mcp-use 2.0.0-beta.24 → 2.0.0-beta.26

package/dist/index.js

@@ -1,49 +1,44 @@
-import {
-  resolvePublicFilePath,
-  servePublicFile
-} from "./chunk-G62AMJHS.js";
-import {
-  synthesizeViewDocument
-} from "./chunk-HUE6SPU6.js";
 import {
   hasExplicitAssetsBase,
   originFromAssetsBase,
   resolveAssetsBase,
   resolveServerOrigin
-} from "./chunk-FC2Z2VFO.js";
+} from "./chunk-HDV7K2TE.js";
 import {
   registerOpenAPITools
-} from "./chunk-AATFAERC.js";
+} from "./chunk-HNNQJLD5.js";
 import {
   completable,
   normalizeCompletions
-} from "./chunk-KIZ72TIK.js";
+} from "./chunk-DFFP6QPR.js";
 import {
-  authInfoFromRequest,
-  getOAuthProtectedResourceMetadataUrl,
-  oauthMetadata,
-  requireBearerAuth
-} from "./chunk-Z326HADF.js";
+  resolvePublicFilePath,
+  servePublicFile
+} from "./chunk-QCIREWRS.js";
 import {
+  authInfoFromRequest,
   composeFetch,
+  getOAuthProtectedResourceMetadataUrl,
   getRequestBag,
   hostValidationMiddleware,
   isHtmlNavigationRequest,
   jsonBodyMiddleware,
   matchesPath,
   matchesPathPrefix,
+  oauthMetadata,
   originValidationMiddleware,
   pathUnderBase,
   pathnameOf,
+  requireBearerAuth,
   routeFetch,
   toFrameworkHandler
-} from "./chunk-QUUANIE4.js";
+} from "./chunk-26JBVQUY.js";
 import {
   getOAuthProviderOptions,
   resolveConfiguredOAuthResource,
   resolveLocalOAuthResource,
   wrapOAuthTokenVerifier
-} from "./chunk-DPL7OEXC.js";
+} from "./chunk-YF5X7FYF.js";
 
 // src/server.ts
 import {
@@ -296,6 +291,30 @@ function assertServerConfig(config) {
       );
     }
   }
+  if (config.port !== void 0 && (typeof config.port !== "number" || !Number.isInteger(config.port) || config.port < 0 || config.port > 65535)) {
+    throw new TypeError("port must be an integer between 0 and 65535");
+  }
+}
+
+// src/listen-address.ts
+var DEFAULT_LISTEN_HOST = "127.0.0.1";
+var DEFAULT_LISTEN_PORT = 3e3;
+function resolveListenHost(explicitHost, configuredHost, env = process.env) {
+  if (explicitHost !== void 0) return explicitHost;
+  const envHost = env.HOST?.trim();
+  if (envHost !== void 0 && envHost !== "") return envHost;
+  return configuredHost ?? DEFAULT_LISTEN_HOST;
+}
+function resolveListenPort(explicitPort, configuredPort, env = process.env) {
+  if (explicitPort !== void 0) return explicitPort;
+  const envPort = parsePort(env.PORT);
+  if (envPort !== void 0) return envPort;
+  return configuredPort ?? DEFAULT_LISTEN_PORT;
+}
+function parsePort(value) {
+  if (value === void 0 || value.trim() === "") return void 0;
+  const port = Number(value);
+  return Number.isInteger(port) && port >= 0 && port <= 65535 ? port : void 0;
 }
 
 // src/context.ts
@@ -761,242 +780,6 @@ function normalizeMcpMiddlewarePattern(raw) {
   return raw.startsWith("mcp:") ? raw.slice(4) : raw;
 }
 
-// src/inspector-shell.ts
-var INSPECTOR_TAG = "beta";
-var DEFAULT_INSPECTOR_ASSETS_URL = `https://cdn.jsdelivr.net/npm/@mcp-use/inspector@${INSPECTOR_TAG}/dist/cdn/inspector.js`;
-var INSPECTOR_VERSION_RESOLVER_URL = `https://data.jsdelivr.com/v1/packages/npm/@mcp-use/inspector/resolved?specifier=${INSPECTOR_TAG}`;
-var INSPECTOR_CDN_PACKAGE_URL = "https://cdn.jsdelivr.net/npm/@mcp-use/inspector";
-function inspectorStylesUrl(assetsUrl) {
-  return assetsUrl.replace(/\.js(?=$|[?#])/, ".css");
-}
-function matchesInspectorShellPath(pathname, basePath) {
-  const prefix = pathUnderBase(basePath, "inspector");
-  if (pathname !== prefix && !pathname.startsWith(`${prefix}/`)) {
-    return false;
-  }
-  const suffix = pathname.slice(prefix.length);
-  return suffix !== "/api" && !suffix.startsWith("/api/");
-}
