mcp-use 2.0.0-beta.18 → 2.0.0-beta.2

package/dist/index.js

@@ -1,49 +1,27 @@
-import {
-  resolvePublicFilePath,
-  servePublicFile
-} from "./chunk-SMN75YED.js";
-import {
-  registerOpenAPITools
-} from "./chunk-AATFAERC.js";
-import {
-  completable,
-  normalizeCompletions
-} from "./chunk-KIZ72TIK.js";
-import {
-  synthesizeViewDocument
-} from "./chunk-XUI7QE2D.js";
-import {
-  hasExplicitAssetsBase,
-  originFromAssetsBase,
-  resolveAssetsBase,
-  resolveServerOrigin
-} from "./chunk-FC2Z2VFO.js";
 import {
   authInfoFromRequest,
-  getOAuthProtectedResourceMetadataUrl,
-  oauthMetadata,
-  requireBearerAuth
-} from "./chunk-Z326HADF.js";
-import {
   composeFetch,
+  getOAuthProtectedResourceMetadataUrl,
   getRequestBag,
   hostValidationMiddleware,
-  isHtmlNavigationRequest,
   jsonBodyMiddleware,
   matchesPath,
   matchesPathPrefix,
+  oauthMetadata,
   originValidationMiddleware,
-  pathUnderBase,
   pathnameOf,
-  routeFetch,
-  toFrameworkHandler
-} from "./chunk-QUUANIE4.js";
+  requireBearerAuth,
+  routeFetch
+} from "./chunk-SFI2T6TE.js";
 import {
   getOAuthProviderOptions,
   resolveConfiguredOAuthResource,
   resolveLocalOAuthResource,
   wrapOAuthTokenVerifier
 } from "./chunk-DPL7OEXC.js";
+import {
+  registerOpenAPITools
+} from "./chunk-AATFAERC.js";
 
 // src/server.ts
 import {
@@ -51,236 +29,9 @@ import {
   localhostAllowedOrigins,
   McpServer as SdkMcpServer,
   ResourceTemplate,
-  isInputRequiredResult as isInputRequiredResult2
+  isInputRequiredResult
 } from "@modelcontextprotocol/server";
 
-// src/branding.ts
-var FAVICON_CACHE_CONTROL = "public, max-age=31536000, immutable";
-var FAVICON_REDIRECT_CACHE_CONTROL = "public, max-age=300";
-function protocolOf(value) {
-  const match = /^([a-z][a-z\d+.-]*):/i.exec(value);
-  return match?.[1]?.toLowerCase();
-}
-function publicAssetPath(basePath, source) {
-  const prefix = basePath === "/" ? "" : basePath;
-  return `${prefix}/_mcp-use/public/${source.split("/").map((segment) => encodeURIComponent(segment)).join("/")}`;
-}
-function isLocalPublicSource(source) {
-  return protocolOf(source) === void 0;
-}
-function selectFaviconFromIcons(icons) {
-  return icons[0];
-}
-function assertLocalPublicSource(source, field) {
-  if (source.startsWith("/") || source.includes("\\") || source.includes("?") || source.includes("#") || source.split("/").some((segment) => segment === "" || segment === "..")) {
-    throw new TypeError(
-      `${field} must be an http(s) URL, image data URL, or safe path relative to public/`
-    );
-  }
-}
-function parseDataImage(source, field) {
-  const comma = source.indexOf(",");
-  if (comma < 0) {
-    throw new TypeError(`${field} must be a valid image data URL`);
-  }
-  const metadata = source.slice(5, comma);
-  const payload = source.slice(comma + 1);
-  const parts = metadata.split(";");
-  const mimeType = parts[0]?.toLowerCase() ?? "";
-  if (!mimeType.startsWith("image/")) {
-    throw new TypeError(`${field} data URL must use an image MIME type`);
-  }
-  try {
-    if (parts.includes("base64")) {
-      const binary = atob(payload);
-      return {
-        mimeType,
-        bytes: Uint8Array.from(binary, (character) => character.charCodeAt(0))
-      };
-    }
-    return {
-      mimeType,
-      bytes: new TextEncoder().encode(decodeURIComponent(payload))
-    };
-  } catch {
-    throw new TypeError(`${field} must be a valid image data URL`);
-  }
-}
-function assertBrandingSource(source, field) {
-  if (typeof source !== "string" || source.length === 0) {
-    throw new TypeError(`${field} must be a non-empty string`);
-  }
-  const protocol = protocolOf(source);
-  if (protocol === void 0) {
-    assertLocalPublicSource(source, field);
-    return source;
-  }
-  if (protocol === "data") {
-    parseDataImage(source, field);
-    return source;
-  }
-  if (protocol !== "http" && protocol !== "https") {
-    throw new TypeError(
-      `${field} must be an http(s) URL, image data URL, or safe path relative to public/`
-    );
-  }
-  try {
-    new URL(source);
-  } catch {
-    throw new TypeError(`${field} must be a valid absolute http(s) URL`);
-  }
-  return source;
-}
-function normalizeServerBranding(config) {
-  let websiteUrl;
-  if (config.websiteUrl !== void 0) {
-    if (typeof config.websiteUrl !== "string" || config.websiteUrl.length === 0) {
-      throw new TypeError(
-        "websiteUrl must be a non-empty absolute http(s) URL"
-      );
-    }
-    let parsed;
-    try {
-      parsed = new URL(config.websiteUrl);
-    } catch {
-      throw new TypeError(
-        "websiteUrl must be a non-empty absolute http(s) URL"
-      );
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new TypeError(
-        "websiteUrl must be a non-empty absolute http(s) URL"
-      );
-    }
-    websiteUrl = config.websiteUrl;
-  }
-  let icons;
-  if (config.icons !== void 0) {
-    if (!Array.isArray(config.icons)) {
-      throw new TypeError("icons must be an array of MCP Icon objects");
-    }
-    icons = Object.freeze(
-      config.icons.map((value, index) => {
-        if (typeof value !== "object" || value === null) {
-          throw new TypeError(`icons[${index}] must be an MCP Icon object`);
-        }
-        const icon = value;
-        const src = assertBrandingSource(icon["src"], `icons[${index}].src`);
-        const mimeType = icon["mimeType"];
-        if (mimeType !== void 0 && (typeof mimeType !== "string" || !mimeType.toLowerCase().startsWith("image/"))) {
-          throw new TypeError(
-            `icons[${index}].mimeType must be an image MIME type when provided`
-          );
-        }
-        const sizes = icon["sizes"];
-        if (sizes !== void 0 && (!Array.isArray(sizes) || sizes.some((size) => typeof size !== "string" || size.length === 0))) {
-          throw new TypeError(
-            `icons[${index}].sizes must be an array of non-empty strings when provided`
-          );
-        }
-        const normalizedSizes = sizes === void 0 ? void 0 : sizes.map((size) => size);
-        const theme = icon["theme"];
-        if (theme !== void 0 && theme !== "light" && theme !== "dark") {
-          throw new TypeError(
-            `icons[${index}].theme must be "light" or "dark" when provided`
-          );
-        }
-        return Object.freeze({
-          src,
-          ...mimeType !== void 0 && { mimeType },
-          ...normalizedSizes !== void 0 && {
-            sizes: Object.freeze(normalizedSizes)
-          },
-          ...theme !== void 0 && { theme }
-        });
-      })
-    );
-  }
-  const explicitFavicon = config.favicon === void 0 ? void 0 : assertBrandingSource(config.favicon, "favicon");
-  const inferred = explicitFavicon === void 0 ? selectFaviconFromIcons(icons ?? []) : void 0;
-  const favicon = explicitFavicon ?? inferred?.src;
-  const faviconMimeType = inferred?.mimeType ?? icons?.find((icon) => icon.src === explicitFavicon)?.mimeType;
-  return Object.freeze({
-    ...favicon !== void 0 && { favicon },
-    ...faviconMimeType !== void 0 && { faviconMimeType },
-    ...icons !== void 0 && { icons },
-    ...websiteUrl !== void 0 && { websiteUrl }
-  });
-}
-function resolveImplementationIcons(icons, request, basePath) {
-  if (icons === void 0) {
-    return void 0;
-  }
-  return icons.map((icon) => ({
-    ...icon,
-    src: request !== void 0 && isLocalPublicSource(icon.src) ? `${resolveAssetsBase(request)}${publicAssetPath(basePath, icon.src)}` : icon.src,
-    ...icon.sizes !== void 0 && { sizes: [...icon.sizes] }
-  }));
-}
-function hasLocalBrandingAsset(branding) {
-  return branding.favicon !== void 0 && isLocalPublicSource(branding.favicon) || branding.icons?.some((icon) => isLocalPublicSource(icon.src)) === true;
-}
-function createFaviconHandler(branding, options) {
