mcp-use 2.0.0-beta.2 → 2.0.0-beta.20

package/dist/index.js

@@ -1,27 +1,49 @@
+import {
+  resolvePublicFilePath,
+  servePublicFile
+} from "./chunk-G62AMJHS.js";
+import {
+  synthesizeViewDocument
+} from "./chunk-EAPJUSK7.js";
+import {
+  hasExplicitAssetsBase,
+  originFromAssetsBase,
+  resolveAssetsBase,
+  resolveServerOrigin
+} from "./chunk-FC2Z2VFO.js";
+import {
+  registerOpenAPITools
+} from "./chunk-AATFAERC.js";
+import {
+  completable,
+  normalizeCompletions
+} from "./chunk-KIZ72TIK.js";
 import {
   authInfoFromRequest,
-  composeFetch,
   getOAuthProtectedResourceMetadataUrl,
+  oauthMetadata,
+  requireBearerAuth
+} from "./chunk-Z326HADF.js";
+import {
+  composeFetch,
   getRequestBag,
   hostValidationMiddleware,
+  isHtmlNavigationRequest,
   jsonBodyMiddleware,
   matchesPath,
   matchesPathPrefix,
-  oauthMetadata,
   originValidationMiddleware,
+  pathUnderBase,
   pathnameOf,
-  requireBearerAuth,
-  routeFetch
-} from "./chunk-SFI2T6TE.js";
+  routeFetch,
+  toFrameworkHandler
+} from "./chunk-QUUANIE4.js";
 import {
   getOAuthProviderOptions,
   resolveConfiguredOAuthResource,
   resolveLocalOAuthResource,
   wrapOAuthTokenVerifier
 } from "./chunk-DPL7OEXC.js";
-import {
-  registerOpenAPITools
-} from "./chunk-AATFAERC.js";
 
 // src/server.ts
 import {
@@ -29,9 +51,236 @@ import {
   localhostAllowedOrigins,
   McpServer as SdkMcpServer,
   ResourceTemplate,
-  isInputRequiredResult
+  isInputRequiredResult as isInputRequiredResult2
 } from "@modelcontextprotocol/server";
 
+// src/branding.ts
+var FAVICON_CACHE_CONTROL = "public, max-age=31536000, immutable";
+var FAVICON_REDIRECT_CACHE_CONTROL = "public, max-age=300";
+function protocolOf(value) {
+  const match = /^([a-z][a-z\d+.-]*):/i.exec(value);
+  return match?.[1]?.toLowerCase();
+}
+function publicAssetPath(basePath, source) {
+  const prefix = basePath === "/" ? "" : basePath;
+  return `${prefix}/_mcp-use/public/${source.split("/").map((segment) => encodeURIComponent(segment)).join("/")}`;
+}
+function isLocalPublicSource(source) {
+  return protocolOf(source) === void 0;
+}
+function selectFaviconFromIcons(icons) {
+  return icons[0];
+}
+function assertLocalPublicSource(source, field) {
+  if (source.startsWith("/") || source.includes("\\") || source.includes("?") || source.includes("#") || source.split("/").some((segment) => segment === "" || segment === "..")) {
+    throw new TypeError(
+      `${field} must be an http(s) URL, image data URL, or safe path relative to public/`
+    );
+  }
+}
+function parseDataImage(source, field) {
+  const comma = source.indexOf(",");
+  if (comma < 0) {
+    throw new TypeError(`${field} must be a valid image data URL`);
+  }
+  const metadata = source.slice(5, comma);
+  const payload = source.slice(comma + 1);
+  const parts = metadata.split(";");
+  const mimeType = parts[0]?.toLowerCase() ?? "";
+  if (!mimeType.startsWith("image/")) {
+    throw new TypeError(`${field} data URL must use an image MIME type`);
+  }
+  try {
+    if (parts.includes("base64")) {
+      const binary = atob(payload);
+      return {
+        mimeType,
+        bytes: Uint8Array.from(binary, (character) => character.charCodeAt(0))
+      };
+    }
+    return {
+      mimeType,
+      bytes: new TextEncoder().encode(decodeURIComponent(payload))
+    };
+  } catch {
+    throw new TypeError(`${field} must be a valid image data URL`);
+  }
+}
+function assertBrandingSource(source, field) {
+  if (typeof source !== "string" || source.length === 0) {
+    throw new TypeError(`${field} must be a non-empty string`);
+  }
+  const protocol = protocolOf(source);
+  if (protocol === void 0) {
+    assertLocalPublicSource(source, field);
+    return source;
+  }
+  if (protocol === "data") {
+    parseDataImage(source, field);
+    return source;
+  }
+  if (protocol !== "http" && protocol !== "https") {
+    throw new TypeError(
+      `${field} must be an http(s) URL, image data URL, or safe path relative to public/`
+    );
+  }
+  try {
+    new URL(source);
+  } catch {
+    throw new TypeError(`${field} must be a valid absolute http(s) URL`);
+  }
+  return source;
+}
+function normalizeServerBranding(config) {
+  let websiteUrl;
+  if (config.websiteUrl !== void 0) {
+    if (typeof config.websiteUrl !== "string" || config.websiteUrl.length === 0) {
+      throw new TypeError(
+        "websiteUrl must be a non-empty absolute http(s) URL"
+      );
+    }
+    let parsed;
+    try {
+      parsed = new URL(config.websiteUrl);
+    } catch {
+      throw new TypeError(
+        "websiteUrl must be a non-empty absolute http(s) URL"
+      );
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new TypeError(
+        "websiteUrl must be a non-empty absolute http(s) URL"
+      );
+    }
+    websiteUrl = config.websiteUrl;
+  }
+  let icons;
+  if (config.icons !== void 0) {
+    if (!Array.isArray(config.icons)) {
+      throw new TypeError("icons must be an array of MCP Icon objects");
+    }
+    icons = Object.freeze(
+      config.icons.map((value, index) => {
+        if (typeof value !== "object" || value === null) {
+          throw new TypeError(`icons[${index}] must be an MCP Icon object`);
+        }
+        const icon = value;
+        const src = assertBrandingSource(icon["src"], `icons[${index}].src`);
+        const mimeType = icon["mimeType"];
+        if (mimeType !== void 0 && (typeof mimeType !== "string" || !mimeType.toLowerCase().startsWith("image/"))) {
+          throw new TypeError(
+            `icons[${index}].mimeType must be an image MIME type when provided`
+          );
+        }
+        const sizes = icon["sizes"];
+        if (sizes !== void 0 && (!Array.isArray(sizes) || sizes.some((size) => typeof size !== "string" || size.length === 0))) {
+          throw new TypeError(
+            `icons[${index}].sizes must be an array of non-empty strings when provided`
+          );
+        }
+        const normalizedSizes = sizes === void 0 ? void 0 : sizes.map((size) => size);
+        const theme = icon["theme"];
+        if (theme !== void 0 && theme !== "light" && theme !== "dark") {
+          throw new TypeError(
+            `icons[${index}].theme must be "light" or "dark" when provided`
+          );
+        }
+        return Object.freeze({
+          src,
+          ...mimeType !== void 0 && { mimeType },
+          ...normalizedSizes !== void 0 && {
+            sizes: Object.freeze(normalizedSizes)
+          },
+          ...theme !== void 0 && { theme }
+        });
+      })
+    );
+  }
+  const explicitFavicon = config.favicon === void 0 ? void 0 : assertBrandingSource(config.favicon, "favicon");
+  const inferred = explicitFavicon === void 0 ? selectFaviconFromIcons(icons ?? []) : void 0;
+  const favicon = explicitFavicon ?? inferred?.src;
+  const faviconMimeType = inferred?.mimeType ?? icons?.find((icon) => icon.src === explicitFavicon)?.mimeType;
+  return Object.freeze({
+    ...favicon !== void 0 && { favicon },
+    ...faviconMimeType !== void 0 && { faviconMimeType },
+    ...icons !== void 0 && { icons },
+    ...websiteUrl !== void 0 && { websiteUrl }
+  });
+}
+function resolveImplementationIcons(icons, request, basePath) {
+  if (icons === void 0) {
+    return void 0;
+  }
+  return icons.map((icon) => ({
+    ...icon,
+    src: request !== void 0 && isLocalPublicSource(icon.src) ? `${resolveAssetsBase(request)}${publicAssetPath(basePath, icon.src)}` : icon.src,
+    ...icon.sizes !== void 0 && { sizes: [...icon.sizes] }
+  }));
+}
+function hasLocalBrandingAsset(branding) {
+  return branding.favicon !== void 0 && isLocalPublicSource(branding.favicon) || branding.icons?.some((icon) => isLocalPublicSource(icon.src)) === true;
+}
+function createFaviconHandler(branding, options) {
+  const source = branding.favicon;
+  if (source === void 0) {
+    return void 0;
+  }
+  return async (request) => {
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      return new Response("Method Not Allowed", {
+        status: 405,
+        headers: { Allow: "GET, HEAD" }
+      });
+    }
+    if (new URL(request.url).pathname !== "/favicon.ico") {
+      return new Response("Not Found", { status: 404 });
+    }
+    const protocol = protocolOf(source);
+    if (protocol === "http" || protocol === "https") {
+      return new Response(null, {
+        status: 307,
+        headers: {
+          Location: source,
+          "Cache-Control": FAVICON_REDIRECT_CACHE_CONTROL
+        }
+      });
+    }
+    if (protocol === "data") {
+      const data = parseDataImage(source, "favicon");
+      return new Response(
+        request.method === "HEAD" ? null : data.bytes.buffer,
+        {
+          status: 200,
