mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
codex/cli-test-lifecycle-cleanup
79 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Andrew Khadder
|
485c79cc56 |
Canary (#2483)
* fix(client): clean up sandbox message listener and cancel readiness wait on unmount in ViewRenderer (#2421) * fix(client): clean up sandbox message listener on unmount and add timeout in ViewRenderer * fix(client): avoid early handshake promise rejection on blob fetch abort and verify timeout listener cleanup * fix(client): tie ViewRenderer sandbox readiness wait to effect lifecycle and clean up on unmount * refactor(client): support optional timeoutMs in waitForSandboxProxyReady and add timeout unit tests * test(client): add ViewRenderer default 15s timeout integration test * refactor(client): remove sandbox readiness timeout and verify exact listener teardown * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(server): report a malformed verifier resource as configuration (#2412) createJwtVerifier canonicalizes options.resource with canonicalUrl, the same helper used for the resource claim carried by a token. That helper raises invalidToken, so misconfiguring the server throws an OAuth invalid_token error at construction, complaining about a token resource claim when no token exists yet. oauthCustomProvider validates the same option with a TypeError. Validation now happens in configuredResourceUrl, which applies the same URL rules and reports a config problem as TypeError. Deliberately not normalizedProviderUrl, which the first revision used: that helper prefixes https:// onto a scheme-less string. Right for a provider domain, wrong here, because it would have accepted "api.example.com/mcp" from a JavaScript caller that the URL type does not constrain. Which URLs are accepted is therefore unchanged from before this PR; only the error type and message move. canonicalUrl now only ever sees a token claim, so it takes a string. * chore(typescript): version packages (canary) * fix(tunnel): default localHostHeader to localhost in standalone mcp-tunnel CLI (#2456) * fix(tunnel): default localHostHeader to localhost in standalone mcp-tunnel CLI * fix(tunnel): drop redundant --local-host-header alias and document Host rewriting * fix(tunnel): drop --local-host CLI flag per maintainer review while keeping localhost default * docs(tunnel): document forwarded Host: localhost default and x-forwarded-host in README * chore(typescript): version packages (canary) * fix(cli): warn on env set secret downgrade, document --secret required on every write (#2423) * fix(cli): preserve sensitive flag on env update when --secret is omitted * refactor: simplify sensitive flag expression per review feedback * fix(cli): warn on env set secret downgrade, document --secret required every write * chore: remove stale changeset describing reverted behavior * fix(cli): tighten env set messages and drop downgradedFromSecret per review * refactor(cli): drop env set downgrade detection, keep help and docs clarification Scope the change to help text, docs, and the success message. The success message now depends only on whether --secret was passed on this invocation. Write semantics and JSON output are unchanged. * chore(typescript): version packages (canary) * fix(client): stabilize useMcp configuration dependencies to prevent reconnection loops (#2403) * fix(client): stabilize useMcp configuration dependencies to prevent reconnection loops * test(client): expand array comparison and clientOptions stability test coverage * feat(client): trigger reconnection in useMcp when headers or clientOptions change * refactor(client): scope useMcp stability to clientInfo and proxyConfig * fix(client): preserve absent vs empty icon fields and normalize proxy headers * fix(client): preserve raw proxyConfig and strengthen useMcp stability and transition tests * fix(client): return shallow copy in clientInfo and proxyConfig useMemo callbacks * test(client): remove oversized integration test file and retain focused helper tests * chore(typescript): version packages (canary) * fix(cli): report a malformed JSON argument as a usage error (#2444) parseMcpArguments raises a clean UsageError for a key=value grammar mistake and for JSON that parses but is not an object, then lets the engine's own SyntaxError escape for JSON that does not parse at all. $ mcp-use client probe tools call foo '{bad json' Expected property name or '}' in JSON at position 1 (line 1 column 2) exit 1 Exit 1 is the operational-failure code, so a typed command line is reported as an API or runtime problem, and the message says nothing about which argument was wrong. That matters most for the key:=<json> form, where one token out of several is at fault. Both parses now go through a helper that names the argument and raises UsageError, so they exit 2 like every other grammar mistake in the same function. The parse runs during argument validation, before the client connects, so this is reachable without a reachable server. * chore(typescript): version packages (canary) * fix(cli): validate servers list pagination before authenticating (#2448) * fix(cli): validate servers list pagination before authenticating servers list creates the cloud client and then validates --limit and --skip, so signed out the check never runs: $ mcp-use servers list --limit 0 Not logged in. Run `mcp-use login`. exit 1 deployments list takes the same two options and reports them properly, because it validates first: $ mcp-use deployments list --limit 0 --limit must be an integer from 1 to 100. exit 2 Moving the call above cloudApiForOrganization makes the two agree, and stops the command reaching for credentials to run something that cannot run either way. * test(cli): cover the --skip message in the validate-before-auth case parsePagination raises a distinct message for --skip, and the fix moves both checks ahead of the cloud client, so both deserve coverage. Reverting servers.ts to the canary ordering now fails two tests rather than one. * chore(typescript): version packages (canary) * fix(client): coalesce concurrent connector operations and prevent process leaks (#2458) * fix(client): coalesce concurrent connector operations and prevent process leaks In @mcp-use/client, BaseConnector delegated connect() to subclasses with only a synchronous `if (this.connected)` guard. Because this.connected was only set after child process spawning, transport creation, and protocol handshakes: 1. Concurrent connect() calls on StdioConnector instantiated multiple StdioConnectionManager instances, spawning duplicate OS child processes and overwriting this.connectionManager. The first child process was abandoned and leaked permanently in the OS. 2. Concurrent connect() calls on HttpConnector overwrote transport and client references, causing partial teardowns mid-flight on failure or leaking SSE sessions. 3. Invoking disconnect() while connect() was in flight saw !this.connected and returned immediately as a no-op, leaving the connection and its underlying resources permanently open after connect() settled. 4. Concurrent disconnect() calls issued racing duplicate calls to cleanupResources(). This moves lifecycle synchronization directly into BaseConnector: - Coalesce concurrent connect() calls using an internal connectPromise. - Coalesce concurrent disconnect() calls using an internal disconnectPromise. - When disconnect() is called while connect() is in flight, await the in-flight connection attempt before tearing down resources so nothing is orphaned, and prevent the connector from marking itself connected. - When connect() is called while disconnect() is in flight, wait for teardown to complete before opening a new connection. - Subclasses now implement protected establishTransport() without needing to re-implement connection concurrency guards. * fix(client): reject in-flight connect when cancelled by disconnect When disconnect() is initiated while establishTransport() is in flight, connect() now rejects with 'Connection cancelled by disconnect' instead of fulfilling. This prevents callers awaiting connect() from assuming the connection succeeded and then encountering disconnected-state errors on subsequent operations. * fix(client): cancel queued reconnects on later disconnect * chore(client): add patch changeset for connector lifecycle fixes --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(server): keep upstream resource annotations and _meta when proxying (#2469) ResourceDefinition carries annotations and _meta, and both survive local registration. The proxy mount copies only title, description and mimeType, and ProxyResource does not even declare the other two, so an upstream resource loses its client hints and its extension metadata the moment the server is composed with use(). Both are documented on the resource descriptor and neither has a framework-derived counterpart, unlike a tool's _meta.ui.* keys, which the server computes from view and visibility. There is nothing to collide with here, so forwarding is a straight passthrough. Prompts need no equivalent change: PromptDefinition has no _meta. * chore(typescript): version packages (canary) * ci: add CLI mirror workflow to canary * feat(server): add public chat CTA to landing page (#2496) * chore(typescript): version packages (canary) * chore(typescript): use official ext-apps 2.0.0 (#2498) * chore(typescript): version packages (canary) * fix(agent): use Responses API for OpenRouter OpenAI models (#2501) * fix(agent): use Responses API for OpenRouter * fix(agent): preserve Responses request options and errors * test(agent): remove OpenRouter Responses coverage * fix(agent): scope OpenRouter Responses to OpenAI models * docs(agent): clarify OpenRouter BYOK fix * fix(agent): preserve direct OpenAI temperature behavior * chore(typescript): version packages (canary) * fix(release): propagate bundled Inspector releases and validate peers (#2504) * fix(release): propagate bundled artifacts and validate published peers * fix(ci): include release automation in dependency analysis * chore(typescript): version packages (canary) * fix(release): allow npm publish-time scanning to finish (#2505) * chore(release): update changelogs for Inspector and TypeScript packages to reflect recent patch releases and enhancements --------- Co-authored-by: Rohith Reddy Nama <104615697+rohith500@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Ayaan Gazali <ayaangazali.work@gmail.com> Co-authored-by: aishwary-dongre <87765118+aishwary-dongre@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> |
||
|
Enrico Toniato
|
5e7e350f80 |
Canary (#2424)
* fix(create-mcp-use-app): drop the dead --no-git flag from help (#2392)
Scaffolding stopped initializing a git repository in
|
||
|
Enrico Toniato
|
82772dcbab |
Canary (#2359)
* fix(cli): isolate dev test cleanup failures (#2337) * chore: enter canary prerelease mode * fix(client): project OAuth tokens before ready (#2358) * docs(python): fix misleading CI badges (#1871) (#1872) * fix(client): project OAuth tokens before ready --------- Co-authored-by: AxelRay <raynaldo.axel@gmail.com> * chore(typescript): version packages (canary) * feat(inspector): show RPC latency in the timing column (#2349) * feat(inspector): prioritize RPC latency in traffic rows * fix(inspector): preserve timestamp semantics * chore(typescript): version packages (canary) * docs(cli): add a README so the npm page is not blank (#2350) * docs(cli): add a README so the npm page is not blank @mcp-use/cli is the only published package in the family without a README, and the registry shows it: $ curl -s https://registry.npmjs.org/@mcp-use%2Fcli | jq -r .readme "" So npmjs.com/package/@mcp-use/cli renders nothing for the package that provides the `mcp-use` executable. The README is deliberately short, because the package is rarely installed directly: `mcp-use` depends on it and exposes the same bin, which the existing CLI reference page states and package.json confirms. It covers what the package is, how it actually reaches users, the command list from `mcp-use --help`, and links to the v2 CLI reference and quickstart. Both links resolve with no redirect. README.md is not in this package's `files` array, but npm always includes it. Confirmed rather than assumed: $ npm pack --dry-run npm notice Tarball Contents npm notice 1.5kB README.md * docs(cli): apply review, lead with the client Review feedback on #2350: mention the built-in MCP client, drop the paragraph about not installing the package directly, and show `mcp-use client` in the example. The example commands are the ones I ran against a local server while checking the command list: `client connect <name> <url>` then `client <name> tools list`. * docs(client): put the sandbox subpath inside the coverage gate (#2353) `@mcp-use/client` publishes three subpaths and typedoc only inspected two of them. `./sandbox` was missing from entryPoints, so everything exported from `src/sandbox.ts` sits outside the gate #2312 turned on. Not theoretical. Appending an undocumented export to that file and running `pnpm docs:api`: without src/sandbox.ts in entryPoints exit 0, no warnings with it exit 3 sandbox.SandboxProbe (TypeAlias) does not have any documentation sandbox.SandboxProbe.probe (Property) does not have any documentation Nothing is undocumented there today. The single export, buildSandboxProxyBlobHtml, has TSDoc and is also re-exported through ./react, which is why the hole has not shown up yet. This closes it before it does. * test(cli): let Windows use native file watching (#2338) * test(cli): let Windows use native file watching Experiment requested in #2273. The dev server currently forces chokidar into 100ms polling on Windows: ...(process.platform === "win32" && { usePolling: true, interval: 100 }) The comment justifies it with Windows notifications being coalesced or dropped during a transform, and nobody has been able to find an upstream Vite, Chokidar or Node report for that specific claim. Polling also makes the initial scan much slower, which is the suspected cause of the Windows-only `dev.test.ts` timeouts: if the test writes a file before the scan finishes, the new contents become the polling baseline and no change event is ever emitted. That failure mode cannot be fixed by raising a timeout, and it matches the observed signature, a `waitFor` timeout with no `last error` because the probe never threw. This removes the override so the Windows CI job runs with native watching. The point is the CI result, not the diff. Local run is unaffected, since the override never applied off Windows: dev.test.ts 34 passed, 34 total. * test(cli): avoid equal-length watcher update --------- Co-authored-by: Andrew Khadder <andrew.khadder@gmail.com> * chore(typescript): version packages (canary) * fix(dev): consolidate server request logs (#2351) * fix(dev): consolidate server request logs * refactor(server): simplify request log formatting * fix(server): omit clients from HTTP logs * fix(server): remove request log timestamps * fix(server): address request logging regressions * chore(typescript): version packages (canary) * docs(changelog): update changelogs for v20.3.3 and v12.0.6 releases - Added details for v20.3.3, including enhancements to RPC latency display and log prefixing for colocated Inspector logs. - Updated mcp-use to v2.3.4. - Added details for v12.0.6, highlighting CLI version heading enhancements and documentation fixes. - Updated mcp-use to v1.34.6. --------- Co-authored-by: Elioooon <102770919+Elioooon@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: AxelRay <raynaldo.axel@gmail.com> Co-authored-by: Ayaan Gazali <ayaangazali.work@gmail.com> Co-authored-by: Andrew Khadder <andrew.khadder@gmail.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> |
||
|
Andrew Khadder
|
f2f4fdbf33 |
Canary (#2334)
* fix(cli): drop the React plugin from the binding-validation server That server is only created when a project has no views (build.ts calls it under views.length === 0), so it never has JSX to transform. Loading @vitejs/plugin-react there pulls react, react-dom and both jsx runtimes into optimizeDeps, which cannot resolve them because such a project has no reason to depend on React. Result was four 'Failed to resolve dependency' lines on the first build of a fresh scaffold, on 3 of the 4 templates. react() had no other use in views.ts, so the import goes too. Closes #2297 * fix(create-mcp-use-app): send "Learn more" to the mcp-use docs (#2328) * fix(create-mcp-use-app): send "Learn more" to the mcp-use docs The last line the scaffold prints is: 📚 Learn more: https://manufact.com/docs That URL no longer reaches mcp-use documentation. It redirects twice and lands on Manufact's own dashboard docs: https://manufact.com/docs -> 200 https://docs.manufact.com/dashboard So someone who has just created an mcp-use server is pointed at a different product's dashboard guide. The README the same command writes into the new project points at the mcp-use quickstart instead, so the two halves of one tool disagree. Point it at the quickstart, which resolves directly with no redirect: https://docs.mcp-use.com/v2/typescript/getting-started/quickstart -> 200, 0 hops The feedback line below it still mentions manufact.com, which is correct: that one is about where to reach the people, not the docs. * fix(create-mcp-use-app): use the bare docs host in "Learn more" Review feedback: docs.mcp-use.com already redirects to the getting-started page, and the short host reads better in a console message than the full path. https://docs.mcp-use.com -> 200 https://docs.mcp-use.com/v2/typescript/getting-started/welcome * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * test(agent): assert in the two tests that assert nothing (#2316) Two tests in @mcp-use/agent run their subject and then check nothing, so they pass no matter what the code does. Both say so in a trailing comment. stream_events.test.ts "should clean up resources on completion" installs a spy on agent.close(), consumes the stream, and never looks at the spy. agent-telemetry.test.ts "should track error type on failure" swallows the error and leaves a comment guessing that telemetry "might not be called". It is called: the recorded execution carries success false and errorType "execution_error". Both assertions were checked in the failing direction against a deliberately broken source, not just against a passing run: close() calls in the cleanup paths removed -> expected "close" to be called at least once errorType hardcoded to null -> expected { executionMethod: 'stream', … } to match object { success: false, errorType: 'execution_error' } No new test files and no new cases. These are the same two tests, now able to fail. * fix(client): disconnect the session createSession replaces (#1964) * chore(typescript): version packages (canary) * docs(typescript): enforce the TypeDoc coverage gate the packages already declare (#2312) * docs(typescript): enforce the TypeDoc coverage gate the packages already declare Each package's typedoc.json sets validation.notDocumented and treatWarningsAsErrors, and eslint.config.js states that documentation coverage "is enforced against each package's public entrypoints by its strict TypeDoc configuration". It is not. The only invocation is `pnpm docs:api`, which runs typedoc with the root typedoc.options.json in packages mode. Validation from the sub-package configs is applied, but treatWarningsAsErrors is not, so the command reported 15 