineNumbers,d=e.wrapLongLines,f=e.wrapLines,p=f!==void 0&&f?P({},typeof s==`function`?s(n):s):{};if(p.className=p.className?[].concat(_(p.className.trim().split(/\s+/)),_(l)):l,n&&a){var m=B(r,n,i);t.unshift(z(n,m))}return d&u&&(p.style=P({display:`flex`},p.style)),{type:`element`,tagName:`span`,properties:p,children:t}}function H(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:[],n=arguments.length>2&&arguments[2]!==void 0?arguments[2]:[];e.length===void 0&&(e=[e]);for(var r=0;r<e.length;r++){var i=e[r];if(i.type===`text`)n.push(V({children:[i],className:_(new Set(t))}));else if(i.children){var a=t.concat(i.properties?.className||[]);H(i.children,a).forEach(function(e){return n.push(e)})}}return n}function ne(e,t,n,r,i,a,o,s,c){var l,u=H(e.value),d=[],f=-1,p=0;function m(e,a){return V({children:e,lineNumber:a,lineNumberStyle:s,largestLineNumber:o,showInlineLineNumbers:i,lineProps:n,className:arguments.length>2&&arguments[2]!==void 0?arguments[2]:[],showLineNumbers:r,wrapLongLines:c,wrapLines:t})}function h(e,t){if(r&&t&&i){var n=B(s,t,o);e.unshift(z(t,n))}return e}function g(e,n){var r=arguments.length>2&&arguments[2]!==void 0?arguments[2]:[];return t||r.length>0?m(e,n,r):h(e,n)}for(var _=function(){var e=u[p],t=e.children[0].value;if(I(t)){var n=t.split(`

package/clients/web/dist/index.html

@@ -8,7 +8,7 @@
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Fredoka:wght@300..700&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap" rel="stylesheet" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-30pI79Cf.js"></script>
+    <script type="module" crossorigin src="/assets/index-DZkZ6KYt.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-dqp8Sd8W.css">
   </head>
   <body>

package/clients/web/static/sandbox_proxy.html

@@ -76,8 +76,19 @@
         return allowList.join("; ");
       }
 
-      const ALLOWED_REFERRER_PATTERN =
-        /^http:\/\/(localhost|127\.0\.0\.1)(:|\/|$)/;
+      // The exact embedder origins this proxy accepts, injected by the sandbox
+      // controller when it serves this page (see `embedderOriginsLiteral` in
+      // server/sandbox-controller.ts). It is the same list the served
+      // `frame-ancestors` header admits, so the two checks agree by
+      // construction — an https or public-hostname Inspector page is accepted
+      // exactly when the backend's ALLOWED_ORIGINS names it (#1862).
+      //
+      // `null` means the controller had no valid list (a hand-constructed
+      // caller or a test); the header then falls back to the loopback family,
+      // and so does this check.
+      const ALLOWED_EMBEDDER_ORIGINS = /*INSPECTOR_EMBEDDER_ORIGINS*/ null;
+      const LOOPBACK_EMBEDDER_PATTERN =
+        /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/;
 
       if (window.self === window.top) {
         throw new Error("This file is only to be used in an iframe sandbox.");
@@ -87,9 +98,24 @@
         throw new Error("No referrer, cannot validate embedding site.");
       }
 
