mcp-use 2.0.0-beta.24 → 2.0.0-beta.26

package/dist/bin.js

@@ -1,196 +1,4 @@
 #!/usr/bin/env node
-import {
-  parseArgs
-} from "./chunk-E4XCL25Z.js";
-
-// src/bin/main.ts
-import { readFileSync } from "fs";
-import { resolve } from "path";
-var HELP = `mcp-use \u2014 run MCP servers built with mcp-use
-
-Usage: mcp-use <command> [options]
-
-Commands:
-  dev      Start the dev server
-  build    Build the server into .mcp-use/build
-  start    Serve the production build from .mcp-use/build
-  login    Authenticate the cloud CLI
-  logout   Delete local cloud credentials
-  whoami   Show the authenticated cloud identity
-  org      Manage the active organization
-  servers  Manage cloud servers and environment variables
-  deployments Manage cloud deployments and logs
-  deploy   Deploy the current GitHub project
-  client   Connect to and invoke MCP servers
-  skills   Install maintained coding-agent skills
-  screenshot Capture an MCP Apps view
-
-Options:
-  -p, --port <n>     Port to serve on (default: $PORT or 3000)
-  --host <host>      Host to bind (dev only)
-  --entry <path>     Server entry module (dev/build only)
-  --path <directory> Project root (default: current directory)
-  --mcp-dir <dir>    Directory containing the MCP entry and views/
-  --views-dir <dir>  Views directory (default: views/ or <mcp-dir>/views/)
-  --with-inspector   Record inspector availability in the build manifest (build only)
-  --source-maps      Emit source maps in build output (build only)
-  --inline           Embed view JS and CSS in MCP resources (build only)
-  --tunnel           Expose the dev server through a public tunnel (dev only)
-  --no-open          Do not auto-open the inspector in a browser (dev only)
-  -h, --help         Show this help
-  -v, --version      Print the version`;
-async function main(argv) {
-  if (argv.length === 1 && ["--version", "-v"].includes(argv[0] ?? "")) {
-    console.log(readOwnVersion());
-    return 0;
-  }
-  if (argv.some((token) => token === "--help" || token === "-h")) {
-    const command2 = argv[0];
-    if (command2 === void 0 || command2 === "--help" || command2 === "-h") {
-      console.log(HELP);
-      return 0;
-    }
-  }
-  const command = argv[0];
-  if (command === "login" || command === "logout" || command === "whoami") {
-    const { runIdentity } = await import("./commands/identity.js");
-    return runIdentity(command, argv.slice(1));
-  }
-  if (command === "org") {
-    const { runOrganizations } = await import("./commands/organizations.js");
-    return runOrganizations(argv.slice(1));
-  }
-  if (command === "servers") {
-    const { runServers } = await import("./commands/servers.js");
-    return runServers(argv.slice(1));
-  }
-  if (command === "deployments") {
-    const { runDeployments } = await import("./commands/deployments.js");
-    return runDeployments(argv.slice(1));
-  }
-  if (command === "deploy") {
-    const { runDeploy } = await import("./commands/deploy.js");
-    return runDeploy(argv.slice(1));
-  }
-  if (command === "client") {
-    const { runClient } = await import("./commands/client.js");
-    return runClient(argv.slice(1));
-  }
-  if (command === "skills") {
-    const { runSkills } = await import("./commands/skills.js");
-    return runSkills(argv.slice(1));
-  }
-  if (command === "screenshot") {
-    const { runScreenshot } = await import("./commands/screenshot.js");
-    return runScreenshot(argv.slice(1));
-  }
-  let args;
-  try {
-    args = parseArgs(argv);
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    return 2;
-  }
-  if (args.version) {
-    console.log(readOwnVersion());
-    return 0;
-  }
-  if (args.help) {
-    console.log(HELP);
-    return 0;
-  }
-  switch (args.command) {
-    case "start":
-      return startCommand(args);
-    case "dev":
-    case "build":
-      return cliCommand(args.command, args);
-    case void 0:
-      console.error(HELP);
-      return 2;
-    default:
-      console.error(`Unknown command: ${args.command}
-
-${HELP}`);
-      return 2;
-  }
-}
-async function startCommand(args) {
-  let started;
-  try {
-    const { runStart } = await import("./commands/start.js");
-    started = await runStart({
-      cwd: resolve(process.cwd(), args.path ?? "."),
-      port: args.port
-    });
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    return 1;
-  }
-  console.log(`mcp-use server running at ${started.url}`);
-  const shutdown = () => {
-    started.close().then(
-      () => process.exit(0),
-      (error) => {
-        console.error(error instanceof Error ? error.message : String(error));
-        process.exit(1);
-      }
-    );
-  };
-  process.once("SIGINT", shutdown);
-  process.once("SIGTERM", shutdown);
-  return 0;
-}
-async function cliCommand(command, args) {
-  const options = {
-    cwd: resolve(process.cwd(), args.path ?? "."),
-    ...args.entry !== void 0 && { entry: args.entry },
-    ...args.mcpDir !== void 0 && { mcpDir: args.mcpDir },
-    ...args.viewsDir !== void 0 && { viewsDir: args.viewsDir },
-    ...args.port !== void 0 && { port: args.port },
-    ...args.host !== void 0 && { host: args.host },
-    ...args.tunnel && { tunnel: true },
-    ...!args.open && { open: false },
-    ...args.withInspector && { withInspector: true },
-    ...args.sourceMaps && { sourceMaps: true },
-    ...args.inline && { inline: true }
-  };
-  try {
-    if (command === "dev") {
-      const { runDev } = await import("./commands/dev.js");
-      await runDev(options);
-    } else {
-      const { runBuild } = await import("./commands/build.js");
-      await runBuild(options);
-    }
-    return 0;
-  } catch (error) {
-    console.error(error instanceof Error ? error.message : String(error));
-    return 1;
-  }
-}
-function readOwnVersion() {
-  for (const relative of ["../package.json", "../../package.json"]) {
-    try {
-      const raw = readFileSync(new URL(relative, import.meta.url), "utf8");
-      const pkg = JSON.parse(raw);
-      if ((pkg.name === "mcp-use" || pkg.name === "mcp-use") && typeof pkg.version === "string") {
-        return pkg.version;
-      }
-    } catch {
-    }
-  }
-  return "unknown";
-}
 