coverage warnings and still exited 0. Set treatWarningsAsErrors in the root options and clear what the gate then catches: - Document the members of SkillSnapshotEntry.resources, required by packages/server/CLAUDE.md and missing. - Document the members of SkillsListResult, SkillGetResult, SkillDirectoryEntry and SkillDirectoryReadResult in the client. - Drop five intentionallyNotDocumented entries for react.UseWidgetResult and react.UserAgent, neither of which exists in the server source any more, and the intentionallyNotExported entry for UseWidgetResultBase. - Add TurbopackConfig to intentionallyNotExported, matching the existing NextHeaderRule entry for the same pattern in the same file, and FinishOAuthAuthorization on the client side. `pnpm docs:api` now exits 0 with zero warnings, and exits 3 again if any public export loses its documentation. No changeset: the source edits are doc comments only, with no runtime or type change to any published API. * chore(typescript): ignore generated TypeDoc output in eslint `.typedoc/` is gitignored but not eslint-ignored, so running `pnpm docs:api` and then `pnpm lint` reports 534 errors from the generated, minified theme assets. The other generated output directories are already listed. * docs(tunnel): bring the fourth package under the same coverage gate server, client and agent each carry a typedoc.json with validation.notDocumented and treatWarningsAsErrors. tunnel is in the same root entryPoints list and had no config at all, so turning the gate on would have left it as the one published package still unchecked. Add the matching config and document the three inline members it turns up, on TunnelManager.start and TunnelManager.status. * ci(docs): run the documentation checks on canary (#2321) The Documentation workflow regenerates the API reference, runs `mint broken-links`, and fails if the committed docs are out of date. It triggers on `main` and `monorepo`. `monorepo` does not exist. `git ls-remote --heads origin monorepo` returns nothing, so that half of the trigger has been dead for a while. Meanwhile every published package's source lands on `canary` first, and the workflow never runs there. Checked against the four most recent canary-targeted pull requests, #2316, #2312, #2309 and #2307: the "Generate and validate API documentation" check is absent from all of them, while it runs on main-targeted PRs that touch the same paths. The practical effect is that documentation drift and broken links are only caught on the canary-to-main release PR, in one batch, rather than on the change that introduced them. Point the trigger at `canary` instead of the branch that is gone. The job only reads: it regenerates into the working tree and fails if anything differs. It publishes nothing, so running it on canary is safe. * docs(cli): remove inaccurate binding server comment * chore(typescript): version packages (canary) * fix(inspector): warn when model tool limit is exceeded (#2333) * chore(typescript): version packages (canary) * docs: update canary changelogs * fix: address canary review findings --------- Co-authored-by: ayaangazali <ayaangazali.work@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Vihaan Agarwal <vihaan@clique.so> |
||
|
Andrew Khadder
|
1af9bebce5 |
Canary (#2329)
* feat(client): support RequestOptions for prompt reads (#2302) * feat(client): support request options for prompts * Apply suggestion from @cubic-dev-ai[bot] Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Signed-off-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> --------- Signed-off-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(inspector): correlate RPC response labels (#2303) * feat(inspector): correlate RPC response labels * fix(inspector): refine RPC latency label styling * chore(typescript): version packages (canary) * fix(server): restore Claude resource domain hashing in v2 (#2326) * fix(server): restore Claude resource domain hashing in v2 v1.29.0 rewrote a view resource's `_meta.ui.domain` to `<sha256(domain)[0..32]>.claudemcpcontent.com` when the reading client advertised a name containing "claude". The v2 rewrite dropped that along with the v1 server package, so Claude receives the authored `view.domain` verbatim and refuses to render the view. Restore the three helpers in `src/views/claude-domain.ts`. The digest and the substring match are byte-for-byte the v1 ones, so a server upgrading from v1 emits the same domain it did before; the v1 fixtures are ported as unit tests. The digest uses Web Crypto rather than `node:crypto` to keep the root module graph free of Node builtins for the Workers build. Client identity reaches the `resources/read` handler through the per-request `_meta` envelope (`io.modelcontextprotocol/clientInfo`) — the same source `ctx.client.info()` already reads, extracted as `requestClientInfo()` in `src/context.ts`. Non-Claude clients, an already-hashed authored domain, and `resources/list` are all unchanged, matching v1. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BAiXkmFngnfwhAeNuDbFKg * docs(v2): drop the stale per-client View metadata limitation The v2 migration guide's beta-limitations list stated that "v2 has no supported hook for rewriting `domain` or other View resource metadata per client". Restoring the Claude resource domain hashing makes that false — `_meta.ui.domain` is now derived per requesting client on `resources/read`. Remove the bullet outright rather than softening it. The rest of the Views limitations list is unaffected and reads cleanly without it; the `resources/list` and authoring surfaces it also described are covered by the resource-facts guidance earlier in the same guide. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BAiXkmFngnfwhAeNuDbFKg * fix(server): detect legacy Claude clients by user agent * fix(server): lazy-load the Claude domain helper to stay under the edge budget `tests/budgets/cli-budget.test.ts` caps the edge entry's static graph at 120 KiB. Statically importing `views/claude-domain.js` from `server.ts` put the graph at 123061 bytes, 181 over the cap, failing CI on this branch (`main` sits at 121721, so the branch consumed all 1159 bytes of headroom). The `resources/read` callback is already async, so the helper loads through a dynamic import at its one call site instead, matching the lazy-loading the same budget test enforces for the CLI commands. The re-export from `views/index.ts` is dropped so the module leaves the static graph; the unit tests already import it from `views/claude-domain.js` directly. Behavior is unchanged — the user-agent fallback and the hash are untouched. Edge static graph: 123061 -> 122208 bytes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BAiXkmFngnfwhAeNuDbFKg * fix(server): keep Claude domain helper in edge graph --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * docs: update TypeScript release changelogs --------- Signed-off-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: WeiHaoxuan <156066259+Whxuan0701@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Andrew Khadder
|
d0107b3484 |
Canary (#2304)
* fix(agent): count Anthropic cache tokens and stop message_delta erasing usage (#2127) * fix(agent): count Anthropic cache tokens and stop message_delta erasing usage Two counting bugs on the Anthropic path, both silent. Anthropic reports `input_tokens` net of the prompt cache and bills `cache_read_input_tokens` and `cache_creation_input_tokens` separately, so `input_tokens + output_tokens` is not what the call is charged on. It never sends `total_tokens`, so the computed branch is always the one that runs. A call billed on 21,623 tokens reported 123. `cache_creation_input_tokens` was not read anywhere in the repository, and Anthropic bills cache writes above the base rate. OpenAI is the opposite: its `cached_tokens` sits inside `prompt_tokens`, so adding it would double count. Only the Anthropic-shaped keys are summed, and a test pins that. Second, `tokenUsageFromRecord` returns every key and sets the ones it did not find to `undefined`. Anthropic's streaming `message_delta` carries `output_tokens` only, so `usage = { ...usage, ...deltaUsage }` overwrote `inputTokens` and `cachedInputTokens` with `undefined`, discarding what `message_start` had already reported. After any streamed call the whole input side of the accounting was gone, with nothing raised. `mergeTokenUsage` merges only defined values. It does not touch `totalTokens`, because whether a cache counter is additive is a provider question and that information is gone once usage has been normalised, so the caller owns the total. Three of the added tests fail on main. * fix(agent,inspector): one owner for the Anthropic total, and stop the inspector dropping cache Follow-up on the review. Four points were raised; three were right and are fixed, one would have introduced a bug and the reasoning is below. The same wrong total existed in a third place. `message_stop` recomputed it as `inputTokens + outputTokens`, so the fix at `message_delta` survived only because `??` short-circuited on the total already set. Two places knowing how Anthropic bills is how this drifts, so `message_stop` now owns it alone and `message_delta` just merges. Added an end-to-end test that drives real `message_start` then `message_delta` SSE through `streamChat`, rather than exercising `mergeTokenUsage` in isolation. On the base commit it reports `totalTokens: undefined`, not merely a wrong number, because the input counters were gone by the time `message_stop` ran. The inspector was dropping more than the new field. `InspectorTokenUsage` declares `cachedInputTokens` and `reasoningTokens`, the trace view reads them, and `inspectorTokenUsageFromUnknown` returned only `inputTokens`, `outputTokens` and `totalTokens`. Both have always rendered as absent whatever the provider sent. It also repeated the same input-plus-output total. Both fixed, and `cacheCreationInputTokens` is carried through. The merge test now seeds `cache_creation_input_tokens` too, since cache writes are billed above base rate and need the same protection as cache reads. Not done, deliberately: adding `cachedInputTokens` to the computed total inside `tokenUsageFromRecord`. On Anthropic that counter sits outside `input_tokens`; on OpenAI `cached_tokens` sits inside `prompt_tokens`. Once usage is normalised that distinction is gone, so summing it would double count OpenAI. Only the Anthropic-shaped keys are added, and a test pins the OpenAI case at 14. * style(inspector): run prettier on trace.ts format:check fails the typescript-lint job on this one file. Prettier wraps the cachedInputTokens call across three lines, the way the two calls below it already are. Formatting only, no behaviour change. * fix(inspector): aggregate cacheCreationInputTokens and stop double-counting OpenAI cache reads Addresses @khandrew1's review on #2127. addUsage dropped cacheCreationInputTokens: the field was parsed onto individual usage events but never summed, so it vanished from state.usage, the LLM span's usage, and the aggregate tokenUsage in the raw-chat payload. It is now summed alongside the other counters. The fallback total could also over-count. uncountedCache was built from the provider-neutral cachedInputTokens, but on OpenAI those tokens are already inside inputTokens, so { inputTokens: 10, outputTokens: 4, cachedInputTokens: 3 } totalled 17 instead of 14. The total now adds only the Anthropic-shaped cache_read_input_tokens, mirroring the provider-safe path in agent/src/llm/usage.ts. cachedInputTokens is still parsed and returned for observability. Two tests in trace.test.ts pin both: the OpenAI-vs-Anthropic total distinction, and that cacheCreationInputTokens survives aggregation and the LLM span. Changesets added for @mcp-use/agent and @mcp-use/inspector. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): scope loading state by chat session (#2232) * fix(inspector): give each chat session one id and one state record Chat state lived in hook-wide React state, so starting a new chat cleared the values an in-flight stream was still writing to: the fresh chat inherited the previous session's loading state and could not send. Rework it around a single identity. A session is created with one id and keeps it; that id is handed to ChatStorageProvider.createChat, so runtime state, chat history and OAuth retry all name the same chat. All of a session's state and turn machinery live in one record inside ChatSessionStore, which notifies only the subscribers of the session that changed, so a background turn keeps streaming into its own record. useChatSessions owns the lifecycle: minting ids, activating a session, reattaching to persisted chats, and reopening the session a full-page OAuth redirect interrupted. New Chat now only switches the active id. Closes #2217 * refactor(inspector): simplify chat session state * fix(inspector): harden chat session recovery --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(ci): give inspector tests the same timeout as every other package (canary) (#2290) * fix(ci): give inspector tests the same timeout as every other package Same one-line change as #2268, which targets main. canary carries the same 10s cap and is failing on it independently: run 32053629834 compressed-assets.test.ts 10230ms Test timed out in 10000ms run 32051250836 same test main is red on it too (run 32054211669). Recent margins are 10029ms, 10230ms and 10837ms, all just over the cap. The inspector is the only package at 10s; agent, client, cli and server all use 60000, and these cases mount a server and decompress the bundled app. 45 files, 217 tests still pass locally. * chore(ci): remove timeout rationale comment --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * feat(oauth): add Scalekit provider (#2272) * feat(oauth): add Scalekit provider Add oauthScalekitProvider next to Auth0 and Clerk. The verifier accepts both environment-root and resource-scoped issuers, binds audience to the res_… resource id, and advertises DCR plus CIMD. No Scalekit SDK. * fix(oauth): keep Scalekit resource-id audience with extra aud Always verify aud includes the resource id. Optional audience is an extra AND check, not a replacement. Drop the new v1 provider page. * fix(oauth): drop Scalekit issuerBoundAccessTokens option Scalekit binds tokens to the resource id. The dashboard will own that opt-in. Keep the static oauthMetadata copy because mcp-use requires it. Custom claims stay on ctx.auth.payload. * docs: drop v1 and legacy skill changes * docs: fix Scalekit environment variables --------- Co-authored-by: Saif Shines <saifshine7@gmail.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): add a test script so pnpm test covers this package (#2289) * fix(inspector): add a test script so pnpm test covers this package The root test script is `pnpm run -r test`, and the inspector only had test:unit. pnpm skips a package with no matching script and reports nothing, so 217 unit tests were absent from the workspace-wide run: $ pnpm --filter @mcp-use/inspector test (no output) $ pnpm --filter @mcp-use/inspector test:unit Test Files 45 passed (45) Tests 217 passed (217) CI is unaffected; its step calls test:unit directly. This is the documented `pnpm test` contributors run. Uses run mode rather than watch, matching tunnel, so a recursive run cannot sit waiting on a watcher. * chore(inspector): remove test-only changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * fix(types): align pnpm workspace tooling (#2301) * docs: update TypeScript release changelogs * fix(inspector): use secure chat session ids --------- Co-authored-by: Arthi Arumugam <62213284+arthi-arumugam-git@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Mert Çetin <97505365+merttcetn@users.noreply.github.com> Co-authored-by: Ayaan Gazali <ayaangazali.work@gmail.com> Co-authored-by: saif-at-scalekit <saif.shaik@scalekit.com> Co-authored-by: Saif Shines <saifshine7@gmail.com> |
||
|
Andrew Khadder
|
e17cd7b8ca |
Canary (#2216)
* feat(client): support mixed OAuth servers
* fix(inspector): pause mixed-auth tool calls
* Revert "fix(inspector): pause mixed-auth tool calls"
This reverts commit
|
||
|
Enrico Toniato
|
1f7df2a82c |
fix release blockers before stable promotion (#2206)
* fix release blockers before stable promotion * fix conformance summary expected outcomes * harden release and conformance validation |
||
|
Andrew Khadder
|
885310e433 | docs: update Canary changelogs | ||
|
Andrew Khadder
|
e41076fb3f |
feat: improve Skills over MCP Inspector support (#2196)
* Codex worktree snapshot: archive-cleanup Co-authored-by: Codex * feat: improve skills over MCP inspector support * fix: address Skills review feedback |
||
|
Enrico
|
2daf9c9d42 | fix: resolve skills over MCP canary conflicts | ||
|
Enrico
|
2768f5bfec | Merge main into beta | ||
|
Enrico
|
ac3d1eb3bb | fix(typescript): resolve CodeQL security alerts | ||
|
Enrico Toniato
|
392d36c079 |
Optimize the standalone Inspector package (#1968)
* fix inspector hosted proxy and oauth recovery * remove inspector compatibility report * refactor(inspector): mount project-local dev inspector * refactor(inspector): remove CDN application delivery * fix(inspector): finalize local mount and proxy health checks * refactor(typescript): optimize inspector packages * fix(typescript): build CLI for server examples * fix(typescript): keep CLI build deps development-only |
||
|
Enrico Toniato
|
eedeb4fc52 |
fix(inspector): recover OAuth and mount project-local dev Inspector (#1966)
* fix inspector hosted proxy and oauth recovery * remove inspector compatibility report * refactor(inspector): mount project-local dev inspector * refactor(inspector): remove CDN application delivery * fix(inspector): finalize local mount and proxy health checks |
||
|
Enrico
|
b5354b5285 | fix(docs): update Inspector URL references to /mcp/inspector | ||
|
Ayaan Gazali
|
9978343d63 |
docs(inspector): add self-hosting guide (#1861)
* docs(inspector): add self-hosting guide The inspector README and feature table reference self-hosting with Docker, but the docs site had no page for it (mcp-use.com/docs/inspector/self-hosting 404s). Add the guide based on the README's self-hosting section: Docker Hub image, docker run / compose deployment, environment variables, and how self-hosting compares to the hosted and CLI options. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(inspector): bind examples to loopback, add exposure warning and air-gapped transfer steps Addresses review feedback on #1861: - trim wordy intro sentence - quick start and deployment examples now bind 127.0.0.1 to avoid exposing the Inspector proxy on all interfaces; added Warning with reverse-proxy/firewall guidance for remote access - add docker save/load transfer steps for air-gapped hosts Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: ayaanmacmini3 <ayaanmacmini3@ayaanmacmini3s-Mac-mini.local> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Enrico
|
003447ce94 | fix(inspector): update CDN asset resolution and modify server start command | ||
|
Enrico Toniato
|
dcd97d69e2 |
fix(client): wire oauthProxyUrl option + stop misclassifying discover… (#1841)
