mcp-use 2.0.0-beta.4 → 2.0.0-beta.41

package/dist/chunk-PSKSL567.js

@@ -0,0 +1 @@
+function stripTrailingSlashes(value){return value.replace(/\/+$/,"")}function readEnv(name){if(typeof process>"u")return;let value=process.env[name];return value!==void 0&&value!==""?value:void 0}function parseForwardedHeader(header){for(let part of header.split(",")){let params=new Map;for(let token of part.split(";")){let[key,...rest]=token.trim().split("=");key===void 0||rest.length===0||params.set(key.toLowerCase(),rest.join("=").replace(/^"|"$/g,""))}let proto=params.get("proto"),host=params.get("host");if(proto!==void 0&&host!==void 0)return`${proto}://${host}`}}function resolveRequestOriginFromHeaders(request){let forwarded=request.headers.get("forwarded");if(forwarded!==null){let fromForwarded=parseForwardedHeader(forwarded);if(fromForwarded!==void 0)return fromForwarded}let proto=request.headers.get("x-forwarded-proto"),host=request.headers.get("x-forwarded-host");if(proto!==null&&host!==null){let firstHost=host.split(",")[0]?.trim(),firstProto=proto.split(",")[0]?.trim();if(firstHost!==void 0&&firstProto!==void 0&&firstHost!=="")return`${firstProto}://${firstHost}`}return new URL(request.url).origin}function resolveServerOrigin(request){let mcpUrl=readEnv("MCP_URL");if(mcpUrl!==void 0)try{return new URL(mcpUrl).origin}catch{}return resolveRequestOriginFromHeaders(request)}function originFromAssetsBase(assetsBase){try{return new URL(assetsBase).origin}catch{return assetsBase}}function normalizeAssetsBaseUrl(value){return stripTrailingSlashes(value)}function resolveAssetsBase(request){let assetsUrl=readEnv("MCP_ASSETS_URL");if(assetsUrl!==void 0)try{return normalizeAssetsBaseUrl(new URL(assetsUrl).href.replace(/\/$/,""))}catch{}return resolveServerOrigin(request)}function hasExplicitAssetsBase(){let assetsUrl=readEnv("MCP_ASSETS_URL");if(assetsUrl===void 0)return!1;try{return new URL(assetsUrl),!0}catch{return!1}}export{resolveServerOrigin,originFromAssetsBase,resolveAssetsBase,hasExplicitAssetsBase};

package/dist/chunk-WYBJYZJB.js

@@ -0,0 +1 @@
+import{getOAuthProviderOptions,wrapOAuthTokenVerifier}from"./chunk-JMDHTN6N.js";import{OAuthError,OAuthErrorCode,bearerAuthChallengeResponse,getOAuthProtectedResourceMetadataUrl as getOAuthProtectedResourceMetadataUrl2,oauthMetadataResponse as oauthMetadataResponse2,requireBearerAuth as requireBearerAuth2,verifyBearerToken}from"@modelcontextprotocol/server";import{getOAuthProtectedResourceMetadataUrl,oauthMetadataResponse,requireBearerAuth}from"@modelcontextprotocol/server";import{hostHeaderValidationResponse,originValidationResponse}from"@modelcontextprotocol/server";var requestBags=new WeakMap;function getRequestBag(request){let bag=requestBags.get(request);return bag===void 0&&(bag={},requestBags.set(request,bag)),bag}function composeFetch(terminal,...middlewares){return async request=>{let index=0,dispatch=async()=>{if(index<middlewares.length){let middleware=middlewares[index];return index+=1,middleware(request,dispatch)}return terminal(request)};return dispatch()}}function pathnameOf(request){return new URL(request.url).pathname}function matchesPath(request,path){return pathnameOf(request)===path}function matchesPathPrefix(request,prefix){let pathname=pathnameOf(request);return pathname===prefix||pathname.startsWith(`${prefix}/`)}function pathUnderBase(basePath,childPath){let child=childPath.replace(/^\/+/,"");return basePath==="/"?`/${child}`:`${basePath}/${child}`}function isHtmlNavigationRequest(request){if(request.method!=="GET"&&request.method!=="HEAD")return!1;let accept=request.headers.get("accept");return accept===null?!1:accept.split(",").some(range=>{let[mediaType,...parameters]=range.split(";");return mediaType?.trim().toLowerCase()!=="text/html"?!1:!parameters.some(parameter=>{let[name,value]=parameter.trim().toLowerCase().split("=");return name==="q"&&Number(value)===0})})}function jsonBodyMiddleware(){return async(request,next)=>{let bag=getRequestBag(request);if(bag.parsedBody!==void 0||!(request.headers.get("content-type")??"").includes("application/json"))return next();try{bag.parsedBody=await request.clone().json()}catch{return new Response("Invalid JSON",{status:400})}return next()}}function hostValidationMiddleware(hosts){return async(request,next)=>hostHeaderValidationResponse(request,hosts)??next()}function originValidationMiddleware(origins,skipSafeMethods=!0){return async(request,next)=>skipSafeMethods&&(request.method==="GET"||request.method==="HEAD")?next():originValidationResponse(request,origins)??next()}function bearerAuth(provider,resource){let options=getOAuthProviderOptions(provider),gate=requireBearerAuth({verifier:wrapOAuthTokenVerifier(provider,resource),resourceMetadataUrl:getOAuthProtectedResourceMetadataUrl(resource),...options.requiredScopes!==void 0&&{requiredScopes:[...options.requiredScopes]}});return async(request,next)=>{let result=await gate(request);return result instanceof Response?result:(getRequestBag(request).authInfo=result,next())}}function oauthMetadata(provider,resource){let options=getOAuthProviderOptions(provider);return async(request,next)=>{let response=oauthMetadataResponse(request,{oauthMetadata:options.oauthMetadata,resourceServerUrl:resource,...options.scopesSupported!==void 0&&{scopesSupported:[...options.scopesSupported]},...options.resourceName!==void 0&&{resourceName:options.resourceName},...options.serviceDocumentationUrl!==void 0&&{serviceDocumentationUrl:options.serviceDocumentationUrl}});return response!==void 0?response:next()}}function authInfoFromRequest(request){return getRequestBag(request).authInfo}export{getRequestBag,composeFetch,pathnameOf,matchesPath,matchesPathPrefix,pathUnderBase,isHtmlNavigationRequest,jsonBodyMiddleware,hostValidationMiddleware,originValidationMiddleware,bearerAuth,oauthMetadata,authInfoFromRequest,OAuthError,OAuthErrorCode,bearerAuthChallengeResponse,getOAuthProtectedResourceMetadataUrl2 as getOAuthProtectedResourceMetadataUrl,oauthMetadataResponse2 as oauthMetadataResponse,requireBearerAuth2 as requireBearerAuth,verifyBearerToken};