 // src/bin.ts
-main(process.argv.slice(2)).then(
-  (code) => {
-    process.exitCode = code;
-  },
-  (error) => {
-    console.error(error instanceof Error ? error.message : String(error));
-    process.exitCode = 1;
-  }
-);
-//# sourceMappingURL=bin.js.map
+await import("@mcp-use/cli");

package/dist/branding.d.ts

@@ -79,4 +79,3 @@ export declare function createFaviconHandler(branding: ServerBranding, options:
     projectRoot: string;
     deferCors?: boolean;
 }): FetchHandler | undefined;
-//# sourceMappingURL=branding.d.ts.map

package/dist/{chunk-QUUANIE4.js → chunk-26JBVQUY.js}

@@ -1,3 +1,26 @@
+import {
+  getOAuthProviderOptions,
+  wrapOAuthTokenVerifier
+} from "./chunk-YF5X7FYF.js";
+
+// src/oauth/index.ts
+import {
+  OAuthError,
+  OAuthErrorCode,
+  bearerAuthChallengeResponse,
+  getOAuthProtectedResourceMetadataUrl as getOAuthProtectedResourceMetadataUrl2,
+  oauthMetadataResponse as oauthMetadataResponse2,
+  requireBearerAuth as requireBearerAuth2,
+  verifyBearerToken
+} from "@modelcontextprotocol/server";
+
+// src/oauth/adapters.ts
+import {
+  getOAuthProtectedResourceMetadataUrl,
+  oauthMetadataResponse,
+  requireBearerAuth
+} from "@modelcontextprotocol/server";
+
 // src/fetch-app.ts
 import {
   hostHeaderValidationResponse,
@@ -108,6 +131,51 @@ function originValidationMiddleware(origins, skipSafeMethods = true) {
   };
 }
 