* fix(client): wire oauthProxyUrl option + stop misclassifying discovered OAuth servers (#1840) Hosted OAuth servers (e.g. gateway-fronted, custom-domain) were dropping to `failed` with "Server does not support OAuth", hiding the Authenticate button. Routing MCP traffic through the inspector proxy anchored OAuth discovery on the proxy origin; a secondary discovery pass (token refresh / SSE fallback) then hit an HTML/500 and matched isOAuthDiscoveryFailure(). - Fully wire UseMcpOptions.oauthProxyUrl through createBrowserOAuthProvider so OAuth traffic can be proxied for CORS while MCP stays direct (transparent proxy preserves RFC 8414 issuer validation). preventAutoAuth manual flow now always uses the scoped OAuth proxy fetch instead of the MCP gateway proxy. - useMcp: when a prepared authorization URL already exists (OAuth discovery succeeded on an earlier pass) and preventAutoAuth is set, surface `pending_auth` on a later failure instead of "server does not support OAuth". * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs: update changelogs for v12.0.0 and v1.34.0 releases - Added details for v12.0.0, highlighting improvements in hosted OAuth reliability and updates from `mcp-use` v1.34.0. - Included fixes for OAuth server failures and updates to peer dependencies in the inspector changelog. - Documented new features and fixes in the TypeScript changelog, emphasizing the introduction of `oauthProxyUrl` for enhanced OAuth proxying and reliability improvements. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Andrew Khadder
|
68afda5885 |
docs(typescript): review and rewrite TypeScript docs (MCP-2466) (#1780)
* docs: remove stale feedback block and orphaned anchor from docs.json * chore(docs): make Typescript more prominent * chore(docs): Update `welcome.mdx` * docs: rewrite TypeScript quickstart and welcome pages Refocus the quickstart on create-mcp-use-app (scaffold, run, and deploy a first MCP server) and drop the agent/client/server primer table and diagram. Convert the welcome page's server + widget example from Tabs to CodeGroup and tighten the intro wording. * docs: remove stale server templates page and fix its references Delete the typescript/server/templates page and repoint the home templates tip to the quickstart, which now covers create-mcp-use-app. * docs(typescript): fix dead example links to real example paths The 'see a full example' links pointed at GitHub folders that 404 or contain only a README. Corrected to the real runnable examples under libraries/typescript/packages/mcp-use/examples/, verified against origin/main (incl. matching cd commands): - installation: examples/server -> packages/.../examples/server - client-configuration: a .py link -> real TS multi-server example - code-mode: examples/client/* -> examples/agent/code-mode/* - elicitation, sampling, notifications: server/X -> server/features/X - supabase: server/supabase -> server/deployment/supabase - clerk: restore missing packages/mcp-use/ path segment Quickstart links were already fixed by the quickstart rewrite (e6903716). Part of the docs audit (MCP-2466). * docs(typescript): rewrite Agent and Client introduction pages Rewrite the Agent and Client intro pages to be task-oriented and scannable: concise feature lists with cross-links, runnable quick-start examples, and added API reference sections. Drop stale CodeSandbox embeds and outdated model names. * docs(typescript): fix MCPServer class name casing in server reference The API Reference heading, prose, and class signature used McpServer; the real SDK export is MCPServer. Corrected all three occurrences in server/index.mdx. * docs: add redirect for bare /typescript/server path Routes the bare /typescript/server path to its index page now that the server section has been restructured. Claude-Session: https://claude.ai/code/session_015uioJjKTAZXGQpbXHUHZWp * docs(typescript): fix broken code examples across MCP Server & Apps section Fix all 102 confirmed code defects found in the MCP Server & MCP Apps documentation audit (47 pages, 401 code blocks), verified against the mcp-use@1.32 SDK source. The recurring patterns that made copy-pasted examples fail to compile or run are now corrected everywhere they appeared: - server.start() -> await server.listen() (no start() method exists) - bare-object tool returns wrapped in object()/text() response helpers; catch blocks renamed so they no longer shadow the error() helper - prompt messages use role:"user" with typed { type:"text" } content instead of the invalid role:"system" + bare-string shape - auth reads ctx.auth.user.userId (not ctx.auth.userId); user fields live under ctx.auth.user, scopes/permissions stay top-level - security: remove verifyJwt: process.env.NODE_ENV === 'production' from all six OAuth provider pages (off-prod it skips signature verification and accepts forged tokens); rely on the secure default, with a warning never to disable it - correct import subpaths: Logger/MCPClient from mcp-use, response helpers and server symbols from mcp-use/server, MCPClient as BrowserMCPClient from mcp-use/browser; drop the unexported getMcpAppsBridge - useWidget generics use the real <TProps, TState, TOutput, ...> order; remove the non-existent notifyIntrinsicHeight (auto-size via McpUseProvider) - fix the deployment URL to <id>.run.mcp-use.com/mcp, add missing z/helper imports, add the --branch/--dockerfile CLI options, and clean up em dashes and bare/malformed code fences Each page was fixed and then independently re-verified against the SDK source, with a repo-wide pattern sweep confirming no instances remain. Structural IA changes (moving widget-components to /react/, orphan redirects) are intentionally deferred to the docs rewrite. * docs(typescript): restructure MCP Server & MCP Apps IA Promote MCP Apps to its own top-level section in the TypeScript SDK Docs tab and move the 9 React widget-component pages out of /server/widget-components/ into /typescript/react/. - Move 9 React component pages to typescript/react/ (git renames) with 9 redirects - Promote MCP Apps to a top-level group (Overview pages + React subgroup) - Remove the duplicate MCP Apps group from the Home product nav; rehome guides/chatgpt-apps-flow under MCP Apps so it no longer orphans - Move cli-reference out of MCP Server into a new Tooling group - Relocate response-helpers -> Core Components, openapi -> Advanced Features, nextjs-drop-in -> Deployment - Repoint all widget-components links to /typescript/react/ - Fix 3 broken anchor links (inspector CLI env var, mcp-apps metadata, auth providers) Structure-only change; no page content rewrites. Refs MCP-2466. * docs: refresh TypeScript server app docs * docs: add TypeScript API reference * docs: streamline TypeScript server navigation * docs: rewrite core TypeScript server guides * docs: rewrite advanced TypeScript server guides * docs: rewrite TypeScript server OAuth guides * docs: rewrite TypeScript server session storage guides * docs: rewrite MCP Apps section * docs: add TypeScript MCP client API reference * docs: add TypeScript MCP agent API reference * docs: reorder TypeScript API reference nav * docs: reorganize TypeScript tooling nav * docs: rewrite inspector guides * docs: rewrite MCP server tunneling guide * docs: rewrite CLI client and reference docs * docs: finalize TypeScript documentation rewrite * docs: move inspector updates under get started * Fix Mintlify validation errors * Fix Mintlify broken links * docs: update Manufact Cloud deployment guide * chore: retrigger Mintlify docs preview * Fix MDX comment syntax on home page * docs: rework TypeScript server examples * docs: fix server docs links * docs: restore SDK links in home sidebar * docs: move SDK links to end of home sidebar |
||
|
Andrew Khadder
|
430178c9a3 |
Canary (#1757)
* chore(deps): bump hono in /libraries/typescript/packages/mcp-use (#1755) Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.23...v4.12.25) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.25 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore: add hono changeset * chore(typescript): version packages (canary) * Fix Codex skills install path (#1756) * chore(typescript): version packages (canary) * chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript (#1742) * chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.8 to 8.0.16. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.16 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * Handle inspector CLI version and unknown options (#1722) * Handle inspector CLI version and unknown options * Keep inspector version in sync with package metadata --------- Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * Make MCP Apps primary widget runtime & Apply Host Context Styles (#1739) * Make MCP Apps primary widget runtime * Format MCP Apps runtime changes * Remove unused OpenAI globals event types * Apply MCP Apps host style variables * fix host style variable application * fix(react): avoid light fallback for missing host theme * Preserve model context when widget state updates * Remove obsolete MCP Apps runtime theme tests * Format MCP Apps runtime tests * chore(typescript): version packages (canary) * fix(cli): surface GitHub App install URL up front on deploy (#1761) * fix(cli): surface GitHub App install URL up front on deploy When `mcp-use deploy` detects the GitHub App is not connected or lacks access to the target repo, it now prints the install URL before any prompt. In a non-interactive context (an agent or CI, without `--yes`) it prints the URL and next steps and exits cleanly instead of hanging on an unanswerable prompt. Interactive and `--yes` flows are unchanged. * test(cli): simplify GitHub install-flow tests; tidy deploy no_access branch - Collapse redundant gitHubInstallUrl cases into one - Mock `open` and assert the non-interactive path never launches a browser - Extract a `noAccess` local in promptGitHubInstallation for readability * fix(cli): unexport internal-only GitHubInstallation type to satisfy knip GitHubInstallation is only referenced within api.ts (via GitHubConnectionStatus), so the export was dead and failed the knip check. * fix(cli): unexport internal-only InstallFlowMode type to satisfy knip InstallFlowMode is only used within deploy.ts as resolveInstallFlowMode's return type; the test imports the function, not the type. Verified with the full `knip --no-progress` run (exit 0), which CI uses. * chore(typescript): version packages (canary) * fix(cli): preserve deployment list sort order (#1752) * fix(cli): preserve deployment list sort order * chore(cli): add changeset for deployment list sort order fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): stop prompting signed-in users to log in (MCP-2142) (#1767) The hosted inspector showed the "free tier — Sign in to increase your limits" CTA to every managed-LLM visitor, even when already authenticated. ChatTab now resolves the shared Manufact session via a new useHostedSession hook (also adopted by HostedUserMenu) and hides the free-tier sign-in/upgrade chrome for authenticated users. The visibility rule is extracted into a pure shouldShowFreeTierUpgrade helper with unit tests. * chore(typescript): version packages (canary) * fix(typescript): pass the cwd field (#1785) * fix: pass the cwd field Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * fix: add changeset Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * doc: add documentation of cwd field Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> --------- Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * chore(typescript): version packages (canary) * fix(inspector): replace stale auto-connect transports (#1792) * chore(typescript): version packages (canary) * fix(templates): score 100% on publishing checklist (MCP-2260) (#1772) * fix(templates): score 100% on publishing checklist (MCP-2260) Auto-derive openai/widgetDescription from the widget description in the Apps SDK adapter so hosts always see a widget description, and fill the small metadata gaps the templates were missing: - starter: fetch-weather declares a title + outputSchema (returns matching structuredContent). - mcp-apps: search-tools and get-fruit-details declare a title; the product-search-result widget declares a domain (widgetDescription is now auto-derived from its description). Adds a unit test for the widgetDescription default. * feat(server): enforce outputSchema at the tool return position (MCP-2260) Type-check a tool's outputSchema through the existing object()/widget() calls with no new API: - Content helpers (text, markdown, image, ...) now return a content-only ToolContentResult (structuredContent?: never), so they're always allowed. - widget() is generic over its props, which become the result's structuredContent — so widget({ props }) is checked against outputSchema. - The tool callback return type is TypedCallToolResult<TOutput> | ToolContentResult, making object({ wrong })/widget({ props: wrong }) a compile-time error. Adds a type-level test (npm run test:types) and removes an internal template comment. Edge cases that now error against a tool with outputSchema: mix() carrying structured content, or a raw literal with a mismatched structuredContent. * fix(templates): remove hardcoded widget domain Keep the generated MCP Apps template client-neutral so deployers can set their own production widget origin. * chore(typescript): update knip.json to include additional ignore patterns and entry points - Added "test_app" to the ignoreWorkspaces list. - Included "tests/types/**/*.ts" in the entry patterns for type checking. - Removed redundant "scripts/**/*.{js,mjs,ts}" from the entry list in the create-mcp-use-app package. * chore(typescript): version packages (canary) * feat(cli): expose monorepo auto-deploy trigger config (#1793) Add --watch-paths/--wait-for-ci to `mcp-use deploy` and --watch-paths/--deploy-branches/--wait-for-ci/--root-dir to `mcp-use servers update`, and surface the effective trigger config in `servers get`/`update`. Closes the gap where the Cloud API accepted these fields but the CLI could not set them, so monorepo apps can be scoped to only redeploy on relevant changes (#1547). Updates the deployment + CLI reference docs accordingly. * chore(typescript): version packages (canary) * fix(mcp-use): restore Apps SDK compatibility in useWidget as a fallback (#1794) Keep the MCP Apps bridge as the primary widget runtime, but use window.openai (Apps SDK) as a compatibility fallback when the bridge does not connect, instead of dropping it entirely. #1739 made the MCP Apps bridge the sole iframe runtime, which left any Apps SDK-only host (e.g. a ChatGPT widget without MCP Apps support) stuck on the loading spinner forever. A connected MCP Apps bridge still always wins, so ChatGPT keeps using MCP Apps as the source of truth. Also fixes two pre-existing issues in the scroll-to-bottom chat e2e test (strict-mode locator + measuring the animated scroll synchronously). * chore(typescript): version packages (canary) * feat(inspector, typescript): release v11.0.0 and v1.33.0 with MCP Apps as primary widget runtime - Introduced MCP Apps as the primary widget runtime, enhancing style variable application. - Fixed issues with auto-connect entries, user prompts for free-tier, and CLI version handling. - Updated dependencies including `vite` and `mcp-use`. - Added monorepo auto-deploy controls and improved CLI documentation for new flags. See changelogs for detailed updates and fixes. * fix(inspector): scope OAuth proxy fetch per server configuration (#1770) * fix(inspector): scope OAuth proxy fetch per server configuration The browser OAuth provider installed a global window.fetch interceptor to route OAuth requests through the inspector proxy. With multiple servers, connecting one server "Via Proxy" mutated fetch for the entire page, so other servers (including "Direct" ones) and unrelated requests were affected, and switching a server from "Via Proxy" back to "Direct" could leave a stale interceptor behind. BrowserOAuthClientProvider now exposes a scoped getProxyFetch() that returns a fetch confined to a single provider. It is passed only to that server's SDK transport and auth() calls (via the SDK's fetch / fetchFn options), so OAuth-proxy behavior is scoped to the selected server's connection and the global fetch is never mutated. Closes #1766 Co-authored-by: Cursor <cursoragent@cursor.com> * chore: remove redundant OAuth cleanup comment --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * Adopt auto connection mode in inspector docs and UI (#1795) * Adopt auto connection mode in inspector docs and UI * Fix embedded inspector auto proxy fallback * chore(typescript): version packages (canary) * docs: update TypeScript release changelogs --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Ghost Monkey <haugun79@gmail.com> Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com> Co-authored-by: 落尘 <cuidong111@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Dr. Carsten Leue <55989662+Carsten-Leue@users.noreply.github.com> Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: Hemant Krishnakumar <51333870+hemant1026@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
efa7fe78b2 |
Canary (#1719)