+          headers: {
+            "Content-Type": branding.faviconMimeType ?? data.mimeType,
+            "Cache-Control": FAVICON_CACHE_CONTROL,
+            "X-Content-Type-Options": "nosniff"
+          }
+        }
+      );
+    }
+    const { join } = await import("path");
+    const publicRoot = options.dev ? join(options.projectRoot, "public") : join(options.projectRoot, ".mcp-use/build/views/public");
+    const diskPath = await resolvePublicFilePath(publicRoot, source);
+    if (diskPath === null) {
+      return new Response("Not Found", {
+        status: 404,
+        headers: { "Cache-Control": "no-store" }
+      });
+    }
+    const response = await servePublicFile(diskPath, {
+      ...options.deferCors === true && { deferCors: true },
+      ...request.method === "HEAD" && { head: true }
+    });
+    response.headers.set("Cache-Control", FAVICON_CACHE_CONTROL);
+    response.headers.set("X-Content-Type-Options", "nosniff");
+    if (branding.faviconMimeType !== void 0) {
+      response.headers.set("Content-Type", branding.faviconMimeType);
+    }
+    return response;
+  };
+}
+
 // src/config.ts
 function assertServerConfig(config) {
   if (config.basePath !== void 0) {
@@ -222,12 +471,318 @@ function toAuthenticatedRequestContext(ctx) {
   };
 }
 
+// src/middleware/cors.ts
+var DEFAULT_METHODS = ["GET", "HEAD", "POST", "OPTIONS"];
+var DEFAULT_ALLOWED_HEADERS = [
+  "Content-Type",
+  "Authorization",
+  "mcp-protocol-version",
+  "mcp-method",
+  "mcp-name"
+];
+function resolveAllowedOrigin(origin, requestOrigin) {
+  if (origin === void 0) {
+    return requestOrigin;
+  }
+  if (typeof origin === "function") {
+    return origin(requestOrigin);
+  }
+  if (origin === "*") {
+    return "*";
+  }
+  if (Array.isArray(origin)) {
+    if (requestOrigin !== null && origin.includes(requestOrigin)) {
+      return requestOrigin;
+    }
+    return null;
+  }
+  return origin;
+}
+function corsHeaders(options, request) {
+  if (request.headers.has("Access-Control-Allow-Origin")) {
+    return void 0;
+  }
+  const requestOrigin = request.headers.get("Origin");
+  const allowedOrigin = resolveAllowedOrigin(options.origin, requestOrigin);
+  if (allowedOrigin === null) {
+    return void 0;
+  }
+  const headers = {
+    "Access-Control-Allow-Origin": allowedOrigin,
+    "Access-Control-Allow-Methods": options.methods.join(", "),
+    "Access-Control-Allow-Headers": options.allowedHeaders.join(", ")
+  };
+  if (options.credentials) {
+    headers["Access-Control-Allow-Credentials"] = "true";
+  }
+  if (allowedOrigin !== "*") {
+    headers.Vary = "Origin";
+  }
+  return headers;
+}
+function mergeCorsHeaders(response, headers) {
+  if (response.headers.has("Access-Control-Allow-Origin")) {
+    return response;
+  }
+  const merged = new Headers(response.headers);
+  const corsHeaders2 = new Headers(headers);
+  corsHeaders2.forEach((value, key) => {
+    merged.set(key, value);
+  });
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: merged
+  });
+}
+function corsFetchMiddleware(options) {
+  const enabled = options.enabled !== false;
+  if (!enabled) {
+    return async (_request, next) => next();
+  }
+  const resolved = {
+    ...options.origin !== void 0 && { origin: options.origin },
+    methods: options.methods ?? DEFAULT_METHODS,
+    allowedHeaders: options.allowedHeaders ?? DEFAULT_ALLOWED_HEADERS,
+    credentials: options.credentials ?? false
+  };
+  return async (request, next) => {
+    const headers = corsHeaders(resolved, request);
+    if (headers === void 0) {
+      return next();
+    }
+    if (request.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers });
+    }
+    const response = await next();
+    return mergeCorsHeaders(response, headers);
+  };
+}
+function isGlobalCorsEnabled(cors) {
+  return cors !== void 0 && cors.enabled !== false;
+}
+
+// src/middleware/mcp-middleware.ts
+import {
+  CallToolResultSchema,
+  GetPromptResultSchema,
+  ListPromptsResultSchema,
+  ListResourcesResultSchema,
+  ListToolsResultSchema,
+  ReadResourceResultSchema
+} from "@modelcontextprotocol/core";
+import { isInputRequiredResult } from "@modelcontextprotocol/server";
+var MCP_MIDDLEWARE_METHODS = [
+  "tools/call",
+  "tools/list",
+  "resources/read",
+  "resources/list",
+  "prompts/get",
+  "prompts/list"
+];
+function withMcpMiddlewareParams(request, params) {
+  if (typeof request !== "object" || request === null || Array.isArray(request)) {
+    throw new TypeError(
+      "[mcp-use] MCP middleware received an invalid downstream request"
+    );
+  }
+  return { ...request, params };
+}
+function createMcpMiddlewareEntry(pattern, handler) {
+  const normalizedPattern = normalizeMcpMiddlewarePattern(pattern);
+  const invoke = handler;
+  if (normalizedPattern !== "*" && !isMcpMiddlewareMethod(normalizedPattern)) {
+    throw new TypeError(
+      `Unsupported MCP middleware pattern "${pattern}". Use an exact MCP method or "mcp:*".`
+    );
+  }
+  if (normalizedPattern === "*") {
+    return {
+      pattern: normalizedPattern,
+      handler: async (ctx, next) => {
+        let downstreamCalled = false;
+        let downstreamResult;
+        await invoke(ctx, async () => {
+          downstreamResult = await next();
+          downstreamCalled = true;
+        });
+        if (!downstreamCalled) {
+          throw new Error(
+            `Wildcard MCP middleware "${normalizedPattern}" must call next()`
+          );
+        }
+        return downstreamResult;
+      }
+    };
+  }
+  return {
+    pattern: normalizedPattern,
+    handler: (ctx, next) => invoke(ctx, next)
+  };
+}
+function createMcpEventListenerEntry(pattern, handler) {
+  const { pattern: normalizedPattern, phase } = parseMcpPattern(pattern);
+  const invoke = handler;
+  return {
+    pattern: normalizedPattern,
+    phase,
+    handler: (ctx, result) => invoke(ctx, result)
+  };
+}
+function matchesPattern(pattern, method) {
+  if (pattern === "*") return true;
+  if (pattern.endsWith("/*")) {
+    const prefix = pattern.slice(0, -1);
+    return method.startsWith(prefix);
+  }
+  return pattern === method;
+}
+function isMcpMiddlewareMethod(value) {
+  return MCP_MIDDLEWARE_METHODS.some((method) => method === value);
+}
+function composeMiddleware(entries, method, innerFn) {
+  const matching = entries.filter(
+    (entry) => matchesPattern(entry.pattern, method)
+  );
+  if (matching.length === 0) {
+    return (_ctx) => innerFn();
+  }
+  return (ctx) => {
+    let index = -1;
+    const dispatch = (i) => {
+      if (i <= index) {
+        return Promise.reject(new Error("next() called multiple times"));
+      }
+      index = i;
+      if (i === matching.length) {
+        return innerFn();
+      }
+      const entry = matching[i];
+      return entry.handler(ctx, () => dispatch(i + 1));
+    };
+    return dispatch(0);
+  };
+}
+function freezeMiddlewareContext(ctx) {
+  return Object.freeze({
+    method: ctx.method,
+    params: Object.freeze({ ...ctx.params }),
+    ...ctx.request !== void 0 && { request: ctx.request },
+    ...ctx.session !== void 0 && {
+      session: Object.freeze({ ...ctx.session })
+    },
+    ...ctx.auth !== void 0 && { auth: ctx.auth },
+    state: new Map(ctx.state)
+  });
+}
+async function runMcpOperation(middlewares, events, method, ctx, innerFn) {
+  dispatchMcpEvents(events, method, "before", ctx);
+  const chained = composeMiddleware(middlewares, method, innerFn);
+  const result = await chained(ctx);
+  assertValidMiddlewareResult(method, result);
+  dispatchMcpEvents(events, method, "complete", ctx, result);
+  return result;
+}
+function assertValidMiddlewareResult(method, result) {
+  if ((method === "tools/call" || method === "resources/read" || method === "prompts/get") && isInputRequiredResult(result)) {
+    return;
+  }
+  const validation = (() => {
+    switch (method) {
+      case "tools/call":
+        assertArrayProperty(method, result, "content");
+        return CallToolResultSchema.safeParse(result);
+      case "tools/list":
+        assertArrayResult(method, result);
+        return ListToolsResultSchema.safeParse({ tools: result });
+      case "resources/read":
+        assertArrayProperty(method, result, "contents");
+        return ReadResourceResultSchema.safeParse(result);
+      case "resources/list":
+        assertArrayResult(method, result);
+        return ListResourcesResultSchema.safeParse({ resources: result });
+      case "prompts/get":
+        assertArrayProperty(method, result, "messages");
+        return GetPromptResultSchema.safeParse(result);
+      case "prompts/list":
+        assertArrayResult(method, result);
+        return ListPromptsResultSchema.safeParse({ prompts: result });