+// src/oauth/adapters.ts
+function bearerAuth(provider, resource) {
+  const options = getOAuthProviderOptions(provider);
+  const gate = requireBearerAuth({
+    verifier: wrapOAuthTokenVerifier(provider, resource),
+    resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resource),
+    ...options.requiredScopes !== void 0 && {
+      requiredScopes: [...options.requiredScopes]
+    }
+  });
+  return async (request, next) => {
+    const result = await gate(request);
+    if (result instanceof Response) {
+      return result;
+    }
+    getRequestBag(request).authInfo = result;
+    return next();
+  };
+}
+function oauthMetadata(provider, resource) {
+  const options = getOAuthProviderOptions(provider);
+  return async (request, next) => {
+    const response = oauthMetadataResponse(request, {
+      oauthMetadata: options.oauthMetadata,
+      resourceServerUrl: resource,
+      ...options.scopesSupported !== void 0 && {
+        scopesSupported: [...options.scopesSupported]
+      },
+      ...options.resourceName !== void 0 && {
+        resourceName: options.resourceName
+      },
+      ...options.serviceDocumentationUrl !== void 0 && {
+        serviceDocumentationUrl: options.serviceDocumentationUrl
+      }
+    });
+    if (response !== void 0) {
+      return response;
+    }
+    return next();
+  };
+}
+function authInfoFromRequest(request) {
+  return getRequestBag(request).authInfo;
+}
+
 export {
   toFrameworkHandler,
   getRequestBag,
@@ -120,6 +188,15 @@ export {
   routeFetch,
   jsonBodyMiddleware,
   hostValidationMiddleware,
-  originValidationMiddleware
+  originValidationMiddleware,
+  bearerAuth,
+  oauthMetadata,
+  authInfoFromRequest,
+  OAuthError,
+  OAuthErrorCode,
+  bearerAuthChallengeResponse,
+  getOAuthProtectedResourceMetadataUrl2 as getOAuthProtectedResourceMetadataUrl,
+  oauthMetadataResponse2 as oauthMetadataResponse,
+  requireBearerAuth2 as requireBearerAuth,
+  verifyBearerToken
 };
-//# sourceMappingURL=chunk-QUUANIE4.js.map

package/dist/{chunk-KIZ72TIK.js → chunk-DFFP6QPR.js}

@@ -35,4 +35,3 @@ export {
   completable,
   normalizeCompletions
 };
-//# sourceMappingURL=chunk-KIZ72TIK.js.map

package/dist/{chunk-FC2Z2VFO.js → chunk-HDV7K2TE.js}

@@ -92,8 +92,6 @@ function hasExplicitAssetsBase() {
 export {
   resolveServerOrigin,
   originFromAssetsBase,
-  normalizeAssetsBaseUrl,
   resolveAssetsBase,
   hasExplicitAssetsBase
 };
-//# sourceMappingURL=chunk-FC2Z2VFO.js.map

package/dist/{chunk-AATFAERC.js → chunk-HNNQJLD5.js}

@@ -381,4 +381,3 @@ function readRecord(value) {
 export {
   registerOpenAPITools
 };
-//# sourceMappingURL=chunk-AATFAERC.js.map

package/dist/{chunk-ZJJD33SF.js → chunk-PPQL2WHL.js}

@@ -738,4 +738,3 @@ a:hover { text-decoration: underline; }
 export {
   generateLandingPage
 };
-//# sourceMappingURL=chunk-ZJJD33SF.js.map

package/dist/{chunk-G62AMJHS.js → chunk-QCIREWRS.js}

@@ -62,4 +62,3 @@ export {
   resolvePublicFilePath,
   servePublicFile
 };
-//# sourceMappingURL=chunk-G62AMJHS.js.map

package/dist/{chunk-DPL7OEXC.js → chunk-YF5X7FYF.js}

@@ -515,4 +515,3 @@ export {
   getOAuthProviderOptions,
   oauthCustomProvider
 };
-//# sourceMappingURL=chunk-DPL7OEXC.js.map