* fix(cli): update EnvVariable type to allow null values for sensitive rows (#1717) - Modified the `value` property in the `EnvVariable` interface to accept `null`, indicating write-only sensitive rows where the stored value is withheld by the API. - Adjusted the `printEnvVar` function to handle cases where `value` is `null`, ensuring proper display of sensitive information. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(server): add outgoing notification logging (#1674) * chore(typescript): version packages (canary) * fix(server): mount RFC 8414 canonical well-known paths for path-suffix issuers (#1684) * fix(server): mount RFC 8414 canonical well-known paths for path-suffix issuers Construct upstream OAuth/OIDC metadata URLs per RFC 8414 and OIDC Discovery, and mount canonical path-suffixed routes on the MCP server when the upstream issuer includes a path component. Fixes #1576 Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> * fix(server): mount OIDC discovery at root only; stop leaking error detail Remove the unreachable, malformed OIDC path-suffix local mount (OIDC Discovery appends the well-known segment to the issuer, so there is no canonical form under the openid-configuration prefix, and no client flow reaches a path-suffixed local route). Keep the RFC 8414 OAuth path-suffix mount. Return a generic error_description to clients and log the raw exception server-side instead of echoing it. * style: apply prettier formatting --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(server/oauth): broker upstream OAuth callback through /oauth/callback (#1728) In proxy mode the server was forwarding each MCP client's redirect_uri straight to the upstream provider, which forced every client's callback (Claude, ChatGPT, the inspector, ...) to be pre-registered on the provider. Instead, /authorize now sends the upstream the server's own /oauth/callback and packs the client's redirect_uri + state into the upstream `state` (base64url JSON, stateless). A new GET /oauth/callback restores them and forwards the code (or upstream error) to the client's original callback. /token rewrites redirect_uri to the brokered callback so it matches the authorize request (RFC 6749 §4.1.3). PKCE passes through untouched. Also: jwksVerifier now rejects opaque (non-JWT) access tokens with an actionable message pointing at the missing `audience`, instead of jose's cryptic "Invalid Compact JWS". Only `<server-domain>/oauth/callback` needs registering upstream now. Closes MCP-2170 * fix(inspector): route localhost MCP servers through client-side chat (MCP-2419) (#1736) * fix(inspector): route localhost MCP servers through client-side chat (MCP-2419) In hosted mode the Chat tab streams through the managed cloud backend (chatApiUrl), which connects to the MCP server server-side and cannot reach a user's localhost server. The request 502s and, lacking CORS headers, surfaces in the browser as an opaque "Failed to fetch" / CORS error. Loopback server URLs now fall back to client-side (in-browser) chat streaming, which already holds a direct session to the localhost server. The configure-key empty state shows an explanatory notice telling the user the managed key can't reach their machine and that a personal API key is needed — only in hosted mode; the local inspector is unchanged. The localhost check is extracted into a shared serverUrl util (with IPv6 [::1] bracket handling) plus unit tests, and e2e tests cover the hosted+localhost fallback, the no-cloud-call guarantee, and the notice's presence/absence. * fix(inspector): address PR review on MCP-2419 localhost chat fix - serverUrl: detect the full 127.0.0.0/8 loopback range (not just 127.0.0.1), anchored so "127.example.com" is not a false positive - serverUrl tests: cover 127.0.0.0/8 and near-loopback negatives - e2e: stub the hosted `/api/auth/get-session` endpoint in enableHostedChatMode so HostedUserMenu never hits the real cloud backend (avoids CI flakiness/slowness) - changeset: fix grammar * style(inspector): prettier formatting for e2e test helpers * chore(typescript): version packages (canary) * fix(cli): use authoritative GitHub repo-access check for deploy (MCP-2467) (#1737) The `mcp-use deploy` pre-flight repo-access check listed an installation's repos and matched the target locally. That only inspected the first page, so repos on later pages were wrongly reported inaccessible (MCP-2467); fully paginating it (the prior behavior) hung on very large orgs. Replace it with a single authoritative question per installation via the new backend `GET /github/installations/:installationId/repos/:owner/:repo/access` endpoint (a `repos.get` probe). The installation whose account matches the repo owner is checked first, falling back to the others, preserving the across-installations fix from MCP-2358 without paginating. * chore(typescript): version packages (canary) * chore(deps): bump esbuild from 0.27.1 to 0.28.1 in /libraries/typescript (#1734) * chore(deps): bump esbuild from 0.27.1 to 0.28.1 in /libraries/typescript Bumps [esbuild](https://github.com/evanw/esbuild) from 0.27.1 to 0.28.1. - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](https://github.com/evanw/esbuild/compare/v0.27.1...v0.28.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(typescript): silence dev widget logs when project has no widgets (#1730) * chore(typescript): version packages (canary) * feat : inspector add scroll-to-bottom button (#1538) * inspector: add scroll-to-bottom button * fix(inspector): center chat scroll button --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): cleanly unsubscribe on Ctrl+C (SIGINT) (#1687) * fix(cli): add SIGINT handler to cleanly unsubscribe from resource Addresses #1686 * chore: add cli changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): update emulate oauth callback (#1743) * refactor: centralize screenshot handling and add REPL screenshot support (#1592) * refactor: centralize screenshot handling and add REPL screenshot support * chore: fix knip checks * chore: drop knip version ignore --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(api): update base URL for remote API calls to manufact.com (#1745) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * fix(api): update base URL for remote API calls to manufact.com - Changed the default base URL from 'https://cloud.mcp-use.com' to 'https://cloud.manufact.com' across multiple files, including MCPAgent and RemoteAgent initializations, ensuring consistency in API endpoint references. * chore(typescript): version packages (canary) * feat(cli): add support for custom Dockerfile path in deployment options (#1746) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * feat(cli): add support for custom Dockerfile path in deployment options - Introduced a new CLI option `--dockerfile` to specify a non-default Dockerfile path relative to the project root. - Updated the `DeployOptions` interface to include the `dockerfile` property. - Enhanced deployment command output to display the specified Dockerfile path, improving user feedback during deployment processes. * refactor(cli): improve console log formatting for Dockerfile output - Reformatted the console log statement for the Dockerfile option in the deploy command to enhance readability by breaking it into multiple lines. This change aims to maintain consistent code style and improve maintainability. * chore(typescript): version packages (canary) * Remove obsolete OAuth proxy callback changeset * chore(typescript): version packages (canary) * docs: update canary changelogs * fix(cli): allow empty env var updates (#1750) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * fix(cli): allow empty env var updates * Add changeset for empty env value updates --------- Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(deps): bump tar from 7.5.11 to 7.5.16 in /libraries/typescript (#1744) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * chore(deps): bump tar from 7.5.11 to 7.5.16 in /libraries/typescript Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-tar/compare/v7.5.11...v7.5.16) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.16 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Dhruv Tiwari <144548881+dhruvtiwari6@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kalpchaniyara <kalpchaniyara.2006@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: 落尘 <cuidong111@gmail.com> |
||
|
Enrico Toniato
|
5b4afc845c |
Add client auth info retrieval to useMcp (#1715)
* feat(auth): add getTokenEndpoint method for OAuth token discovery (#1714) * feat(auth): add getTokenEndpoint method for OAuth token discovery - Implemented `getTokenEndpoint` in `BrowserOAuthClientProvider` and `OAuthSessionStore` to resolve and cache the OAuth token endpoint via server metadata discovery. - Updated `UseMcpResult` type to include `token_endpoint` for consumers to persist the endpoint alongside tokens. - Enhanced `useMcp` to utilize the new method for proactive token refresh. - Added unit tests to verify the functionality of the `getTokenEndpoint` method, including caching behavior and error handling. * refactor(auth): improve code formatting in OAuthSessionStore and related tests - Reformatted code in `OAuthSessionStore` for better readability by breaking long lines into multiple lines. - Updated unit tests for `OAuthSessionStore` to enhance clarity by applying similar formatting improvements. - These changes aim to enhance maintainability and readability of the codebase. * feat(auth): add getClientCredentials method for OAuth client information retrieval - Implemented `getClientCredentials` in `BrowserOAuthClientProvider` and `OAuthSessionStore` to allow consumers to retrieve stored OAuth client credentials, facilitating server-side token refresh. - Updated `UseMcpResult` type to include `client_id` and `client_secret` for better token management. - Enhanced `useMcp` to utilize the new method for proactive token refresh, ensuring smoother authentication flows. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v9.0.2 and v1.32.0 releases - Added details for patch release v9.0.2 in the inspector changelog, noting the update to `mcp-use` v1.32.0 with no inspector-specific runtime changes. - Documented minor release v1.32.0 in the TypeScript changelog, highlighting the introduction of OAuth token endpoint discovery and new methods for retrieving client credentials, along with an update to `@mcp-use/inspector`. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
0fb18685d3 |
feat(cli): servers update + branch-scoped env/deploy management (#1711) (#1712)
* feat(cli): servers update + branch-scoped env/deploy management (#1711) * feat(cli): add servers update + branch-scoped env/deploy management Adds `mcp-use servers update` to mutate server config in place (productionBranch, name, description, build/start commands) without delete/recreate, mapping flags to the backend UpdateServerBody (--branch -> productionBranch; build/start commands nested under config). Also completes MCP-1794 branch scoping: - deploy --branch (defaults to current git branch) scopes env sync to the branch's preview env - servers env list/add/update/rm --branch; update/rm accept a KEY resolved within the branch scope, not just a UUID - deployments restart --branch (defaults to the deployment's branch) Supersedes #1706 with the correct field mapping. Adds unit tests, README docs (flags + env naming mapping), and a changeset. * docs(skills): document servers update + branch-scoped env CLI commands Update the mcp-apps-builder and openapi-to-mcp skills for the new CLI surface: add the deploy `--branch` flag, document `servers update` and `servers env` for post-deploy config, and fix the stale `mcp-use deployments env set` reference (the real command is `mcp-use servers env add`). * feat(cli): map empty build/start flags to null for config unset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v9.0.1 and v1.31.1 releases - Added details for patch release v9.0.1 in the inspector changelog, noting the update to `mcp-use` v1.31.1 with no inspector-specific runtime changes. - Documented patch release v1.31.1 in the TypeScript changelog, highlighting workspace dependency alignment and new features in `@mcp-use/cli`, including server updates and branch-scoped environment management. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
4d00a1ffc4 |
Canary (#1704)
* fix(mcp-use): move chalk to regular dependencies (#1702) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(cli): enhance deployment and server management feedback (#1703) * feat(cli): enhance deployment and server management feedback - Added server ID retrieval during deployment to provide clearer context. - Improved user messaging for deployments without a GitHub remote, clarifying the source location. - Updated server information display to indicate when a repository is platform-managed. - Enhanced the `removeServer` function to optionally clear OAuth credentials, allowing for explicit logout actions. This update aims to improve user experience by providing more informative feedback during deployment and server management operations. * refactor(cli, mcp-use): improve code formatting and readability - Simplified console log formatting in `getServerCommand` for better clarity. - Enhanced type definition formatting in `pushSourceToServer` for improved readability. - Streamlined conditional checks in `runAuthPopup` and `useMcp` to follow consistent formatting. - Updated test utility for dispatching messages to enhance clarity. These changes aim to improve code maintainability and readability across the CLI and MCP use libraries. * delete(tests): remove obsolete diag test file - Eliminated the `diag.test.ts` file as it is no longer needed. This cleanup helps maintain a more relevant and streamlined test suite. * chore(typescript): version packages (canary) * feat(auth): enhance popup authentication flow with grace period and return URL - Added a `returnUrl` parameter to the `renderCloseWindowMessage` function to provide users a way back to the app when popups cannot be closed. - Implemented a grace period in `runAuthPopup` to handle scenarios where the popup reports closed before tokens are received, improving reliability during cross-origin navigation. - Updated tests to validate the new grace period behavior and ensure successful resolution of authentication when tokens arrive during this window. These changes aim to enhance user experience and reliability in the authentication process. * chore(changelog): update changelogs for v9.0.0 and v1.31.0 releases - Added details for major release v9.0.0 in the inspector changelog, highlighting OAuth credential lifecycle improvements and updates to peer dependencies. - Included patch release v1.31.0 in the TypeScript changelog, focusing on OAuth popup reliability and credential lifecycle enhancements, along with updates to dependencies. - Updated mcp-use version references in both changelogs to reflect the latest changes. * chore(changelog): update TypeScript changelog for v1.30.2 release - Removed outdated entries for v1.30.2, including the chalk CJS compatibility fix and updates to @mcp-use/inspector and @mcp-use/cli. - Added a fix for downgrading chalk to v4 to resolve compatibility issues with CJS server bundles on Node ≥ 22. This update ensures the changelog accurately reflects the latest changes and fixes. --------- Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
c866bdaa7c |
Canary (#1695)
* feat(cli): managed (no-GitHub) deploy + device-code login (#1691) * feat(cli): add managed (no-GitHub) deploy and device-code login - `mcp-use deploy --managed` packs the local project into a tarball and uploads it to the platform-managed GitHub org, so users can deploy without connecting their own GitHub. Redeploys reuse the linked server. - `mcp-use login --device-code <code>` authenticates non-interactively with a pre-approved OAuth device code (used by the web onboarding flow), skipping the browser step. * feat(cli): auto-detect managed server on redeploy A project linked to a managed server now redeploys via the managed upload path without needing --managed again (detected from the server's connectedRepository.isManaged flag). * docs(skill): document managed deploy + device-code login Update the mcp-apps-builder deployment guide for `mcp-use deploy --managed` (no GitHub required) and non-interactive `mcp-use login --device-code`. * refactor(cli): rename managed deploy option to no-github Updated the CLI command from `--managed` to `--no-github` for deploying local sources without connecting to GitHub. This change clarifies the functionality and aligns with the new documentation. The deployment process remains unchanged, allowing users to upload their project source directly to the platform-managed organization. Additionally, updated related documentation to reflect this change. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): stop inspector widget status label blocking iframe i… (#1694) * feat(greeting-card): migrate greeting-card resource to React widget tool (#1659) * feat(greeting-card): migrate greeting-card resource to React widget tool (#1658) * chore(changeset): add changeset for greeting-card widget migration * fix(widget): disable prefersBorder for greeting-card to prevent double border and remove old changeset * fix(typescript): stop inspector widget status label blocking iframe interactions * chore(inspector): add changeset and pointer-events-none on Apps SDK label Add a patch changeset for @mcp-use/inspector and apply pointer-events-none to the OpenAIComponentRenderer status label for parity with MCPAppsRenderer. --------- Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: iframe collapse when widget renders null (#1693) Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> * chore(typescript): version packages (canary) * chore: update changelogs for v8.0.1 and v1.30.1 releases - Added details for v8.0.1, addressing the widget status label pointer-events issue in the inspector. - Documented v1.30.1 enhancements, including no-GitHub deployment and device-code login features, along with fixes for iframe interactions and zero-height collapse in the McpUseProvider. * feat(mcp): enhance error handling for MCP client readiness (#1528) * feat(mcp): enhance error handling for MCP client readiness - Introduced `formatMcpNotReadyReason` function to provide clearer error messages when MCP operations are attempted before the client is ready. - Updated error messages in `useMcp` to utilize the new formatting function, improving clarity on client state and connection status. * fix(mcp): refine disconnect logic to prevent race conditions - Updated `disconnect()` to only nullify `clientRef` when it points to the closing client and the connect epoch remains unchanged. This adjustment addresses scenarios where `connect()` reuses the same `BrowserMCPClient` instance for a new URL, enhancing error handling for MCP operations. - Introduced a `connectEpochRef` to track connection attempts and ensure proper client state management during disconnects. * fix(react,client): enhance disconnect logic to prevent session wipe on reconnect - Updated `disconnect()` to only nullify `clientRef` when it points to the closing client and the connect epoch remains unchanged, addressing race conditions during reconnections. - Modified `BaseMCPClient.closeSession()` to conditionally delete sessions, ensuring that a new session created during a disconnect does not get wiped, which improves error handling for MCP operations. * fix(react,client): guard disconnect state reset; test closeSession slot guard Address review follow-ups on the disconnect/reconnect race fix: - disconnect() now skips the state reset (setState("discovering") + list clearing) when superseded by a newer connect(), so a manual disconnect() racing a reconnect can no longer clobber the live connection's state. - Add a direct unit test for BaseMCPClient.closeSession's slot-equality guard (parallel createSession survives, normal delete still happens, delete still runs when disconnect() throws). * chore(typescript): version packages (canary) * chore: update changelog for v1.30.1 and enhance MCP client error handling - Documented patch release v1.30.1, including fixes for `McpUseProvider` zero-height collapse, `useMcp` disconnect/reconnect race conditions, and clearer error messages for client readiness. - Improved `useMcp` disconnect logic to prevent stale state issues during reconnections. - Minor formatting adjustment in `MCPAppsRenderer` for cleaner code. --------- Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: sonikagutha <gsonikachowdary@gmail.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Parship Chowdhury <parshipchowdhury@gmail.com> |
||
|
Andrew Khadder
|
25ae46eb6a |
Canary (#1657)