-  const source = branding.favicon;
-  if (source === void 0) {
-    return void 0;
-  }
-  return async (request) => {
-    if (request.method !== "GET" && request.method !== "HEAD") {
-      return new Response("Method Not Allowed", {
-        status: 405,
-        headers: { Allow: "GET, HEAD" }
-      });
-    }
-    if (new URL(request.url).pathname !== "/favicon.ico") {
-      return new Response("Not Found", { status: 404 });
-    }
-    const protocol = protocolOf(source);
-    if (protocol === "http" || protocol === "https") {
-      return new Response(null, {
-        status: 307,
-        headers: {
-          Location: source,
-          "Cache-Control": FAVICON_REDIRECT_CACHE_CONTROL
-        }
-      });
-    }
-    if (protocol === "data") {
-      const data = parseDataImage(source, "favicon");
-      return new Response(
-        request.method === "HEAD" ? null : data.bytes.buffer,
-        {
-          status: 200,
-          headers: {
-            "Content-Type": branding.faviconMimeType ?? data.mimeType,
-            "Cache-Control": FAVICON_CACHE_CONTROL,
-            "X-Content-Type-Options": "nosniff"
-          }
-        }
-      );
-    }
-    const { join } = await import("path");
-    const publicRoot = options.dev ? join(options.projectRoot, "public") : join(options.projectRoot, ".mcp-use/build/views/public");
-    const diskPath = await resolvePublicFilePath(publicRoot, source);
-    if (diskPath === null) {
-      return new Response("Not Found", {
-        status: 404,
-        headers: { "Cache-Control": "no-store" }
-      });
-    }
-    const response = await servePublicFile(diskPath, {
-      ...options.deferCors === true && { deferCors: true },
-      ...request.method === "HEAD" && { head: true }
-    });
-    response.headers.set("Cache-Control", FAVICON_CACHE_CONTROL);
-    response.headers.set("X-Content-Type-Options", "nosniff");
-    if (branding.faviconMimeType !== void 0) {
-      response.headers.set("Content-Type", branding.faviconMimeType);
-    }
-    return response;
-  };
-}
-
 // src/config.ts
 function assertServerConfig(config) {
   if (config.basePath !== void 0) {
@@ -471,317 +222,12 @@ function toAuthenticatedRequestContext(ctx) {
   };
 }
 
-// src/middleware/cors.ts
-var DEFAULT_METHODS = ["GET", "HEAD", "POST", "OPTIONS"];
-var DEFAULT_ALLOWED_HEADERS = [
-  "Content-Type",
-  "Authorization",
-  "mcp-protocol-version",
-  "mcp-method",
-  "mcp-name"
-];
-function resolveAllowedOrigin(origin, requestOrigin) {
-  if (origin === void 0) {
-    return requestOrigin;
-  }
-  if (typeof origin === "function") {
-    return origin(requestOrigin);
-  }
-  if (origin === "*") {
-    return "*";
-  }
-  if (Array.isArray(origin)) {
-    if (requestOrigin !== null && origin.includes(requestOrigin)) {
-      return requestOrigin;
-    }
-    return null;
-  }
-  return origin;
-}
-function corsHeaders(options, request) {
-  if (request.headers.has("Access-Control-Allow-Origin")) {
-    return void 0;
-  }
-  const requestOrigin = request.headers.get("Origin");
-  const allowedOrigin = resolveAllowedOrigin(options.origin, requestOrigin);
-  if (allowedOrigin === null) {
-    return void 0;
-  }
-  const headers = {
-    "Access-Control-Allow-Origin": allowedOrigin,
-    "Access-Control-Allow-Methods": options.methods.join(", "),
-    "Access-Control-Allow-Headers": options.allowedHeaders.join(", ")
-  };
-  if (options.credentials) {
-    headers["Access-Control-Allow-Credentials"] = "true";
-  }
-  if (allowedOrigin !== "*") {
-    headers.Vary = "Origin";
-  }
-  return headers;
-}
-function mergeCorsHeaders(response, headers) {
-  if (response.headers.has("Access-Control-Allow-Origin")) {
-    return response;
-  }
-  const merged = new Headers(response.headers);
-  const corsHeaders2 = new Headers(headers);
-  corsHeaders2.forEach((value, key) => {
-    merged.set(key, value);
-  });
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: merged
-  });
-}
-function corsFetchMiddleware(options) {
-  const enabled = options.enabled !== false;
-  if (!enabled) {
-    return async (_request, next) => next();
-  }
-  const resolved = {
-    ...options.origin !== void 0 && { origin: options.origin },
-    methods: options.methods ?? DEFAULT_METHODS,
-    allowedHeaders: options.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS,
-    credentials: options.credentials ?? false
-  };
-  return async (request, next) => {
-    const headers = corsHeaders(resolved, request);
-    if (headers === void 0) {
-      return next();
-    }
-    if (request.method === "OPTIONS") {
-      return new Response(null, { status: 204, headers });
-    }
-    const response = await next();
-    return mergeCorsHeaders(response, headers);
-  };
-}
-function isGlobalCorsEnabled(cors) {
-  return cors !== void 0 && cors.enabled !== false;
-}
-
-// src/middleware/mcp-middleware.ts
-import {
-  CallToolResultSchema,
-  GetPromptResultSchema,
-  ListPromptsResultSchema,
-  ListResourcesResultSchema,
-  ListToolsResultSchema,
-  ReadResourceResultSchema
-} from "@modelcontextprotocol/core";
-import { isInputRequiredResult } from "@modelcontextprotocol/server";
-var MCP_MIDDLEWARE_METHODS = [
-  "tools/call",
-  "tools/list",
-  "resources/read",
-  "resources/list",
-  "prompts/get",
-  "prompts/list"
-];
-function withMcpMiddlewareParams(request, params) {
-  if (typeof request !== "object" || request === null || Array.isArray(request)) {
-    throw new TypeError(
-      "[mcp-use] MCP middleware received an invalid downstream request"
-    );
-  }
-  return { ...request, params };
-}
-function createMcpMiddlewareEntry(pattern, handler) {
-  const normalizedPattern = normalizeMcpMiddlewarePattern(pattern);
-  const invoke = handler;
-  if (normalizedPattern !== "*" && !isMcpMiddlewareMethod(normalizedPattern)) {
-    throw new TypeError(
-      `Unsupported MCP middleware pattern "${pattern}". Use an exact MCP method or "mcp:*".`
-    );
-  }
-  if (normalizedPattern === "*") {
-    return {
-      pattern: normalizedPattern,
-      handler: async (ctx, next) => {
-        let downstreamCalled = false;
-        let downstreamResult;
-        await invoke(ctx, async () => {
-          downstreamResult = await next();
-          downstreamCalled = true;
-        });
-        if (!downstreamCalled) {
-          throw new Error(
-            `Wildcard MCP middleware "${normalizedPattern}" must call next()`
-          );
-        }
-        return downstreamResult;
-      }
-    };
-  }
-  return {
-    pattern: normalizedPattern,
-    handler: (ctx, next) => invoke(ctx, next)
-  };
-}
-function createMcpEventListenerEntry(pattern, handler) {
-  const { pattern: normalizedPattern, phase } = parseMcpPattern(pattern);
-  const invoke = handler;
-  return {
-    pattern: normalizedPattern,
-    phase,
-    handler: (ctx, result) => invoke(ctx, result)
-  };
-}
-function matchesPattern(pattern, method) {
-  if (pattern === "*") return true;
-  if (pattern.endsWith("/*")) {
-    const prefix = pattern.slice(0, -1);
-    return method.startsWith(prefix);
-  }
-  return pattern === method;
-}
-function isMcpMiddlewareMethod(value) {
-  return MCP_MIDDLEWARE_METHODS.some((method) => method === value);
-}
-function composeMiddleware(entries, method, innerFn) {
-  const matching = entries.filter(
-    (entry) => matchesPattern(entry.pattern, method)
-  );
-  if (matching.length === 0) {
-    return (_ctx) => innerFn();
-  }
-  return (ctx) => {
-    let index = -1;
-    const dispatch = (i) => {
-      if (i <= index) {
-        return Promise.reject(new Error("next() called multiple times"));
-      }
-      index = i;
-      if (i === matching.length) {
-        return innerFn();
-      }
-      const entry = matching[i];
-      return entry.handler(ctx, () => dispatch(i + 1));