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
-function serializeForInlineScript(value) {
-  return JSON.stringify(value).replaceAll("<", "\\u003c");
-}
-function renderDefaultInspectorAssetLoader() {
-  return `<script type="module">
-      const resolverUrl = ${serializeForInlineScript(INSPECTOR_VERSION_RESOLVER_URL)};
-      const packageUrl = ${serializeForInlineScript(INSPECTOR_CDN_PACKAGE_URL)};
-      const versionPattern = /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/;
-
-      try {
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 10_000);
-        let response;
-        try {
-          response = await fetch(resolverUrl, { signal: controller.signal });
-        } finally {
-          clearTimeout(timeout);
-        }
-        if (!response.ok) {
-          throw new Error(\`Inspector version resolver returned HTTP \${response.status}\`);
-        }
-
-        const resolved = await response.json();
-        if (
-          resolved?.name !== "@mcp-use/inspector" ||
-          typeof resolved.version !== "string" ||
-          !versionPattern.test(resolved.version)
-        ) {
-          throw new Error("Inspector version resolver returned an invalid release");
-        }
-
-        const version = resolved.version;
-        const assetBase = \`\${packageUrl}@\${version}/dist/cdn\`;
-        const stylesheet = document.createElement("link");
-        stylesheet.rel = "stylesheet";
-        stylesheet.href = \`\${assetBase}/inspector.css\`;
-        document.head.append(stylesheet);
-
-        window.__INSPECTOR_VERSION__ = version;
-        await import(\`\${assetBase}/inspector.js\`);
-      } catch (error) {
-        console.error("[Inspector] Failed to load the latest Inspector release:", error);
-        document.querySelector(".mcp-boot-spinner")?.remove();
-        const label = document.querySelector(".mcp-boot-label");
-        if (label) {
-          label.textContent = "Unable to load Inspector. Reload to try again.";
-        }
-      }
-    </script>`;
-}
-function renderInspectorShell(options) {
-  const {
-    serverName,
-    basePath,
-    faviconHref,
-    faviconType,
-    assetsUrl,
-    manufactChatUrl
-  } = options;
-  const serializedBasePath = serializeForInlineScript(basePath);
-  const serializedManufactChatUrl = manufactChatUrl ? serializeForInlineScript(manufactChatUrl) : null;
-  const usesDefaultAssets = assetsUrl === void 0;
-  const customScriptSrc = assetsUrl === void 0 ? null : escapeHtml(assetsUrl);
-  const customStylesHref = assetsUrl === void 0 ? null : escapeHtml(inspectorStylesUrl(assetsUrl));
-  const assetPreconnects = usesDefaultAssets ? `    <link rel="preconnect" href="https://data.jsdelivr.com" crossorigin />
-    <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin />` : "";
-  const stylesheetTag = customStylesHref !== null ? `    <link rel="stylesheet" href="${customStylesHref}" />` : "";
-  const assetLoader = usesDefaultAssets ? renderDefaultInspectorAssetLoader() : `<script type="module" src="${customScriptSrc}"></script>`;
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(serverName)} \u2014 MCP Inspector</title>
-    ${faviconHref !== void 0 ? `<link rel="icon"${faviconType !== void 0 ? ` type="${escapeHtml(faviconType)}"` : ""} href="${escapeHtml(faviconHref)}" />` : ""}
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-${assetPreconnects}
-    <link
-      href="https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;500;700&display=swap"
-      rel="stylesheet"
-    />
-${stylesheetTag}
-    <style>
-      :root { color-scheme: light dark; }