+      default:
+        throw new TypeError(`Unsupported MCP middleware method "${method}"`);
+    }
+  })();
+  if (!validation.success) {
+    throw new TypeError(
+      `[mcp-use] ${method} middleware returned an invalid result: ${validation.error.message}`
+    );
+  }
+}
+function assertArrayResult(method, result) {
+  if (!Array.isArray(result)) {
+    throw new TypeError(
+      `[mcp-use] ${method} middleware returned an invalid result: expected an array`
+    );
+  }
+}
+function assertArrayProperty(method, result, property) {
+  if (typeof result !== "object" || result === null || !Array.isArray(result[property])) {
+    throw new TypeError(
+      `[mcp-use] ${method} middleware returned an invalid result: expected a ${property} array`
+    );
+  }
+}
+function dispatchMcpEvents(events, method, phase, ctx, result) {
+  const frozen = freezeMiddlewareContext(ctx);
+  for (const entry of events) {
+    if (entry.phase !== phase || !matchesPattern(entry.pattern, method)) {
+      continue;
+    }
+    try {
+      entry.handler(frozen, result);
+    } catch (error) {
+      console.error(
+        `[mcp-use] MCP event listener for "${entry.pattern}" (${phase}) threw:`,
+        error
+      );
+    }
+  }
+}
+function parseMcpPattern(raw) {
+  const pattern = raw.startsWith("mcp:") ? raw.slice(4) : raw;
+  if (pattern.endsWith(":complete")) {
+    return {
+      pattern: pattern.slice(0, -":complete".length),
+      phase: "complete"
+    };
+  }
+  return { pattern, phase: "before" };
+}
+function normalizeMcpMiddlewarePattern(raw) {
+  return raw.startsWith("mcp:") ? raw.slice(4) : raw;
+}
+
 // src/inspector-shell.ts
 var INSPECTOR_TAG = "beta";
 var DEFAULT_INSPECTOR_ASSETS_URL = `https://cdn.jsdelivr.net/npm/@mcp-use/inspector@${INSPECTOR_TAG}/dist/cdn/inspector.js`;
 function inspectorStylesUrl(assetsUrl) {
   return assetsUrl.replace(/\.js(?=$|[?#])/, ".css");
 }
+function isDefaultJsdelivrInspectorUrl(url) {
+  return url.startsWith("https://cdn.jsdelivr.net/npm/@mcp-use/inspector@");
+}
+function withInspectorCacheBust(assetsUrl) {
+  if (!isDefaultJsdelivrInspectorUrl(assetsUrl)) return assetsUrl;
+  const sep = assetsUrl.includes("?") ? "&" : "?";
+  return `${assetsUrl}${sep}cb=${crypto.randomUUID()}`;
+}
+function matchesInspectorShellPath(pathname, basePath) {
+  const prefix = pathUnderBase(basePath, "inspector");
+  if (pathname !== prefix && !pathname.startsWith(`${prefix}/`)) {
+    return false;
+  }
+  const suffix = pathname.slice(prefix.length);
+  return suffix !== "/api" && !suffix.startsWith("/api/");
+}
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
@@ -235,10 +790,18 @@ function serializeForInlineScript(value) {
   return JSON.stringify(value).replaceAll("<", "\\u003c");
 }
 function renderInspectorShell(options) {
-  const { serverName, basePath, assetsUrl, manufactChatUrl } = options;
+  const {
+    serverName,
+    basePath,
+    faviconHref,
+    faviconType,
+    assetsUrl,
+    manufactChatUrl
+  } = options;
   const serializedBasePath = serializeForInlineScript(basePath);
   const serializedManufactChatUrl = manufactChatUrl ? serializeForInlineScript(manufactChatUrl) : null;
-  const bundleUrl = assetsUrl ?? DEFAULT_INSPECTOR_ASSETS_URL;
+  const rawUrl = assetsUrl ?? DEFAULT_INSPECTOR_ASSETS_URL;
+  const bundleUrl = withInspectorCacheBust(rawUrl);
   const scriptSrc = escapeHtml(bundleUrl);
   const stylesHref = escapeHtml(inspectorStylesUrl(bundleUrl));
   return `<!doctype html>
@@ -247,6 +810,7 @@ function renderInspectorShell(options) {
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>${escapeHtml(serverName)} \u2014 MCP Inspector</title>
+    ${faviconHref !== void 0 ? `<link rel="icon"${faviconType !== void 0 ? ` type="${escapeHtml(faviconType)}"` : ""} href="${escapeHtml(faviconHref)}" />` : ""}
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link
@@ -257,10 +821,65 @@ function renderInspectorShell(options) {
     <style>
       :root { color-scheme: light dark; }
       html, body { height: 100%; margin: 0; background-color: #f3f3f3; }
+      #root { height: 100%; }
+      .mcp-boot {
+        display: flex;
+        height: 100%;
+        align-items: center;
+        justify-content: center;
+        background-color: #f3f3f3;
+      }
+      .mcp-boot-inner {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        gap: 16px;
+      }
+      .mcp-boot-spinner {
+        width: 32px;
+        height: 32px;
+        color: #52525b;
+        animation: mcp-boot-spin 1s linear infinite;
+      }
+      .mcp-boot-label {
+        margin: 0;
+        font-family: Ubuntu, sans-serif;
+        font-size: 0.875rem;
+        line-height: 1.25rem;
+        color: #52525b;
+      }
+      @keyframes mcp-boot-spin {
+        to { transform: rotate(360deg); }
+      }
+      @media (prefers-color-scheme: dark) {
+        html, body { background-color: #000; }
+        .mcp-boot { background-color: #000; }
+        .mcp-boot-spinner, .mcp-boot-label { color: #a1a1aa; }
+      }
     </style>
   </head>
   <body>
-    <div id="root"></div>
+    <div id="root">
+      <div class="mcp-boot">
+        <div class="mcp-boot-inner">
+          <svg
+            class="mcp-boot-spinner"
+            xmlns="http://www.w3.org/2000/svg"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            role="status"
+            aria-label="Loading"
+          >
+            <path d="M21 12a9 9 0 1 1-6.219-8.56" />
+          </svg>
+          <p class="mcp-boot-label">Connecting to MCP server...</p>
+        </div>
+      </div>
+    </div>
     <script>
       (function () {
         var basePath = ${serializedBasePath};
@@ -272,6 +891,7 @@ function renderInspectorShell(options) {
         };
         // Read by the current inspector bundle to derive its own URLs.
         window.__MCP_BASE_PATH__ = basePath;
+        ${process.env.MCP_USE_DEV_CLI === "1" ? "window.__MCP_DEV_CLI__ = true;" : ""}
         ${serializedManufactChatUrl ? `window.__MANUFACT_CHAT_URL__ = ${serializedManufactChatUrl};` : ""}
         // The bundle carries Node-flavored dependencies that touch \`process\`
         // at module scope; give them the same browser polyfill the v1
@@ -304,22 +924,27 @@ function createInspectorHandler(inspector, options) {
   const { assetsUrl: configAssetsUrl, manufactChatUrl: configManufactChatUrl } = inspector ?? {};
   const assetsUrl = configAssetsUrl ?? process.env["MCP_USE_INSPECTOR_ASSETS_URL"] ?? void 0;
   const manufactChatUrl = configManufactChatUrl ?? process.env["MANUFACT_CHAT_URL"] ?? void 0;
-  const html = renderInspectorShell({
+  const shellOptions = {
     serverName: options.serverName,
     basePath: options.basePath,
+    ...options.faviconHref !== void 0 && {
+      faviconHref: options.faviconHref
+    },
+    ...options.faviconType !== void 0 && {
+      faviconType: options.faviconType
+    },
     assetsUrl,
     manufactChatUrl
-  });
-  const path = `${options.basePath}/inspector`;
-  const slashPath = `${path}/`;
+  };
   return async (request) => {
     if (request.method !== "GET" && request.method !== "HEAD") {
       return new Response("Method Not Allowed", { status: 405 });
     }
     const pathname = new URL(request.url).pathname;
-    if (pathname !== path && pathname !== slashPath) {
+    if (!matchesInspectorShellPath(pathname, options.basePath)) {
       return new Response("Not Found", { status: 404 });
     }
+    const html = renderInspectorShell(shellOptions);
     return new Response(request.method === "HEAD" ? null : html, {
       status: 200,
       headers: { "content-type": "text/html; charset=utf-8" }
@@ -709,9 +1334,6 @@ function createMcpMount(factory, options = {}) {
   };
   return { handler, fetch };
 }
-function mountMcp(factory, options = {}) {
-  return createMcpMount(factory, options);
-}
 
 // src/tools.ts
 function resolveToolInputSchema(definition) {
@@ -721,117 +1343,148 @@ function resolveToolInputSchema(definition) {
 // src/views/register.ts
 var registerViews = /* @__PURE__ */ Symbol("mcp-use/registerViews");
 
-// src/views/document.ts
-function resolveAssetUrl(assetPath, origin) {
-  if (!assetPath.startsWith("/")) {
-    throw new Error(
-      `View manifest asset path must be origin-absolute (start with "/"); got ${JSON.stringify(assetPath)}`
-    );
+// src/views/csp-env.ts
+var CATEGORY_ENV = {
+  connectDomains: "CSP_CONNECT_DOMAINS",
+  resourceDomains: "CSP_RESOURCE_DOMAINS",
+  frameDomains: "CSP_FRAME_DOMAINS",
+  baseUriDomains: "CSP_BASE_URI_DOMAINS"
+};
+function parseDomainList(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return [];
   }
-  return `${origin}${assetPath}`;
-}
-function resolvePublicBase(origin, basePath) {