-    };
-    return dispatch(0);
-  };
-}
-function freezeMiddlewareContext(ctx) {
-  return Object.freeze({
-    method: ctx.method,
-    params: Object.freeze({ ...ctx.params }),
-    ...ctx.session !== void 0 && {
-      session: Object.freeze({ ...ctx.session })
-    },
-    ...ctx.auth !== void 0 && { auth: ctx.auth },
-    state: new Map(ctx.state)
-  });
-}
-async function runMcpOperation(middlewares, events, method, ctx, innerFn) {
-  dispatchMcpEvents(events, method, "before", ctx);
-  const chained = composeMiddleware(middlewares, method, innerFn);
-  const result = await chained(ctx);
-  assertValidMiddlewareResult(method, result);
-  dispatchMcpEvents(events, method, "complete", ctx, result);
-  return result;
-}
-function assertValidMiddlewareResult(method, result) {
-  if ((method === "tools/call" || method === "resources/read" || method === "prompts/get") && isInputRequiredResult(result)) {
-    return;
-  }
-  const validation = (() => {
-    switch (method) {
-      case "tools/call":
-        assertArrayProperty(method, result, "content");
-        return CallToolResultSchema.safeParse(result);
-      case "tools/list":
-        assertArrayResult(method, result);
-        return ListToolsResultSchema.safeParse({ tools: result });
-      case "resources/read":
-        assertArrayProperty(method, result, "contents");
-        return ReadResourceResultSchema.safeParse(result);
-      case "resources/list":
-        assertArrayResult(method, result);
-        return ListResourcesResultSchema.safeParse({ resources: result });
-      case "prompts/get":
-        assertArrayProperty(method, result, "messages");
-        return GetPromptResultSchema.safeParse(result);
-      case "prompts/list":
-        assertArrayResult(method, result);
-        return ListPromptsResultSchema.safeParse({ prompts: result });
-      default:
-        throw new TypeError(`Unsupported MCP middleware method "${method}"`);
-    }
-  })();
-  if (!validation.success) {
-    throw new TypeError(
-      `[mcp-use] ${method} middleware returned an invalid result: ${validation.error.message}`
-    );
-  }
-}
-function assertArrayResult(method, result) {
-  if (!Array.isArray(result)) {
-    throw new TypeError(
-      `[mcp-use] ${method} middleware returned an invalid result: expected an array`
-    );
-  }
-}
-function assertArrayProperty(method, result, property) {
-  if (typeof result !== "object" || result === null || !Array.isArray(result[property])) {
-    throw new TypeError(
-      `[mcp-use] ${method} middleware returned an invalid result: expected a ${property} array`
-    );
-  }
-}
-function dispatchMcpEvents(events, method, phase, ctx, result) {
-  const frozen = freezeMiddlewareContext(ctx);
-  for (const entry of events) {
-    if (entry.phase !== phase || !matchesPattern(entry.pattern, method)) {
-      continue;
-    }
-    try {
-      entry.handler(frozen, result);
-    } catch (error) {
-      console.error(
-        `[mcp-use] MCP event listener for "${entry.pattern}" (${phase}) threw:`,
-        error
-      );
-    }
-  }
-}
-function parseMcpPattern(raw) {
-  const pattern = raw.startsWith("mcp:") ? raw.slice(4) : raw;
-  if (pattern.endsWith(":complete")) {
-    return {
-      pattern: pattern.slice(0, -":complete".length),
-      phase: "complete"
-    };
-  }
-  return { pattern, phase: "before" };
-}
-function normalizeMcpMiddlewarePattern(raw) {
-  return raw.startsWith("mcp:") ? raw.slice(4) : raw;
-}
-
 // src/inspector-shell.ts
 var INSPECTOR_TAG = "beta";
 var DEFAULT_INSPECTOR_ASSETS_URL = `https://cdn.jsdelivr.net/npm/@mcp-use/inspector@${INSPECTOR_TAG}/dist/cdn/inspector.js`;
 function inspectorStylesUrl(assetsUrl) {
   return assetsUrl.replace(/\.js(?=$|[?#])/, ".css");
 }
-function isDefaultJsdelivrInspectorUrl(url) {
-  return url.startsWith("https://cdn.jsdelivr.net/npm/@mcp-use/inspector@");
-}
-function withInspectorCacheBust(assetsUrl) {
-  if (!isDefaultJsdelivrInspectorUrl(assetsUrl)) return assetsUrl;
-  const sep = assetsUrl.includes("?") ? "&" : "?";
-  return `${assetsUrl}${sep}cb=${crypto.randomUUID()}`;
-}
-function matchesInspectorShellPath(pathname, basePath) {
-  const prefix = pathUnderBase(basePath, "inspector");
-  if (pathname !== prefix && !pathname.startsWith(`${prefix}/`)) {
-    return false;
-  }
-  const suffix = pathname.slice(prefix.length);
-  return suffix !== "/api" && !suffix.startsWith("/api/");
-}
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
@@ -789,18 +235,10 @@ function serializeForInlineScript(value) {
   return JSON.stringify(value).replaceAll("<", "\\u003c");
 }
 function renderInspectorShell(options) {
-  const {
-    serverName,
-    basePath,
-    faviconHref,
-    faviconType,
-    assetsUrl,
-    manufactChatUrl
-  } = options;
+  const { serverName, basePath, assetsUrl, manufactChatUrl } = options;
   const serializedBasePath = serializeForInlineScript(basePath);
   const serializedManufactChatUrl = manufactChatUrl ? serializeForInlineScript(manufactChatUrl) : null;
-  const rawUrl = assetsUrl ?? DEFAULT_INSPECTOR_ASSETS_URL;
-  const bundleUrl = withInspectorCacheBust(rawUrl);
+  const bundleUrl = assetsUrl ?? DEFAULT_INSPECTOR_ASSETS_URL;
   const scriptSrc = escapeHtml(bundleUrl);
   const stylesHref = escapeHtml(inspectorStylesUrl(bundleUrl));
   return `<!doctype html>
@@ -809,7 +247,6 @@ function renderInspectorShell(options) {
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>${escapeHtml(serverName)} \u2014 MCP Inspector</title>
-    ${faviconHref !== void 0 ? `<link rel="icon"${faviconType !== void 0 ? ` type="${escapeHtml(faviconType)}"` : ""} href="${escapeHtml(faviconHref)}" />` : ""}
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link
@@ -820,65 +257,10 @@ function renderInspectorShell(options) {
     <style>
       :root { color-scheme: light dark; }
       html, body { height: 100%; margin: 0; background-color: #f3f3f3; }
-      #root { height: 100%; }
-      .mcp-boot {
-        display: flex;
-        height: 100%;
-        align-items: center;
-        justify-content: center;
-        background-color: #f3f3f3;
-      }
-      .mcp-boot-inner {
-        display: flex;
-        flex-direction: column;
-        align-items: center;
-        gap: 16px;
-      }
-      .mcp-boot-spinner {
-        width: 32px;
-        height: 32px;
-        color: #52525b;
-        animation: mcp-boot-spin 1s linear infinite;
-      }
-      .mcp-boot-label {
-        margin: 0;
-        font-family: Ubuntu, sans-serif;
-        font-size: 0.875rem;
-        line-height: 1.25rem;
-        color: #52525b;
-      }
-      @keyframes mcp-boot-spin {
-        to { transform: rotate(360deg); }
-      }
-      @media (prefers-color-scheme: dark) {
-        html, body { background-color: #000; }
-        .mcp-boot { background-color: #000; }
-        .mcp-boot-spinner, .mcp-boot-label { color: #a1a1aa; }
-      }
     </style>
   </head>
   <body>
-    <div id="root">
-      <div class="mcp-boot">
-        <div class="mcp-boot-inner">
-          <svg
-            class="mcp-boot-spinner"
-            xmlns="http://www.w3.org/2000/svg"
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            stroke-width="2"
-            stroke-linecap="round"
-            stroke-linejoin="round"
-            role="status"
-            aria-label="Loading"
-          >
-            <path d="M21 12a9 9 0 1 1-6.219-8.56" />
-          </svg>
-          <p class="mcp-boot-label">Connecting to MCP server...</p>
-        </div>
-      </div>
-    </div>
+    <div id="root"></div>
     <script>
       (function () {
         var basePath = ${serializedBasePath};
@@ -890,7 +272,6 @@ function renderInspectorShell(options) {
         };
         // Read by the current inspector bundle to derive its own URLs.