package/dist/chunk-Y26DNVWA.js

@@ -0,0 +1,3 @@
+import{fromJsonSchema}from"@modelcontextprotocol/server";var HTTP_METHODS=["get","put","post","delete","options","head","patch","trace"];function registerOpenAPITools(server,options){let operations=collectOperations(options.spec,options),names=createToolNames(operations),baseUrl=operations.length>0?resolveBaseUrl(options):void 0;for(let[index,operation]of operations.entries()){let name=names[index];if(name===void 0||baseUrl===void 0)continue;let inputBindings=createInputBindings(operation);server.tool({name,description:createToolDescription(operation),inputSchema:createToolInputSchema(options.spec,operation,inputBindings)},async params=>callOpenAPIOperation(operation,params,options,inputBindings,baseUrl))}}function collectOperations(spec,options){let collected=[];for(let[path,pathItemOrRef]of Object.entries(spec.paths??{})){let pathItem=resolveRef(spec,pathItemOrRef);if(pathItem===void 0||isReferenceObject(pathItem))continue;let pathParameters=resolveParameters(spec,pathItem.parameters);for(let method of HTTP_METHODS){let operationOrRef=pathItem[method];if(operationOrRef===void 0)continue;let operation=resolveRef(spec,operationOrRef);if(operation===void 0||isReferenceObject(operation))continue;let operationParameters=resolveParameters(spec,operation.parameters),requestBody=operation.requestBody===void 0?void 0:resolveRef(spec,operation.requestBody),item={method,path,operation,parameters:mergeParameters(pathParameters,operationParameters),...requestBody!==void 0&&!isReferenceObject(requestBody)&&{requestBody}};isIncluded(item,options)&&collected.push(item)}}return collected}function resolveParameters(spec,parameters){let resolved=[];for(let parameter of parameters??[]){let value=resolveRef(spec,parameter);value!==void 0&&!isReferenceObject(value)&&resolved.push(value)}return resolved}function mergeParameters(pathParameters,operationParameters){let merged=new Map;for(let parameter of[...pathParameters,...operationParameters])merged.set(`${parameter.in}:${parameter.name}`,parameter);return[...merged.values()]}function isIncluded(operation,options){if(options.tags?.length){let tags=new Set(operation.operation.tags??[]);if(!options.tags.some(tag=>tags.has(tag)))return!1}return!(options.exclude??[]).some(rule=>matchesExcludeRule(operation,rule))}function matchesExcludeRule(operation,rule){if(rule.method&&rule.method.toLowerCase()!==operation.method||rule.operationId&&!matchesPattern(rule.operationId,operation.operation.operationId??"")||rule.path&&!matchesPattern(rule.path,operation.path))return!1;if(rule.tags?.length){let tags=new Set(operation.operation.tags??[]);if(!rule.tags.some(tag=>tags.has(tag)))return!1}return!0}function matchesPattern(pattern,value){return typeof pattern=="string"?pattern===value:(pattern.lastIndex=0,pattern.test(value))}function createToolNames(operations){let seen=new Map;return operations.map(operation=>{let baseName=slugifyToolName(operation.operation.operationId??`${operation.method}_${operation.path.replace(/[{}]/g,"").replace(/\//g,"_")}`),count=seen.get(baseName)??0;if(seen.set(baseName,count+1),count===0)return baseName;let suffix=`_${count+1}`;return`${baseName.slice(0,64-suffix.length)}${suffix}`})}function createToolDescription(operation){return[operation.operation.summary,operation.operation.description,`HTTP: ${operation.method.toUpperCase()} ${operation.path}`].filter(part=>!!part).join(`
+
+`)}function slugifyToolName(value){return value.trim().replace(/[^a-zA-Z0-9_-]+/g,"_").replace(/_+/g,"_").replace(/^_/,"").replace(/_$/,"").slice(0,64)||"openapi_tool"}function createToolInputSchema(spec,operation,inputBindings){let properties={},required=[];for(let{parameter,inputName}of inputBindings.parameters){let parameterSchema=transformSchema(spec,parameter.schema??{});properties[inputName]={...parameterSchema,description:parameter.description??`${parameter.in} parameter`},(parameter.required||parameter.in==="path")&&required.push(inputName)}let bodySchema=getJsonRequestBodySchema(operation.requestBody);bodySchema!==void 0&&inputBindings.bodyInputName!==void 0&&(properties[inputBindings.bodyInputName]=transformSchema(spec,bodySchema),operation.requestBody?.required&&required.push(inputBindings.bodyInputName));let definitions=createSchemaDefinitions(spec),schema={type:"object",properties,additionalProperties:!1,...required.length>0&&{required},...definitions!==void 0&&{$defs:definitions}};return fromJsonSchema(schema)}function createInputBindings(operation){let parameters=operation.parameters.filter(parameter=>parameter.in!=="cookie"),bodyInputName=getJsonRequestBodySchema(operation.requestBody)===void 0?void 0:"body",nameCounts=new Map;for(let parameter of parameters)nameCounts.set(parameter.name,(nameCounts.get(parameter.name)??0)+1);let usedNames=new Set(bodyInputName===void 0?[]:[bodyInputName]);return{parameters:parameters.map(parameter=>{let preferredName=(nameCounts.get(parameter.name)??0)>1||parameter.name===bodyInputName?