-  return `${origin}${basePath}/_mcp-use/public/`;
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 }
-function escapeInlineScript(code) {
-  return code.replaceAll(/<\/script/gi, "<\\/script").replaceAll("<!--", "\\x3C!--");
-}
-function escapeInlineStyle(css) {
-  return css.replaceAll(/<\/style/gi, "<\\/style");
+function readEnvDomains(name) {
+  if (typeof process === "undefined") {
+    return void 0;
+  }
+  const raw = process.env[name];
+  if (raw === void 0 || raw.trim() === "") {
+    return void 0;
+  }
+  return parseDomainList(raw);
 }
-function escapeHtml2(value) {
-  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+function readCspUrlsShortcut() {
+  return readEnvDomains("CSP_URLS") ?? [];
 }
-function synthesizeViewDocument(entry, origin, basePath) {
-  const viewConfig = {
-    publicBase: resolvePublicBase(origin, basePath)
-  };
-  const configScript = `<script>globalThis.__mcpUseViewConfig=${JSON.stringify(viewConfig)};</script>`;
-  if (entry.kind === "inline") {
-    const styleTag = entry.css.length > 0 ? `<style>${escapeInlineStyle(entry.css)}</style>` : "";
-    const moduleScript = `<script type="module">${escapeInlineScript(entry.js)}</script>`;
-    return `<!doctype html>
-<html>
-<head>
-<meta charset="utf-8">
-${configScript}
-${styleTag}
-</head>
-<body>
-<div id="root"></div>
-${moduleScript}
-</body>
-</html>`;
-  }
-  const cssLinks = entry.css.map(
-    (path) => `<link rel="stylesheet" href="${escapeHtml2(resolveAssetUrl(path, origin))}">`
-  ).join("\n");
-  const scriptTags = (entry.scripts ?? []).map(
-    (path) => `<script type="module" src="${escapeHtml2(resolveAssetUrl(path, origin))}"></script>`
-  ).join("\n");
-  const entryUrl = resolveAssetUrl(entry.entry, origin);
-  return `<!doctype html>
-<html>
-<head>
-<meta charset="utf-8">
-${configScript}
-${cssLinks}
-</head>
-<body>
-<div id="root"></div>
-${scriptTags}
-<script type="module" src="${escapeHtml2(entryUrl)}"></script>
-</body>
-</html>`;
+function readEnvDomainsForCategory(category) {
+  const perCategory = readEnvDomains(CATEGORY_ENV[category]);
+  if (perCategory !== void 0) {
+    return perCategory;
+  }
+  return readCspUrlsShortcut();
 }
-
-// src/views/origin.ts
-function resolveRequestOrigin(request) {
-  const forwarded = request.headers.get("forwarded");
-  if (forwarded !== null) {
-    const fromForwarded = parseForwardedHeader(forwarded);
-    if (fromForwarded !== void 0) {
-      return fromForwarded;
-    }
-  }
-  const proto = request.headers.get("x-forwarded-proto");
-  const host = request.headers.get("x-forwarded-host");
-  if (proto !== null && host !== null) {
-    const firstHost = host.split(",")[0]?.trim();
-    const firstProto = proto.split(",")[0]?.trim();
-    if (firstHost !== void 0 && firstProto !== void 0 && firstHost !== "") {
-      return `${firstProto}://${firstHost}`;
-    }
-  }
-  return new URL(request.url).origin;
-}
-function parseForwardedHeader(header) {
-  for (const part of header.split(",")) {
-    const params = /* @__PURE__ */ new Map();
-    for (const token of part.split(";")) {
-      const [key, ...rest] = token.trim().split("=");
-      if (key === void 0 || rest.length === 0) {
-        continue;
+function mergeDomainLists(...segments) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const segment of segments) {
+    for (const domain of segment) {
+      if (!seen.has(domain)) {
+        seen.add(domain);
+        out.push(domain);
       }
-      params.set(key.toLowerCase(), rest.join("=").replace(/^"|"$/g, ""));
     }
-    const proto = params.get("proto");
-    const host = params.get("host");
-    if (proto !== void 0 && host !== void 0) {
-      return `${proto}://${host}`;
+  }
+  return out;
+}
+function toWebSocketOrigin(serverOrigin) {
+  if (serverOrigin.startsWith("https://")) {
+    return `wss://${serverOrigin.slice("https://".length)}`;
+  }
+  if (serverOrigin.startsWith("http://")) {
+    return `ws://${serverOrigin.slice("http://".length)}`;
+  }
+  return serverOrigin;
+}
+function buildMergedResourceCsp(authorFacts, options) {
+  const author = authorFacts?.csp;
+  const mcpConnectAuto = [];
+  if (options.serverOrigin !== "") {
+    mcpConnectAuto.push(options.serverOrigin);
+    if (options.hmrWs === true) {
+      mcpConnectAuto.push(toWebSocketOrigin(options.serverOrigin));
     }
   }
-  return void 0;
+  const mcpResourceAuto = [];
+  const resourceOrigin = options.explicitAssetsBase ? options.assetsOrigin : options.serverOrigin;
+  if (resourceOrigin !== "") {
+    mcpResourceAuto.push(resourceOrigin);
+  }
+  const connectDomains = mergeDomainLists(
+    author?.connectDomains ?? [],
+    readEnvDomainsForCategory("connectDomains"),
+    mcpConnectAuto
+  );
+  const resourceDomains = mergeDomainLists(
+    author?.resourceDomains ?? [],
+    readEnvDomainsForCategory("resourceDomains"),
+    mcpResourceAuto
+  );
+  const frameDomains = mergeDomainLists(
+    author?.frameDomains ?? [],
+    readEnvDomainsForCategory("frameDomains")
+  );
+  const baseUriDomains = mergeDomainLists(
+    author?.baseUriDomains ?? [],
+    readEnvDomainsForCategory("baseUriDomains")
+  );
+  return {
+    ...author,
+    connectDomains,
+    resourceDomains,
+    frameDomains,
+    baseUriDomains
+  };
 }
 
 // src/views/routes.ts
 var PUBLIC_BUILD_DIR = ".mcp-use/build/views/public";
 var PUBLIC_DEV_DIR = "public";
-function createViewPublicHandler(basePath, views, options) {
+var VIEW_ASSETS_BUILD_ROOT = ".mcp-use/build/views";
+function createViewAssetsHandler(basePath, views, options) {
   if (views.size === 0) {
     return void 0;
   }
-  const publicPrefix = `${basePath}/_mcp-use/public`;
+  const assetsPrefix = pathUnderBase(basePath, "_mcp-use/views");
+  const projectRoot = options?.projectRoot ?? process.cwd();
+  return async (request) => {
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      return new Response("Method Not Allowed", { status: 405 });
+    }
+    if (!matchesPathPrefix(request, assetsPrefix)) {
+      return new Response("Not Found", { status: 404 });
+    }
+    const pathname = pathnameOf(request);
+    const remainder = pathname.slice(assetsPrefix.length + 1);
+    const slash = remainder.indexOf("/");
+    if (slash <= 0 || slash === remainder.length - 1) {
+      return new Response("Not Found", { status: 404 });
+    }
+    const viewName = remainder.slice(0, slash);
+    const subpath = remainder.slice(slash + 1);
+    const entry = views.get(viewName);
+    if (entry === void 0 || entry.kind !== "external") {
+      return new Response("Not Found", { status: 404 });
+    }
+    const [{ join }, { resolvePublicFilePath: resolvePublicFilePath2, servePublicFile: servePublicFile2 }] = await Promise.all([import("path"), import("./public-route-RWJVJQTX.js")]);
+    const viewRoot = join(projectRoot, VIEW_ASSETS_BUILD_ROOT, viewName);
+    const diskPath = await resolvePublicFilePath2(viewRoot, subpath);
+    if (diskPath === null) {
+      return new Response("Not Found", { status: 404 });
+    }
+    return await servePublicFile2(diskPath, {
+      ...options?.deferCors === true && { deferCors: true },
+      ...request.method === "HEAD" && { head: true }
+    });
+  };
+}
+function createViewPublicHandler(basePath, views, options) {
+  if (views.size === 0 && options?.enabled !== true) {
+    return void 0;
+  }
+  const publicPrefix = pathUnderBase(basePath, "_mcp-use/public");
   const subdir = options?.dev === true ? PUBLIC_DEV_DIR : PUBLIC_BUILD_DIR;
   const projectRoot = options?.projectRoot ?? process.cwd();
   return async (request) => {
@@ -842,34 +1495,53 @@ function createViewPublicHandler(basePath, views, options) {
       return new Response("Not Found", { status: 404 });
     }
     const pathname = pathnameOf(request);
-    const subpath = pathname.slice(publicPrefix.length + 1);
+    const encodedSubpath = pathname.slice(publicPrefix.length + 1);
+    let subpath;
+    try {
+      subpath = decodeURIComponent(encodedSubpath);
+    } catch {
+      return new Response("Not Found", { status: 404 });
+    }
     if (subpath.length === 0) {
       return new Response("Not Found", { status: 404 });
     }
-    const [{ join }, { resolvePublicFilePath, servePublicFile }] = await Promise.all([import("path"), import("./public-route-7IK5D7V7.js")]);
+    const [{ join }, { resolvePublicFilePath: resolvePublicFilePath2, servePublicFile: servePublicFile2 }] = await Promise.all([import("path"), import("./public-route-RWJVJQTX.js")]);
     const publicRoot = join(projectRoot, subdir);
-    const diskPath = await resolvePublicFilePath(publicRoot, subpath);
+    const diskPath = await resolvePublicFilePath2(publicRoot, subpath);