-      html, body { height: 100%; margin: 0; background-color: #f3f3f3; }
-      #root { height: 100%; }
-      .mcp-boot {
-        display: flex;
-        height: 100%;
-        align-items: center;
-        justify-content: center;
-        background-color: #f3f3f3;
-      }
-      .mcp-boot-inner {
-        display: flex;
-        flex-direction: column;
-        align-items: center;
-        gap: 16px;
-      }
-      .mcp-boot-spinner {
-        width: 32px;
-        height: 32px;
-        color: #52525b;
-        animation: mcp-boot-spin 1s linear infinite;
-      }
-      .mcp-boot-label {
-        margin: 0;
-        font-family: Ubuntu, sans-serif;
-        font-size: 0.875rem;
-        line-height: 1.25rem;
-        color: #52525b;
-      }
-      @keyframes mcp-boot-spin {
-        to { transform: rotate(360deg); }
-      }
-      @media (prefers-color-scheme: dark) {
-        html, body { background-color: #000; }
-        .mcp-boot { background-color: #000; }
-        .mcp-boot-spinner, .mcp-boot-label { color: #a1a1aa; }
-      }
-    </style>
-  </head>
-  <body>
-    <div id="root">
-      <div class="mcp-boot">
-        <div class="mcp-boot-inner">
-          <svg
-            class="mcp-boot-spinner"
-            xmlns="http://www.w3.org/2000/svg"
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            stroke-width="2"
-            stroke-linecap="round"
-            stroke-linejoin="round"
-            role="status"
-            aria-label="Loading"
-          >
-            <path d="M21 12a9 9 0 1 1-6.219-8.56" />
-          </svg>
-          <p class="mcp-boot-label">Connecting to MCP server...</p>
-        </div>
-      </div>
-    </div>
-    <script>
-      (function () {
-        var basePath = ${serializedBasePath};
-        // The connect URL is derived from the page's own origin: the server
-        // never guesses the hostname a browser reached it by.
-        window.__MCP_USE_INSPECTOR__ = {
-          autoConnectUrl: window.location.origin + basePath,
-          basePath: basePath,
-        };
-        // Read by the current inspector bundle to derive its own URLs.
-        window.__MCP_BASE_PATH__ = basePath;
-        ${process.env.MCP_USE_DEV_CLI === "1" ? "window.__MCP_DEV_CLI__ = true;" : ""}
-        ${serializedManufactChatUrl ? `window.__MANUFACT_CHAT_URL__ = ${serializedManufactChatUrl};` : ""}
-        // The bundle carries Node-flavored dependencies that touch \`process\`
-        // at module scope; give them the same browser polyfill the v1
-        // inspector shell provides, or the bundle throws on load.
-        if (typeof window.process === "undefined") {
-          window.process = {
-            env: {},
-            platform: "browser",
-            browser: true,
-            version: "v18.0.0",
-            versions: { node: "18.0.0" },
-            cwd: function () { return "/"; },
-            nextTick: function (fn) {
-              var args = Array.prototype.slice.call(arguments, 1);
-              queueMicrotask(function () { fn.apply(null, args); });
-            },
-          };
-        }
-      })();
-    </script>
-    ${assetLoader}
-  </body>
-</html>
-`;
-}
-function createInspectorHandler(inspector, options) {
-  if (inspector?.enabled === false) {
-    return void 0;
-  }
-  const { assetsUrl: configAssetsUrl, manufactChatUrl: configManufactChatUrl } = inspector ?? {};
-  const assetsUrl = configAssetsUrl ?? process.env["MCP_USE_INSPECTOR_ASSETS_URL"] ?? void 0;
-  const manufactChatUrl = configManufactChatUrl ?? process.env["MANUFACT_CHAT_URL"] ?? void 0;
-  const shellOptions = {