`${parameter.name}_${parameter.in}`:parameter.name;return{parameter,inputName:claimInputName(preferredName,usedNames)}}),...bodyInputName!==void 0&&{bodyInputName}}}function claimInputName(preferredName,usedNames){let inputName=preferredName,suffix=2;for(;usedNames.has(inputName);)inputName=`${preferredName}_${suffix}`,suffix+=1;return usedNames.add(inputName),inputName}function createSchemaDefinitions(spec){let schemas=readRecord(spec.components?.schemas);if(schemas===void 0)return;let definitions={};for(let[name,schema]of Object.entries(schemas))definitions[name]=transformSchemaNode(spec,schema,new Set);return definitions}function transformSchema(spec,schema){let transformed=transformSchemaNode(spec,schema,new Set);return readRecord(transformed)??{}}function transformSchemaNode(spec,value,resolvingRefs){if(Array.isArray(value))return value.map(item=>transformSchemaNode(spec,item,resolvingRefs));let object=readRecord(value);if(object===void 0)return value;let ref=typeof object.$ref=="string"?object.$ref:void 0,siblings={};for(let[key,child]of Object.entries(object))key!=="$ref"&&(key==="nullable"&&typeof child=="boolean"||(siblings[key]=transformSchemaNode(spec,child,resolvingRefs)));let transformed=siblings;if(ref!==void 0){let schemaRef=rewriteSchemaRef(spec,ref);if(schemaRef!==void 0)transformed={$ref:schemaRef,...siblings};else if(!resolvingRefs.has(ref)){let resolved=resolveRef(spec,{$ref:ref});if(resolved!==void 0){let nextRefs=new Set(resolvingRefs);nextRefs.add(ref),transformed={...readRecord(transformSchemaNode(spec,resolved,nextRefs))??{},...siblings}}}}return object.nullable===!0?{anyOf:[transformed,{type:"null"}]}:transformed}function rewriteSchemaRef(spec,ref){let prefix="#/components/schemas/";if(ref.startsWith(prefix))return resolveRef(spec,{$ref:ref})===void 0?void 0:`#/$defs/${ref.slice(prefix.length)}`}function getJsonRequestBodySchema(requestBody){let content=requestBody?.content;if(content!==void 0)return content["application/json"]?.schema??content["application/*+json"]?.schema??Object.entries(content).find(([mediaType])=>mediaType.includes("+json"))?.[1].schema}async function callOpenAPIOperation(operation,params,options,inputBindings,baseUrl){let fetchImpl=options.fetch??globalThis.fetch,url=buildUrl(operation,params,inputBindings.parameters,baseUrl),headers=buildHeaders(inputBindings.parameters,params,options),bodyInputName=inputBindings.bodyInputName,body=bodyInputName===void 0||params[bodyInputName]===void 0?void 0:JSON.stringify(params[bodyInputName]);body!==void 0&&!hasHeader(headers,"content-type")&&(headers["content-type"]="application/json");let response=await fetchImpl(url,{method:operation.method.toUpperCase(),headers,...body!==void 0&&{body}}),contentType=response.headers.get("content-type")??"";if(!response.ok)return{content:[{type:"text",text:await response.text()}],isError:!0};if(contentType.includes("application/json")||contentType.includes("+json")){let text=await response.text();try{let data=JSON.parse(text);return{content:[{type:"text",text:JSON.stringify(data)}],structuredContent:data}}catch{return{content:[{type:"text",text}]}}}return{content:[{type:"text",text:await response.text()}]}}function buildUrl(operation,params,parameterBindings,baseUrl){let interpolatedPath=operation.path.replace(/{([^}]+)}/g,(_match,name)=>{let binding=parameterBindings.find(({parameter})=>parameter.in==="path"&&parameter.name===name);return encodeURIComponent(String(binding===void 0?"":params[binding.inputName]??""))}),url=new URL(interpolatedPath.replace(/^\/+/,""),ensureTrailingSlash(baseUrl));for(let{parameter,inputName}of parameterBindings){if(parameter.in!=="query")continue;let value=params[inputName];value==null||value===""||appendQueryParam(url,parameter.name,value)}return url.toString()}function buildHeaders(parameterBindings,params,options){let headers={...options.headers??{}};for(let{parameter,inputName}of parameterBindings){if(parameter.in!=="header")continue;let value=params[inputName];value==null||value===""||(headers[parameter.name]=String(value))}return options.auth?.type==="bearer"&&options.auth.token&&(headers.authorization=`Bearer ${options.auth.token}`),options.auth?.type==="header"&&options.auth.value&&(headers[options.auth.name]=options.auth.value),headers}function resolveBaseUrl(options){let baseUrl=options.baseUrl??options.spec.servers?.[0]?.url;if(baseUrl===void 0||baseUrl.trim()==="")throw new Error("MCPServer.fromOpenAPI requires options.baseUrl or spec.servers[0].url");return baseUrl}function appendQueryParam(url,name,value){if(Array.isArray(value)){for(let item of value)item!=null&&item!==""&&url.searchParams.append(name,String(item));return}url.searchParams.set(name,String(value))}function ensureTrailingSlash(url){return url.endsWith("/")?url:`${url}/`}function hasHeader(headers,name){return Object.keys(headers).some(headerName=>headerName.toLowerCase()===name)}function isReferenceObject(value){let object=readRecord(value);return object!==void 0&&typeof object.$ref=="string"}function resolveRef(spec,value){if(!isReferenceObject(value))return value;if(!value.$ref.startsWith("#/"))return;let segments=value.$ref.slice(2).split("/").map(segment=>segment.replace(/~1/g,"/").replace(/~0/g,"~")),current=spec;for(let segment of segments){let object=readRecord(current);if(object===void 0||!(segment in object))return;current=object[segment]}return current}function readRecord(value){return typeof value=="object"&&value!==null&&!Array.isArray(value)?value:void 0}export{registerOpenAPITools};

package/dist/chunk-YBGMCISI.js

@@ -0,0 +1,2 @@