* Add MCP server instructions to TypeScript docs and templates (#1601) * Add MCP server instructions to TypeScript docs and templates * Address MCP instructions review feedback * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Potential fix for code scanning alert no. 78: Incomplete string escaping or encoding (#1661) * Potential fix for code scanning alert no. 78: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * fix(inspector): enhance user experience with copy button for messages Added a copy button to user messages in the inspector, improving usability by allowing users to easily copy message content. This change addresses user feedback for better interaction within the chat interface. Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(mcp-use): bump hono to 4.12.23 for CVE-2026-47674 (#1663) Address Dependabot alert #222 by upgrading the direct hono dependency and raising the pnpm override floor to the patched release. * chore(typescript): version packages (canary) * Handle paginated cloud lists (#1619) * chore(typescript): version packages (canary) * Add OpenAPI-based server generation to the TypeScript SDK (#1583) * Add OpenAPI constructor to MCPServer * Add OpenAPI server example * Simplify OpenAPI example run instructions * Format OpenAPI server generation files * Use live weather.gov OpenAPI spec in example * Clarify weather.gov example path selection * Document OpenAPI server generation * Fix OpenAPI docs example and sidebar placement * Add OpenAPI server tool generation * chore(typescript): version packages (canary) * Fix idle cleanup of session refs (#1624) Co-authored-by: Deepak kudi <deepakkudi23@adsl-172-10-9-116.dsl.sndg02.sbcglobal.net> * chore(typescript): version packages (canary) * fix(cli): check repo access across all GitHub installations (#1629) * fix(cli): check repo access across all GitHub installations getGitHubRepos() only fetched repos from the first installation linked to the organization, so deploys of repos owned by any other installation failed the access check with "GitHub App doesn't have access" even when the app had all-repositories access. Aggregate repos across every installation instead, tolerating per-installation fetch errors. Fixes MCP-2358 * chore(changeset): add changeset for cli repo access fix * chore(typescript): version packages (canary) * docs: add v1.30.0 and inspector v8.0.0 changelog entries Document the canary release wave covering OpenAPI server generation, MCP instructions, session cleanup, and CLI fixes. Co-authored-by: Cursor <cursoragent@cursor.com> * test(agent): skip MCPAgent Quick Start when OPENAI_API_KEY is unset Conditionally skip the docs example test in fork PR CI where secrets are unavailable, with Prettier-correct indentation for describe.skipIf. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(openapi): prevent ReDoS in slugifyToolName regex Split the ambiguous leading/trailing underscore trim pattern and cap input length before regex processing to satisfy CodeQL js/polynomial-redos. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(openapi): remove polynomial regex in slugifyToolName Replace the end-anchored `_+$` trim (and `^_+`) with single-character `_$`/`^_` trims. Because underscore runs are already collapsed to a single `_` by the preceding replace, the edge trims never need a quantifier, eliminating the O(n^2) backtracking that CodeQL flagged as js/polynomial-redos. Drop the now-unnecessary length cap. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(openapi): remove explanatory comment in slugifyToolName Co-authored-by: Cursor <cursoragent@cursor.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Rohith Matam <81304757+Rohithmatham12@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Puneet Dixit <puneetdixit4321@gmail.com> Co-authored-by: Deepak kudi <deepakkudi23@adsl-172-10-9-116.dsl.sndg02.sbcglobal.net> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
feb8f09b6e |
Canary (#1616)
* chore(deps): bump hono from 4.12.12 to 4.12.18 in /libraries/typescript/packages/mcp-use (#1615) * chore(deps): bump hono in /libraries/typescript/packages/mcp-use Bumps [hono](https://github.com/honojs/hono) from 4.12.12 to 4.12.18. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.12...v4.12.18) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix: require bearer auth on /sse MCP transport (#1628) The MCP JSON-RPC handler is mounted on both /mcp and /sse, but the OAuth bearer-auth middleware was only applied to /mcp/*, leaving /sse reachable without a token on OAuth-protected servers. Apply the middleware to /sse and /sse/* as well, and advertise RFC 9728 path-scoped protected-resource metadata for /sse. Adds a regression test exercising setupOAuthForServer. * chore: update dependencies in TypeScript libraries (#1626) - Bump versions of `react-router`, `react-router-dom`, and `qs` in package.json and pnpm-lock.yaml. - Update `hono`, `dompurify`, and `axios` to their latest versions. - Add new dependencies: `protobufjs`, `@protobufjs/utf8`, `vitest`, `ws`, `uuid`, `fast-uri`, `ip-address`, `postcss`, `langsmith`, `follow-redirects`, and `better-auth` to package.json. - Update `@vitest/coverage-v8` to version ~4.1.0 in mcp-use package.json. * chore(typescript): version packages (canary) * chore(deps-dev): bump oauth2-mock-server in /libraries/typescript (#1650) Bumps [oauth2-mock-server](https://github.com/axa-group/oauth2-mock-server) from 8.2.1 to 8.2.2. - [Release notes](https://github.com/axa-group/oauth2-mock-server/releases) - [Changelog](https://github.com/axa-group/oauth2-mock-server/blob/master/CHANGELOG.md) - [Commits](https://github.com/axa-group/oauth2-mock-server/compare/v8.2.1...v8.2.2) --- updated-dependencies: - dependency-name: oauth2-mock-server dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump eslint-import-resolver-typescript (#1643) Bumps [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript) from 4.4.4 to 4.4.5. - [Release notes](https://github.com/import-js/eslint-import-resolver-typescript/releases) - [Changelog](https://github.com/import-js/eslint-import-resolver-typescript/blob/master/CHANGELOG.md) - [Commits](https://github.com/import-js/eslint-import-resolver-typescript/compare/v4.4.4...v4.4.5) --- updated-dependencies: - dependency-name: eslint-import-resolver-typescript dependency-version: 4.4.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump vitest from 4.0.18 to 4.1.0 in /libraries/typescript (#1600) * chore(deps-dev): bump vitest in /libraries/typescript Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.0.18 to 4.1.0. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * docs: add v1.29.1 and v7.0.1 changelog entries Document the OAuth /sse bearer-auth fix and workspace security dependency bumps on the docs site ahead of the canary release wave. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: update changelog --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
83271e869f |
Canary (#1508)
* chore: remove unused mcp-use source files (#1476) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs(cli): clarify inspector skipped-in-production log + start section (#1505) * docs(cli): clarify inspector skipped-in-production log + start section The runtime log "[INSPECTOR] Skipped in production (use --with-inspector flag during build)" reads as if the flag can be passed to `mcp-use start`, which it can't (the flag is only registered under `build`). The new wording spells out the rebuild command, and `cli-reference.mdx` gains a short note under `start` pointing at the build flag for inspector-in-production. Closes #1495 * docs(cli): apply reviewer reword on inspector note * chore(typescript): version packages (canary) * chore(inspector): remove unused source files (#1510) Drops the 18 inspector files reported by `pnpm knip` from libraries/typescript and stops generating the unused client-side version.ts (the client reads the version from the window.__INSPECTOR_VERSION__ global injected by the server). Part of #1446. * chore(typescript): version packages (canary) * chore(typescript): prune 187 unused exports and 161 unused export types flagged by knip (#1511) * chore(typescript): prune 161 unused exported types flagged by knip Phase 2 of #1450: remove or de-export types that knip flags as unused. Skipped tuning knip.json (Phase 1) — focused only on the type cleanup. For each flagged type: - Used only within its source file → drop `export` - Re-exported through a barrel but never imported downstream → remove the re-export - Genuinely dead → delete No public-API removals: types exposed through the `mcp-use`, `@mcp-use/cli`, `@mcp-use/inspector`, or `create-mcp-use-app` package entry points remain exported. `client.ts` switches from inline `import("...")` to a top-level import so knip can see the `ToolSearchResponse` usage. Verified `pnpm knip` reports 0 unused types (down from 161) and `pnpm build` passes across all packages. * chore(typescript): prune 187 unused exports flagged by knip Closes #1450. * chore(typescript): fix prettier formatting * chore(typescript): delete orphaned PropsSelect.tsx Removing the unused barrel re-export in the prior commit left this file with no consumers. * chore(typescript): version packages (canary) * ci(knip): enforce knip and clear final baseline findings (#1512) * chore(knip): clear remaining baseline findings so knip passes clean - Mark `src/index.tsx` as an entry for create-mcp-use-app so its CLI dependencies (chalk, commander, ink, ora, tar, react, etc.) stop being flagged as unused. - Add `lsof`, `sleep`, and `dev` to ignoreBinaries for the mcp-use workspace — these appear in example scripts and are either system utilities or pnpm script names, not npm-resolvable binaries. - Turn off the `optionalPeerDependencies` rule. Optional peer deps (langchain/langfuse/e2b/etc.) are loaded conditionally by design; flagging them as referenced is noise. After this change `pnpm exec knip` exits 0 against canary. * ci(knip): enforce knip in CI The baseline is now clean (canary + previous PRs cleared all findings), so drop `--no-exit-code` and let the job fail when knip reports issues. Also generate `packages/mcp-use/src/version.ts` before knip runs so the gitignored `version.js` imports resolve. * chore(deps): bump better-auth in /libraries/typescript (#1515) Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.1 to 1.6.11. - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.6.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: tighten PR readiness and docs hygiene (#1509) * docs: tighten review readiness and doc links * docs: anchor api-reference redirect and fix missed node note Move the /typescript/server/api-reference target from a bare redirect to an anchored one (#mcpserver-api-reference) so existing "API Reference" links land on the renamed section directly. Drop the self-link in server/index.mdx and bring the commonjs example's Node note in line with the package engines range. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * feat(server/oauth): allow Supabase URL override for self-hosted/local instances (#1517) * feat(server/oauth): allow overriding Supabase URL for self-hosted/local instances `oauthSupabaseProvider` previously hardcoded `https://${projectId}.supabase.co`, preventing use against local Supabase (`http://localhost:54321`) or self-hosted deployments — even though those instances expose the same OAuth 2.1 server. Add an optional `supabaseUrl` config (and `MCP_USE_OAUTH_SUPABASE_URL` env var) that overrides the projectId-derived URL. `projectId` is now optional when `supabaseUrl` is set; hosted-project users are unaffected. Closes mcp-use/mcp-oauth-supabase-template#2 * test(server/oauth): trim supabase provider tests to factory contract Drop low-value string-concatenation and pre-existing-behavior tests; keep the two that cover the new behavior (supabaseUrl alone is accepted; empty config throws). Isolate process.env in the factory describe so the "throws when neither configured" assertion isn't defeated by local MCP_USE_OAUTH_SUPABASE_* env vars. * docs(server/oauth): document supabaseUrl override for local/self-hosted Supabase * chore(typescript): version packages (canary) * chore: use cross-platform clean commands (#1523) * chore: use cross-platform clean commands * chore: add empty changeset for cross-platform clean scripts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy (#1483) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy The DCR-direct metadata proxy was string-concatenating a path onto the issuer, which canonically ends with a trailing slash: `${issuer}/.well-known/oauth-authorization-server` // → "https://tenant.auth0.com//.well-known/oauth-authorization-server" Auth0 returns 404 for any path starting with "//", which broke OAuth discovery end-to-end against real Auth0 tenants in DCR-direct mode. new URL(path, base) normalizes the join regardless of trailing slash, so this works for any provider whose canonical issuer ends with "/". Fixes #1482. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(server/oauth): normalize issuer trailing slash instead of using URL constructor `new URL("/.well-known/...", issuer)` resolves the leading-slash path against the issuer's origin, stripping any path on the issuer. That breaks providers like Supabase whose issuer is `https://<project>.supabase.co/auth/v1`. Replace with a trailing-slash-stripping template literal, which handles both Auth0 (issuer ends with `/`) and Supabase (issuer has a path). * chore(changeset): trim oauth metadata fix entry * chore(changeset): drop issue reference --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * test(inspector): add OAuth e2e against emulated Google issuer (#1481) * test(inspector): add OAuth e2e test using emulated Google issuer Covers the inspector's OAuth redirect flow end-to-end against an `emulate`-backed Google issuer + MCP server in oauthProxy mode, run twice across the Direct and Via Proxy connection-type matrix. Both variants share one fixture in serial mode since the registered redirect URI pins the MCP server to a fixed port. * test(inspector): switch loop to factory to satisfy no-loop-func The for-loop variant captured the mutable `fixture` binding from beforeAll, which eslint's no-loop-func flags. Hoisting the body into a small factory keeps the shared fixture without the closure-over-loop pattern. * test(inspector): close emulator if MCPServer setup fails Wrap post-createEmulator work in try/catch so the emulator port doesn't stay bound when MCPServer construction or listen() throws. * chore(typescript): version packages (canary) * fix(inspector): surface MCP server auth failures with reconnect banner (#1485) * fix(inspector): surface MCP server auth failures with reconnect banner (MCP-2111) When the hosted inspector's chat backend returns 401 because the upstream MCP server rejected the user's OAuth token (e.g. Linear token expired), the inspector previously threw a generic `HTTP error! status: 401` and the cloud response misleadingly pointed users at the Manufact account login. The chat now recognises the cloud's `{ error: "mcp_auth_required", mcpServerUrl }` response and renders an inline banner above the input ("Reconnect to <server>") with a button that calls `connection.authenticate()`. Reconnect refreshes the OAuth token in localStorage; the banner clears on success and chat resumes. Pairs with a cloud-side change that drops the misleading `loginUrl` field from the 401 response. * fix(inspector): harden mcp_auth_required handling - Drop the no-op setMessages filter in the 401 branch; the optimistic assistant message is only added after the response check, so there's nothing to remove. - Guard `new URL(serverUrl)` in McpReconnectBanner so a malformed URL falls back to the raw string instead of crashing the chat tab. * refactor(inspector): rename mcpAuthRequired to mcpServerAuthRequired The hook's internal state was already named `mcpServerAuthRequired`, but the returned key and clear callback used the shorter `mcpAuthRequired`, forcing the ChatTab consumer to re-alias them. The shorter name was also ambiguous in a codebase that has two distinct auth flows: the Manufact account login (429 path) and the upstream MCP server OAuth (401 path). Align the public surface of `useChatMessages` with the internal state and the consumer's local name. The backend wire value `"mcp_auth_required"` is unchanged. * chore(inspector): remove mcpServerAuthRequired comment * chore(typescript): version packages (canary) * fix(inspector): keep tab count badges visible in collapsed mode (#1490) * fix(inspector): keep tab count badges visible in collapsed mode * Keep tab badges aligned in collapsed mode * extract TabCountBadge and fix badge visibility * chore(typescript): version packages (canary) * fix(inspector): drop unused TabCountBadge barrel re-export (#1533) The only consumer (LayoutHeader.tsx) imports TabCountBadge directly from ./shared/TabCountBadge, so the re-export in shared/index.ts is unused. Knip flagged it and started failing CI on canary after the TabCountBadge change landed. * chore(typescript): version packages (canary) * feat(inspector): add local LLM provider support for chat in Inspector (#1395) * feat(inspector): integrate ollama provider * feat(inspector): integrate lmstudio provider * fix(inspector): preserve no-icon behavior for openai-compatible provider * refactor(inspector): remove LM Studio provider and address PR feedback * fix(inspector): remove duplicate ollama union members Collapses the accidental `"ollama" | "ollama"` duplicates in ProviderName, MCPChatMessageEventData, and LLMConfig. * refactor(inspector): drop LLM proxy and call Ollama directly Ollama allows localhost origins by default, so the inspector talks to the daemon over CORS and skips the server-side proxy entirely. Surface an OLLAMA_ORIGINS hint when the browser fetch fails so tunneled or remote setups know what to configure. Theme the Ollama logo and tighten its size so the non-circular mark sits cleanly next to the other provider icons. * chore(inspector): revert gratuitous field reorders Restore original ordering of temperature/baseUrl and useCallback deps; remove stray blank line in vite.config.ts to keep the diff focused. * test(inspector): add unit tests for parseNDJSON * refactor(inspector): tighten Ollama provider integration - Guard Ollama streamChat against duplicate tool-call emissions when a chunk's tool_calls are repeated by proxies/forks - Key the models cache on (provider, baseUrl) for any base-url provider so openai-compatible no longer serves stale entries on URL changes; normalize Ollama variants (trailing slash, /api suffix) to one entry - Move OllamaCorsError into the Ollama provider module - Replace hand-written provider unions in telemetry events and server shared-utils with ProviderName - Single-source DEFAULT_OLLAMA_BASE_URL from ollama/utils.ts - Drop the unrelated tempApiKey/tempModel trim() drift in saveLLMConfig - Make OPENROUTER_ICON_URL module-private, clean up merge-artifact blank lines * chore: simplify changeset * style(inspector): apply prettier to shared-utils * fix(inspector): drop unused export on DEFAULT_BASE_URLS DEFAULT_BASE_URLS is only consumed by getDefaultBaseUrl in the same module. Knip flagged the export as unused and failed CI. * ci: retrigger after canary knip fix (#1533) --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): resolve CodeQL polynomial-regex alert in Ollama url normalizer (#1534) * fix(inspector): replace trailing-slash regex in Ollama url normalizer CodeQL flagged `/\/+$/` in `normalizeOllamaBaseUrl` as a polynomial regular expression on uncontrolled input. Swap the regex for an explicit linear scan and add unit tests covering the trimming behaviour plus a pathological-input case. * chore: drop unit test for trivial regex refactor * chore: drop accidentally committed .antigravitycli symlink * chore(typescript): version packages (canary) * chore: remove dead typescript-format-and-lint pre-commit hook (#1541) The hook entry pointed to `.git/hooks/typescript-pre-commit.sh`, a path that is never tracked and was never populated by any setup step, so the hook could not run for anyone. TypeScript formatting and linting are already handled by Husky (libraries/typescript/.husky/pre-commit), installed automatically via `pnpm install`'s `prepare` script. Closes #1536 * fix(inspector): stop ToolInputForm from mutating live tool inputSchema (#1545) * fix(inspector): stop ToolInputForm from mutating live tool inputSchema `ToolInputForm` was writing `required: boolean` onto each property of the live tool inputSchema during render. `required` is not valid as a per- property boolean — it belongs on the parent object as a `string[]`. Anthropic's draft 2020-12 validator rejected