     if (diskPath === null) {
       return new Response("Not Found", { status: 404 });
     }
-    return await servePublicFile(diskPath);
+    return await servePublicFile2(diskPath, {
+      ...options?.deferCors === true && { deferCors: true },
+      ...request.method === "HEAD" && { head: true }
+    });
   };
 }
 
 // src/views/wire.ts
-function buildToolUiMeta(viewName, visibility) {
-  if (viewName === void 0 && visibility === void 0) {
+function buildToolUiMeta(viewName, visibility, existingMetadata) {
+  if (viewName === void 0 && visibility === void 0 && existingMetadata === void 0) {
     return void 0;
   }
-  const ui = {};
-  const meta = { [UI_META_KEY]: ui };
+  const meta = { ...existingMetadata };
+  const existingUi = existingMetadata?.[UI_META_KEY];
+  const existingUiIsObject = typeof existingUi === "object" && existingUi !== null && !Array.isArray(existingUi);
+  const ui = existingUiIsObject ? { ...existingUi } : {};
   if (viewName !== void 0) {
     const resourceUri = viewResourceUri(viewName);
     ui["resourceUri"] = resourceUri;
     meta[UI_RESOURCE_URI_META_KEY] = resourceUri;
+  } else {
+    delete ui["resourceUri"];
+    delete meta[UI_RESOURCE_URI_META_KEY];
   }
   if (visibility !== void 0) {
     ui["visibility"] = [visibility];
+  } else {
+    delete ui["visibility"];
+  }
+  if (viewName !== void 0 || visibility !== void 0 || existingUiIsObject) {
+    meta[UI_META_KEY] = ui;
   }
   return meta;
 }
@@ -880,36 +1552,20 @@ function buildToolResultUiMeta(viewName) {
     [UI_RESOURCE_URI_META_KEY]: resourceUri
   };
 }
-function toWebSocketOrigin(servingOrigin) {
-  if (servingOrigin.startsWith("https://")) {
-    return `wss://${servingOrigin.slice("https://".length)}`;
-  }
-  if (servingOrigin.startsWith("http://")) {
-    return `ws://${servingOrigin.slice("http://".length)}`;
-  }
-  return servingOrigin;
-}
-function buildResourceUiMeta(authorFacts, servingOrigin, options) {
-  const authorResourceDomains = authorFacts?.csp?.resourceDomains ?? [];
-  const resourceDomains = [
-    ...authorResourceDomains,
-    ...servingOrigin !== "" ? [servingOrigin] : []
-  ];
-  const authorConnectDomains = authorFacts?.csp?.connectDomains ?? [];
-  const connectDomains = [...authorConnectDomains];
-  if (options?.hmrWs === true && servingOrigin !== "") {
-    const wsOrigin = toWebSocketOrigin(servingOrigin);
-    if (!connectDomains.includes(wsOrigin)) {
-      connectDomains.push(wsOrigin);
-    }
-  }
-  const ui = {
-    csp: {
-      ...authorFacts?.csp,
-      connectDomains,
-      resourceDomains
-    }
+function resolveCspOptions(options) {
+  const request = options?.request;
+  const serverOrigin = options?.serverOrigin ?? (request !== void 0 ? resolveServerOrigin(request) : "");
+  const assetsBase = options?.assetsBase ?? (request !== void 0 ? resolveAssetsBase(request) : serverOrigin);
+  return {
+    serverOrigin,
+    assetsOrigin: originFromAssetsBase(assetsBase),
+    explicitAssetsBase: hasExplicitAssetsBase(),
+    ...options?.hmrWs === true ? { hmrWs: true } : {}
   };
+}
+function buildResourceUiMeta(authorFacts, options) {
+  const csp = buildMergedResourceCsp(authorFacts, resolveCspOptions(options));
+  const ui = { csp };
   if (authorFacts?.permissions !== void 0) {
     ui["permissions"] = authorFacts.permissions;
   }
@@ -921,19 +1577,35 @@ function buildResourceUiMeta(authorFacts, servingOrigin, options) {
   }
   return { [UI_META_KEY]: ui };
 }
-function viewResourceConfig(_viewName, _entry, authorFacts, servingOrigin, options) {
+function viewResourceConfig(_viewName, _entry, authorFacts, options) {
   return {
     mimeType: UI_MIME_TYPE,
     ...authorFacts?.description !== void 0 && {
       description: authorFacts.description
     },
-    _meta: buildResourceUiMeta(authorFacts, servingOrigin, options)
+    _meta: buildResourceUiMeta(authorFacts, options)
   };
 }
 
 // src/server.ts
+function omitRootSchemaDialect(schema) {
+  if (typeof schema !== "object" || schema === null || Array.isArray(schema) || !("$schema" in schema)) {
+    return schema;
+  }
+  const emittedSchema = { ...schema };
+  delete emittedSchema["$schema"];
+  return emittedSchema;
+}
+function omitToolSchemaDialects(tools) {
+  return tools.map((tool) => ({
+    ...tool,
+    inputSchema: omitRootSchemaDialect(tool.inputSchema),
+    ...tool.outputSchema === void 0 ? {} : { outputSchema: omitRootSchemaDialect(tool.outputSchema) }
+  }));
+}
 var MCPServer = class _MCPServer {
   #config;
+  #branding;
   #tools = /* @__PURE__ */ new Map();
   #resources = /* @__PURE__ */ new Map();
   #resourceTemplates = /* @__PURE__ */ new Map();
@@ -948,7 +1620,7 @@ var MCPServer = class _MCPServer {
   #viewsPrimed = false;
   /** When true, resource CSP emission includes the HMR websocket origin. */
   #viewsDevMode = false;
-  /** Project root for filesystem-backed view routes (dev `public/`). */
+  /** Project root for filesystem-backed view bundle and public routes. */
   #viewsProjectRoot = process.cwd();
   #fetchHandler;
   #handler;
@@ -958,6 +1630,14 @@ var MCPServer = class _MCPServer {
   #oauthResourceConfigurationAbsent = false;
   /** Whether the mounted app validates Host headers (fixed at first mount). */
   #hostValidated = false;
+  #mcpMiddlewares = [];
+  #mcpEventListeners = [];
+  /** Client instances created by {@link MCPServer.proxy} and owned by this server. */
+  #proxyOwners = [];
+  /** Proxy registrations that {@link close} must let finish before cleanup. */
+  #proxyOperations = /* @__PURE__ */ new Set();
+  /** Whether terminal shutdown has begun. */
+  #closed = false;
   /**
    * Create an MCP server from a parsed, bundled OpenAPI document.
    *
@@ -997,6 +1677,7 @@ var MCPServer = class _MCPServer {
   constructor(config) {
     assertServerConfig(config);
     this.#config = config;
+    this.#branding = normalizeServerBranding(config);
     if (config.oauth !== void 0) {
       const mcpUrl = typeof process === "undefined" ? void 0 : process.env["MCP_URL"];
       const resource = resolveConfiguredOAuthResource({
@@ -1019,6 +1700,24 @@ var MCPServer = class _MCPServer {
   get basePath() {
     return this.#basePath();
   }
+  /**
+   * Immutable normalized branding shared by MCP identity and browser pages.
+   *
+   * `favicon` is the final source after explicit-favicon and icon-selection
+   * precedence. Landing-page integrations can use this accessor and link to
+   * the server's root-level `/favicon.ico` route without reading private
+   * configuration or depending on the inspector/view layers.
+   *
+   * @example
+   * ```ts
+   * if (server.branding.favicon) {
+   *   console.log("Browser favicon: /favicon.ico");
+   * }
+   * ```
+   */
+  get branding() {
+    return this.#branding;
+  }
   /**
    * Register a tool. Input is validated against `inputSchema` before the callback
    * runs; results carrying `structuredContent` are type-checked against
@@ -1039,9 +1738,9 @@ var MCPServer = class _MCPServer {
     });
   }
   /**
-   * Prime the views registry from a build/dev manifest.
+   * Prime the views registry from build/dev registry data.
    *
-   * @param views - Manifest map keyed by view directory name.
+   * @param views - Registry map keyed by view directory name.
    * @param options - Priming options. When `dev` is true, resource CSP
    * emission appends the serving origin's websocket variant to
    * `connectDomains` so Vite HMR passes host-enforced CSP. Pass
@@ -1098,8 +1797,10 @@ var MCPServer = class _MCPServer {
    */
   resourceTemplate(definition, callback) {
     this.#assertNotStarted("resourceTemplate", definition.name);
+    const complete = definition.complete === void 0 ? void 0 : normalizeCompletions(definition.complete);
     this.#resourceTemplates.set(definition.name, {
       definition,
+      ...complete !== void 0 && { complete },
       callback
     });
     return this;
@@ -1116,6 +1817,23 @@ var MCPServer = class _MCPServer {
     });
     return this;
   }
+  async proxy(input) {
+    this.#assertOpen("proxy()");
+    const operation = (async () => {
+      const { isProxyConnection, mountProxyConnection, mountProxyServers } = await import("./mcp-proxy-5YQJJ4RT.js");
+      if (isProxyConnection(input)) {
+        await mountProxyConnection(this.#proxyHost(), input);
+        return;
+      }
+      await mountProxyServers(this.#proxyHost(), input);
+    })();
+    this.#proxyOperations.add(operation);
+    try {
+      await operation;
+    } finally {
+      this.#proxyOperations.delete(operation);
+    }
+  }
   /**
    * Web-standard request handler for the whole app (MCP endpoint included) —
    * usable directly on serverless/edge runtimes or in tests.