package/dist/completable.d.ts

@@ -39,4 +39,3 @@ export declare function createPrefixCompletion(values: ReadonlyArray<string | nu
  * ```
  */
 export declare function completable<T extends StandardSchemaV1>(schema: T, complete: ReadonlyArray<string | number | boolean> | CompletionCallback): ReturnType<typeof sdkCompletable<T>>;
-//# sourceMappingURL=completable.d.ts.map

package/dist/config.d.ts

@@ -1,34 +1,6 @@
 import type { Icon, ServerOptions } from "@modelcontextprotocol/server";
 import type { LoggingOptions } from "./logging.js";
 import type { OAuthProvider } from "./oauth/index.js";
-/**
- * Options for the inspector shell route — the shape of
- * {@link ServerConfig.inspector}.
- */
-export interface InspectorOptions {
-    /**
-     * Whether the inspector shell route is mounted.
-     *
-     * @defaultValue `true`
-     */
-    enabled?: boolean;
-    /**
-     * Full replacement URL for the inspector bundle script (FastAPI's
-     * `swagger_js_url` analog). When set, the shell's `<script type="module">`
-     * loads exactly this URL, so it must point at a complete copy of the
-     * `@mcp-use/inspector` CDN bundle (`dist/cdn/inspector.js`) — self-host it
-     * for air-gapped environments where the public CDN is unreachable.
-     *
-     * @defaultValue The latest `@mcp-use/inspector` beta, resolved to one exact
-     * asset version in the browser before the bundle loads.
-     */
-    assetsUrl?: string;
-    /**
-     * Hosted managed-chat backend URL (injected as `window.__MANUFACT_CHAT_URL__`).
-     * Defaults to `process.env.MANUFACT_CHAT_URL` when the shell is mounted.
-     */
-    manufactChatUrl?: string;
-}
 /**
  * Common server identity and behavior, passed to `new MCPServer(...)`.
  *
@@ -130,7 +102,8 @@ interface BaseServerConfig {
      */
     basePath?: string;
     /**
-     * Hostname `listen()` binds. Defaults to `127.0.0.1`; localhost-class
+     * Hostname `listen()` binds when neither an explicit listener host nor
+     * `HOST` is set. Defaults to `127.0.0.1`; localhost-class
      * binds get DNS-rebinding protection (`Host` on every request; `Origin`
      * only on non-GET/HEAD) automatically. Set `"0.0.0.0"` to serve publicly — behind a platform
      * edge (Railway, Fly, …) nothing more is needed, since the edge only
@@ -138,6 +111,13 @@ interface BaseServerConfig {
      * which never binds.
      */
     host?: string;
+    /**
+     * TCP port `listen()` binds when neither an explicit port nor `PORT` is set.
+     * Use `0` to request an ephemeral port.
+     *
+     * @defaultValue `3000`
+     */
+    port?: number;
     /**
      * Extra allowed hostnames for Host-header validation (DNS-rebinding
      * protection), e.g. `["api.example.com"]`. Port-agnostic and additive:
@@ -179,46 +159,6 @@ interface BaseServerConfig {
      * @defaultValue `false`
      */
     publicLandingPage?: boolean;
-    /**
-     * Inspector shell route at `${basePath}/inspector` — a browser UI for
-     * exploring and calling the server's tools, resources, and prompts.
-     *
-     * @remarks
-     * Follows the FastAPI `/docs` model: the server itself ships only a tiny
-     * dependency-free HTML page whose inline module loader resolves the latest
-     * `@mcp-use/inspector` beta to one exact CDN release before loading it, so
-     * the UI updates independently of SDK releases without mixing asset
-     * versions or adding anything to the install. The page tells the inspector
-     * to connect to this server's MCP endpoint at `basePath`, deriving the URL
-     * from the browser's own origin.
-     *
-     * Enabled by default; set `{ enabled: false }` to disable the route, or
-     * pass `{ assetsUrl }` to load the bundle from a self-hosted copy instead
-     * of the public CDN (air-gapped environments). For local development,
-     * `MCP_USE_INSPECTOR_ASSETS_URL` provides the same override without changing
-     * application code; an explicit `assetsUrl` takes precedence.
-     *
-     * @example
-     * ```ts
-     * // Default: inspector served at /mcp/inspector from the public CDN.