the resulting payload with `tools.0.custom.input_schema invalid`, breaking the Inspector chat after any tool had been opened in the Tools tab. Replace the mutation with a local `isRequired` const used only for the `*` indicator render. Fixes MCP-1970. * chore(inspector): trim comment on schema-mutation fix * chore: remove verbose comment * style(inspector): apply prettier to ToolInputForm * chore(typescript): version packages (canary) * Improve tab switch animation timing (#1544) * chore(ui): improve tab switch animation timing * chore(changeset): add changeset for tab animation improvement * chore(typescript): version packages (canary) * fix(inspector): propagate server alias updates through mcp server wrapper (#1539) * fix(inspector): propagate server alias updates through McpServerWrapper onUpdate * chore: add changeset for mcp-use server alias propagation fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * chore(typescript): add 3-day install cooldown via pnpm minimumReleaseAge (#1516) Blocks `pnpm install` from fetching npm versions published less than 3 days ago, mitigating supply-chain attacks where a malicious release is typically yanked within hours of discovery. The setting (introduced in pnpm 10.16) lives in pnpm-workspace.yaml — in modern pnpm only auth/registry config is read from .npmrc, so putting it there would be silently ignored. Workspace-published names (`mcp-use`, `@mcp-use/*`, `create-mcp-use-app`) are exempted so the cooldown never interferes with local development or fresh releases of our own packages. * fix(react): improve server management in McpClientProvider (#1561) Refactor server removal and update logic to use a ref for synchronous access to the latest server state. This change prevents React's warning about updating a component during rendering by ensuring that teardown side effects (`disconnect()` and `clearStorage()`) are executed outside of the state updater functions. The ref is updated in a useEffect hook to maintain the latest server state for event handlers. * chore(typescript): version packages (canary) * fix(inspector): forward MCP image tool results as image content (#1487) * fix(inspector): forward MCP image tool results as image content (MCP-1941) Previously, the inspector's chat loop and provider adapters serialized MCP tool results with JSON.stringify, which buried the base64 `data` field of `image` content blocks inside a text payload. Vision-capable models received a wall of base64 text instead of the image. Extract MCP `content` blocks into provider-neutral `ContentPart[]` and route image bytes through each provider's vision channel: - Anthropic: image blocks inside `tool_result.content` (base64 source). - OpenAI: tool role keeps text; image bytes forwarded as a follow-up user turn with `image_url` parts. - Google: `functionResponse.response` keeps text/metadata; image bytes forwarded as a follow-up user turn with `inlineData` parts. Text-only tool results keep the legacy `content: string` path on every provider. * style(inspector): apply prettier formatting * chore(inspector): drop unused export on collapseToString Only called internally by toolResultToContent — knip flagged it as an unused export. * fix(inspector): propagate MCP isError flag and fix image example tools - Add isToolResultError() helper and use it in toolLoop + replay so tool calls that return { isError: true } are flagged the same as thrown errors on both live and saved-conversation paths. - Pick a no-content fallback for OpenAI's tool role when there are no image parts to forward. - Replace via.placeholder.com URLs in the everything example with real base64-encoded bytes fetched from picsum.photos, since the image() helper expects MCP ImageContent base64 data, not URLs. * style(inspector): apply prettier formatting * chore(typescript): version packages (canary) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL (#1552) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL Browsers cannot resolve 0.0.0.0 as a destination, and the MCP SDK's OAuth resource validator does strict origin equality — so the inspector auto-connecting to http://0.0.0.0:PORT/mcp mismatches the resource metadata published as http://localhost:PORT (which goes through normalizeUrlHost in server-helpers.ts). Result: OAuth-protected mcp-use apps fail at the inspector's post-callback validation with "Protected resource X does not match expected Y". Mirror the existing normalization for the autoConnect URL and the banner log so both reflect the browser-reachable host. Closes #1551 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: add changeset for inspector autoConnect loopback normalization --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): align widget Vite base with /mcp-use/widgets (#1560) * fix(cli): align widget Vite base with /mcp-use/widgets/ when MCP_URL is set * chore: add changeset for cli widget base path fix * chore: format widget-paths.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(cli): headless screenshot with auto-sizing and external MCP server support (#1579) * feat(cli): headless screenshot command with auto-sizing and external MCP server support - Make width/height optional; when omitted, clips to the widget's natural rendered size by reading body[data-view-*] rect attrs set by the preview page - Add useBundleReadinessSignal in ViewPreview that uses ResizeObserver to wait for the iframe to stabilize before setting data-view-ready, serializing the iframe's bounding rect so the CLI can clip tightly instead of capturing the full viewport - Switch ViewPreviewBundle to displayMode="inline" so widgets auto-size to content height - Add inlineWidthOverride prop to MCPAppsRenderer to bypass the 768px inline cap when screenshotting at an explicit width - Fix extractViewName to handle external MCP server URIs (ui://<server>/<name>.html) by flattening to <server>-<name>; previously only ui://widget/ was handled, causing React Router to fail to match the preview route for third-party servers like Excalidraw * chore: add changeset for screenshot auto-sizing and external MCP fix * fix(cli): unexport CaptureScreenshotResult to satisfy knip * chore(typescript): version packages (canary) * feat(auth): enhance OAuth callback handling with improved state management and user feedback (#1580) * feat(auth): enhance OAuth callback handling with improved state management and user feedback - Introduced a module-level cache for in-flight authorization promises to prevent duplicate network requests during the same page load. - Added utility functions to determine if the current window is a popup and to render user-friendly messages for closing the window after authentication. - Improved handling of redirect flows and popup scenarios to ensure a seamless user experience, including error handling and messaging for lost opener situations. * fix(auth): BroadcastChannel fallback when popup opener is severed Popup callback now broadcasts success/failure over a same-origin BroadcastChannel("mcp_auth_callback") in the lost-opener branch, and useMcp subscribes to that channel alongside the existing window.message listener. Without this, popups whose window.opener was severed by COOP or cross-origin intermediate redirects would save tokens but leave the parent stuck in `authenticating`. Matches the dual-transport pattern used by oidc-client-ts and MSAL.js for the same COOP scenario. * chore(auth): unexport MCP_AUTH_BROADCAST_CHANNEL to satisfy knip It's only used inside callback.ts; the parent side hard-codes the same string in useMcp.ts. Removing the export drops knip's "unused export" finding while keeping a single source-of-truth comment that links the two files. * fix(mcp-use): split langchain agents out of mcp-use/browser entry Move MCPAgent, RemoteAgent, adapters, and observability to mcp-use/browser/agent so Next.js clients importing MCPClient only no longer pull @langchain/* into the browser bundle. * chore: format browser bundle test file * chore(typescript): version packages (canary) * fix(inspector): add copy button to user messages (#1556) * fix(inspector): add copy button to user messages Extract CopyButton into a shared component and add it to UserMessage, matching the existing assistant message UX. Resolves #1555 * chore: add inspector copy button changeset --------- Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(server): add publicLandingPage option for OAuth-protected servers (#1550) * feat(server): add publicLandingPage option for OAuth-protected servers * fix(server): keep public landing auth gate in oauth setup * docs(server): add public landing page example * chore(server): format mcp endpoint * chore(server): simplify accept header lookup * chore(server): restore mcp mount diff * fix(server): align oauth exports with canary * chore(server): format oauth exports * fix(server): remove unused oauth barrel exports --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * Move mcp-apps template pnpm settings to workspace config (#1602) * fix(inspector): widget fullscreen above embedded host chrome (MCP-2181) (#1605) * fix(inspector): portal widget fullscreen above host chrome MCP-2181: cloud chat headers at z-50 covered the fullscreen exit control because the overlay used z-40 inside a nested stacking context. Portals the fullscreen shell to document.body at z-[100], sets data-mcp-widget-fullscreen for hosts, and shows the Apps SDK exit navbar in CSS fullscreen fallback. * fix(inspector): native fullscreen first, no portal remount (MCP-2181) Revert conditional createPortal that remounted widgets on fullscreen toggle. Use requestFullscreen() as the primary path; apply CSS z-[100] overlay only when the API fails. Keep exit navbar and data-mcp-widget-fullscreen for both. * refactor(inspector): consolidate widget fullscreen into shared hook Extract useWidgetFullscreenControls for native-first fullscreen + CSS fallback. Removes duplicated handlers, unused helpers, and OpenAI edge-case branches from MCPAppsRenderer and OpenAIComponentRenderer. * fix(inspector): preserve widget state when entering fullscreen (MCP-2181) Route ui/request-display-mode through native fullscreen handling, target requestFullscreen on the iframe wrapper, and avoid resetting load state on display-mode-only changes. Stabilize OpenAI iframe listeners so chat re-renders do not flash the skeleton. * style(inspector): format OpenAIComponentRenderer for Prettier * fix(inspector): fullscreen shell includes navbar and fills viewport Promote the outer widget shell via requestFullscreen so FullscreenNavbar stays visible and bg-background fills the screen instead of browser black letterboxing around a nested iframe wrapper. * fix(inspector): PiP portal and sandbox remount bridge reconnect (MCP-2181) Port PiP to document.body with z-[100]. Re-run AppBridge when the sandbox iframe remounts; keep the host spinner until initCount recovers. Unify display-mode document attributes for optional host chrome hiding. * fix(inspector): resend widget data after PiP remount * chore(typescript): version packages (canary) * Hash Claude resource domains from authored ui.domain (#1599) * Apply Claude resource domain hashing for UI metadata * chore: format Claude domain helper * fix(inspector): drop unused widget-fullscreen exports to satisfy knip (#1607) widget-fullscreen.ts (added in #1605) exported several symbols that nothing outside the file consumes, plus pre-emptive @deprecated aliases for an API that never shipped. Only useWidgetDisplayModeControls is used (by MCPAppsRenderer and OpenAIComponentRenderer). - Unexport internal-only constants, the WidgetDisplayMode type, and the useWidgetDisplayModeDocumentChrome helper - Remove the dead useWidgetFullscreenControls / useWidgetFullscreenDocumentChrome aliases * test(agent): drop live Langfuse API integration tests (#1608) The observability integration tests queried the live Langfuse REST API (via getRecentTraces) to verify traces landed. cloud.langfuse.com has been returning 403 Forbidden for both ingestion and queries, failing the 'should send traces to Langfuse when observability is enabled' test and reddening canary CI. Remove the two tests that depend on the live API (the failing test and the already-skipped manual-trace test) plus the now-unused getRecentTraces helper. Keep the two tests that verify observability enable/disable behavior locally with no network dependency. * chore(typescript): version packages (canary) * fix(oauth): redact token verification errors (#1573) * fix(oauth): redact token verification errors * chore: add oauth error redaction changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): skip emulate oauth tests in builtin e2e (#1609) * chore: add codex to gitignore (#1612) * fix(docs): update server API reference links (#1611) * fix(mcp-use): pin published dependency versions (#1610) * docs(changelog): document v1.29.0 / inspector v7.0.0 release TypeScript changelog gains a v1.29.0 entry (public landing pages, Supabase URL override, Claude UI-resource domain hashing, OAuth callback + React-provider hardening). Inspector changelog gains a major v7.0.0 entry (local Ollama provider, image tool results, MCP-server reconnect banner, widget fullscreen/PiP rework). * Fix builtin inspector auto-connect to use HTTP (#1613) * Switch builtin inspector auto-connect to HTTP * Use plain URL autoConnect in builtin e2e helper * Fix built-in inspector auto-connect to use HTTP * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: asim48-ctrl <asim48@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Truffle <truffleagent@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SSharma1103 <shivamsharma11032009@gmail.com> Co-authored-by: Polæ <steven@polae.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Udaykumar Dhokia <udaykumardhokia@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Jefsky Wong <hwj3344@hotmail.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Ritwij Aryan Parmar <88580521+RitwijParmar@users.noreply.github.com> |
||
|
Pietro Zullo
|
8348c59a53 |
docs: reorganize, fix accuracy, and update for agent readability (#1502)
* docs: reorganize navigation and clean up content - Remove 'Misc' group with misplaced blog posts - Remove 'Libraries' redirect group from Home nav - Simplify 'Dev Tools' group (flatten Inspector, CLI, Tunneling) - Remove individual changelog versions from Python nav (keep summary) - Remove changelog from TypeScript 'Get Started' group - Remove tunneling duplicate from Python Development group - Rewrite mcp101 as clean MCP concepts page (was pitch deck) - Delete typescript/blog posts (not technical docs) - Add redirects for deleted blog post URLs * docs: fix content accuracy and remove sloppy language - Fix broken python/server/mcp-apps link in home page - Remove informal pitch-speak from python/server/index.mdx - Fix grammar error in typescript/server/index.mdx - Update typescript/client/logging.mdx: remove fake 'coming soon' API code - Fix non-existent model name gpt-5.1 in typescript quickstart - Fix mcp_use naming in development contributing guide * docs: fix incorrect TypeScript server API calls in inspector docs - Replace server.addTool() with server.tool() (correct mcp-use API) - Add missing zod import to debugging-chatgpt-apps example * docs: fix fake model names (gpt-5.1 → gpt-4o) in agent docs * docs: update model names, fix APIs, and add agent visibility hints - Replace all deprecated model names with latest: gpt-4.1, gpt-4.1-mini, claude-sonnet-4-6, claude-opus-4-7, gemini-2.5-flash across all docs - Fix TypeScript server.tool() API in installation.mdx (old positional string form) - Fix TypeScript agent.run() in quickstart.mdx (deprecated string form → object) - Remove broken manufact.com/docs/llms.txt hidden hints from 5 pages - Add <Visibility for="agents"> block to mcp101.mdx with install commands, key classes, and API signatures for agent-oriented navigation - Add LangChain provider install note to Python quickstart (mcp-use agent requires a separate langchain-* provider package) - Update model name cards in Python llm-integration.mdx * docs: clean up remaining stale model names and improve accuracy - Update supported model lists in Python and TypeScript llm-integration pages - Fix cost optimization table to use current model IDs - Update TypeScript agent overview supported providers list * docs: add LangChain provider install to TypeScript quickstart agent section The MCPAgent requires a separate @langchain/* provider package; this was not mentioned before the code example that imports from @langchain/openai. * docs: update to latest flagship model IDs (May 2026) - OpenAI: gpt-4.1 → gpt-5.5, gpt-4.1-mini → gpt-5.5-mini - Google: gemini-2.5-flash → gemini-3.1-flash, gemini-2.5-pro → gemini-3.1-pro - Groq: llama-3.1-* → llama-4-scout-17b-16e-instruct - Anthropic (claude-opus-4-7, claude-sonnet-4-6) already current, no change * docs: replace all em dashes with hyphens * docs: restore llms.txt hints using Visibility component * docs: simplify TypeScript logging page to unsupported notice only * docs: rewrite mcp101 to explain MCP protocol with mcp-use examples and doc links * docs: remove goal.md * docs: revert nav changes, keep only Misc group removal and blog redirects * docs: reorder mcp101 to Server/App -> Client/Inspector -> Agent, restore title * docs: add code examples for Resources and Prompts in mcp101 * docs: remove em dashes from mcp101 * docs: add MCPClient code examples to mcp101 * docs: add React client example to mcp101 * docs: add agent code examples to mcp101 * docs: expand MCP Apps section in mcp101 with example and links * docs: restore Contacts, Socials, and Founders sections to mcp101 * docs: add context-setting intro paragraph to mcp101 for new readers * docs: add MCP stores section to mcp101 intro with Claude, ChatGPT, Cursor * docs: fix Claude store link * docs: fix ChatGPT store link * docs: fix Cursor store link * docs: replace store Cards with linked image grid * docs: add captions to store images * docs: add Notifications to client primitives table in mcp101 * docs: add lead-in paragraph before resource cards at bottom of mcp101 * docs: move resource cards to end of page after Contacts/Socials/Founders * docs: demote Contacts/Socials/Founders to bold text to remove from TOC * docs: move Contacts/Socials/Founders to very end of mcp101 * docs: add Resources and Contacts section headers, link official MCP docs * chore(docs): update site metadata, footer links, and rename mcp_use to mcp-use * update docs metadata + images * docs: enhance MCP section by highlighting the reach of MCP stores with 1 billion weekly active users * api ref |
||
|
Andrew Khadder
|
46caf8059b |
Canary (#1473)
* chore(deps): bump next from 15.5.15 to 15.5.18 in /libraries/typescript (#1472)
* chore(deps): bump next from 15.5.15 to 15.5.18 in /libraries/typescript
Bumps [next](https://github.com/vercel/next.js) from 15.5.15 to 15.5.18.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/compare/v15.5.15...v15.5.18)
---
updated-dependencies:
- dependency-name: next
dependency-version: 15.5.18
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore(typescript): drop unused dependencies and dev dependencies (#14… (#1458)
* chore(typescript): drop unused dependencies and dev dependencies (#1447).
* docs(typescript): align CLAUDE.md pre-commit notes with husky hook
lint-staged was removed in this PR; the actual .husky/pre-commit
script runs `pnpm format` and `pnpm lint:fix` directly plus a
changeset presence check.