-    serverName: options.serverName,
-    basePath: options.basePath,
-    ...options.faviconHref !== void 0 && {
-      faviconHref: options.faviconHref
-    },
-    ...options.faviconType !== void 0 && {
-      faviconType: options.faviconType
-    },
-    assetsUrl,
-    manufactChatUrl
-  };
-  return async (request) => {
-    if (request.method !== "GET" && request.method !== "HEAD") {
-      return new Response("Method Not Allowed", { status: 405 });
-    }
-    const pathname = new URL(request.url).pathname;
-    if (!matchesInspectorShellPath(pathname, options.basePath)) {
-      return new Response("Not Found", { status: 404 });
-    }
-    const html = renderInspectorShell(shellOptions);
-    return new Response(request.method === "HEAD" ? null : html, {
-      status: 200,
-      headers: { "content-type": "text/html; charset=utf-8" }
-    });
-  };
-}
-
 // src/logging.ts
 import {
   CLIENT_INFO_META_KEY,
@@ -1249,7 +1032,7 @@ function styleStatus(status) {
 }
 function isNoisyRequest(httpMethod, pathname) {
   if (httpMethod !== "GET" && httpMethod !== "HEAD") return false;
-  return pathname.includes("/inspector") || pathname.endsWith("/favicon.ico");
+  return pathname.endsWith("/favicon.ico");
 }
 function requestLogger(options = {}) {
   if (options.enabled === false) {
@@ -1388,6 +1171,95 @@ function resolveToolInputSchema(definition) {
 // src/views/register.ts
 var registerViews = /* @__PURE__ */ Symbol("mcp-use/registerViews");
 
+// src/views/document.ts
+function resolveAssetUrl(assetPath, origin) {
+  if (!assetPath.startsWith("/")) {
+    throw new Error(
+      `View manifest asset path must be origin-absolute (start with "/"); got ${JSON.stringify(assetPath)}`
+    );
+  }
+  return `${origin}${assetPath}`;
+}
+function viewAssetsBasePath(basePath, viewName) {
+  return `${pathUnderBase(basePath, `_mcp-use/views/${viewName}`)}/`;
+}
+function resolveExternalAssetUrl(assetPath, assetsBase, basePath, viewName) {
+  if (assetPath.startsWith("http://") || assetPath.startsWith("https://") || assetPath.startsWith("data:")) {
+    return assetPath;
+  }
+  if (assetPath.startsWith("/")) {
+    return resolveAssetUrl(assetPath, assetsBase);
+  }
+  return `${assetsBase}${viewAssetsBasePath(basePath, viewName)}${assetPath.replace(/^\/+/, "")}`;
+}
+function resolvePublicBase(assetsBase, basePath) {
+  return `${assetsBase}${pathUnderBase(basePath, "_mcp-use/public")}/`;
+}
+function escapeInlineScript(code) {
+  return code.replaceAll(/<\/script/gi, "<\\/script").replaceAll("<!--", "\\x3C!--");
+}
+function escapeInlineStyle(css) {
+  return css.replaceAll(/<\/style/gi, "<\\/style");
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+var TRANSPARENT_IFRAME_STYLE = "<style>html,body,#root{background:transparent}</style>";
+function synthesizeViewDocument(entry, assetsBase, basePath, viewName) {
+  const viewConfig = {
+    publicBase: resolvePublicBase(assetsBase, basePath)
+  };
+  const configScript = `<script>globalThis.__mcpUseViewConfig=${JSON.stringify(viewConfig)};</script>`;
+  if (entry.kind === "inline") {
+    const styleTag = entry.css.length > 0 ? `<style>${escapeInlineStyle(entry.css)}</style>` : "";
+    const moduleScript = `<script type="module">${escapeInlineScript(entry.js)}</script>`;
+    return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+${configScript}
+${TRANSPARENT_IFRAME_STYLE}
+${styleTag}
+</head>
+<body>
+<div id="root"></div>
+${moduleScript}
+</body>
+</html>`;
+  }
+  if (viewName === void 0) {
+    throw new Error(
+      "viewName is required when synthesizing an external view document."