+var EVENT="mcp_use_sdk_event",ENDPOINT="https://eu.i.posthog.com/i/v0/e/",TOKEN="phc_lyTtbYwvkdSbrcMQNPiKiiRWrrM1seyKIMjycSvItEI",CONTENT=/(^|_)(arguments?|args|body|command|headers?|location|message|organization|path|query|response|secret|subject|token|uri|url|user_agent)(_|$)/i,RESERVED=new Set("feature action sdk_generation telemetry_schema_version sdk_package sdk_version server_id runtime_id identity_stability distinct_id validation_run_id is_validation".split(" ")),runtimeId=crypto.randomUUID(),once=new Set,pending=new Set,identities=new Map;function hasControl(value){return[...value].some(character=>{let code=character.charCodeAt(0);return code<32||code===127})}function env(name){return typeof process>"u"?void 0:process.env?.[name]}function safeEnv(name){let value=env(name);return value!==void 0&&value.length>0&&value.length<=128&&!hasControl(value)?value:void 0}function clean(properties){return Object.fromEntries(Object.entries(properties).filter(([key,value])=>key.length>128||hasControl(key)||key.startsWith("$")||RESERVED.has(key)||CONTENT.test(key)||value===void 0?!1:typeof value=="string"?value.length<=128&&!hasControl(value):typeof value=="boolean"||typeof value=="number"&&Number.isFinite(value)))}async function identity(serverRoot){let projectId=safeEnv("MCP_USE_TELEMETRY_PROJECT_ID");if(projectId!==void 0)return{id:projectId,stability:"project"};if(serverRoot===void 0||typeof process>"u")return{id:runtimeId,stability:"process"};let existing=identities.get(serverRoot);if(existing!==void 0)return existing;let resolving=(async()=>{try{let fs=await import("fs/promises"),directory=`${serverRoot}/.mcp-use`,file=`${directory}/usage.json`,read=async()=>{try{let value=JSON.parse(await fs.readFile(file,"utf8"));if(typeof value=="object"&&value!==null&&"schemaVersion"in value&&value.schemaVersion===1&&"serverId"in value&&typeof value.serverId=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value.serverId))return value.serverId}catch{}},stored=await read();if(stored!==void 0)return{id:stored,stability:"server"};await fs.mkdir(directory,{recursive:!0,mode:448});let created=crypto.randomUUID();try{return await fs.writeFile(file,`${JSON.stringify({schemaVersion:1,serverId:created})}
+`,{flag:"wx",mode:384}),{id:created,stability:"server"}}catch{let raced=await read();if(raced!==void 0)return{id:raced,stability:"server"}}}catch{}return{id:runtimeId,stability:"process"}})();return identities.set(serverRoot,resolving),resolving}function recordUsage(feature,action,properties={},options={}){let validationId=safeEnv("MCP_USE_TELEMETRY_VALIDATION_ID");if(env("MCP_USE_ANONYMIZED_TELEMETRY")==="false"||env("NODE_ENV")==="test"&&validationId===void 0||pending.size>=16)return;if(options.onceKey!==void 0){if(once.has(options.onceKey))return;once.add(options.onceKey)}let rate=Math.max(0,Math.min(1,options.sampleRate??1));if(validationId===void 0&&Math.random()>=rate)return;let request=(async()=>{try{let resolvedIdentity=await identity(options.serverRoot),body=JSON.stringify({api_key:TOKEN,event:EVENT,properties:{...clean(properties),feature,action,sdk_generation:"v2",telemetry_schema_version:2,sdk_package:"mcp-use",sdk_version:"2.0.0-beta.41",server_id:resolvedIdentity.id,runtime_id:runtimeId,identity_stability:resolvedIdentity.stability,distinct_id:resolvedIdentity.id,sample_rate:validationId===void 0?rate:1,$process_person_profile:!1,$geoip_disable:!0,...validationId!==void 0&&{is_validation:!0,validation_run_id:validationId}}});await fetch(ENDPOINT,{method:"POST",headers:{"content-type":"application/json"},keepalive:!0,body})}catch{return}})();pending.add(request),request.then(()=>pending.delete(request))}async function flushUsage(){await Promise.all([...pending])}export{recordUsage,flushUsage};

package/dist/chunk-ZMU5USAZ.js

@@ -0,0 +1 @@
+var PUBLIC_CONTENT_TYPES={".css":"text/css",".gif":"image/gif",".html":"text/html",".ico":"image/x-icon",".jpeg":"image/jpeg",".jpg":"image/jpeg",".js":"application/javascript",".json":"application/json",".map":"application/json",".png":"image/png",".svg":"image/svg+xml",".txt":"text/plain",".webp":"image/webp",".woff":"font/woff",".woff2":"font/woff2"};async function resolvePublicFilePath(publicRoot,subpath){let{stat}=await import("fs/promises"),{resolve,sep}=await import("path");if(subpath===""||subpath.includes("\\")||subpath.split("/").some(segment=>segment===".."))return null;let clean=subpath.replace(/^\/+/,"");if(clean===""||clean.endsWith("/"))return null;let root=resolve(publicRoot),abs=resolve(root,clean);if(abs!==root&&!abs.startsWith(root+sep))return null;try{if(!(await stat(abs)).isFile())return null}catch{return null}return abs}async function servePublicFile(diskPath,options={}){let{readFile}=await import("fs/promises"),{extname}=await import("path"),ext=extname(diskPath).toLowerCase(),contentType=PUBLIC_CONTENT_TYPES[ext]??"application/octet-stream",body=options.head===!0?null:new Uint8Array(await readFile(diskPath));return new Response(body,{status:200,headers:{"Content-Type":contentType,"Cache-Control":"public, max-age=0, must-revalidate",...options.deferCors!==!0&&{"Access-Control-Allow-Origin":"*"}}})}export{resolvePublicFilePath,servePublicFile};

package/dist/completable.d.ts

@@ -6,6 +6,15 @@ export interface CompletionContext {
 }
 /** Callback form: return suggestions for the current (partial) value. */
 export type CompletionCallback = (value: string, context?: CompletionContext) => string[] | Promise<string[]>;
+/**
+ * Build the shared case-insensitive prefix completer used by static values.