* chore(typescript): version packages (canary)
* docs(typescript): make response helpers discoverable in tool() and blank template (#1474)
* docs(typescript): make response helpers discoverable in tool() and blank template
MCPServer.tool() JSDoc examples called text()/error() with no import line,
so the hover doc gave no breadcrumb to mcp-use/server. The blank scaffold
template had the same gap — helpers appeared only inside commented-out
example blocks.
- Add import statements + a leading note to each @example block on tool()
- Replace the commented fetch-weather placeholder in the blank template
with a real, working echo tool that imports text from mcp-use/server
* docs(typescript): keep blank template empty, surface helper imports inside the commented examples
Revert the real echo tool — blank should stay actually blank. Instead, the
commented-out tool/resource/prompt blocks now contain their own `import` lines
for `text` / `object` / `z`, so an agent reading the file sees the complete
pattern (including where the helpers come from) without anything actually
being registered.
* chore(typescript): version packages (canary)
* chore(mcp-use): declare jsdom and @vitest/coverage-v8 as explicit devDependencies (#1454)
* feat(deps): add jsdom and vitest coverage dependencies
* chore(deps): pin @vitest/coverage-v8 to ~4.0.18
Aligns coverage-v8 with the installed vitest 4.0.18 to satisfy its exact
peer-dep constraint; previous ^4.0.17 let pnpm resolve 4.1.6 which peers
on vitest 4.1.6 and produced a lockfile mismatch.
* chore(changeset): add changeset for unlisted devDep declarations
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* refactor(auth): extract OAuthSessionStore from BrowserOAuthClientProvider (#1451)
* refactor(auth): extract OAuthSessionStore from BrowserOAuthClientProvider
Pulls token storage, JWT-expiry-driven refresh (with deduplication),
client-info validation, code-verifier handling, key hashing, and
authorization-state persistence into a new platform-neutral
`OAuthSessionStore` parameterized over a `KVStore`. The browser
provider now holds an `OAuthSessionStore` and delegates the SDK
`OAuthClientProvider` interface methods to it.
Browser-only concerns stay on `BrowserOAuthClientProvider`:
- popup/redirect flow + popup-blocker fallback
- fetch interceptor for OAuth-proxy CORS bypass
- inspector-proxy resource-param rewrite (now `rewriteResourceIfLocalProxy`)
- `clearStorage` / `getLastAttemptedAuthUrl` (kept on the provider until
a Node provider gives the abstraction a real second caller)
No behavior change. Prepares the ground for a future Node/CLI OAuth
provider built on the same session store.
* refactor(auth): simplify OAuthSessionStore — drop pendingCodeVerifier mirror, parallelize KV ops
- Remove `pendingCodeVerifier` in-memory mirror; read through KV store directly
- Parallelize independent KV writes/removes with `Promise.all` in `saveTokens`,
`invalidateCredentials("all")`, `clientInformation` redirect-mismatch path,
and `storeAuthorizationState` — preparing for the upcoming async file store
- Drop redundant `sanitizeUrl` in `redirectUrl` getter (constructor already sanitizes)
- Remove debug `console.log` and write-then-verify read in `storeAuthorizationState`
* chore: format
* chore: format
* refactor(auth): sequence KV writes in OAuthSessionStore
Replace Promise.all blocks with sequential awaits in saveTokens,
clientInformation mismatch invalidation, invalidateCredentials("all"),
and storeAuthorizationState. No behavior change for the browser path
(sync localStorage), but ordering now matters for the upcoming async
file-backed KVStore — saveTokens persists tokens before clearing the
verifier / last_auth_url so a failed write can't strand the auth flow,
and storeAuthorizationState persists the state record before
last_auth_url so a partial failure can't leave an auth URL whose state
has no backing record.
* chore(typescript): version packages (canary)
* feat(cli/auth): Node OAuth provider + agent-ready CLI client (#1452)
* feat(cli/auth): Node OAuth provider + agent-ready CLI client
Adds a real OAuth flow to the `mcp-use client` CLI so it works against
OAuth-protected MCP servers without requiring a browser harness, and
makes every one-shot client subcommand exit cleanly so headless agents
can drive it.
mcp-use:
- New `mcp-use/auth/node` entrypoint exporting `NodeOAuthClientProvider`,
`FileKVStore`, the `KVStore` type, and re-exporting the SDK's `auth`
and `UnauthorizedError`.
- `NodeOAuthClientProvider` implements `OAuthClientProvider`, owns a
loopback callback server (preferred port 33418, walks up to 33427 on
conflict, persisted across runs), and exposes `getAuthorizationCode()`
for the orchestrator pattern in `useMcp.ts`. Adds `hasPendingFlow` so
callers can detect when the SDK transport already triggered the
redirect on a 401 and skip straight to the code exchange.
- `FileKVStore` writes tokens / client info / code verifiers to one file
per key under `~/.mcp-use/oauth/<urlHash>/` with `0o600` perms and
atomic rename on write.
@mcp-use/cli:
- `client connect <url>` auto-runs OAuth on `UnauthorizedError` when no
`--auth` is supplied. New flags: `--no-oauth`, `--auth-timeout`.
`isUnauthorized` also matches the rewrapped 401 the HttpConnector
throws (plain Error with `code = 401`) so the OAuth retry actually
triggers instead of `process.exit(1)`-ing before the browser callback
arrives.
- `client auth status|refresh|logout [session]` for token introspection,
forced refresh, and revocation.
- One-shot subcommands (`tools list/call/describe`, `resources
list/read`, `prompts list/get`, `auth *`) now close their in-memory
sessions and exit at the end so the underlying socket can't keep the
Node event loop alive. Long-running commands (`subscribe`,
`interactive`) are unchanged.
- Follow-up commands on OAuth sessions transparently refresh expiring
JWTs. If the refresh token itself is dead, the CLI prompts to re-auth
on TTY or prints the exact `connect` command on non-TTY.
* chore: fix http disconnect race condition
* chore(server): hint at mcp-use CLI client on startup
Print a one-line dim-gray tip after the existing Listening / Endpoints
lines so devs see how to connect with `mcp-use client connect <url>`
from the CLI client added in this branch.
* fix(cli): exit 1 when `client tools call` returns isError
The CLI printed "Tool execution failed" but still exited 0, so headless
agents couldn't tell a successful tool call apart from a failed one.
Honor `callResult.isError` and exit 1 in both default and --json modes;
the formatted output is still printed first so the failure detail stays
visible.
* feat(cli): borderless aligned-columns table rendering
Replace the box-drawing ASCII table in `mcp-use client {tools,resources,
prompts,sessions} list` with a gh/kubectl-style borderless layout: UPPERCASE
bold headers, two-space gutter, ANSI-stripped width math, ellipsis truncation
for long descriptions, sized to the terminal width (or 100 cols).
Tool rows now also show a MODE column (read-only / write / destructive,
derived from MCP tool annotations) and an ARGS column (required/total).
When stdout is not a TTY (pipes, agents, CI), every list command emits
tab-separated values with no header, no decorative banners, and no ANSI —
matching how the GitHub CLI behaves so the output is parseable by AI
agents and shell pipelines.
* fix(cli): skip auto-opening browser for OAuth in non-TTY contexts
When `mcp-use client connect` (or a session restore) hits an OAuth flow,
the CLI used to launch a browser unconditionally. That's surprising when
an agent or CI script runs the command — the agent can't see the
browser, and the user gets an unexpected window.
`stdout.isTTY` now gates the browser launch: TTY opens it as before;
non-TTY prints the authorization URL to stderr and waits on the loopback
callback. The leading message also flips to "OAuth authentication
required." in non-TTY mode so the log doesn't claim a browser was opened.
* fix(auth): real forceRefresh + HTML-escape OAuth loopback failure page
- `OAuthSessionStore.forceRefresh()` calls the dedup'd refresh path
directly. `NodeOAuthClientProvider.forceRefresh()` now delegates to
it. The previous "blank access_token and re-read" trick never
triggered a refresh because `tokens()` gates that path on a truthy
access_token, so `mcp-use client auth refresh` was a no-op.
- Escape both `error` and `error_description` in the loopback failure
HTML. The previous version stripped `<>&` from the description but
interpolated `error` unsanitized, allowing reflected XSS on the
localhost callback page.
* feat(cli): accept key=value args for `client tools call` and `client prompts get`
Replace the single JSON-string argument with variadic `key=value` positionals.
Values are type-coerced from the tool's input schema (number/integer/boolean/
array/object/nullable). `key:=<json>` (httpie convention) forces JSON parsing
for nested objects/arrays. A leading `--` on a key is stripped so flag-style
habits work. The legacy single-JSON-object form is still accepted when the
sole positional starts with `{`. Same syntax applies to `client prompts get`.
Errors print usage examples and the target tool's schema so agents can self-
correct.
* fix(cli): surface tool call error details in `client tools call`
Label error content explicitly, color text content red, render
`structuredContent` for both success and failure, and print a fallback
when the server returned neither. Connection-level failures also print
any attached `data` payload.
* chore(cli): satisfy lint+prettier on format.ts ANSI regex
* chore(typescript): version packages (canary)
* feat(cli): add mcp-use screenshot command for visual feedback loop (#1432)
* feat(cli): add mcp-use screenshot command for visual feedback loop
Implements `mcp-use screenshot` — a CLI command that renders an MCP Apps
view headlessly via Playwright and saves a PNG. Designed for AI agent
visual feedback loops where the assistant calls a tool, screenshots the
result, and self-corrects without human round-trips (MCP-1566).
- New `packages/cli/src/commands/screenshot.ts` with --tool, --args,
--width, --height, --theme, --output, --header, and --server flags
- Auto-spawns a dev server if none is running; probes /inspector/health
first and tears the child process down on exit
- Default output path: `./<view>-<hash>.png` (6-char stable hash of
props + theme so re-runs at the same inputs overwrite the same file)
- New `/inspector/preview/:view` client-side route in the inspector SPA
- New `<ViewPreview>` component wrapping `<MCPAppsRenderer>` in
fullscreen+chromeless mode; sets `data-view-ready` on body once the
AppBridge handshake completes and fonts are ready
- `MCPAppsRenderer` gains `onReady` and `chromeless` optional props;
`chromeless` suppresses the fullscreen navbar and top padding
- Playwright added as optional peer dep on `@mcp-use/cli`; missing
Playwright prints an install hint and exits non-zero
- Unit tests covering arg parsing, hash stability, error paths
- Example PNGs from weather-display view as end-to-end verification
* style: apply prettier formatting to screenshot command files
* fix(cli): use timestamp instead of hash in default screenshot filename
Replaces the sha256-based hash suffix with a YYYYMMDDTHHmmss timestamp so
saved screenshots are sorted chronologically and self-descriptive.
* feat(cli, inspector): drop Playwright, use system Chrome via CDP
Replaces the optional `playwright` peer dep + `--install` flow on the
`mcp-use screenshot` command with a hand-rolled minimal Chrome DevTools
Protocol client that drives the user's existing system Chrome / Chromium
/ Edge / Brave install. No new dependencies — uses the `ws` package the
CLI already shipped. CLI dist is unchanged at 1.7 MB; users no longer
need to download a ~170 MB Chromium binary or run a separate install
step before screenshotting.
CLI changes:
- New `src/utils/chrome-path.ts`: detect Chrome-family binaries on
macOS / Linux / Windows. Honors `MCP_USE_CHROME_PATH`,
`PUPPETEER_EXECUTABLE_PATH`, and `CHROME_PATH` overrides.
- New `src/utils/cdp-screenshot.ts`: minimal CDP client (~200 LOC).
Spawns Chrome with `--headless=new --remote-debugging-port=0`, parses
the WS URL from stderr, opens a target via `Target.createTarget` +
`Target.attachToTarget {flatten:true}`, applies viewport + theme via
`Emulation.setDeviceMetricsOverride` / `setEmulatedMedia`, polls
`Runtime.evaluate` for the readiness selector, captures via
`Page.captureScreenshot`. Cleans up child + temp `--user-data-dir`.
- Drop `--install` flag, `loadPlaywright`, `runInstall`, and the
`playwright` peer + dev dependency from `package.json`.
- Split `--server` into `--inspector` (SPA host) and `--mcp` (RPC
target) so a remote MCP can be rendered inside a local inspector.
- Add `--delay <ms>` so chart libraries that animate past the readiness
signal can settle before capture, and emulate
`prefers-reduced-motion: reduce` to suppress animations where
possible.
- New `tests/chrome-path.test.ts` covers env-var precedence, platform
fallthrough, and the throwing wrapper.
Inspector changes:
- `ViewPreview.tsx` reads a `?headers=<base64 JSON>` query param and
forwards it as `headers` to `addServer`, so the preview's MCP
connection authenticates against a remote server. Temporary plumb
until the auth-aware MCP client lands in the CLI.
Verified end-to-end against `mcp.manufact.com/mcp`'s
`get_server_client_breakdown` view rendered through a local inspector.
* feat(cli, inspector): screenshot uses CLI session, inject bundle via CDP
`mcp-use screenshot` now reuses the saved OAuth session from `mcp-use
client connect` instead of requiring `--auth <token>` and `--mcp <url>`
on every invocation. The CLI calls the tool and reads the widget
resource itself, then injects the result into Chrome via CDP
`Page.addScriptToEvaluateOnNewDocument` as `globalThis.__mcpUsePreviewBundle`
before navigating to the inspector preview route. The OAuth token never
enters the browser and there's only one MCP connection per screenshot
instead of two.
- New `cli/src/utils/session.ts` extracts `getOrRestoreSession`,
`cleanupAndExit`, `activeSessions`, and `getCliClientInfo` from
`client.ts` so screenshot can reuse them.
- `screenshot.ts` drops `--auth` and `--header`; adds `--session <name>`
(defaults to active session). `--mcp <url>` remains as an
unauthenticated escape hatch.
- `cdp-screenshot.ts` accepts an optional `bundle` and injects it
before any document scripts run.
- `ViewPreview.tsx` splits into a bundle-mode branch (no
`useMcpClient`, no live MCP connection) and the existing live branch
for interactive debugging. The shared body-styling and readiness
effects are factored into `usePreviewViewport` and
`usePreviewReadinessSignal`.
* feat(cli): auto-capture widget screenshot in `client tools call`
When `mcp-use client tools call <name>` invokes a tool that declares a UI
resource (`_meta.ui.resourceUri` or `openai/outputTemplate`), the CLI now
captures a widget screenshot using the same pipeline as `mcp-use screenshot`.
The tool result is reused (no double tool-call) and the dev server is
auto-spawned if needed.
`--no-screenshot` opts out, `--screenshot-output <path>` overrides the
default `./<view>-<timestamp>.png` path. Screenshot failures warn to stderr
but don't fail the tool call. The success line is also on stderr so
`--json` stdout stays a clean CallToolResult.
* chore: remove SPEC.md from PR
* chore: remove example screenshots from PR
* refactor(cli): always spawn fresh inspector for screenshot, strict health probe
The screenshot path now always spawns @mcp-use/inspector standalone on a free
port instead of probing localhost:3000 / falling back to `mcp-use dev`. Two
fixes in one:
- A Vite/SPA dev server returns 200+HTML for any path, so the prior probe
(res.ok only) misidentified unrelated dev servers as a valid inspector.
probeServer now requires JSON `{ status: "ok" }` on /inspector/health.
- Spawning the inspector directly removes the need to be in a project with
an MCP server entry, so `screenshot` works from any cwd against any
remote MCP. `--inspector <url>` still works for pointing at an existing
instance.
Drops the cliBin plumbing now that screenshot no longer shells out to
`mcp-use dev`.
* chore: format
* fix(cli): use posix path joining in findOnPath for cross-platform tests
`findOnPath` is only called from the Linux branch of `findChrome`, but
relied on host-OS `path.join`. On Windows CI, tests that mock
`process.platform = "linux"` saw `path.join("/usr/bin", "google-chrome")`
return `\usr\bin\google-chrome`, breaking the PATH-walk assertion.
Use `path.posix.join` and a `:` separator unconditionally so the function
behaves the same regardless of the host OS.
* chore(typescript): version packages (canary)
* feat(cli): support remote CDP browsers via --cdp-url in screenshot (#1477)
Adds a `--cdp-url <ws|wss>` flag to `mcp-use screenshot` so the
screenshot pipeline can drive a hosted Chromium (e.g. Notte) instead of
spawning a local Chrome. Useful for running the pipeline in sandboxed
environments where a local browser install isn't available.
When the flag is set, `captureScreenshot` skips Chrome spawn / temp
user-data-dir / stderr parsing and connects the existing CDP client
directly to the supplied WebSocket. To pick up a flat-mode page session
it uses `Target.setAutoAttach` and listens for the resulting
`Target.attachedToTarget` event — providers like Notte forbid explicit
`Target.attachToTarget`. The local-Chrome path is unchanged when
`--cdp-url` is omitted.