@@ -1139,8 +1857,68 @@ var MCPServer = class _MCPServer {
    * ```
    */
   getHandler(options = {}) {
+    this.#assertOpen("getHandler()");
     const { fetch } = this.#ensureMounted("handler", void 0, options.bus);
-    return fetch;
+    return toFrameworkHandler(fetch);
+  }
+  /**
+   * Node `(req, res) => void` handler for composing with an existing
+   * `http.Server`. Uses the same internal `toNodeHandler` bridge as
+   * {@link MCPServer.listen}; MCPServer users do not need to import
+   * `mcp-use/node`.
+   *
+   * @example
+   * ```ts
+   * import { createServer } from "node:http";
+   * const httpServer = createServer(await server.getNodeHandler());
+   * httpServer.listen(3000);
+   * ```
+   */
+  async getNodeHandler() {
+    const { fetch } = this.#ensureMounted("handler");
+    const { toNodeHandler } = await import("./node-bridge.js");
+    return toNodeHandler({ fetch });
+  }
+  /**
+   * Register MCP operation middleware that intercepts JSON-RPC dispatch.
+   *
+   * Patterns use an `mcp:` prefix (for example `mcp:tools/call`, `mcp:*`).
+   * Exact methods may transform their typed result. The global `mcp:*` pattern
+   * is pass-through middleware. Middleware runs in registration order; call
+   * `next()` to continue the chain.
+   *
+   * @example
+   * ```ts
+   * server.use("mcp:tools/call", async (ctx, next) => {
+   *   console.log(`Calling tool: ${ctx.params.name}`);
+   *   return next();
+   * });
+   * ```
+   */
+  use(pattern, handler) {
+    this.#assertNotStarted("middleware", pattern);
+    this.#mcpMiddlewares.push(createMcpMiddlewareEntry(pattern, handler));
+    return this;
+  }
+  /**
+   * Register a read-only MCP observer. Unlike {@link MCPServer.use}, listeners
+   * cannot block, override, or mutate params. Throwing is logged and does not
+   * fail the request.
+   *
+   * Append `:complete` to run after the handler (for example
+   * `mcp:tools/call:complete`).
+   *
+   * @example
+   * ```ts
+   * server.on("mcp:tools/call", (ctx) => {
+   *   metrics.increment("tools.call", { tool: ctx.params.name });
+   * });
+   * ```
+   */
+  on(pattern, handler) {
+    this.#assertNotStarted("event listener", pattern);
+    this.#mcpEventListeners.push(createMcpEventListenerEntry(pattern, handler));
+    return this;
   }
   /**
    * Publish a tools-list change to v2 clients with active subscriptions.
@@ -1192,9 +1970,8 @@ var MCPServer = class _MCPServer {
    * Serve over HTTP on Node. Pass port `0` for an ephemeral port.
    *
    * Binds `config.host` (default `127.0.0.1`). Localhost-class binds get
-   * DNS-rebinding protection automatically: `Host` on every request,
-   * `Origin` only on non-GET/HEAD (sandboxed view iframes send
-   * `Origin: null` on asset GETs). To serve publicly set `host: "0.0.0.0"`;
+   * DNS-rebinding Host protection automatically. Origin validation is off
+   * unless `allowedOrigins` is set. To serve publicly set `host: "0.0.0.0"`;
    * behind a platform edge that is all that's needed, and `allowedHosts`
    * restricts direct exposure (additive — localhost-class values stay allowed).
    *
@@ -1208,6 +1985,7 @@ var MCPServer = class _MCPServer {
    * already mounted the app without Host validation.
    */
   async listen(port = 3e3) {
+    this.#assertOpen("listen()");
     this.#assertListenOAuthConfiguration();
     const { createServer } = await import("http");
     const { toNodeHandler } = await import("./node-bridge.js");
@@ -1272,15 +2050,43 @@ var MCPServer = class _MCPServer {
    * instance to serve again.
    */
   async close() {
-    await this.#handler?.close();
+    this.#closed = true;
+    await Promise.allSettled([...this.#proxyOperations]);
+    const errors = [];
+    const proxyOwners = this.#proxyOwners.splice(0);
+    const ownerResults = await Promise.allSettled(
+      proxyOwners.map((owner) => owner.close())
+    );
+    for (const result of ownerResults) {
+      if (result.status === "rejected") errors.push(result.reason);
+    }
+    try {
+      await this.#handler?.close();
+    } catch (error) {
+      errors.push(error);
+    }
     const httpServer = this.#httpServer;
     if (httpServer !== void 0) {
-      await new Promise((resolve, reject) => {
-        httpServer.close((err) => err ? reject(err) : resolve());
-      });
-      this.#httpServer = void 0;
+      try {
+        await new Promise((resolve, reject) => {
+          httpServer.close((err) => err ? reject(err) : resolve());
+        });
+        this.#httpServer = void 0;
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    if (errors.length > 0) {
+      throw new AggregateError(errors, "Failed to close MCP server cleanly");
     }
   }
+  #assertOpen(operation) {
+    if (!this.#closed) return;
+    if (operation !== void 0) {
+      throw new Error(`Cannot call ${operation} after the server has closed.`);
+    }
+    throw new Error("Cannot use the server after it has closed.");
+  }
   #basePath() {
     return this.#config.basePath ?? "/mcp";
   }
@@ -1326,40 +2132,79 @@ var MCPServer = class _MCPServer {
       );
     }
   }
+  #proxyHost() {
+    return {
+      isStarted: () => this.#handler !== void 0,
+      hasTool: (name) => this.#tools.has(name),
+      hasResource: (name) => this.#resources.has(name),
+      hasPrompt: (name) => this.#prompts.has(name),
+      registerTool: (definition, callback) => {
+        this.#assertNotStarted("tool", definition.name);
+        this.#tools.set(definition.name, {
+          definition,
+          callback
+        });
+      },
+      registerResource: (definition, callback) => {
+        this.#assertNotStarted("resource", definition.name);
+        this.#resources.set(definition.name, {
+          definition,
+          callback
+        });
+      },
+      registerPrompt: (definition, callback) => {
+        this.#assertNotStarted("prompt", definition.name);
+        this.#prompts.set(definition.name, {
+          definition,
+          callback
+        });
+      },
+      trackOwner: (owner) => {
+        this.#proxyOwners.push(owner);
+      }
+    };
+  }
   /**
    * Effective Host/Origin allowlists for a mount mode; `undefined` means the
    * corresponding validation is off.
    *
    * Configured lists are additive to the localhost-class allowlists, so local
    * runs keep working when a deployment hostname is added. With nothing
-   * configured, `listen()` on a localhost-class bind validates against the
+   * configured, `listen()` on a localhost-class bind validates Host against the
    * localhost lists (the DNS-rebinding threat model), while `getHandler()` —
-   * which never binds — applies no validation. `allowedOrigins` defaults to
-   * mirroring the effective Host allowlist. Origin validation runs only on
-   * non-GET/HEAD requests.
+   * which never binds — applies no validation. Origin validation is off unless
+   * `allowedOrigins` is set explicitly (SDK-aligned: the handler is open by
+   * default). When enabled, Origin is checked only on non-GET/HEAD requests.