+ *
+ * @param values - Values retained in declaration order and stringified once.
+ * @returns A callback that filters the values against an untrimmed prefix.
+ *
+ * @internal
+ */
+export declare function createPrefixCompletion(values: ReadonlyArray<string | number | boolean>): (value: unknown) => string[];
 /**
  * Make a schema field completable so clients can request autocomplete
  * suggestions via `completion/complete`.
@@ -30,4 +39,3 @@ export type CompletionCallback = (value: string, context?: CompletionContext) =>
  * ```
  */
 export declare function completable<T extends StandardSchemaV1>(schema: T, complete: ReadonlyArray<string | number | boolean> | CompletionCallback): ReturnType<typeof sdkCompletable<T>>;
-//# sourceMappingURL=completable.d.ts.map

package/dist/config.d.ts

@@ -1,34 +1,6 @@
-import type { ServerOptions } from "@modelcontextprotocol/server";
+import type { Icon, ServerOptions } from "@modelcontextprotocol/server";
 import type { LoggingOptions } from "./logging.js";
 import type { OAuthProvider } from "./oauth/index.js";
-/**
- * Options for the inspector shell route — the shape of
- * {@link ServerConfig.inspector}.
- */
-export interface InspectorOptions {
-    /**
-     * Whether the inspector shell route is mounted.
-     *
-     * @defaultValue `true`
-     */
-    enabled?: boolean;
-    /**
-     * Full replacement URL for the inspector bundle script (FastAPI's
-     * `swagger_js_url` analog). The shell's `<script type="module">` loads
-     * exactly this URL, so it must point at a complete copy of the
-     * `@mcp-use/inspector` CDN bundle (`dist/cdn/inspector.js`) — self-host it
-     * for air-gapped environments where the public CDN is unreachable.
-     *
-     * @defaultValue The mcp-use CDN URL for the `@mcp-use/inspector` bundle,
-     * pinned to the current version.
-     */
-    assetsUrl?: string;
-    /**
-     * Hosted managed-chat backend URL (injected as `window.__MANUFACT_CHAT_URL__`).
-     * Defaults to `process.env.MANUFACT_CHAT_URL` when the shell is mounted.
-     */
-    manufactChatUrl?: string;
-}
 /**
  * Common server identity and behavior, passed to `new MCPServer(...)`.
  *
@@ -47,6 +19,74 @@ interface BaseServerConfig {
      * implementation metadata during negotiation.
      */
     description?: string;
+    /**
+     * Browser favicon source.
+     *
+     * Accepts a safe path relative to the project `public/` directory, an
+     * absolute HTTP(S) URL, or an image data URL. The selected image is served
+     * at the root-level `/favicon.ico` route. When omitted, the first entry in
+     * `icons` selects the favicon. An explicit value always wins; an empty
+     * string is invalid.
+     *
+     * @defaultValue Inferred from `icons`, or no favicon when `icons` is absent
+     * or empty.
+     * @throws TypeError When the value is empty, uses an unsupported URL scheme,
+     * or is an unsafe local path.
+     *
+     * @example
+     * ```ts
+     * new MCPServer({
+     *   name: "my-server",
+     *   version: "1.0.0",
+     *   favicon: "brand/favicon.svg",
+     * });
+     * ```
+     */
+    favicon?: string;
+    /**
+     * Server icons reported to clients in MCP implementation metadata.
+     *
+     * Uses the official SDK {@link Icon} shape. Each `src` accepts a safe path
+     * relative to `public/`, an absolute HTTP(S) URL, or an image data URL.
+     * Local paths become request-scoped absolute URLs under
+     * `${basePath}/_mcp-use/public/`; author order is preserved on the wire.
+     * When `favicon` is omitted, the first icon in this array also selects
+     * `/favicon.ico`. An empty array is valid and selects no favicon.
+     *
+     * @defaultValue `undefined`
+     * @throws TypeError When an icon has an invalid source, MIME type, sizes,
+     * or theme.
+     *
+     * @example
+     * ```ts
+     * new MCPServer({
+     *   name: "my-server",
+     *   version: "1.0.0",
+     *   icons: [
+     *     { src: "brand/icon.svg", mimeType: "image/svg+xml" },
+     *     { src: "brand/icon-32.png", mimeType: "image/png", sizes: ["32x32"] },
+     *   ],
+     * });
+     * ```
+     */
+    icons?: Icon[];
+    /**
+     * Absolute HTTP(S) URL for the server's website or documentation, reported
+     * to clients in MCP implementation metadata.
+     *
+     * @defaultValue `undefined`
+     * @throws TypeError When the value is empty, relative, or not HTTP(S).