+    );
+  }
+  const cssLinks = entry.css.map(
+    (path) => `<link rel="stylesheet" href="${escapeHtml(resolveExternalAssetUrl(path, assetsBase, basePath, viewName))}">`
+  ).join("\n");
+  const scriptTags = (entry.scripts ?? []).map(
+    (path) => `<script type="module" src="${escapeHtml(resolveExternalAssetUrl(path, assetsBase, basePath, viewName))}"></script>`
+  ).join("\n");
+  const entryUrl = resolveExternalAssetUrl(
+    entry.entry,
+    assetsBase,
+    basePath,
+    viewName
+  );
+  return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+${configScript}
+${TRANSPARENT_IFRAME_STYLE}
+${cssLinks}
+</head>
+<body>
+<div id="root"></div>
+${scriptTags}
+<script type="module" src="${escapeHtml(entryUrl)}"></script>
+</body>
+</html>`;
+}
+
 // src/views/csp-env.ts
 var CATEGORY_ENV = {
   connectDomains: "CSP_CONNECT_DOMAINS",
@@ -1513,7 +1385,7 @@ function createViewAssetsHandler(basePath, views, options) {
     if (entry === void 0 || entry.kind !== "external") {
       return new Response("Not Found", { status: 404 });
     }
-    const [{ join }, { resolvePublicFilePath: resolvePublicFilePath2, servePublicFile: servePublicFile2 }] = await Promise.all([import("path"), import("./public-route-RWJVJQTX.js")]);
+    const [{ join }, { resolvePublicFilePath: resolvePublicFilePath2, servePublicFile: servePublicFile2 }] = await Promise.all([import("path"), import("./public-route-BAMZRI4R.js")]);
     const viewRoot = join(projectRoot, VIEW_ASSETS_BUILD_ROOT, viewName);
     const diskPath = await resolvePublicFilePath2(viewRoot, subpath);
     if (diskPath === null) {
@@ -1550,7 +1422,7 @@ function createViewPublicHandler(basePath, views, options) {
     if (subpath.length === 0) {
       return new Response("Not Found", { status: 404 });
     }
-    const [{ join }, { resolvePublicFilePath: resolvePublicFilePath2, servePublicFile: servePublicFile2 }] = await Promise.all([import("path"), import("./public-route-RWJVJQTX.js")]);
+    const [{ join }, { resolvePublicFilePath: resolvePublicFilePath2, servePublicFile: servePublicFile2 }] = await Promise.all([import("path"), import("./public-route-BAMZRI4R.js")]);
     const publicRoot = join(projectRoot, subdir);
     const diskPath = await resolvePublicFilePath2(publicRoot, subpath);
     if (diskPath === null) {
@@ -1740,18 +1612,26 @@ var MCPServer = class _MCPServer {
    *
    * Reflects `config.basePath` (default `"/mcp"`). Exposed so tooling that
    * imports the entry module — `mcp-use dev`'s startup log, for example —
-   * can build the endpoint and inspector URLs without assuming the default.
+   * can build endpoint and development-tool URLs without assuming the default.
    */
   get basePath() {
     return this.#basePath();
   }
+  /** Configured bind host, before CLI and environment overrides. */
+  get host() {
+    return this.#config.host;
+  }
+  /** Configured bind port, before CLI and environment overrides. */
+  get port() {
+    return this.#config.port;
+  }
   /**
    * Immutable normalized branding shared by MCP identity and browser pages.
    *
    * `favicon` is the final source after explicit-favicon and icon-selection
    * precedence. Landing-page integrations can use this accessor and link to
    * the server's root-level `/favicon.ico` route without reading private
-   * configuration or depending on the inspector/view layers.
+   * configuration or depending on the landing/view layers.
    *
    * @example
    * ```ts
@@ -1865,7 +1745,7 @@ var MCPServer = class _MCPServer {
   async proxy(input) {
     this.#assertOpen("proxy()");
     const operation = (async () => {
-      const { isProxyConnection, mountProxyConnection, mountProxyServers } = await import("./mcp-proxy-5YQJJ4RT.js");
+      const { isProxyConnection, mountProxyConnection, mountProxyServers } = await import("./mcp-proxy-QYZQ6LNV.js");
       if (isProxyConnection(input)) {
         await mountProxyConnection(this.#proxyHost(), input);
         return;
@@ -2012,9 +1892,11 @@ var MCPServer = class _MCPServer {
     await this.#ensureMounted("handler").handler.notify.resourceUpdated(uri);
   }
   /**
-   * Serve over HTTP on Node. Pass port `0` for an ephemeral port.
+   * Serve over HTTP on Node. Pass port `0` for an ephemeral port. Port
+   * precedence is the argument, `PORT`, `config.port`, then `3000`; host
+   * precedence is `options.host`, `HOST`, `config.host`, then `127.0.0.1`.