    */
   #validationPolicy(mode) {
     const { host = "127.0.0.1", allowedHosts, allowedOrigins } = this.#config;
     const localhostBind = ["127.0.0.1", "localhost", "::1"].includes(host);
     const hosts = allowedHosts !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedHostnames(), ...allowedHosts])] : mode === "listen" && localhostBind ? localhostAllowedHostnames() : void 0;
-    const origins = allowedOrigins !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedOrigins(), ...allowedOrigins])] : hosts;
+    const origins = allowedOrigins !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedOrigins(), ...allowedOrigins])] : void 0;
     return { hosts, origins };
   }
   #ensureMounted(mode, listenPort, bus) {
+    this.#assertOpen();
     if (this.#fetchHandler === void 0 || this.#handler === void 0) {
       const { hosts, origins } = this.#validationPolicy(mode);
       const basePath = this.#basePath();
+      const nestedBasePath = basePath === "/" ? "" : basePath;
       const middlewares = [
         jsonBodyMiddleware(),
         requestLogger(this.#config.logging)
       ];
+      const corsConfig = this.#config.cors;
+      if (corsConfig !== void 0) {
+        middlewares.unshift(corsFetchMiddleware(corsConfig));
+      }
+      const deferViewCors = isGlobalCorsEnabled(corsConfig);
       if (hosts !== void 0) {
         middlewares.unshift(hostValidationMiddleware(hosts));
-        middlewares.push(originValidationMiddleware(origins ?? hosts));
-      } else {
-        if (origins !== void 0) {
-          middlewares.push(originValidationMiddleware(origins));
-        }
+      }
+      if (origins !== void 0) {
+        middlewares.push(originValidationMiddleware(origins));
+      }
+      if (hosts === void 0) {
         if (mode === "listen") {
           console.warn(
             `[mcp-use] listen() is serving on ${this.#config.host} without Host validation. Behind a platform edge that only routes your own domains this is expected; if this process is reachable directly, set allowedHosts to restrict it.`
@@ -1389,7 +2234,7 @@ var MCPServer = class _MCPServer {
           }
         }
       );
-      let mcpRouteHandler = mcpFetch;
+      let protectWithBearer = async (_request, next) => next();
       if (resource !== void 0) {
         const provider = this.#config.oauth;
         const providerOptions = getOAuthProviderOptions(provider);
@@ -1400,32 +2245,89 @@ var MCPServer = class _MCPServer {
             requiredScopes: providerOptions.requiredScopes
           }
         });
-        mcpRouteHandler = async (request) => {
+        protectWithBearer = async (request, next) => {
           const result = await gate(request);
           if (result instanceof Response) {
             return result;
           }
           const bag = getRequestBag(request);
           bag.authInfo = result;
-          return mcpFetch(request);
+          return next();
         };
       }
+      const mcpRouteHandler = (request) => protectWithBearer(request, () => mcpFetch(request));
+      const endpointHandler = async (request) => {
+        if (!isHtmlNavigationRequest(request)) {
+          return mcpRouteHandler(request);
+        }
+        const respond = async () => {
+          const { createLandingPageResponse } = await import("./landing-handler-WE66NIGB.js");
+          return createLandingPageResponse(
+            request,
+            basePath,
+            this.#config,
+            this.#branding,
+            this.#tools.values(),
+            this.#prompts.values(),
+            this.#resources.values()
+          );
+        };
+        if (resource !== void 0 && this.#config.publicLandingPage !== true) {
+          return protectWithBearer(request, respond);
+        }
+        return respond();
+      };
       const routes = [];
+      const brandingDevMode = this.#viewsPrimed ? this.#viewsDevMode : process.env["NODE_ENV"] !== "production";
+      const faviconHandler = createFaviconHandler(this.#branding, {
+        dev: brandingDevMode,
+        projectRoot: this.#viewsProjectRoot,
+        deferCors: deferViewCors
+      });
+      if (faviconHandler !== void 0) {
+        routes.push({
+          match: (request) => new URL(request.url).pathname === "/favicon.ico",
+          handler: faviconHandler
+        });
+      }
       const viewHandler = createViewPublicHandler(basePath, this.#views, {
-        dev: this.#viewsDevMode,
-        projectRoot: this.#viewsProjectRoot
+        dev: this.#viewsPrimed ? this.#viewsDevMode : brandingDevMode,
+        projectRoot: this.#viewsProjectRoot,
+        enabled: hasLocalBrandingAsset(this.#branding),
+        deferCors: deferViewCors
       });
       if (viewHandler !== void 0) {
         routes.push({
           match: (request) => request.method === "GET" || request.method === "HEAD" ? new URL(request.url).pathname.startsWith(
-            `${basePath}/_mcp-use/public/`
+            `${nestedBasePath}/_mcp-use/public/`
           ) : false,
           handler: viewHandler
         });
       }
+      if (!this.#viewsDevMode) {
+        const viewAssetsHandler = createViewAssetsHandler(
+          basePath,
+          this.#views,
+          { projectRoot: this.#viewsProjectRoot, deferCors: deferViewCors }
+        );
+        if (viewAssetsHandler !== void 0) {
+          routes.push({
+            match: (request) => request.method === "GET" || request.method === "HEAD" ? new URL(request.url).pathname.startsWith(
+              `${nestedBasePath}/_mcp-use/views/`
+            ) : false,
+            handler: viewAssetsHandler
+          });
+        }
+      }
       const inspectorHandler = createInspectorHandler(this.#config.inspector, {
         serverName: this.#config.name,
-        basePath
+        basePath,
+        ...faviconHandler !== void 0 && {
+          faviconHref: "/favicon.ico",
+          ...this.#branding.faviconMimeType !== void 0 && {
+            faviconType: this.#branding.faviconMimeType
+          }
+        }
       });
       if (inspectorHandler !== void 0) {
         routes.push({
@@ -1434,14 +2336,14 @@ var MCPServer = class _MCPServer {
               return false;
             }
             const pathname = new URL(request.url).pathname;
-            return pathname === `${basePath}/inspector` || pathname === `${basePath}/inspector/`;
+            return matchesInspectorShellPath(pathname, basePath);
           },
           handler: inspectorHandler
         });
       }
       routes.push({
         match: (request) => matchesPath(request, basePath),
-        handler: mcpRouteHandler
+        handler: endpointHandler
       });
       const terminal = routeFetch(routes);
       this.#fetchHandler = composeFetch(terminal, ...middlewares);
@@ -1514,7 +2416,17 @@ var MCPServer = class _MCPServer {
         name,
         version,
         ...title !== void 0 && { title },
-        ...description !== void 0 && { description }
+        ...description !== void 0 && { description },
+        ...this.#branding.websiteUrl !== void 0 && {
+          websiteUrl: this.#branding.websiteUrl
+        },
+        ...this.#branding.icons !== void 0 && {
+          icons: resolveImplementationIcons(
+            this.#branding.icons,
+            ctx.requestInfo,
+            this.#basePath()
+          )
+        }
       },
       {
         capabilities: {
@@ -1530,7 +2442,7 @@ var MCPServer = class _MCPServer {
       }
     );
     const request = ctx.requestInfo;
-    const servingOrigin = request !== void 0 ? resolveRequestOrigin(request) : "";
+    const viewMetaOptions = request !== void 0 ? { request, hmrWs: this.#viewsDevMode } : { hmrWs: this.#viewsDevMode };
     const basePath = this.#basePath();
     for (const entry of this.#tools.values()) {
       this.#registerTool(server, entry);
@@ -1549,15 +2461,109 @@ var MCPServer = class _MCPServer {
         server,
         viewName,
         viewEntry,
-        servingOrigin,
+        viewMetaOptions,
         basePath
       );
     }
+    this.#wrapListHandlers(server);
     return server;
   }
+  #createMiddlewareContext(method, params, ctx) {
+    return {
+      method,
+      params,
+      ...ctx.http?.req !== void 0 && { request: ctx.http.req },
+      ...ctx.sessionId !== void 0 && {
+        session: { sessionId: ctx.sessionId }
+      },
+      ...ctx.http?.authInfo !== void 0 && { auth: ctx.http.authInfo },
+      state: /* @__PURE__ */ new Map()
+    };
+  }
+  #runMcpHook(method, ctx, innerFn) {
+    return runMcpOperation(
+      this.#mcpMiddlewares,
+      this.#mcpEventListeners,
+      method,
+      ctx,
+      innerFn
+    );
+  }
+  /**
+   * Wrap native SDK list handlers with the MCP middleware chain.
+   *
+   * ponytail: uses SDK-private `_requestHandlers`; pin compile-time test.