         window.__MCP_BASE_PATH__ = basePath;
-        ${process.env.MCP_USE_DEV_CLI === "1" ? "window.__MCP_DEV_CLI__ = true;" : ""}
         ${serializedManufactChatUrl ? `window.__MANUFACT_CHAT_URL__ = ${serializedManufactChatUrl};` : ""}
         // The bundle carries Node-flavored dependencies that touch \`process\`
         // at module scope; give them the same browser polyfill the v1
@@ -923,27 +304,22 @@ function createInspectorHandler(inspector, options) {
   const { assetsUrl: configAssetsUrl, manufactChatUrl: configManufactChatUrl } = inspector ?? {};
   const assetsUrl = configAssetsUrl ?? process.env["MCP_USE_INSPECTOR_ASSETS_URL"] ?? void 0;
   const manufactChatUrl = configManufactChatUrl ?? process.env["MANUFACT_CHAT_URL"] ?? void 0;
-  const shellOptions = {
+  const html = renderInspectorShell({
     serverName: options.serverName,
     basePath: options.basePath,
-    ...options.faviconHref !== void 0 && {
-      faviconHref: options.faviconHref
-    },
-    ...options.faviconType !== void 0 && {
-      faviconType: options.faviconType
-    },
     assetsUrl,
     manufactChatUrl
-  };
+  });
+  const path = `${options.basePath}/inspector`;
+  const slashPath = `${path}/`;
   return async (request) => {
     if (request.method !== "GET" && request.method !== "HEAD") {
       return new Response("Method Not Allowed", { status: 405 });
     }
     const pathname = new URL(request.url).pathname;
-    if (!matchesInspectorShellPath(pathname, options.basePath)) {
+    if (pathname !== path && pathname !== slashPath) {
       return new Response("Not Found", { status: 404 });
     }
-    const html = renderInspectorShell(shellOptions);
     return new Response(request.method === "HEAD" ? null : html, {
       status: 200,
       headers: { "content-type": "text/html; charset=utf-8" }
@@ -1333,6 +709,9 @@ function createMcpMount(factory, options = {}) {
   };
   return { handler, fetch };
 }
+function mountMcp(factory, options = {}) {
+  return createMcpMount(factory, options);
+}
 
 // src/tools.ts
 function resolveToolInputSchema(definition) {
@@ -1342,148 +721,117 @@ function resolveToolInputSchema(definition) {
 // src/views/register.ts
 var registerViews = /* @__PURE__ */ Symbol("mcp-use/registerViews");
 
-// src/views/csp-env.ts
-var CATEGORY_ENV = {
-  connectDomains: "CSP_CONNECT_DOMAINS",
-  resourceDomains: "CSP_RESOURCE_DOMAINS",
-  frameDomains: "CSP_FRAME_DOMAINS",
-  baseUriDomains: "CSP_BASE_URI_DOMAINS"
-};
-function parseDomainList(raw) {
-  if (raw === void 0 || raw.trim() === "") {
-    return [];
+// src/views/document.ts
+function resolveAssetUrl(assetPath, origin) {
+  if (!assetPath.startsWith("/")) {
+    throw new Error(
+      `View manifest asset path must be origin-absolute (start with "/"); got ${JSON.stringify(assetPath)}`
+    );
   }
-  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  return `${origin}${assetPath}`;
 }
-function readEnvDomains(name) {
-  if (typeof process === "undefined") {
-    return void 0;
-  }
-  const raw = process.env[name];
-  if (raw === void 0 || raw.trim() === "") {
-    return void 0;
-  }
-  return parseDomainList(raw);
+function resolvePublicBase(origin, basePath) {
+  return `${origin}${basePath}/_mcp-use/public/`;
 }
-function readCspUrlsShortcut() {
-  return readEnvDomains("CSP_URLS") ?? [];
+function escapeInlineScript(code) {
+  return code.replaceAll(/<\/script/gi, "<\\/script").replaceAll("<!--", "\\x3C!--");
 }
-function readEnvDomainsForCategory(category) {
-  const perCategory = readEnvDomains(CATEGORY_ENV[category]);
-  if (perCategory !== void 0) {
-    return perCategory;
-  }
-  return readCspUrlsShortcut();
+function escapeInlineStyle(css) {
+  return css.replaceAll(/<\/style/gi, "<\\/style");
 }
-function mergeDomainLists(...segments) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const segment of segments) {
-    for (const domain of segment) {
-      if (!seen.has(domain)) {
-        seen.add(domain);
-        out.push(domain);
-      }
-    }
-  }
-  return out;
+function escapeHtml2(value) {
+  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
-function toWebSocketOrigin(serverOrigin) {
-  if (serverOrigin.startsWith("https://")) {
-    return `wss://${serverOrigin.slice("https://".length)}`;
-  }
-  if (serverOrigin.startsWith("http://")) {
-    return `ws://${serverOrigin.slice("http://".length)}`;
-  }
-  return serverOrigin;
+function synthesizeViewDocument(entry, origin, basePath) {
+  const viewConfig = {
+    publicBase: resolvePublicBase(origin, basePath)
+  };
+  const configScript = `<script>globalThis.__mcpUseViewConfig=${JSON.stringify(viewConfig)};</script>`;
+  if (entry.kind === "inline") {
+    const styleTag = entry.css.length > 0 ? `<style>${escapeInlineStyle(entry.css)}</style>` : "";
+    const moduleScript = `<script type="module">${escapeInlineScript(entry.js)}</script>`;
+    return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+${configScript}
+${styleTag}
+</head>
+<body>
+<div id="root"></div>
+${moduleScript}
+</body>
+</html>`;
+  }
+  const cssLinks = entry.css.map(
+    (path) => `<link rel="stylesheet" href="${escapeHtml2(resolveAssetUrl(path, origin))}">`
+  ).join("\n");
+  const scriptTags = (entry.scripts ?? []).map(
+    (path) => `<script type="module" src="${escapeHtml2(resolveAssetUrl(path, origin))}"></script>`
+  ).join("\n");
+  const entryUrl = resolveAssetUrl(entry.entry, origin);
+  return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+${configScript}
+${cssLinks}
+</head>
+<body>
+<div id="root"></div>
+${scriptTags}
+<script type="module" src="${escapeHtml2(entryUrl)}"></script>
+</body>
+</html>`;
 }
-function buildMergedResourceCsp(authorFacts, options) {
-  const author = authorFacts?.csp;
-  const mcpConnectAuto = [];
-  if (options.serverOrigin !== "") {
-    mcpConnectAuto.push(options.serverOrigin);
-    if (options.hmrWs === true) {
-      mcpConnectAuto.push(toWebSocketOrigin(options.serverOrigin));
+
+// src/views/origin.ts
+function resolveRequestOrigin(request) {
+  const forwarded = request.headers.get("forwarded");
+  if (forwarded !== null) {
+    const fromForwarded = parseForwardedHeader(forwarded);
+    if (fromForwarded !== void 0) {
+      return fromForwarded;
+    }
+  }
+  const proto = request.headers.get("x-forwarded-proto");
+  const host = request.headers.get("x-forwarded-host");
+  if (proto !== null && host !== null) {
+    const firstHost = host.split(",")[0]?.trim();
+    const firstProto = proto.split(",")[0]?.trim();
+    if (firstHost !== void 0 && firstProto !== void 0 && firstHost !== "") {
+      return `${firstProto}://${firstHost}`;
+    }
+  }
+  return new URL(request.url).origin;
+}
+function parseForwardedHeader(header) {
+  for (const part of header.split(",")) {
+    const params = /* @__PURE__ */ new Map();
+    for (const token of part.split(";")) {
+      const [key, ...rest] = token.trim().split("=");
+      if (key === void 0 || rest.length === 0) {
+        continue;
+      }
+      params.set(key.toLowerCase(), rest.join("=").replace(/^"|"$/g, ""));
+    }
+    const proto = params.get("proto");
+    const host = params.get("host");
+    if (proto !== void 0 && host !== void 0) {
+      return `${proto}://${host}`;
     }
   }
-  const mcpResourceAuto = [];
-  const resourceOrigin = options.explicitAssetsBase ? options.assetsOrigin : options.serverOrigin;
-  if (resourceOrigin !== "") {
-    mcpResourceAuto.push(resourceOrigin);
-  }
-  const connectDomains = mergeDomainLists(
-    author?.connectDomains ?? [],
-    readEnvDomainsForCategory("connectDomains"),
-    mcpConnectAuto
-  );
-  const resourceDomains = mergeDomainLists(
-    author?.resourceDomains ?? [],
-    readEnvDomainsForCategory("resourceDomains"),
-    mcpResourceAuto
-  );
-  const frameDomains = mergeDomainLists(
-    author?.frameDomains ?? [],
-    readEnvDomainsForCategory("frameDomains")
-  );
-  const baseUriDomains = mergeDomainLists(
-    author?.baseUriDomains ?? [],
-    readEnvDomainsForCategory("baseUriDomains")
-  );
-  return {
-    ...author,
-    connectDomains,
-    resourceDomains,
-    frameDomains,
-    baseUriDomains
-  };
+  return void 0;
 }
 
 // src/views/routes.ts
 var PUBLIC_BUILD_DIR = ".mcp-use/build/views/public";
 var PUBLIC_DEV_DIR = "public";
-var VIEW_ASSETS_BUILD_ROOT = ".mcp-use/build/views";
-function createViewAssetsHandler(basePath, views, options) {
-  if (views.size === 0) {
-    return void 0;
-  }
-  const assetsPrefix = pathUnderBase(basePath, "_mcp-use/views");
-  const projectRoot = options?.projectRoot ?? process.cwd();
-  return async (request) => {
-    if (request.method !== "GET" && request.method !== "HEAD") {
-      return new Response("Method Not Allowed", { status: 405 });
-    }
-    if (!matchesPathPrefix(request, assetsPrefix)) {
-      return new Response("Not Found", { status: 404 });
-    }
-    const pathname = pathnameOf(request);
-    const remainder = pathname.slice(assetsPrefix.length + 1);
-    const slash = remainder.indexOf("/");
-    if (slash <= 0 || slash === remainder.length - 1) {
-      return new Response("Not Found", { status: 404 });
-    }
-    const viewName = remainder.slice(0, slash);
-    const subpath = remainder.slice(slash + 1);
-    const entry = views.get(viewName);
-    if (entry === void 0 || entry.kind !== "external") {
-      return new Response("Not Found", { status: 404 });
-    }
-    const [{ join }, { resolvePublicFilePath: resolvePublicFilePath2, servePublicFile: servePublicFile2 }] = await Promise.all([import("path"), import("./public-route-5JEGFEIN.js")]);
-    const viewRoot = join(projectRoot, VIEW_ASSETS_BUILD_ROOT, viewName);