    *
-   * Binds `config.host` (default `127.0.0.1`). Localhost-class binds get
+   * Localhost-class binds get
    * DNS-rebinding Host protection automatically. Origin validation is off
    * unless `allowedOrigins` is set. To serve publicly set `host: "0.0.0.0"`;
    * behind a platform edge that is all that's needed, and `allowedHosts`
@@ -2029,12 +1911,13 @@ var MCPServer = class _MCPServer {
    * @throws If called on a localhost-class bind after {@link MCPServer.getHandler}
    * already mounted the app without Host validation.
    */
-  async listen(port = 3e3) {
+  async listen(port = void 0, options = {}) {
     this.#assertOpen("listen()");
-    this.#assertListenOAuthConfiguration();
     const { createServer } = await import("http");
     const { toNodeHandler } = await import("./node-bridge.js");
-    const host = this.#config.host ?? "127.0.0.1";
+    const host = resolveListenHost(options.host, this.#config.host);
+    const requestedPort = resolveListenPort(port, this.#config.port);
+    this.#assertListenOAuthConfiguration(host);
     return new Promise((resolve, reject) => {
       let resolveFetch;
       let rejectFetch;
@@ -2067,11 +1950,17 @@ var MCPServer = class _MCPServer {
         void nodeHandler(req, res);
       });
       server.once("error", rejectAndClose);
-      server.listen(port, host, () => {
+      server.listen(requestedPort, host, () => {
         try {
           const address = server.address();
-          const boundPort = typeof address === "object" && address !== null ? address.port : port;
-          const { fetch } = this.#ensureMounted("listen", boundPort);
+          const boundPort = typeof address === "object" && address !== null ? address.port : requestedPort;
+          const { fetch } = this.#ensureMounted(
+            "listen",
+            boundPort,
+            void 0,
+            options.routes,
+            host
+          );
           resolveFetch?.(fetch);
           if (!settled) {
             settled = true;
@@ -2135,14 +2024,14 @@ var MCPServer = class _MCPServer {
   #basePath() {
     return this.#config.basePath ?? "/mcp";
   }
-  #resolveOAuthResource(mode, listenPort) {
+  #resolveOAuthResource(mode, listenPort, listenHost) {
     if (this.#config.oauth === void 0) {
       return void 0;
     }
     if (this.#oauthResourceResolved) {
       return this.#oauthResource;
     }
-    const host = this.#config.host ?? "127.0.0.1";
+    const host = listenHost ?? this.#config.host ?? "127.0.0.1";
     const localListen = mode === "listen" && listenPort !== void 0 && ["127.0.0.1", "localhost", "::1"].includes(host);
     if (this.#oauthResourceConfigurationAbsent && localListen) {
       this.#oauthResource = resolveLocalOAuthResource(
@@ -2156,11 +2045,10 @@ var MCPServer = class _MCPServer {
       "OAuth requires an explicit resource or MCP_URL when using getHandler() or listening on a non-local host"
     );
   }
-  #assertListenOAuthConfiguration() {
+  #assertListenOAuthConfiguration(host) {
     if (this.#config.oauth === void 0) {
       return;
     }
-    const host = this.#config.host ?? "127.0.0.1";
     if (["127.0.0.1", "localhost", "::1"].includes(host)) {
       return;
     }
@@ -2221,17 +2109,18 @@ var MCPServer = class _MCPServer {
    * `allowedOrigins` is set explicitly (SDK-aligned: the handler is open by
    * default). When enabled, Origin is checked only on non-GET/HEAD requests.