+     *
+     * @example
+     * ```ts
+     * new MCPServer({
+     *   name: "my-server",
+     *   version: "1.0.0",
+     *   websiteUrl: "https://example.com/my-server",
+     * });
+     * ```
+     */
+    websiteUrl?: string;
     /** Usage instructions surfaced to the model by clients. */
     instructions?: string;
     /**
@@ -62,28 +102,36 @@ interface BaseServerConfig {
      */
     basePath?: string;
     /**
-     * Hostname `listen()` binds. Defaults to `127.0.0.1`; localhost-class
+     * Hostname `listen()` binds when neither an explicit listener host nor
+     * `HOST` is set. Defaults to `127.0.0.1`; localhost-class
      * binds get DNS-rebinding protection (`Host` on every request; `Origin`
      * only on non-GET/HEAD) automatically. Set `"0.0.0.0"` to serve publicly — behind a platform
      * edge (Railway, Fly, …) nothing more is needed, since the edge only
-     * routes hostnames assigned to the deployment. Ignored by `getHandler()`,
-     * which never binds.
+     * routes hostnames assigned to the deployment. Ignored by `server.fetch`,
+     * which never binds a socket.
      */
     host?: string;
+    /**
+     * TCP port `listen()` binds when neither an explicit port nor `PORT` is set.
+     * Use `0` to request an ephemeral port.
+     *
+     * @defaultValue `3000`
+     */
+    port?: number;
     /**
      * Extra allowed hostnames for Host-header validation (DNS-rebinding
      * protection), e.g. `["api.example.com"]`. Port-agnostic and additive:
      * localhost-class hostnames stay allowed, so local runs keep working
      * unmodified. Setting this also turns Host validation on for
-     * `getHandler()`, which otherwise applies none.
+     * `server.fetch`, which otherwise applies none.
      */
     allowedHosts?: string[];
     /**
      * Extra allowed origin hostnames for Origin-header validation
      * (port-agnostic, additive to the localhost-class origins). When unset,
-     * mirrors the effective Host allowlist. Origin is validated only on
-     * non-GET/HEAD requests (sandboxed view iframes send `Origin: null` on
-     * asset GETs; the MCP wire is POST). Requests without an `Origin` header
+     * Origin validation is off (SDK-aligned). When set, Origin is validated
+     * only on non-GET/HEAD requests (sandboxed view iframes send `Origin: null`
+     * on asset GETs; the MCP wire is POST). Requests without an `Origin` header
      * always pass (non-browser MCP clients don't send one).
      */
     allowedOrigins?: string[];
@@ -100,45 +148,17 @@ interface BaseServerConfig {
      */
     legacy?: "stateless" | "reject";
     /**
-     * Inspector shell route at `${basePath}/inspector` — a browser UI for
-     * exploring and calling the server's tools, resources, and prompts.
-     *
-     * @remarks
-     * Follows the FastAPI `/docs` model: the server itself ships only a tiny
-     * dependency-free HTML page whose `<script type="module">` loads the
-     * `@mcp-use/inspector` bundle from a CDN (pinned to the current inspector
-     * version), so the UI updates independently of SDK releases and adds
-     * nothing to the install. The page tells the inspector to connect to this
-     * server's MCP endpoint at `basePath`, deriving the URL from the browser's
-     * own origin.
-     *
-     * Enabled by default; set `{ enabled: false }` to disable the route, or
-     * pass `{ assetsUrl }` to load the bundle from a self-hosted copy instead
-     * of the public CDN (air-gapped environments). For local development,
-     * `MCP_USE_INSPECTOR_ASSETS_URL` provides the same override without changing
-     * application code; an explicit `assetsUrl` takes precedence.
-     *
-     * @example
-     * ```ts
-     * // Default: inspector served at /mcp/inspector from the public CDN.
-     * new MCPServer({ name: "my-server", version: "1.0.0" });
+     * Expose the HTML landing page without bearer authentication when OAuth is
+     * configured.
      *
-     * // Disabled:
-     * new MCPServer({
-     *   name: "my-server",
-     *   version: "1.0.0",
-     *   inspector: { enabled: false },
-     * });
+     * The landing page itself is always mounted at `basePath` for browser GET
+     * and HEAD requests that explicitly accept `text/html`. Without OAuth it is
+     * public. With OAuth, it requires a valid bearer token unless this option is
+     * `true`. MCP protocol requests remain protected in either case.
      *
-     * // Air-gapped: load a self-hosted copy of the inspector bundle.
-     * new MCPServer({
-     *   name: "my-server",
-     *   version: "1.0.0",
-     *   inspector: { assetsUrl: "https://intranet.example.com/inspector.js" },
-     * });
-     * ```
+     * @defaultValue `false`
      */
-    inspector?: InspectorOptions;
+    publicLandingPage?: boolean;
     /**
      * HTTP/MCP request logging: one summary line per request plus an indented
      * detail line naming the MCP method, its subject (tool name, resource URI,
@@ -165,6 +185,47 @@ interface BaseServerConfig {
      * @defaultValue `undefined`
      */
     requestState?: ServerOptions["requestState"];
+    /**
+     * Optional CORS headers on every route served by `server.fetch` / `listen()`
+     * (MCP endpoint, view assets, landing page, OAuth metadata). Off when omitted.
+     *
+     * Pair with {@link BaseServerConfig.allowedOrigins | allowedOrigins} for
+     * browser clients: CORS tells the browser it may read the response; Origin
+     * validation decides whether the server accepts the request.
+     *
+     * @example
+     * ```ts
+     * new MCPServer({
+     *   name: "api",
+     *   version: "1.0.0",
+     *   allowedOrigins: ["app.example.com"],
+     *   cors: {
+     *     origin: "https://app.example.com",
+     *     credentials: true,
+     *   },
+     * });
+     * ```
+     */
+    cors?: CorsOptions;
+}
+/**
+ * CORS configuration for routes owned by the Hono application.
+ *
+ * Omit `cors` entirely for the current no-CORS behavior. Pass `cors: {}` to
+ * enable with defaults (reflects the request `Origin` when present; wildcard
+ * `origin: "*"` requires an explicit opt-in).