-    const diskPath = await resolvePublicFilePath2(viewRoot, subpath);
-    if (diskPath === null) {
-      return new Response("Not Found", { status: 404 });
-    }
-    return await servePublicFile2(diskPath, {
-      ...options?.deferCors === true && { deferCors: true },
-      ...request.method === "HEAD" && { head: true }
-    });
-  };
-}
 function createViewPublicHandler(basePath, views, options) {
-  if (views.size === 0 && options?.enabled !== true) {
+  if (views.size === 0) {
     return void 0;
   }
-  const publicPrefix = pathUnderBase(basePath, "_mcp-use/public");
+  const publicPrefix = `${basePath}/_mcp-use/public`;
   const subdir = options?.dev === true ? PUBLIC_DEV_DIR : PUBLIC_BUILD_DIR;
   const projectRoot = options?.projectRoot ?? process.cwd();
   return async (request) => {
@@ -1494,53 +842,34 @@ function createViewPublicHandler(basePath, views, options) {
       return new Response("Not Found", { status: 404 });
     }
     const pathname = pathnameOf(request);
-    const encodedSubpath = pathname.slice(publicPrefix.length + 1);
-    let subpath;
-    try {
-      subpath = decodeURIComponent(encodedSubpath);
-    } catch {
-      return new Response("Not Found", { status: 404 });
-    }
+    const subpath = pathname.slice(publicPrefix.length + 1);
     if (subpath.length === 0) {
       return new Response("Not Found", { status: 404 });
     }
-    const [{ join }, { resolvePublicFilePath: resolvePublicFilePath2, servePublicFile: servePublicFile2 }] = await Promise.all([import("path"), import("./public-route-5JEGFEIN.js")]);
+    const [{ join }, { resolvePublicFilePath, servePublicFile }] = await Promise.all([import("path"), import("./public-route-7IK5D7V7.js")]);
     const publicRoot = join(projectRoot, subdir);
-    const diskPath = await resolvePublicFilePath2(publicRoot, subpath);
+    const diskPath = await resolvePublicFilePath(publicRoot, subpath);
     if (diskPath === null) {
       return new Response("Not Found", { status: 404 });
     }
-    return await servePublicFile2(diskPath, {
-      ...options?.deferCors === true && { deferCors: true },
-      ...request.method === "HEAD" && { head: true }
-    });
+    return await servePublicFile(diskPath);
   };
 }
 
 // src/views/wire.ts
-function buildToolUiMeta(viewName, visibility, existingMetadata) {
-  if (viewName === void 0 && visibility === void 0 && existingMetadata === void 0) {
+function buildToolUiMeta(viewName, visibility) {
+  if (viewName === void 0 && visibility === void 0) {
     return void 0;
   }
-  const meta = { ...existingMetadata };
-  const existingUi = existingMetadata?.[UI_META_KEY];
-  const existingUiIsObject = typeof existingUi === "object" && existingUi !== null && !Array.isArray(existingUi);
-  const ui = existingUiIsObject ? { ...existingUi } : {};
+  const ui = {};
+  const meta = { [UI_META_KEY]: ui };
   if (viewName !== void 0) {
     const resourceUri = viewResourceUri(viewName);
     ui["resourceUri"] = resourceUri;
     meta[UI_RESOURCE_URI_META_KEY] = resourceUri;
-  } else {
-    delete ui["resourceUri"];
-    delete meta[UI_RESOURCE_URI_META_KEY];
   }
   if (visibility !== void 0) {
     ui["visibility"] = [visibility];
-  } else {
-    delete ui["visibility"];
-  }
-  if (viewName !== void 0 || visibility !== void 0 || existingUiIsObject) {
-    meta[UI_META_KEY] = ui;
   }
   return meta;
 }
@@ -1551,20 +880,36 @@ function buildToolResultUiMeta(viewName) {
     [UI_RESOURCE_URI_META_KEY]: resourceUri
   };
 }
-function resolveCspOptions(options) {
-  const request = options?.request;
-  const serverOrigin = options?.serverOrigin ?? (request !== void 0 ? resolveServerOrigin(request) : "");
-  const assetsBase = options?.assetsBase ?? (request !== void 0 ? resolveAssetsBase(request) : serverOrigin);
-  return {
-    serverOrigin,
-    assetsOrigin: originFromAssetsBase(assetsBase),
-    explicitAssetsBase: hasExplicitAssetsBase(),
-    ...options?.hmrWs === true ? { hmrWs: true } : {}
-  };
+function toWebSocketOrigin(servingOrigin) {
+  if (servingOrigin.startsWith("https://")) {
+    return `wss://${servingOrigin.slice("https://".length)}`;
+  }
+  if (servingOrigin.startsWith("http://")) {
+    return `ws://${servingOrigin.slice("http://".length)}`;
+  }
+  return servingOrigin;
 }
-function buildResourceUiMeta(authorFacts, options) {
-  const csp = buildMergedResourceCsp(authorFacts, resolveCspOptions(options));
-  const ui = { csp };
+function buildResourceUiMeta(authorFacts, servingOrigin, options) {
+  const authorResourceDomains = authorFacts?.csp?.resourceDomains ?? [];
+  const resourceDomains = [
+    ...authorResourceDomains,
+    ...servingOrigin !== "" ? [servingOrigin] : []
+  ];
+  const authorConnectDomains = authorFacts?.csp?.connectDomains ?? [];
+  const connectDomains = [...authorConnectDomains];
+  if (options?.hmrWs === true && servingOrigin !== "") {
+    const wsOrigin = toWebSocketOrigin(servingOrigin);
+    if (!connectDomains.includes(wsOrigin)) {
+      connectDomains.push(wsOrigin);
+    }
+  }
+  const ui = {
+    csp: {
+      ...authorFacts?.csp,
+      connectDomains,
+      resourceDomains
+    }
+  };
   if (authorFacts?.permissions !== void 0) {
     ui["permissions"] = authorFacts.permissions;
   }
@@ -1576,35 +921,19 @@ function buildResourceUiMeta(authorFacts, options) {
   }
   return { [UI_META_KEY]: ui };
 }
-function viewResourceConfig(_viewName, _entry, authorFacts, options) {
+function viewResourceConfig(_viewName, _entry, authorFacts, servingOrigin, options) {
   return {
     mimeType: UI_MIME_TYPE,
     ...authorFacts?.description !== void 0 && {
       description: authorFacts.description
     },
-    _meta: buildResourceUiMeta(authorFacts, options)
+    _meta: buildResourceUiMeta(authorFacts, servingOrigin, options)
   };
 }
 
 // src/server.ts
-function omitRootSchemaDialect(schema) {
-  if (typeof schema !== "object" || schema === null || Array.isArray(schema) || !("$schema" in schema)) {
-    return schema;
-  }
-  const emittedSchema = { ...schema };
-  delete emittedSchema["$schema"];
-  return emittedSchema;
-}
-function omitToolSchemaDialects(tools) {
-  return tools.map((tool) => ({
-    ...tool,
-    inputSchema: omitRootSchemaDialect(tool.inputSchema),
-    ...tool.outputSchema === void 0 ? {} : { outputSchema: omitRootSchemaDialect(tool.outputSchema) }
-  }));
-}
 var MCPServer = class _MCPServer {
   #config;
-  #branding;
   #tools = /* @__PURE__ */ new Map();
   #resources = /* @__PURE__ */ new Map();
   #resourceTemplates = /* @__PURE__ */ new Map();
@@ -1629,14 +958,6 @@ var MCPServer = class _MCPServer {
   #oauthResourceConfigurationAbsent = false;
   /** Whether the mounted app validates Host headers (fixed at first mount). */
   #hostValidated = false;
-  #mcpMiddlewares = [];
-  #mcpEventListeners = [];
-  /** Client instances created by {@link MCPServer.proxy} and owned by this server. */
-  #proxyOwners = [];
-  /** Proxy registrations that {@link close} must let finish before cleanup. */
-  #proxyOperations = /* @__PURE__ */ new Set();
-  /** Whether terminal shutdown has begun. */
-  #closed = false;
   /**
    * Create an MCP server from a parsed, bundled OpenAPI document.
    *
@@ -1676,7 +997,6 @@ var MCPServer = class _MCPServer {
   constructor(config) {
     assertServerConfig(config);
     this.#config = config;
-    this.#branding = normalizeServerBranding(config);
     if (config.oauth !== void 0) {
       const mcpUrl = typeof process === "undefined" ? void 0 : process.env["MCP_URL"];
       const resource = resolveConfiguredOAuthResource({
@@ -1699,24 +1019,6 @@ var MCPServer = class _MCPServer {
   get basePath() {
     return this.#basePath();
   }
-  /**
-   * Immutable normalized branding shared by MCP identity and browser pages.
-   *
-   * `favicon` is the final source after explicit-favicon and icon-selection
-   * precedence. Landing-page integrations can use this accessor and link to
-   * the server's root-level `/favicon.ico` route without reading private
-   * configuration or depending on the inspector/view layers.
-   *
-   * @example
-   * ```ts
-   * if (server.branding.favicon) {
-   *   console.log("Browser favicon: /favicon.ico");
-   * }
-   * ```
-   */
-  get branding() {
-    return this.#branding;
-  }
   /**
    * Register a tool. Input is validated against `inputSchema` before the callback
    * runs; results carrying `structuredContent` are type-checked against
@@ -1796,10 +1098,8 @@ var MCPServer = class _MCPServer {
    */
   resourceTemplate(definition, callback) {
     this.#assertNotStarted("resourceTemplate", definition.name);
-    const complete = definition.complete === void 0 ? void 0 : normalizeCompletions(definition.complete);
     this.#resourceTemplates.set(definition.name, {
       definition,
-      ...complete !== void 0 && { complete },
       callback
     });
     return this;
@@ -1816,23 +1116,6 @@ var MCPServer = class _MCPServer {
     });
     return this;
   }
-  async proxy(input) {
-    this.#assertOpen("proxy()");
-    const operation = (async () => {
-      const { isProxyConnection, mountProxyConnection, mountProxyServers } = await import("./proxy-DJYWGTGX.js");
-      if (isProxyConnection(input)) {
-        await mountProxyConnection(this.#proxyHost(), input);
-        return;
-      }
-      await mountProxyServers(this.#proxyHost(), input);
-    })();
-    this.#proxyOperations.add(operation);
-    try {
-      await operation;
-    } finally {
-      this.#proxyOperations.delete(operation);
-    }
-  }
   /**
    * Web-standard request handler for the whole app (MCP endpoint included) —
    * usable directly on serverless/edge runtimes or in tests.