    */
-  #validationPolicy(mode) {
-    const { host = "127.0.0.1", allowedHosts, allowedOrigins } = this.#config;
+  #validationPolicy(mode, listenHost) {
+    const { allowedHosts, allowedOrigins } = this.#config;
+    const host = listenHost ?? this.#config.host ?? "127.0.0.1";
     const localhostBind = ["127.0.0.1", "localhost", "::1"].includes(host);
     const hosts = allowedHosts !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedHostnames(), ...allowedHosts])] : mode === "listen" && localhostBind ? localhostAllowedHostnames() : void 0;
     const origins = allowedOrigins !== void 0 ? [.../* @__PURE__ */ new Set([...localhostAllowedOrigins(), ...allowedOrigins])] : void 0;
     return { hosts, origins };
   }
-  #ensureMounted(mode, listenPort, bus) {
+  #ensureMounted(mode, listenPort, bus, additionalRoutes = [], listenHost) {
     this.#assertOpen();
     if (this.#fetchHandler === void 0 || this.#handler === void 0) {
-      const { hosts, origins } = this.#validationPolicy(mode);
+      const { hosts, origins } = this.#validationPolicy(mode, listenHost);
       const basePath = this.#basePath();
       const nestedBasePath = basePath === "/" ? "" : basePath;
       const middlewares = [
@@ -2252,12 +2141,12 @@ var MCPServer = class _MCPServer {
       if (hosts === void 0) {
         if (mode === "listen") {
           console.warn(
-            `[mcp-use] listen() is serving on ${this.#config.host} without Host validation. Behind a platform edge that only routes your own domains this is expected; if this process is reachable directly, set allowedHosts to restrict it.`
+            `[mcp-use] listen() is serving on ${listenHost} without Host validation. Behind a platform edge that only routes your own domains this is expected; if this process is reachable directly, set allowedHosts to restrict it.`
           );
         }
       }
       this.#validateViewBindingsAtMount();
-      const resource = this.#resolveOAuthResource(mode, listenPort);
+      const resource = this.#resolveOAuthResource(mode, listenPort, listenHost);
       if (resource !== void 0) {
         const provider = this.#config.oauth;
         middlewares.push(oauthMetadata(provider, resource));
@@ -2306,7 +2195,7 @@ var MCPServer = class _MCPServer {
           return mcpRouteHandler(request);
         }
         const respond = async () => {
-          const { createLandingPageResponse } = await import("./landing-handler-WE66NIGB.js");
+          const { createLandingPageResponse } = await import("./landing-handler-QEH2ATIR.js");
           return createLandingPageResponse(
             request,
             basePath,
@@ -2322,7 +2211,7 @@ var MCPServer = class _MCPServer {
         }
         return respond();
       };
-      const routes = [];
+      const routes = [...additionalRoutes];
       const brandingDevMode = this.#viewsPrimed ? this.#viewsDevMode : process.env["NODE_ENV"] !== "production";
       const faviconHandler = createFaviconHandler(this.#branding, {
         dev: brandingDevMode,
@@ -2364,28 +2253,6 @@ var MCPServer = class _MCPServer {
           });
         }
       }
-      const inspectorHandler = createInspectorHandler(this.#config.inspector, {
-        serverName: this.#config.name,
-        basePath,
-        ...faviconHandler !== void 0 && {
-          faviconHref: "/favicon.ico",
-          ...this.#branding.faviconMimeType !== void 0 && {
-            faviconType: this.#branding.faviconMimeType
-          }
-        }
-      });
-      if (inspectorHandler !== void 0) {
-        routes.push({
-          match: (request) => {
-            if (request.method !== "GET" && request.method !== "HEAD") {
-              return false;
-            }
-            const pathname = new URL(request.url).pathname;
-            return matchesInspectorShellPath(pathname, basePath);
-          },
-          handler: inspectorHandler
-        });
-      }
       routes.push({
         match: (request) => matchesPath(request, basePath),
         handler: endpointHandler
@@ -2398,7 +2265,7 @@ var MCPServer = class _MCPServer {
       throw new Error(
         "Cannot change the MCP event bus after the server has started."
       );
-    } else if (mode === "listen" && !this.#hostValidated && this.#validationPolicy("listen").hosts !== void 0) {
+    } else if (mode === "listen" && !this.#hostValidated && this.#validationPolicy("listen", listenHost).hosts !== void 0) {
       throw new Error(
         "Cannot listen() on a localhost bind after getHandler(): the app is already mounted without Host validation (getHandler() expects a platform edge in front). Call listen() first, or set allowedHosts."
       );
@@ -2886,4 +2753,3 @@ export {
   routeFetch,
   toFrameworkHandler
 };
-//# sourceMappingURL=index.js.map

package/dist/internal/resource-completion.js

@@ -1,7 +1,6 @@
 import {
   normalizeCompletions
-} from "../chunk-KIZ72TIK.js";
+} from "../chunk-DFFP6QPR.js";
 export {
   normalizeCompletions
 };
-//# sourceMappingURL=resource-completion.js.map