+ */
+export interface CorsOptions {
+    /** @defaultValue `true` when `cors` is set; ignored when `cors` is omitted */
+    enabled?: boolean;
+    /** Allowed Origin(s). Reflect matching `Origin` header, or `"*"` when set. */
+    origin?: string | string[] | ((origin: string | null) => string | null);
+    /** @defaultValue `["GET", "HEAD", "POST", "OPTIONS"]` */
+    methods?: string[];
+    /** @defaultValue common MCP + JSON headers */
+    allowedHeaders?: string[];
+    /** @defaultValue `false` */
+    credentials?: boolean;
 }
 /**
  * Runtime checks for optional {@link ServerConfig} fields that TypeScript
@@ -176,6 +237,7 @@ interface BaseServerConfig {
  */
 export declare function assertServerConfig(config: {
     basePath?: unknown;
+    port?: unknown;
 }): void;
 /**
  * Server identity and behavior, passed to `new MCPServer(...)`.
@@ -195,4 +257,3 @@ export type ServerConfig<TUser = never> = BaseServerConfig & ([TUser] extends [n
     oauth: OAuthProvider<TUser>;
 });
 export {};
-//# sourceMappingURL=config.d.ts.map

package/dist/context.d.ts

@@ -1,16 +1,127 @@
-import { type InputRequiredResult, type RequestStateAccessor, type ServerContext, type StandardSchemaWithJSON } from "@modelcontextprotocol/server";
+import { type ClientCapabilities, type Implementation, type InputRequiredResult, type RequestStateAccessor, type ServerContext, type StandardSchemaWithJSON } from "@modelcontextprotocol/server";
+import type { Context, Env, HonoRequest as HonoRequestType } from "hono";
 /**
- * Per-request client capability queries.
+ * OpenAI-specific end-user hints declared in request metadata.
  *
- * Reads the modern per-request envelope only — never session state.
+ * All fields are optional, client-reported, and unverified. Use
+ * {@link OAuthAuth.user} for an authenticated identity.
+ */
+export interface UserContext {
+    /** Requested BCP 47 locale from `openai/locale` or legacy `webplus/i18n`. */
+    locale?: string;
+    /** Best-effort browser or host identifier from `openai/userAgent`. */
+    userAgent?: string;
+    /** Coarse end-user location from `openai/userLocation`. */
+    location?: {
+        /** City name, when supplied. */
+        city?: string;
+        /** Region or state name, when supplied. */
+        region?: string;
+        /** Country identifier, when supplied. */
+        country?: string;
+        /** IANA timezone identifier, when supplied. */
+        timezone?: string;
+        /** Approximate latitude; clients may encode coordinates as strings or numbers. */
+        latitude?: string | number;
+        /** Approximate longitude; clients may encode coordinates as strings or numbers. */
+        longitude?: string | number;
+    };
+    /** Client-reported subject hint from `openai/subject`. */
+    subject?: string;
+    /** Client-reported conversation hint from `openai/session`. */
+    conversationId?: string;
+    /** Client-reported organization hint from `openai/organization`. */
+    organizationId?: string;
+}
+/**
+ * Per-request client metadata and capability queries.
+ *
+ * Reads only the current request's metadata — never session state.
  */
 export interface RequestClientContext {
+    /**
+     * Checks whether this request declares a top-level client capability.
+     *
+     * @param capability - Capability name such as `sampling`, `elicitation`,
+     * `roots`, or `extensions`.
+     * @returns `true` when the current request advertises the capability.
+     *
+     * @example
+     * ```ts
+     * if (ctx.client.can("elicitation")) {
+     *   // Shape the result for an elicitation-capable client.
+     * }
+     * ```
+     */
+    can(capability: string): boolean;
+    /**
+     * Returns the capabilities declared by the client for this request.
+     *
+     * The returned object is a shallow copy. Requests without the modern
+     * metadata envelope return an empty object.
+     *
+     * @example
+     * ```ts
+     * const capabilities = ctx.client.capabilities();
+     * const supportsFormElicitation = capabilities.elicitation?.form !== undefined;
+     * ```
+     */
+    capabilities(): ClientCapabilities;
+    /**
+     * Returns one extension settings object declared for this request.
+     *
+     * @param id - Namespaced extension identifier, such as
+     * `io.modelcontextprotocol/ui`.
+     * @returns A shallow copy of the extension settings, or `undefined` when the
+     * current request does not advertise the extension.
+     *
+     * @example
+     * ```ts
+     * const ui = ctx.client.extension("io.modelcontextprotocol/ui");
+     * ```
+     */
+    extension(id: string): NonNullable<ClientCapabilities["extensions"]>[string] | undefined;
+    /**
+     * Returns the client implementation metadata declared for this request.
+     *
+     * Valid modern requests include `name` and `version`. The partial return
+     * type preserves v1 ergonomics for legacy requests without an envelope.
+     * The returned object is a shallow copy.
+     *
+     * @example
+     * ```ts
+     * const { name, version } = ctx.client.info();
+     * ```
+     */
+    info(): Partial<Implementation>;
+    /**
+     * Returns normalized OpenAI-specific end-user hints for this request.
+     *
+     * The data comes from ordinary request `_meta`, not the MCP client-info
+     * envelope. It is client-reported and must not be used for authentication
+     * or authorization. Each call returns a fresh object, including a fresh
+     * location object. Requests without recognized metadata return `undefined`.
+     *
+     * @example
+     * ```ts
+     * const caller = ctx.client.user();
+     * const locale = caller?.locale ?? "en";
+     * ```
+     */
+    user(): UserContext | undefined;
     /**
      * Whether this request's client advertises MCP Apps / UI support.
      *
      * True when the client declares the `io.modelcontextprotocol/ui` extension
      * with `text/html;profile=mcp-app` in `mimeTypes`. Legacy (non-envelope)
      * requests always return `false`.
+     *
+     * @example
+     * ```ts
+     * if (ctx.client.supportsViews()) {
+     *   // Return a view-optimized result.