-      if (!document.referrer.match(ALLOWED_REFERRER_PATTERN)) {
+      // Compare the referrer's parsed ORIGIN, never the raw string: a pattern
+      // over the full referrer is a prefix/substring match an attacker page's
+      // path or query can be shaped to satisfy.
+      let referrerOrigin = null;
+      try {
+        referrerOrigin = new URL(document.referrer).origin;
+      } catch (e) {
+        referrerOrigin = null;
+      }
+
+      if (
+        !referrerOrigin ||
+        !(Array.isArray(ALLOWED_EMBEDDER_ORIGINS)
+          ? ALLOWED_EMBEDDER_ORIGINS.includes(referrerOrigin)
+          : LOOPBACK_EMBEDDER_PATTERN.test(referrerOrigin))
+      ) {
         throw new Error(
-          `Embedding domain not allowed in referrer ${document.referrer}. (Consider updating the validation logic to allow your domain.)`,
+          `Embedding origin ${referrerOrigin} is not allowed to load the MCP Apps sandbox. Add it to the Inspector's ALLOWED_ORIGINS (e.g. ALLOWED_ORIGINS=https://inspector.example.com) and restart.`,
         );
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "The Model Context Protocol Inspector",
   "keywords": [
     "MCP",
@@ -38,7 +38,9 @@
     "build:tui": "cd clients/tui && npm run build",
     "build:web": "cd clients/web && npm run build",
     "build:launcher": "cd clients/launcher && npm run build",
-    "local:gate": "npm run validate && npm run verify:skills:cli && npm run coverage && npm run verify:build-gate && npm run verify:bundle-externals && npm run smoke && npm run smoke:web:firefox && npm run local:storybook",
+    "local:gate": "node scripts/gate-lease.mjs npm run local:gate:stages",
+    "local:gate:stages": "npm run local:validate && npm run verify:skills:cli && npm run coverage && npm run verify:build-gate && npm run verify:bundle-externals && npm run smoke && npm run smoke:web:firefox && npm run local:storybook",
+    "local:validate": "npm run validate:guards && npm run validate:core && cd clients/web && npm run check && cd ../cli && npm run check && cd ../tui && npm run check && cd ../launcher && npm run check",
     "local:storybook": "cd clients/web && npx playwright install chromium && npm run test:storybook",
     "verify:build-gate": "node scripts/verify-build-gate.mjs",
     "verify:bundle-externals": "node scripts/verify-bundle-externals.mjs",
@@ -46,18 +48,20 @@
     "verify:skills": "node scripts/verify-skills.mjs",
     "verify:skills:cli": "node scripts/verify-skills-cli.mjs",
     "test:scripts": "node --test \"scripts/**/*.test.mjs\"",
-    "validate": "npm run verify:format-coverage && npm run verify:skills && npm run verify:typecheck-coverage && npm run verify:dep-lockstep && npm run test:scripts && npm run validate:core && npm run validate:web && npm run validate:cli && npm run validate:tui && npm run validate:launcher",
+    "validate": "npm run validate:guards && npm run validate:core && npm run validate:web && npm run validate:cli && npm run validate:tui && npm run validate:launcher",
+    "validate:guards": "npm run verify:format-coverage && npm run verify:skills && npm run verify:typecheck-coverage && npm run verify:dep-lockstep && npm run verify:test-timeouts && npm run test:scripts",
     "verify:format-coverage": "node scripts/verify-format-coverage.mjs",
     "verify:dep-lockstep": "node scripts/verify-dep-lockstep.mjs",
+    "verify:test-timeouts": "node scripts/verify-test-timeouts.mjs",
     "validate:core": "npm run format:check:core && npm run format:check:scripts && npm run format:check:shared && npm run lint:core && npm run lint:shared",
     "lint:core": "eslint \"core/**/*.{ts,tsx}\" --max-warnings 0",
-    "lint:shared": "eslint \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js --max-warnings 0",
+    "lint:shared": "eslint \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts vitest.setup.shared.mts eslint.config.js --max-warnings 0",
     "format:core": "prettier --write \"core/**/*.{ts,tsx}\"",
     "format:check:core": "prettier --check \"core/**/*.{ts,tsx}\"",
     "format:scripts": "prettier --write \"scripts/**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
     "format:check:scripts": "prettier --check \"scripts/**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}\"",
-    "format:shared": "prettier --write \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js",
-    "format:check:shared": "prettier --check \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts eslint.config.js",
+    "format:shared": "prettier --write \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts vitest.setup.shared.mts eslint.config.js",
+    "format:check:shared": "prettier --check \"test-servers/src/**/*.{ts,tsx,mts,cts}\" vitest.shared.mts vitest.setup.shared.mts eslint.config.js",
     "format": "npm run format:core && npm run format:scripts && npm run format:shared && cd clients/web && npm run format && cd ../cli && npm run format && cd ../tui && npm run format && cd ../launcher && npm run format",
     "validate:cli": "cd clients/cli && npm run validate",
     "validate:tui": "cd clients/tui && npm run validate",
@@ -90,7 +94,7 @@
     "@hono/node-server": "^2.0.12",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/core": "2.0.0",
-    "@modelcontextprotocol/ext-apps": "^1.7.4",
+    "@modelcontextprotocol/ext-apps": "^2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@modelcontextprotocol/server-legacy": "2.0.0",
     "@napi-rs/keyring": "^1.3.0",
@@ -117,7 +121,7 @@
     "@eslint/js": "^10.0.1",
     "@types/node": "^24.12.4",
     "@types/proper-lockfile": "^4.1.4",
-    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/coverage-v8": "4.1.11",
     "eslint": "^10.8.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "express": "^5.2.1",
@@ -126,6 +130,6 @@
     "semver": "^7.8.5",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.65.0",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   }
 }