@@ -1856,68 +1139,8 @@ var MCPServer = class _MCPServer {
    * ```
    */
   getHandler(options = {}) {
-    this.#assertOpen("getHandler()");
     const { fetch } = this.#ensureMounted("handler", void 0, options.bus);
-    return toFrameworkHandler(fetch);
-  }
-  /**
-   * Node `(req, res) => void` handler for composing with an existing
-   * `http.Server`. Uses the same internal `toNodeHandler` bridge as
-   * {@link MCPServer.listen}; MCPServer users do not need to import
-   * `mcp-use/node`.
-   *
-   * @example
-   * ```ts
-   * import { createServer } from "node:http";
-   * const httpServer = createServer(await server.getNodeHandler());
-   * httpServer.listen(3000);
-   * ```
-   */
-  async getNodeHandler() {
-    const { fetch } = this.#ensureMounted("handler");
-    const { toNodeHandler } = await import("./node-bridge.js");
-    return toNodeHandler({ fetch });
-  }
-  /**
-   * Register MCP operation middleware that intercepts JSON-RPC dispatch.
-   *
-   * Patterns use an `mcp:` prefix (for example `mcp:tools/call`, `mcp:*`).
-   * Exact methods may transform their typed result. The global `mcp:*` pattern
-   * is pass-through middleware. Middleware runs in registration order; call
-   * `next()` to continue the chain.
-   *
-   * @example
-   * ```ts
-   * server.use("mcp:tools/call", async (ctx, next) => {
-   *   console.log(`Calling tool: ${ctx.params.name}`);
-   *   return next();
-   * });
-   * ```
-   */
-  use(pattern, handler) {
-    this.#assertNotStarted("middleware", pattern);
-    this.#mcpMiddlewares.push(createMcpMiddlewareEntry(pattern, handler));
-    return this;
-  }
-  /**
-   * Register a read-only MCP observer. Unlike {@link MCPServer.use}, listeners
-   * cannot block, override, or mutate params. Throwing is logged and does not
-   * fail the request.
-   *
-   * Append `:complete` to run after the handler (for example
-   * `mcp:tools/call:complete`).
-   *
-   * @example
-   * ```ts
-   * server.on("mcp:tools/call", (ctx) => {
-   *   metrics.increment("tools.call", { tool: ctx.params.name });
-   * });
-   * ```
-   */
-  on(pattern, handler) {
-    this.#assertNotStarted("event listener", pattern);
-    this.#mcpEventListeners.push(createMcpEventListenerEntry(pattern, handler));
-    return this;
+    return fetch;
   }
   /**
    * Publish a tools-list change to v2 clients with active subscriptions.
@@ -1969,8 +1192,9 @@ var MCPServer = class _MCPServer {
    * Serve over HTTP on Node. Pass port `0` for an ephemeral port.
    *
    * Binds `config.host` (default `127.0.0.1`). Localhost-class binds get
-   * DNS-rebinding Host protection automatically. Origin validation is off
-   * unless `allowedOrigins` is set. To serve publicly set `host: "0.0.0.0"`;
+   * DNS-rebinding protection automatically: `Host` on every request,
+   * `Origin` only on non-GET/HEAD (sandboxed view iframes send
+   * `Origin: null` on asset GETs). To serve publicly set `host: "0.0.0.0"`;
    * behind a platform edge that is all that's needed, and `allowedHosts`
    * restricts direct exposure (additive — localhost-class values stay allowed).
    *
@@ -1984,7 +1208,6 @@ var MCPServer = class _MCPServer {
    * already mounted the app without Host validation.
    */
   async listen(port = 3e3) {
-    this.#assertOpen("listen()");
     this.#assertListenOAuthConfiguration();
     const { createServer } = await import("http");
     const { toNodeHandler } = await import("./node-bridge.js");
@@ -2049,42 +1272,14 @@ var MCPServer = class _MCPServer {
    * instance to serve again.
    */
   async close() {
-    this.#closed = true;
-    await Promise.allSettled([...this.#proxyOperations]);
-    const errors = [];
-    const proxyOwners = this.#proxyOwners.splice(0);
-    const ownerResults = await Promise.allSettled(
-      proxyOwners.map((owner) => owner.close())
-    );
-    for (const result of ownerResults) {
-      if (result.status === "rejected") errors.push(result.reason);
-    }
-    try {
-      await this.#handler?.close();
-    } catch (error) {
-      errors.push(error);
-    }
+    await this.#handler?.close();
     const httpServer = this.#httpServer;
     if (httpServer !== void 0) {
-      try {
-        await new Promise((resolve, reject) => {
-          httpServer.close((err) => err ? reject(err) : resolve());
-        });
-        this.#httpServer = void 0;
-      } catch (error) {
-        errors.push(error);
-      }
-    }
-    if (errors.length > 0) {
-      throw new AggregateError(errors, "Failed to close MCP server cleanly");
-    }
-  }
-  #assertOpen(operation) {
-    if (!this.#closed) return;
-    if (operation !== void 0) {
-      throw new Error(`Cannot call ${operation} after the server has closed.`);
+      await new Promise((resolve, reject) => {
+        httpServer.close((err) => err ? reject(err) : resolve());
+      });
+      this.#httpServer = void 0;
     }
-    throw new Error("Cannot use the server after it has closed.");
   }
   #basePath() {
     return this.#config.basePath ?? "/mcp";
@@ -2131,79 +1326,40 @@ var MCPServer = class _MCPServer {
       );
     }
   }
-  #proxyHost() {
-    return {
-      isStarted: () => this.#handler !== void 0,
-      hasTool: (name) => this.#tools.has(name),
-      hasResource: (name) => this.#resources.has(name),
-      hasPrompt: (name) => this.#prompts.has(name),
-      registerTool: (definition, callback) => {
-        this.#assertNotStarted("tool", definition.name);
-        this.#tools.set(definition.name, {
-          definition,
-          callback
-        });
-      },
-      registerResource: (definition, callback) => {
-        this.#assertNotStarted("resource", definition.name);
-        this.#resources.set(definition.name, {
-          definition,
-          callback
-        });
-      },
-      registerPrompt: (definition, callback) => {
-        this.#assertNotStarted("prompt", definition.name);
-        this.#prompts.set(definition.name, {
-          definition,
-          callback
-        });
-      },
-      trackOwner: (owner) => {
-        this.#proxyOwners.push(owner);
-      }
-    };
-  }
   /**
    * Effective Host/Origin allowlists for a mount mode; `undefined` means the
    * corresponding validation is off.
    *
    * Configured lists are additive to the localhost-class allowlists, so local
    * runs keep working when a deployment hostname is added. With nothing
-   * configured, `listen()` on a localhost-class bind validates Host against the
+   * configured, `listen()` on a localhost-class bind validates against the
    * localhost lists (the DNS-rebinding threat model), while `getHandler()` —
-   * which never binds — applies no validation. Origin validation is off unless
-   * `allowedOrigins` is set explicitly (SDK-aligned: the handler is open by
-   * default). When enabled, Origin is checked only on non-GET/HEAD requests.
+   * which never binds — applies no validation. `allowedOrigins` defaults to
+   * mirroring the effective Host allowlist. Origin validation runs only on
+   * non-GET/HEAD requests.