+     * }
+     * ```
      */
     supportsViews(): boolean;
 }
@@ -79,11 +190,17 @@ export type OAuthAuth<TUser> = {
     expiresAt: number;
     resource?: URL;
 };
-type RequestContextBase = {
+type RequestContextBase<TEnv extends Env> = Omit<Context<TEnv>, "req"> & {
     /** Aborted when the client cancels the request or the connection drops. */
     signal: AbortSignal;
-    /** The originating HTTP request, when served over HTTP. */
-    request?: Request;
+    /** Hono request for the originating HTTP exchange. Its raw Web Request is available as `request.raw`. */
+    request?: HonoRequestType;
+    /**
+     * Deprecated v1-compatible alias for {@link RequestContext.request}.
+     *
+     * @deprecated Use `request` instead.
+     */
+    req?: HonoRequestType;
     /** Per-request client capability queries. */
     client: RequestClientContext;
     /** Request or read a keyed form- or URL-mode elicitation. */
@@ -99,6 +216,26 @@ type RequestContextBase = {
      * when state affects authorization or business logic.
      */
     requestState: RequestStateAccessor;
+    /**
+     * Sends a one-way notification related to the current MCP request.
+     *
+     * The notification is delivered on the originating request's response
+     * stream and must be sent before the callback returns. Use the
+     * `server.notifyToolsChanged()` and related server helpers for
+     * cross-request list or resource invalidations.
+     *
+     * @param method - Application-defined notification method.
+     * @param params - Optional JSON-serializable notification parameters.
+     * @returns A promise that resolves after the notification is sent.
+     *
+     * @example
+     * ```ts
+     * await ctx.sendNotification("com.example/import-status", {
+     *   status: "started",
+     * });
+     * ```
+     */
+    sendNotification(method: string, params?: Record<string, unknown>): Promise<void>;
     /**
      * Report request-scoped progress when the caller supplied a progress token.
      *
@@ -112,9 +249,9 @@ type RequestContextBase = {
 /**
  * Per-request callback context, authenticated when OAuth is configured.
  */
-export type RequestContext<TUser = never, HasOAuth extends boolean = false> = HasOAuth extends true ? RequestContextBase & {
+export type RequestContext<TUser = never, HasOAuth extends boolean = false, TEnv extends Env = Env> = HasOAuth extends true ? RequestContextBase<TEnv> & {
     auth: OAuthAuth<TUser>;
-} : RequestContextBase & {
+} : RequestContextBase<TEnv> & {
     auth?: never;
 };
 /**
@@ -123,8 +260,7 @@ export type RequestContext<TUser = never, HasOAuth extends boolean = false> = Ha
  *
  * @internal
  */
-export declare function toRequestContext(ctx: ServerContext): RequestContext<never, false>;
+export declare function toRequestContext<TEnv extends Env = Env>(ctx: ServerContext): RequestContext<never, false, TEnv>;
 /** @internal Projects mapped OAuth auth information into callback context. */
-export declare function toAuthenticatedRequestContext<TUser>(ctx: ServerContext): RequestContext<TUser, true>;
+export declare function toAuthenticatedRequestContext<TUser, TEnv extends Env = Env>(ctx: ServerContext): RequestContext<TUser, true, TEnv>;
 export {};
-//# sourceMappingURL=context.d.ts.map

package/dist/fetch-app.d.ts

@@ -1,4 +1,5 @@
 import { type AuthInfo } from "@modelcontextprotocol/server";
+import type { Context, Env } from "hono";
 /** Web-standard request handler. */
 export type FetchHandler = (request: Request) => Promise<Response>;
 /** Onion middleware over a {@link FetchHandler} terminal. */
@@ -9,6 +10,8 @@ export interface RequestBag {
     parsedBody?: unknown;
     /** Verified OAuth identity forwarded to the SDK handler. */
     authInfo?: AuthInfo;
+    /** Hono context associated with this request while it traverses the app. */
+    honoContext?: Context<Env>;
 }
 /**
  * Mutable per-request bag; created on first access.
@@ -44,15 +47,31 @@ export declare function matchesPath(request: Request, path: string): boolean;
  */
 export declare function matchesPathPrefix(request: Request, prefix: string): boolean;
 /**
- * Dispatch to the first matching route handler.
+ * Append a framework-owned child path beneath an MCP base path.
  *
- * @param routes - Ordered route table; first match wins.
- * @param fallback - Handler when nothing matches.
+ * Unlike string interpolation, this keeps the root base path from producing
+ * a double slash: `pathUnderBase("/", "inspector")` is `"/inspector"`.
+ *
+ * @param basePath - Valid MCP base path, including the root path `/`.
+ * @param childPath - Relative child path, with or without a leading slash.
+ * @returns Absolute pathname beneath `basePath`.
+ *
+ * @internal
+ */
+export declare function pathUnderBase(basePath: string, childPath: string): string;
+/**
+ * Classify a request as explicit browser HTML navigation.
+ *
+ * Only GET and HEAD requests whose Accept header names `text/html` with a
+ * non-zero quality value qualify. Wildcard-only and missing Accept headers
+ * remain available to protocol and health probes.
+ *
+ * @param request - Incoming request to classify.
+ * @returns Whether the request explicitly accepts HTML.
+ *
+ * @internal
  */
-export declare function routeFetch(routes: Array<{
-    match: (request: Request) => boolean;
-    handler: FetchHandler;
-}>, fallback?: FetchHandler): FetchHandler;
+export declare function isHtmlNavigationRequest(request: Request): boolean;
 /**
  * Parse JSON bodies once and stash them in the request bag.
  */
@@ -70,4 +89,3 @@ export declare function hostValidationMiddleware(hosts: string[]): FetchMiddlewa
  * @param skipSafeMethods - When true, skip GET/HEAD (view asset GETs).
  */
 export declare function originValidationMiddleware(origins: string[], skipSafeMethods?: boolean): FetchMiddleware;
-//# sourceMappingURL=fetch-app.d.ts.map