+   *
+   * @internal
+   */
+  #wrapListHandlers(server) {
+    const handlers = server.server._requestHandlers;
+    if (handlers === void 0) {
+      return;
+    }
+    const wrapListMethod = (method, resultKey, transform) => {
+      const original = handlers.get(method);
+      if (original === void 0) {
+        return;
+      }
+      if (original.__mcpListWrapped) {
+        return;
+      }
+      const wrapped = async (request, extra) => {
+        const serverContext = extra;
+        const params = request.params ?? {};
+        const mwCtx = this.#createMiddlewareContext(
+          method,
+          params,
+          serverContext
+        );
+        let originalEnvelope;
+        const innerFn = async () => {
+          const downstreamRequest = withMcpMiddlewareParams(
+            request,
+            mwCtx.params
+          );
+          const result = await original(downstreamRequest, extra);
+          if (typeof result !== "object" || result === null) {
+            throw new TypeError(
+              `[mcp-use] ${method} handler returned a non-object result`
+            );
+          }
+          originalEnvelope = result;
+          const items = originalEnvelope[resultKey];
+          if (!Array.isArray(items)) {
+            throw new TypeError(
+              `[mcp-use] ${method} handler result is missing a ${resultKey} array`
+            );
+          }
+          return items;
+        };
+        const filtered = await this.#runMcpHook(method, mwCtx, innerFn);
+        if (!Array.isArray(filtered)) {
+          throw new TypeError(
+            `[mcp-use] ${method} middleware must return a ${resultKey} array`
+          );
+        }
+        const emitted = transform?.(filtered) ?? filtered;
+        return {
+          ...originalEnvelope,
+          [resultKey]: emitted
+        };
+      };
+      wrapped.__mcpListWrapped = true;
+      handlers.set(method, wrapped);
+    };
+    wrapListMethod("tools/list", "tools", omitToolSchemaDialects);
+    wrapListMethod("resources/list", "resources");
+    wrapListMethod("prompts/list", "prompts");
+  }
   #registerTool(server, { definition, callback }) {
     const view = definition.view;
-    const toolUiMeta = buildToolUiMeta(view?.name, definition.visibility);
+    const toolMeta = buildToolUiMeta(
+      view?.name,
+      definition.visibility,
+      definition._meta
+    );
     const config = {
       ...definition.title !== void 0 && { title: definition.title },
       ...definition.description !== void 0 && {
@@ -1569,51 +2575,60 @@ var MCPServer = class _MCPServer {
       ...definition.outputSchema !== void 0 && {
         outputSchema: definition.outputSchema
       },
-      ...toolUiMeta !== void 0 && { _meta: toolUiMeta }
+      ...toolMeta !== void 0 && { _meta: toolMeta }
     };
     const wireResultMeta = view !== void 0 ? buildToolResultUiMeta(view.name) : void 0;
     const inputSchema = resolveToolInputSchema(definition);
-    if (inputSchema !== void 0) {
-      server.registerTool(
-        definition.name,
-        { ...config, inputSchema },
-        async (args, ctx) => {
-          const params = args;
-          const result = await callback(params, this.#toRequestContext(ctx));
-          if (isInputRequiredResult(result) || wireResultMeta === void 0 || result.isError === true) {
-            return result;
-          }
-          return {
-            ...result,
-            _meta: { ...result._meta, ...wireResultMeta }
-          };
-        }
+    const invokeTool = async (args, ctx) => {
+      const mwCtx = this.#createMiddlewareContext(
+        "tools/call",
+        {
+          name: definition.name,
+          arguments: args,
+          ...ctx.mcpReq._meta !== void 0 && { _meta: ctx.mcpReq._meta }
+        },
+        ctx
       );
-    } else {
-      server.registerTool(definition.name, config, async (ctx) => {
-        const result = await callback({}, this.#toRequestContext(ctx));
-        if (isInputRequiredResult(result) || wireResultMeta === void 0 || result.isError === true) {
+      const innerFn = async () => {
+        const effectiveArgs = mwCtx.params.arguments ?? {};
+        const result = await callback(
+          effectiveArgs,
+          this.#toRequestContext(ctx)
+        );
+        if (isInputRequiredResult2(result) || wireResultMeta === void 0 || result.isError === true) {
           return result;
         }
         return {
           ...result,
           _meta: { ...result._meta, ...wireResultMeta }
         };
-      });
+      };
+      return await this.#runMcpHook("tools/call", mwCtx, innerFn);
+    };
+    if (inputSchema !== void 0) {
+      server.registerTool(
+        definition.name,
+        { ...config, inputSchema },
+        async (args, ctx) => invokeTool(args, ctx)
+      );
+    } else {
+      server.registerTool(
+        definition.name,
+        config,
+        async (ctx) => invokeTool({}, ctx)
+      );
     }
   }
-  #registerViewResource(server, viewName, entry, servingOrigin, basePath) {
+  #registerViewResource(server, viewName, entry, metaOptions, basePath) {
     const uri = viewResourceUri(viewName);
     const authorFacts = this.#viewResourceFacts(
       this.#viewBindings.get(viewName)?.config
     );
-    const hmrWs = this.#viewsDevMode;
     const resourceConfig = viewResourceConfig(
       viewName,
       entry,
       authorFacts,
-      servingOrigin,
-      { hmrWs }
+      metaOptions
     );
     server.registerResource(
       viewName,
@@ -1621,15 +2636,24 @@ var MCPServer = class _MCPServer {
       resourceConfig,
       async (readUri, ctx) => {
         const req = ctx.http?.req;
-        const origin = req !== void 0 ? resolveRequestOrigin(req) : servingOrigin;
-        const html = synthesizeViewDocument(entry, origin, basePath);
+        const readOptions = req !== void 0 ? {
+          request: req,
+          ...metaOptions.hmrWs === true ? { hmrWs: true } : {}
+        } : metaOptions.hmrWs === true ? { hmrWs: true } : {};
+        const assetsBase = req !== void 0 ? resolveAssetsBase(req) : metaOptions.request !== void 0 ? resolveAssetsBase(metaOptions.request) : "";
+        const html = synthesizeViewDocument(
+          entry,
+          assetsBase,
+          basePath,
+          viewName
+        );
         return {
           contents: [
             {
               uri: readUri.href,
               mimeType: resourceConfig.mimeType,
               text: html,
-              _meta: buildResourceUiMeta(authorFacts, origin, { hmrWs })
+              _meta: buildResourceUiMeta(authorFacts, readOptions)
             }
           ]
         };
@@ -1647,14 +2671,36 @@ var MCPServer = class _MCPServer {
         },
         ...definition.mimeType !== void 0 && {
           mimeType: definition.mimeType
+        },
+        ...definition.annotations !== void 0 && {
+          annotations: definition.annotations
+        },
+        ...definition._meta !== void 0 && {
+          _meta: { ...definition._meta }
         }
       },
-      async (uri, ctx) => callback(uri, this.#toRequestContext(ctx))
+      async (uri, ctx) => {
+        const mwCtx = this.#createMiddlewareContext(
+          "resources/read",
+          {
+            uri: uri.href,
+            ...ctx.mcpReq._meta !== void 0 && { _meta: ctx.mcpReq._meta }
+          },
+          ctx
+        );
+        const innerFn = async () => callback(uri, this.#toRequestContext(ctx));
+        return await this.#runMcpHook(
+          "resources/read",
+          mwCtx,
+          innerFn
+        );
+      }
     );
   }
-  #registerResourceTemplate(server, { definition, callback }) {
+  #registerResourceTemplate(server, { definition, callback, complete }) {
     const template = new ResourceTemplate(definition.uriTemplate, {
-      list: void 0
+      list: void 0,
+      ...complete !== void 0 && { complete }
     });
     server.registerResource(
       definition.name,
@@ -1666,13 +2712,34 @@ var MCPServer = class _MCPServer {
         },
         ...definition.mimeType !== void 0 && {
           mimeType: definition.mimeType
+        },
+        ...definition.annotations !== void 0 && {
+          annotations: definition.annotations
+        },
+        ...definition._meta !== void 0 && {
+          _meta: { ...definition._meta }
         }
       },
-      async (uri, variables, ctx) => callback(
-        uri,
-        variables,
-        this.#toRequestContext(ctx)
-      )
+      async (uri, variables, ctx) => {
+        const mwCtx = this.#createMiddlewareContext(
+          "resources/read",
+          {
+            uri: uri.href,
+            ...ctx.mcpReq._meta !== void 0 && { _meta: ctx.mcpReq._meta }
+          },
+          ctx
+        );
+        const innerFn = async () => callback(
+          uri,
+          variables,
+          this.#toRequestContext(ctx)
+        );
+        return await this.#runMcpHook(
+          "resources/read",
+          mwCtx,
+          innerFn
+        );
+      }
     );
   }
   #viewResourceFacts(viewConfig) {
@@ -1700,17 +2767,30 @@ var MCPServer = class _MCPServer {
         description: definition.description
       }
     };
+    const invokePrompt = async (args, ctx) => {
+      const mwCtx = this.#createMiddlewareContext(
+        "prompts/get",
+        {
+          name: definition.name,
+          arguments: args,
+          ...ctx.mcpReq._meta !== void 0 && { _meta: ctx.mcpReq._meta }
+        },
+        ctx
+      );
+      const innerFn = async () => {
+        const effectiveArgs = mwCtx.params.arguments ?? {};
+        return callback(effectiveArgs, this.#toRequestContext(ctx));
+      };
+      return await this.#runMcpHook("prompts/get", mwCtx, innerFn);
+    };
     if (definition.schema !== void 0) {
       server.registerPrompt(
         definition.name,
         { ...config, argsSchema: definition.schema },
-        async (args, ctx) => {
-          const params = args;
-          return callback(params, this.#toRequestContext(ctx));
-        }
+        async (args, ctx) => invokePrompt(args, ctx)
       );
     } else {
-      const handler = async (ctx) => callback({}, this.#toRequestContext(ctx));
+      const handler = async (ctx) => invokePrompt({}, ctx);
       server.registerPrompt(
         definition.name,
         config,
@@ -1732,46 +2812,32 @@ import {
   createRequestStateCodec,
   inputRequired as inputRequired2,
   inputResponse as inputResponse2,
-  isInputRequiredResult as isInputRequiredResult2
+  isInputRequiredResult as isInputRequiredResult3
 } from "@modelcontextprotocol/server";
-
-// src/completable.ts
-import {
-  completable as sdkCompletable
-} from "@modelcontextprotocol/server";
-function completable(schema, complete) {
-  if (typeof complete === "function") {
-    return sdkCompletable(
-      schema,
-      (value, context) => complete(String(value ?? ""), context)
-    );
-  }
-  const values = complete.map(String);
-  return sdkCompletable(schema, (value) => {
-    const prefix = String(value ?? "").toLowerCase();
-    return values.filter((v) => v.toLowerCase().startsWith(prefix));
-  });
-}
 export {
   MCPServer,
   acceptedContent,
   completable,
   composeFetch,
+  composeMiddleware,
+  createMcpEventListenerEntry,
+  createMcpMiddlewareEntry,
   createMcpMount,
   createRequestStateCodec,
   getRequestBag,
   hostValidationMiddleware,
   inputRequired2 as inputRequired,
   inputResponse2 as inputResponse,
-  isInputRequiredResult2 as isInputRequiredResult,
+  isInputRequiredResult3 as isInputRequiredResult,
   jsonBodyMiddleware,
   matchesPath,
   matchesPathPrefix,
-  mountMcp,
+  matchesPattern,
   originValidationMiddleware,
   pathnameOf,
   registerViews,
   requestLogger,
-  routeFetch
+  routeFetch,
+  toFrameworkHandler
 };
 //# sourceMappingURL=index.js.map