    */
   #validationPolicy(mode) {
     const { host = "127.0.0.1", allowedHosts, allowedOrigins } = this.#config;
     const localhostBind = ["127.0.0.1", "localhost", "::1"].includes(host);
     const hosts = allowedHosts !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedHostnames(), ...allowedHosts])] : mode === "listen" && localhostBind ? localhostAllowedHostnames() : void 0;
-    const origins = allowedOrigins !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedOrigins(), ...allowedOrigins])] : void 0;
+    const origins = allowedOrigins !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedOrigins(), ...allowedOrigins])] : hosts;
     return { hosts, origins };
   }
   #ensureMounted(mode, listenPort, bus) {
-    this.#assertOpen();
     if (this.#fetchHandler === void 0 || this.#handler === void 0) {
       const { hosts, origins } = this.#validationPolicy(mode);
       const basePath = this.#basePath();
-      const nestedBasePath = basePath === "/" ? "" : basePath;
       const middlewares = [
         jsonBodyMiddleware(),
         requestLogger(this.#config.logging)
       ];
-      const corsConfig = this.#config.cors;
-      if (corsConfig !== void 0) {
-        middlewares.unshift(corsFetchMiddleware(corsConfig));
-      }
-      const deferViewCors = isGlobalCorsEnabled(corsConfig);
       if (hosts !== void 0) {
         middlewares.unshift(hostValidationMiddleware(hosts));
-      }
-      if (origins !== void 0) {
-        middlewares.push(originValidationMiddleware(origins));
-      }
-      if (hosts === void 0) {
+        middlewares.push(originValidationMiddleware(origins ?? hosts));
+      } else {
+        if (origins !== void 0) {
+          middlewares.push(originValidationMiddleware(origins));
+        }
         if (mode === "listen") {
           console.warn(
             `[mcp-use] listen() is serving on ${this.#config.host} without Host validation. Behind a platform edge that only routes your own domains this is expected; if this process is reachable directly, set allowedHosts to restrict it.`
@@ -2233,7 +1389,7 @@ var MCPServer = class _MCPServer {
           }
         }
       );
-      let protectWithBearer = async (_request, next) => next();
+      let mcpRouteHandler = mcpFetch;
       if (resource !== void 0) {
         const provider = this.#config.oauth;
         const providerOptions = getOAuthProviderOptions(provider);
@@ -2244,89 +1400,32 @@ var MCPServer = class _MCPServer {
             requiredScopes: providerOptions.requiredScopes
           }
         });
-        protectWithBearer = async (request, next) => {
+        mcpRouteHandler = async (request) => {
           const result = await gate(request);
           if (result instanceof Response) {
             return result;
           }
           const bag = getRequestBag(request);
           bag.authInfo = result;
-          return next();
+          return mcpFetch(request);
         };
       }
-      const mcpRouteHandler = (request) => protectWithBearer(request, () => mcpFetch(request));
-      const endpointHandler = async (request) => {
-        if (!isHtmlNavigationRequest(request)) {
-          return mcpRouteHandler(request);
-        }
-        const respond = async () => {
-          const { createLandingPageResponse } = await import("./landing-handler-WE66NIGB.js");
-          return createLandingPageResponse(
-            request,
-            basePath,
-            this.#config,
-            this.#branding,
-            this.#tools.values(),
-            this.#prompts.values(),
-            this.#resources.values()
-          );
-        };
-        if (resource !== void 0 && this.#config.publicLandingPage !== true) {
-          return protectWithBearer(request, respond);
-        }
-        return respond();
-      };
       const routes = [];
-      const brandingDevMode = this.#viewsPrimed ? this.#viewsDevMode : process.env["NODE_ENV"] !== "production";
-      const faviconHandler = createFaviconHandler(this.#branding, {
-        dev: brandingDevMode,
-        projectRoot: this.#viewsProjectRoot,
-        deferCors: deferViewCors
-      });
-      if (faviconHandler !== void 0) {
-        routes.push({
-          match: (request) => new URL(request.url).pathname === "/favicon.ico",
-          handler: faviconHandler
-        });
-      }
       const viewHandler = createViewPublicHandler(basePath, this.#views, {
-        dev: this.#viewsPrimed ? this.#viewsDevMode : brandingDevMode,
-        projectRoot: this.#viewsProjectRoot,
-        enabled: hasLocalBrandingAsset(this.#branding),
-        deferCors: deferViewCors
+        dev: this.#viewsDevMode,
+        projectRoot: this.#viewsProjectRoot
       });
       if (viewHandler !== void 0) {
         routes.push({
           match: (request) => request.method === "GET" || request.method === "HEAD" ? new URL(request.url).pathname.startsWith(
-            `${nestedBasePath}/_mcp-use/public/`
+            `${basePath}/_mcp-use/public/`
           ) : false,
           handler: viewHandler
         });
       }
-      if (!this.#viewsDevMode) {
-        const viewAssetsHandler = createViewAssetsHandler(
-          basePath,
-          this.#views,
-          { projectRoot: this.#viewsProjectRoot, deferCors: deferViewCors }
-        );
-        if (viewAssetsHandler !== void 0) {
-          routes.push({
-            match: (request) => request.method === "GET" || request.method === "HEAD" ? new URL(request.url).pathname.startsWith(
-              `${nestedBasePath}/_mcp-use/views/`
-            ) : false,
-            handler: viewAssetsHandler
-          });
-        }
-      }
       const inspectorHandler = createInspectorHandler(this.#config.inspector, {
         serverName: this.#config.name,
-        basePath,
-        ...faviconHandler !== void 0 && {
-          faviconHref: "/favicon.ico",
-          ...this.#branding.faviconMimeType !== void 0 && {
-            faviconType: this.#branding.faviconMimeType
-          }
-        }
+        basePath
       });
       if (inspectorHandler !== void 0) {
         routes.push({
@@ -2335,14 +1434,14 @@ var MCPServer = class _MCPServer {
               return false;
             }
             const pathname = new URL(request.url).pathname;
-            return matchesInspectorShellPath(pathname, basePath);
+            return pathname === `${basePath}/inspector` || pathname === `${basePath}/inspector/`;
           },
           handler: inspectorHandler
         });
       }
       routes.push({
         match: (request) => matchesPath(request, basePath),
-        handler: endpointHandler
+        handler: mcpRouteHandler
       });
       const terminal = routeFetch(routes);
       this.#fetchHandler = composeFetch(terminal, ...middlewares);
@@ -2415,17 +1514,7 @@ var MCPServer = class _MCPServer {
         name,
         version,
         ...title !== void 0 && { title },
-        ...description !== void 0 && { description },
-        ...this.#branding.websiteUrl !== void 0 && {
-          websiteUrl: this.#branding.websiteUrl
-        },
-        ...this.#branding.icons !== void 0 && {
-          icons: resolveImplementationIcons(
-            this.#branding.icons,
-            ctx.requestInfo,
-            this.#basePath()
-          )
-        }
+        ...description !== void 0 && { description }
       },
       {
         capabilities: {
@@ -2441,7 +1530,7 @@ var MCPServer = class _MCPServer {
       }
     );
     const request = ctx.requestInfo;
-    const viewMetaOptions = request !== void 0 ? { request, hmrWs: this.#viewsDevMode } : { hmrWs: this.#viewsDevMode };
+    const servingOrigin = request !== void 0 ? resolveRequestOrigin(request) : "";
     const basePath = this.#basePath();
     for (const entry of this.#tools.values()) {
       this.#registerTool(server, entry);
@@ -2460,108 +1549,15 @@ var MCPServer = class _MCPServer {
         server,
         viewName,
         viewEntry,
-        viewMetaOptions,
+        servingOrigin,
         basePath
       );
     }
-    this.#wrapListHandlers(server);
     return server;
   }
-  #createMiddlewareContext(method, params, ctx) {
-    return {
-      method,
-      params,
-      ...ctx.sessionId !== void 0 && {
-        session: { sessionId: ctx.sessionId }
-      },
-      ...ctx.http?.authInfo !== void 0 && { auth: ctx.http.authInfo },
-      state: /* @__PURE__ */ new Map()
-    };
-  }
-  #runMcpHook(method, ctx, innerFn) {
-    return runMcpOperation(
-      this.#mcpMiddlewares,
-      this.#mcpEventListeners,
-      method,
-      ctx,
-      innerFn
-    );
-  }
-  /**
-   * Wrap native SDK list handlers with the MCP middleware chain.
-   *
-   * ponytail: uses SDK-private `_requestHandlers`; pin compile-time test.
