mcp-use 2.0.0-beta.12 → 2.0.0-beta.13

package/dist/index.js

@@ -68,41 +68,8 @@ function publicAssetPath(basePath, source) {
 function isLocalPublicSource(source) {
   return protocolOf(source) === void 0;
 }
-function extensionPath(source) {
-  const protocol = protocolOf(source);
-  if (protocol === "data") {
-    return "";
-  }
-  if (protocol === "http" || protocol === "https") {
-    return new URL(source).pathname.toLowerCase();
-  }
-  return source.toLowerCase();
-}
-function dataUrlMimeType(source) {
-  if (protocolOf(source) !== "data") {
-    return void 0;
-  }
-  const comma = source.indexOf(",");
-  if (comma < 0) {
-    return void 0;
-  }
-  const mimeType = source.slice(5, comma).split(";", 1)[0]?.toLowerCase();
-  return mimeType === "" ? void 0 : mimeType;
-}
-function iconMimeType(icon) {
-  return icon.mimeType?.toLowerCase() ?? dataUrlMimeType(icon.src);
-}
-function isIco(icon) {
-  const mimeType = iconMimeType(icon);
-  return mimeType === "image/x-icon" || mimeType === "image/vnd.microsoft.icon" || extensionPath(icon.src).endsWith(".ico");
-}
-function isPng(icon) {
-  return iconMimeType(icon) === "image/png" || extensionPath(icon.src).endsWith(".png");
-}
 function selectFaviconFromIcons(icons) {
-  return icons.find(isIco) ?? icons.find(
-    (icon) => isPng(icon) && icon.sizes?.some((size) => size === "16x16" || size === "32x32")
-  ) ?? icons.find(isPng) ?? icons[0];
+  return icons[0];
 }
 function assertLocalPublicSource(source, field) {
   if (source.startsWith("/") || source.includes("\\") || source.includes("?") || source.includes("#") || source.split("/").some((segment) => segment === "" || segment === "..")) {
@@ -703,7 +670,14 @@ function serializeForInlineScript(value) {
   return JSON.stringify(value).replaceAll("<", "\\u003c");
 }
 function renderInspectorShell(options) {
-  const { serverName, basePath, faviconHref, assetsUrl, manufactChatUrl } = options;
+  const {
+    serverName,
+    basePath,
+    faviconHref,
+    faviconType,
+    assetsUrl,
+    manufactChatUrl
+  } = options;
   const serializedBasePath = serializeForInlineScript(basePath);
   const serializedManufactChatUrl = manufactChatUrl ? serializeForInlineScript(manufactChatUrl) : null;
   const rawUrl = assetsUrl ?? DEFAULT_INSPECTOR_ASSETS_URL;
@@ -716,7 +690,7 @@ function renderInspectorShell(options) {
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>${escapeHtml(serverName)} \u2014 MCP Inspector</title>
-    ${faviconHref !== void 0 ? `<link rel="icon" href="${escapeHtml(faviconHref)}" />` : ""}
+    ${faviconHref !== void 0 ? `<link rel="icon"${faviconType !== void 0 ? ` type="${escapeHtml(faviconType)}"` : ""} href="${escapeHtml(faviconHref)}" />` : ""}
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link
@@ -780,6 +754,9 @@ function createInspectorHandler(inspector, options) {
     ...options.faviconHref !== void 0 && {
       faviconHref: options.faviconHref
     },
+    ...options.faviconType !== void 0 && {
+      faviconType: options.faviconType
+    },
     assetsUrl,
     manufactChatUrl
   };
@@ -1808,9 +1785,8 @@ var MCPServer = class _MCPServer {
    * Serve over HTTP on Node. Pass port `0` for an ephemeral port.
    *
    * Binds `config.host` (default `127.0.0.1`). Localhost-class binds get
-   * DNS-rebinding protection automatically: `Host` on every request,
-   * `Origin` only on non-GET/HEAD (sandboxed view iframes send
-   * `Origin: null` on asset GETs). To serve publicly set `host: "0.0.0.0"`;
+   * DNS-rebinding Host protection automatically. Origin validation is off
+   * unless `allowedOrigins` is set. To serve publicly set `host: "0.0.0.0"`;
    * behind a platform edge that is all that's needed, and `allowedHosts`
    * restricts direct exposure (additive — localhost-class values stay allowed).
    *
@@ -2009,17 +1985,17 @@ var MCPServer = class _MCPServer {
    *
    * Configured lists are additive to the localhost-class allowlists, so local
    * runs keep working when a deployment hostname is added. With nothing
-   * configured, `listen()` on a localhost-class bind validates against the
+   * configured, `listen()` on a localhost-class bind validates Host against the
    * localhost lists (the DNS-rebinding threat model), while `getHandler()` —
-   * which never binds — applies no validation. `allowedOrigins` defaults to
-   * mirroring the effective Host allowlist. Origin validation runs only on
-   * non-GET/HEAD requests.
+   * which never binds — applies no validation. Origin validation is off unless
+   * `allowedOrigins` is set explicitly (SDK-aligned: the handler is open by
+   * default). When enabled, Origin is checked only on non-GET/HEAD requests.
    */
   #validationPolicy(mode) {
     const { host = "127.0.0.1", allowedHosts, allowedOrigins } = this.#config;
     const localhostBind = ["127.0.0.1", "localhost", "::1"].includes(host);
     const hosts = allowedHosts !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedHostnames(), ...allowedHosts])] : mode === "listen" && localhostBind ? localhostAllowedHostnames() : void 0;
-    const origins = allowedOrigins !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedOrigins(), ...allowedOrigins])] : hosts;
+    const origins = allowedOrigins !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedOrigins(), ...allowedOrigins])] : void 0;
     return { hosts, origins };
   }
   #ensureMounted(mode, listenPort, bus) {
@@ -2039,11 +2015,11 @@ var MCPServer = class _MCPServer {
       const deferViewCors = isGlobalCorsEnabled(corsConfig);
       if (hosts !== void 0) {
         middlewares.unshift(hostValidationMiddleware(hosts));
-        middlewares.push(originValidationMiddleware(origins ?? hosts));
-      } else {
-        if (origins !== void 0) {
-          middlewares.push(originValidationMiddleware(origins));
-        }
+      }
+      if (origins !== void 0) {
+        middlewares.push(originValidationMiddleware(origins));
+      }
+      if (hosts === void 0) {
         if (mode === "listen") {
           console.warn(
             `[mcp-use] listen() is serving on ${this.#config.host} without Host validation. Behind a platform edge that only routes your own domains this is expected; if this process is reachable directly, set allowedHosts to restrict it.`
@@ -2100,7 +2076,7 @@ var MCPServer = class _MCPServer {
           return mcpRouteHandler(request);
         }
         const respond = async () => {
-          const { createLandingPageResponse } = await import("./landing-handler-3VN4BMR2.js");
+          const { createLandingPageResponse } = await import("./landing-handler-Z7WDR4S2.js");
           return createLandingPageResponse(
             request,
             basePath,
@@ -2161,7 +2137,12 @@ var MCPServer = class _MCPServer {
       const inspectorHandler = createInspectorHandler(this.#config.inspector, {
         serverName: this.#config.name,
         basePath,
-        ...faviconHandler !== void 0 && { faviconHref: "/favicon.ico" }
+        ...faviconHandler !== void 0 && {
+          faviconHref: "/favicon.ico",
+          ...this.#branding.faviconMimeType !== void 0 && {
+            faviconType: this.#branding.faviconMimeType
+          }
+        }
       });
       if (inspectorHandler !== void 0) {
         routes.push({