-     * new MCPServer({ name: "my-server", version: "1.0.0" });
-     *
-     * // Disabled:
-     * new MCPServer({
-     *   name: "my-server",
-     *   version: "1.0.0",
-     *   inspector: { enabled: false },
-     * });
-     *
-     * // Air-gapped: load a self-hosted copy of the inspector bundle.
-     * new MCPServer({
-     *   name: "my-server",
-     *   version: "1.0.0",
-     *   inspector: { assetsUrl: "https://intranet.example.com/inspector.js" },
-     * });
-     * ```
-     */
-    inspector?: InspectorOptions;
     /**
      * HTTP/MCP request logging: one summary line per request plus an indented
      * detail line naming the MCP method, its subject (tool name, resource URI,
@@ -247,7 +187,7 @@ interface BaseServerConfig {
     requestState?: ServerOptions["requestState"];
     /**
      * Optional CORS headers on every route served by `getHandler()` / `listen()`
-     * (MCP endpoint, view assets, inspector, OAuth metadata). Off when omitted.
+     * (MCP endpoint, view assets, landing page, OAuth metadata). Off when omitted.
      *
      * Pair with {@link BaseServerConfig.allowedOrigins | allowedOrigins} for
      * browser clients: CORS tells the browser it may read the response; Origin
@@ -297,6 +237,7 @@ export interface CorsOptions {
  */
 export declare function assertServerConfig(config: {
     basePath?: unknown;
+    port?: unknown;
 }): void;
 /**
  * Server identity and behavior, passed to `new MCPServer(...)`.
@@ -316,4 +257,3 @@ export type ServerConfig<TUser = never> = BaseServerConfig & ([TUser] extends [n
     oauth: OAuthProvider<TUser>;
 });
 export {};
-//# sourceMappingURL=config.d.ts.map

package/dist/context.d.ts

@@ -127,4 +127,3 @@ export declare function toRequestContext(ctx: ServerContext): RequestContext<nev
 /** @internal Projects mapped OAuth auth information into callback context. */
 export declare function toAuthenticatedRequestContext<TUser>(ctx: ServerContext): RequestContext<TUser, true>;
 export {};
-//# sourceMappingURL=context.d.ts.map

package/dist/fetch-app.d.ts

@@ -113,4 +113,3 @@ export declare function hostValidationMiddleware(hosts: string[]): FetchMiddlewa
  * @param skipSafeMethods - When true, skip GET/HEAD (view asset GETs).
  */
 export declare function originValidationMiddleware(origins: string[], skipSafeMethods?: boolean): FetchMiddleware;
-//# sourceMappingURL=fetch-app.d.ts.map

package/dist/index.d.ts

@@ -5,6 +5,7 @@
  * 2026-07-28 MCP protocol. See specs/SPEC.md for the phase plan and API contract.
  */
 export { MCPServer } from "./server.js";
+export type { ListenOptions, ListenRoute } from "./server.js";
 export { createMcpMount } from "./mount-mcp.js";
 export type { MountMcpOptions, McpMount } from "./mount-mcp.js";
 export { composeFetch, getRequestBag, hostValidationMiddleware, jsonBodyMiddleware, matchesPath, matchesPathPrefix, originValidationMiddleware, pathnameOf, routeFetch, toFrameworkHandler, } from "./fetch-app.js";
@@ -41,7 +42,7 @@ export type { CompletionCallback, CompletionContext } from "./completable.js";
  * Implemented by zod v4, ArkType, Valibot, …
  */
 export type { StandardSchemaV1, StandardSchemaWithJSON, } from "@modelcontextprotocol/server";
-export type { InspectorOptions, ServerConfig, CorsOptions } from "./config.js";
+export type { ServerConfig, CorsOptions } from "./config.js";
 export type { ServerBranding } from "./branding.js";
 /** Official MCP icon shape used by {@link ServerConfig.icons}. */
 export type { Icon } from "@modelcontextprotocol/server";
@@ -55,4 +56,3 @@ export type { ExternalViewManifestEntry, InlineViewManifestEntry, UiPermissions,
 export type { InferTemplateParams, ResourceCallback, ResourceDefinition, ResourceTemplateCallback, ResourceTemplateCompleter, ResourceTemplateCompletions, ResourceTemplateDefinition, TemplateVariableValue, } from "./resources.js";
 export type { InferPromptInput, PromptCallback, PromptDefinition, } from "./prompts.js";
 export type { ProxyConnection, ProxyHttpConfig, ProxyProgress, ProxyPrompt, ProxyRequestOptions, ProxyResource, ProxyServerConfig, ProxyTool, } from "./mcp-proxy.js";
-//# sourceMappingURL=index.d.ts.map