-   *
-   * @internal
-   */
-  #wrapListHandlers(server) {
-    const handlers = server.server._requestHandlers;
-    if (handlers === void 0) {
-      return;
-    }
-    const wrapListMethod = (method, resultKey, transform) => {
-      const original = handlers.get(method);
-      if (original === void 0) {
-        return;
-      }
-      if (original.__mcpListWrapped) {
-        return;
-      }
-      const wrapped = async (request, extra) => {
-        const serverContext = extra;
-        const params = request.params ?? {};
-        const mwCtx = this.#createMiddlewareContext(
-          method,
-          params,
-          serverContext
-        );
-        let originalEnvelope;
-        const innerFn = async () => {
-          const downstreamRequest = withMcpMiddlewareParams(
-            request,
-            mwCtx.params
-          );
-          const result = await original(downstreamRequest, extra);
-          if (typeof result !== "object" || result === null) {
-            throw new TypeError(
-              `[mcp-use] ${method} handler returned a non-object result`
-            );
-          }
-          originalEnvelope = result;
-          const items = originalEnvelope[resultKey];
-          if (!Array.isArray(items)) {
-            throw new TypeError(
-              `[mcp-use] ${method} handler result is missing a ${resultKey} array`
-            );
-          }
-          return items;
-        };
-        const filtered = await this.#runMcpHook(method, mwCtx, innerFn);
-        if (!Array.isArray(filtered)) {
-          throw new TypeError(
-            `[mcp-use] ${method} middleware must return a ${resultKey} array`
-          );
-        }
-        const emitted = transform?.(filtered) ?? filtered;
-        return {
-          ...originalEnvelope,
-          [resultKey]: emitted
-        };
-      };
-      wrapped.__mcpListWrapped = true;
-      handlers.set(method, wrapped);
-    };
-    wrapListMethod("tools/list", "tools", omitToolSchemaDialects);
-    wrapListMethod("resources/list", "resources");
-    wrapListMethod("prompts/list", "prompts");
-  }
   #registerTool(server, { definition, callback }) {
     const view = definition.view;
-    const toolMeta = buildToolUiMeta(
-      view?.name,
-      definition.visibility,
-      definition._meta
-    );
+    const toolUiMeta = buildToolUiMeta(view?.name, definition.visibility);
     const config = {
       ...definition.title !== void 0 && { title: definition.title },
       ...definition.description !== void 0 && {
@@ -2573,60 +1569,51 @@ var MCPServer = class _MCPServer {
       ...definition.outputSchema !== void 0 && {
         outputSchema: definition.outputSchema
       },
-      ...toolMeta !== void 0 && { _meta: toolMeta }
+      ...toolUiMeta !== void 0 && { _meta: toolUiMeta }
     };
     const wireResultMeta = view !== void 0 ? buildToolResultUiMeta(view.name) : void 0;
     const inputSchema = resolveToolInputSchema(definition);
-    const invokeTool = async (args, ctx) => {
-      const mwCtx = this.#createMiddlewareContext(
-        "tools/call",
-        {
-          name: definition.name,
-          arguments: args,
-          ...ctx.mcpReq._meta !== void 0 && { _meta: ctx.mcpReq._meta }
-        },
-        ctx
+    if (inputSchema !== void 0) {
+      server.registerTool(
+        definition.name,
+        { ...config, inputSchema },
+        async (args, ctx) => {
+          const params = args;
+          const result = await callback(params, this.#toRequestContext(ctx));
+          if (isInputRequiredResult(result) || wireResultMeta === void 0 || result.isError === true) {
+            return result;
+          }
+          return {
+            ...result,
+            _meta: { ...result._meta, ...wireResultMeta }
+          };
+        }
       );
-      const innerFn = async () => {
-        const effectiveArgs = mwCtx.params.arguments ?? {};
-        const result = await callback(
-          effectiveArgs,
-          this.#toRequestContext(ctx)
-        );
-        if (isInputRequiredResult2(result) || wireResultMeta === void 0 || result.isError === true) {
+    } else {
+      server.registerTool(definition.name, config, async (ctx) => {
+        const result = await callback({}, this.#toRequestContext(ctx));
+        if (isInputRequiredResult(result) || wireResultMeta === void 0 || result.isError === true) {
           return result;
         }
         return {
           ...result,
           _meta: { ...result._meta, ...wireResultMeta }
         };
-      };
-      return await this.#runMcpHook("tools/call", mwCtx, innerFn);
-    };
-    if (inputSchema !== void 0) {
-      server.registerTool(
-        definition.name,
-        { ...config, inputSchema },
-        async (args, ctx) => invokeTool(args, ctx)
-      );
-    } else {
-      server.registerTool(
-        definition.name,
-        config,
-        async (ctx) => invokeTool({}, ctx)
-      );
+      });
     }
   }
-  #registerViewResource(server, viewName, entry, metaOptions, basePath) {
+  #registerViewResource(server, viewName, entry, servingOrigin, basePath) {
     const uri = viewResourceUri(viewName);
     const authorFacts = this.#viewResourceFacts(
       this.#viewBindings.get(viewName)?.config
     );
+    const hmrWs = this.#viewsDevMode;
     const resourceConfig = viewResourceConfig(
       viewName,
       entry,
       authorFacts,
-      metaOptions
+      servingOrigin,
+      { hmrWs }
     );
     server.registerResource(
       viewName,
@@ -2634,24 +1621,15 @@ var MCPServer = class _MCPServer {
       resourceConfig,
       async (readUri, ctx) => {
         const req = ctx.http?.req;
-        const readOptions = req !== void 0 ? {
-          request: req,
-          ...metaOptions.hmrWs === true ? { hmrWs: true } : {}
-        } : metaOptions.hmrWs === true ? { hmrWs: true } : {};
-        const assetsBase = req !== void 0 ? resolveAssetsBase(req) : metaOptions.request !== void 0 ? resolveAssetsBase(metaOptions.request) : "";
-        const html = synthesizeViewDocument(
-          entry,
-          assetsBase,
-          basePath,
-          viewName
-        );
+        const origin = req !== void 0 ? resolveRequestOrigin(req) : servingOrigin;
+        const html = synthesizeViewDocument(entry, origin, basePath);
         return {
           contents: [
             {
               uri: readUri.href,
               mimeType: resourceConfig.mimeType,
               text: html,
-              _meta: buildResourceUiMeta(authorFacts, readOptions)
+              _meta: buildResourceUiMeta(authorFacts, origin, { hmrWs })
             }
           ]
         };
@@ -2669,36 +1647,14 @@ var MCPServer = class _MCPServer {
         },
         ...definition.mimeType !== void 0 && {
           mimeType: definition.mimeType
-        },
-        ...definition.annotations !== void 0 && {
-          annotations: definition.annotations
-        },
-        ...definition._meta !== void 0 && {
-          _meta: { ...definition._meta }
         }
       },
-      async (uri, ctx) => {
-        const mwCtx = this.#createMiddlewareContext(
-          "resources/read",
-          {
-            uri: uri.href,
-            ...ctx.mcpReq._meta !== void 0 && { _meta: ctx.mcpReq._meta }
-          },
-          ctx
-        );
-        const innerFn = async () => callback(uri, this.#toRequestContext(ctx));
-        return await this.#runMcpHook(
-          "resources/read",
-          mwCtx,
-          innerFn
-        );
-      }
+      async (uri, ctx) => callback(uri, this.#toRequestContext(ctx))
     );
   }
-  #registerResourceTemplate(server, { definition, callback, complete }) {
+  #registerResourceTemplate(server, { definition, callback }) {
     const template = new ResourceTemplate(definition.uriTemplate, {
-      list: void 0,
-      ...complete !== void 0 && { complete }
+      list: void 0
     });
     server.registerResource(
       definition.name,
@@ -2710,34 +1666,13 @@ var MCPServer = class _MCPServer {
         },
         ...definition.mimeType !== void 0 && {
           mimeType: definition.mimeType
-        },
-        ...definition.annotations !== void 0 && {
-          annotations: definition.annotations
-        },
-        ...definition._meta !== void 0 && {
-          _meta: { ...definition._meta }
         }
       },
-      async (uri, variables, ctx) => {
-        const mwCtx = this.#createMiddlewareContext(
-          "resources/read",
-          {
-            uri: uri.href,
-            ...ctx.mcpReq._meta !== void 0 && { _meta: ctx.mcpReq._meta }
-          },
-          ctx
-        );
-        const innerFn = async () => callback(
-          uri,
-          variables,
-          this.#toRequestContext(ctx)
-        );
-        return await this.#runMcpHook(
-          "resources/read",
-          mwCtx,
-          innerFn
-        );
-      }
+      async (uri, variables, ctx) => callback(
+        uri,
+        variables,
+        this.#toRequestContext(ctx)
+      )
     );
   }
   #viewResourceFacts(viewConfig) {
@@ -2765,30 +1700,17 @@ var MCPServer = class _MCPServer {
         description: definition.description
       }
     };
-    const invokePrompt = async (args, ctx) => {
-      const mwCtx = this.#createMiddlewareContext(
-        "prompts/get",
-        {
-          name: definition.name,
-          arguments: args,
-          ...ctx.mcpReq._meta !== void 0 && { _meta: ctx.mcpReq._meta }
-        },
-        ctx
-      );
-      const innerFn = async () => {
-        const effectiveArgs = mwCtx.params.arguments ?? {};
-        return callback(effectiveArgs, this.#toRequestContext(ctx));
-      };
-      return await this.#runMcpHook("prompts/get", mwCtx, innerFn);
-    };
     if (definition.schema !== void 0) {
       server.registerPrompt(
         definition.name,
         { ...config, argsSchema: definition.schema },
-        async (args, ctx) => invokePrompt(args, ctx)
+        async (args, ctx) => {
+          const params = args;
+          return callback(params, this.#toRequestContext(ctx));
+        }
       );
     } else {
-      const handler = async (ctx) => invokePrompt({}, ctx);
+      const handler = async (ctx) => callback({}, this.#toRequestContext(ctx));
       server.registerPrompt(
         definition.name,
         config,
@@ -2810,32 +1732,46 @@ import {
   createRequestStateCodec,
   inputRequired as inputRequired2,
   inputResponse as inputResponse2,
-  isInputRequiredResult as isInputRequiredResult3
+  isInputRequiredResult as isInputRequiredResult2
 } from "@modelcontextprotocol/server";
+
+// src/completable.ts
+import {
+  completable as sdkCompletable
+} from "@modelcontextprotocol/server";
+function completable(schema, complete) {
+  if (typeof complete === "function") {
+    return sdkCompletable(
+      schema,
+      (value, context) => complete(String(value ?? ""), context)
+    );
+  }
+  const values = complete.map(String);
+  return sdkCompletable(schema, (value) => {
+    const prefix = String(value ?? "").toLowerCase();
+    return values.filter((v) => v.toLowerCase().startsWith(prefix));
+  });
+}
 export {
   MCPServer,
   acceptedContent,
   completable,
   composeFetch,
-  composeMiddleware,
-  createMcpEventListenerEntry,
-  createMcpMiddlewareEntry,
   createMcpMount,
   createRequestStateCodec,
   getRequestBag,
   hostValidationMiddleware,
   inputRequired2 as inputRequired,
   inputResponse2 as inputResponse,
-  isInputRequiredResult3 as isInputRequiredResult,
+  isInputRequiredResult2 as isInputRequiredResult,
   jsonBodyMiddleware,
   matchesPath,
   matchesPathPrefix,
-  matchesPattern,
+  mountMcp,
   originValidationMiddleware,
   pathnameOf,
   registerViews,
   requestLogger,
-  routeFetch,
-  toFrameworkHandler
+  routeFetch
 };
 //# sourceMappingURL=index.js.map