The hosted preview already supported via `--inspector <url>` pairs
naturally: point the remote browser at a publicly reachable inspector
deployment and the bundle-mode preview renders without any local
infrastructure.
* Fix/duplicate exports 1449 (#1453)
* chore(typescript): resolve duplicate exports flagged by Knip (#1449)
- Removed redundant JsonRpcLoggerView default export\n- Removed Tel alias in favor of canonical Telemetry class\n- Unified re-exports in mcp-use to a single canonical path\n- Added changeset for breaking change in mcp-use
* chore: restore Tel alias with @alias directive and downgrade changeset to patch
# Conflicts:
# libraries/typescript/.changeset/resolve-duplicate-exports.md
# libraries/typescript/packages/mcp-use/src/telemetry/telemetry-browser.ts
# libraries/typescript/packages/mcp-use/src/telemetry/telemetry-node.ts
* feat(telemetry): re-export Tel alias from public entrypoints
* fix(telemetry): add missing Tel export to telemetry entry point
* feat(telemetry): explicitly export Tel from browser and react entrypoints
* feat(telemetry): use Tel alias consistently across the codebase
* chore(telemetry): correct changeset description and revert nit comment churn
- Rewrite changeset to match the PR (the re-exports from mcp-use/react
and mcp-use/browser are not removed; only Tel alias is suppressed via
@alias and the canonical source path is unified).
- Align telemetry-browser.ts class docstring example to use Tel for
consistency with telemetry-node.ts.
- Restore the more informative comments on browser.ts, react/index.ts,
and tel-fetch.ts.
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* feat(cli): add --header/-H to mcp-use screenshot for authenticated --mcp servers (#1491)
Lets `mcp-use screenshot --mcp <url>` reach an authenticated MCP server
without running `mcp-use client connect` first. Repeatable `-H "Key: Value"`
flags (curl-style) are parsed into the ad-hoc client's headers; only
honored with `--mcp <url>` so misuse alongside `--session` errors clearly.
* chore(typescript): version packages (canary)
* fix(inspector): implement dark-mode aware scrollbars (#1484)
* fix(inspector): implement dark-mode aware scrollbars #1479
* Improve dark mode scrollbar styling and hover visibility
* Add changeset for inspector scrollbar improvements
* chore: rerun ci
* chore(typescript): version packages (canary)
* feat(cli): drop "active session" model — every client command takes a name (#1494)
* fix(cli): stop printing tool results twice when servers return structuredContent
Per the MCP spec, a tool that returns `structuredContent` SHOULD also serialize
the same JSON into a `TextContent` block for backwards compatibility. The
client was rendering both, so every call to a structured-output tool printed
the JSON payload twice. Treat `structuredContent` as the canonical form: when
it's present, the content block is suppressed and only the structured JSON is
shown.
* feat(cli)!: drop the "active session" model — every client command takes a name
The CLI used to track an implicit active client and let you switch between
saved clients with `client sessions switch`. Per-command flags like
`--session` and `--name` were sprinkled around to override it. The active
state was hidden, easy to get wrong, and forced every subcommand to handle
"no session" as a real case.
It's gone. The client name is now a required positional, and every
per-client command lives under `mcp-use client <name> <scope> <action>`.
BREAKING CHANGES:
- `client connect <url> --name <name>` → `client connect <name> <url>`
- `--session <name>` removed from every per-client subcommand
- `client sessions list` → `client list`
- `client sessions switch` removed (no active client to switch to)
- `client disconnect --all` removed; disconnect each client by name
- `mcp-use screenshot` no longer falls back to the active session;
pass `--session <name>` or `--mcp <url>` explicitly
Existing `~/.mcp-use/cli-sessions.json` files keep working; the unused
`activeSession` field is silently ignored on load. Docs and integration
tests are updated for the new shape, and the CLI gives clearer feedback
for the shape mistakes the new syntax invites.
* fix(cli): tests no longer touch the developer's real ~/.mcp-use directory
Two leaks are closed:
- `session-storage.test.ts` computed its target path from `os.homedir()` and
`rmSync`'d it in `beforeEach`/`afterEach`, so running `pnpm test` during
local development deleted any saved clients on disk. The tests now mock
`node:os.homedir` to a per-process temp directory.
- `cli-integration.test.ts` spawned the real CLI as a subprocess and so read
the developer's real `cli-sessions.json` when running `client list`.
`runCLI` now sets HOME (and USERPROFILE) to an isolated temp dir for
every spawn.
* fix(cli): friendlier `client <name>` help and rename saved-client copy to "server"
Two related polish fixes for the CLI:
- `mcp-use client <name>` (no subcommand, or with `--help`) used to fall
through to commander's per-server help even when the name wasn't a
saved server, leaking subcommand surface instead of telling the user
how to make the name resolve. It now prints `Server '<name>' not
found.` plus a `client connect <name> <url>` hint and exits non-zero.
Existing servers still get the full help.
- User-facing copy throughout the `client` subcommand tree (help text,
table headers, errors, REPL prompts, docs) referred to saved entries
as "clients" — but the CLI itself is the client, and the things it
connects to are servers. Renamed to "server" / "saved server"
consistently. The `mcp-use client` command name is unchanged, so no
scripts break.
* fix(cli): tighten client routing and trim review nits from prior commits
- index.ts: pin per-client routing to argv[2] instead of indexOf("client", 2),
which would otherwise match the literal "client" appearing later in argv
as someone's argument value and mis-route to a tailored error.
- index.ts: route the two routing-layer error prints through formatError for
style parity with the rest of the codebase.
- client-auth.ts: destructure { name, url } from `target` after the guard so
the `target!` non-null assertions disappear.
- session-storage.ts: drop the existsSync guard around mkdir (recursive mkdir
is already a no-op when the dir exists) and memoize the call.
- cli-integration.test.ts: prettier reflow that was missed in a prior commit.
* feat(cli): add `mcp-use client remove <name>` to drop a saved server
Saved servers could be added (`client connect`) and listed (`client list`),
but the only way to delete one was to hand-edit
`~/.mcp-use/cli-sessions.json`. `client remove <name>` now does this: it
errors if no server by that name exists, closes any in-process connection,
deletes the entry, and — for OAuth-authenticated servers — also revokes
the stored tokens for that URL. If another saved server still points at
the same URL the tokens are kept (they're URL-keyed, so wiping them would
break the sibling); the CLI prints which sibling is keeping them alive.
* fix(cli): stop auto-opening the browser during OAuth flows
When `mcp-use client` commands hit a 401 they would launch the user's
browser via the `open` package on TTYs, and only print the URL when stdout
wasn't a TTY. That was surprising in two directions: scripts that did
happen to inherit a TTY got pop-up windows, and the heuristic missed
plenty of agentic/CI environments that *do* keep a TTY attached. The CLI
now always prints the authorization URL and waits on the loopback
callback — the user opens the link themselves whenever it's convenient.
Other CLI surfaces that intentionally open a browser (`deploy --open`,
the `auth login` flow) are unchanged.
* fix(cli): address review feedback for client-name refactor
- formatToolCall: when structuredContent is present, suppress only the
duplicate TextContent blocks. Image/resource markers are kept since they
carry information the structured payload doesn't (and the terminal can
only render them as placeholders anyway).
- index.ts: attach a .catch() to the per-server routing IIFE so a rejection
from parseAsync surfaces a clean error message + exit 1 instead of an
UnhandledPromiseRejection trace.
- connectCommand: reject saved-server names that collide with per-server
scope tokens (tools, resources, prompts, auth, disconnect, interactive),
which would otherwise be silently unreachable through the new routing.
- session.ts: rename a stray "Failed to restore client" log to "server" to
match the rest of the renamed copy.
* chore(typescript): version packages (canary)
* feat(cli): move screenshot under client and require explicit session name (#1497)
* feat(cli): move screenshot under client and require explicit session name
The standalone `mcp-use screenshot` command is folded into `mcp-use client`:
- Saved-server form: `mcp-use client <name> screenshot --tool <tool>` reuses
the saved server's auth from `mcp-use client connect`. The `--session` flag
is removed — the server name is the positional, matching every other
per-client command.
- Ad-hoc form: `mcp-use client screenshot --mcp <url> --tool <tool>` keeps
`-H/--header` for one-off authenticated captures (programmatic / CI use
that doesn't want to save a server first).
`screenshot` becomes a reserved subcommand name under `client`.
* refactor(cli): lift session name out of ScreenshotOptions into a context arg
Replace the internal `session?` field on `ScreenshotOptions` (set via spread
into Commander's options bag) with a separate `ScreenshotContext` parameter
carrying `sessionName` and `usagePrefix`. Drop the default-value parameter
on `screenshotCommand` and strip redundant WHAT-comments in client.ts.
* chore(typescript): version packages (canary)
* feat(cli): add --device-scale-factor flag for high-DPI screenshots (#1498)
Exposes the previously-hardcoded CDP deviceScaleFactor on both the
dedicated `mcp-use screenshot` command (`--device-scale-factor <n>`)
and the auto-screenshot in `mcp-use client <name> tools call`
(`--screenshot-device-scale-factor <n>`). Defaults to 1, accepts
fractional values, bounded to (0, 4]. Closes MCP-2167.
* chore(typescript): version packages (canary)
* fix(cli): error when client screenshot omits required tool args (#1499)
* fix(cli): error when client screenshot omits required tool args
`mcp-use client screenshot --tool <tool>` silently produced a blank
PNG and exited 0 when the tool declared required arguments but none
were passed — the empty-args call reached the server, the iframe
rendered nothing, the readiness selector still flipped, and capture
proceeded. Mirror the `client tools call` validation: error with
"This tool requires arguments." plus the tool schema, exit 1,
skip the inspector/browser spawn.
* fix(cli): use context.usagePrefix in screenshot args error path
Typo introduced in
|
||
|
Enrico Toniato
|
ca1b34fa66 |
Canary (#1467)
* fix(create-mcp-use-app): add tool annotations and outputSchema for Ch… (#1466)
* fix(create-mcp-use-app): add tool annotations and outputSchema for ChatGPT
* fix(mcp-use): expose tool outputSchema in tools/list
* chore: format mcp-ui server example
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* fix(inspector): pin iframe width in inline chat mode (#1459) (#1462)
* fix(inspector): pin iframe width in inline mode, ignore widget-reported width
* fix(inspector): drop width from inline transition string; add changeset
* fix(inspector): drop trailing comment from self-documenting condition
* fix(inspector): drop unused width param from onsizechange destructure
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* docs(oauth examples): fix broken links in Clerk and WorkOS READMEs (#1465)
* docs(skills): add Clerk OAuth ref and link standalone provider templates (#1463)
Adds a Clerk authentication reference to the mcp-apps-builder skill (and
its mcp-builder / chatgpt-app-builder mirrors), and links the standalone
mcp-oauth-{provider}-template starter repos from each provider guide.
Closes MCP-2065
* docs(oauth/clerk): point Clerk Dashboard links to /sign-in (200 instead of 404)
* docs(oauth/workos): replace 404 quickstart URL with /docs/authkit (200)
---------
Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com>
* Revert "docs(oauth examples): fix broken links in Clerk and WorkOS READMEs (#…" (#1469)
This reverts commit
|
||
|
Andrew Khadder
|
78cfc8a74d |
Canary (#1434)
* feat(mcp-use): add Clerk OAuth provider for TypeScript (#1429) * feat(mcp-use): add Clerk OAuth provider * docs: add Clerk OAuth provider documentation page * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(cli): propagate --env/--env-file to server on deploy redeploys (#1433) The deploy command only forwarded `--env`/`--env-file` values when creating a brand-new server (where they ride on the createServer body). On redeploys to an existing linked server, env vars were parsed and shown in the preview, then silently dropped before createDeployment. Now upserts each entry against /api/v1/servers/{id}/env-variables (PATCH for existing keys, POST for new ones) before triggering the deployment. Closes MCP-1995 * chore(typescript): version packages (canary) * chore(typescript): adopt Knip to find and remove unused code (#1359) * chore(typescript): adopt knip at workspace root Add Knip as a dev dependency at the TypeScript workspace root with a root-level knip.json covering all packages. Consolidates the existing per-package Knip setup in @mcp-use/inspector into the shared config and delegates its check-deps script to the root install. Adds `pnpm knip`, `pnpm knip:deps`, and `pnpm knip:production` scripts and documents them in the TypeScript README. Baseline configuration suppresses known false positives (build-generated version.js, Tailwind/ Scarf deps, nested example and template workspaces, test helpers and servers). Actual dead-code removal is deferred to follow-up PRs. Refs MCP-1707 * ci: add warning-only Knip step Runs `pnpm knip --no-exit-code --no-progress` on TypeScript-affecting PRs/pushes and writes the report to the GitHub Actions step summary. Stays non-blocking by design — tighten to a failing check once the baseline cleanup PRs land. * chore(inspector): drop redundant check-deps script Root-level pnpm knip:deps already covers all workspaces, so the inspector-only wrapper just duplicated the same delegation. Devs needing scoped output can use pnpm knip --workspace packages/inspector. * chore(typescript): drop changeset for dev-only knip adoption * feat(inspector): support custom base URL for OpenAI-compatible providers (#1437) * feat(inspector): support custom base URL for OpenAI-compatible providers * feat(inspector): add support for OpenAI-compatible providers with configurable base URL Co-authored-by: Copilot <copilot@github.com> * refactor(inspector): simplify openai-compatible plumbing - Widen ProviderName union to include "openai-compatible" and drop the resolveProvider helper; the providers dispatcher fall-throughs from "openai-compatible" to the openai impl, so callers can pass the UI provider name straight through. - openai.ts: extract buildEndpoint/buildHeaders, strip trailing slashes on baseUrl, and skip Authorization header when apiKey is empty. - ConfigurationDialog: defensive parsing of /models response, surface CORS hint on fetch failure, mention CORS requirement in helper text, move "OpenAI Compatible" to end of dropdown. - useConfig: persist openai-compatible base URL per-provider in localStorage (mirrors api keys), restore on switch + cross-tab sync. - Drop openai-compatible logo references in ChatHeader / ChatLandingForm / ConfigurationDialog dropdown. * style(inspector): apply prettier formatting * chore(changeset): bump @mcp-use/inspector to minor for openai-compatible provider --------- Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat: integrate OpenRouter as a first-class LLM provider (fixes #1402) (#1403) * feat(inspector): integrate OpenRouter as a first-class LLM provider Adds OpenRouter to the inspector chat configuration. Selecting OpenRouter routes through the existing OpenAI provider with an override base URL and the required HTTP-Referer / X-Title headers, so users get multi-model access (OpenAI, Anthropic, Google, etc.) from a single API key without duplicating provider plumbing. Co-authored-by: Andrew Khadder <andrew@mcp-use.com> Closes #1402 * fix(inspector): use inspector.mcp-use.com as OpenRouter HTTP-Referer * feat(inspector): swap OpenRouter favicon.ico for inline gray SVG Drops the runtime fetch to openrouter.ai/favicon.ico in favor of an inline data-URL'd SVG with a neutral #94A3B8 fill. Follow-up will lift this onto the provider CDN alongside the other provider marks. * fix(inspector): stop OpenRouter SVG curves from being implicitly filled The two arrow-body paths are open curves; with the parent svg's fill set, the browser implicitly closed them and filled the resulting region, producing visual artifacts at small sizes. Mark those two paths fill="none" so only their strokes render. * fix(inspector): use OpenRouter SVG in ChatLandingForm chip The landing-form provider chip was hardcoded to the CDN png URL, which 404s for the openrouter provider and rendered a broken-image blob clipped by rounded-full styling. Match the ChatHeader behavior and fall back to OPENROUTER_ICON_URL. * fix(inspector): set OpenRouter X-Title to mcp-use Inspector * refactor(inspector): drop OpenRouter baseUrl path special-case Set OpenRouter's baseUrl to the API root (/api/v1) and let buildEndpoint append /chat/completions like the rest of the OpenAI-compatible flow, removing the includes("/chat/completions") short-circuit that only existed to defuse the path baked into the override. * style(inspector): apply prettier formatting * chore(inspector): drop redundant baseUrl jsdoc comment --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(auth): pre-registered OAuth client credentials and scopes in Inspector (#1400) * feat(auth): pre-registered OAuth client credentials and scopes Wires clientId, clientSecret, and scope end-to-end from the Inspector's Authentication dialog through useMcp into BrowserOAuthClientProvider's staticClientInfo. When clientId is set the SDK skips Dynamic Client Registration (required for proxy-mode servers like Slack/WorkOS that strip registration_endpoint). When clientSecret is also set, the SDK auto-switches token-endpoint auth from "none" to client_secret_basic / client_secret_post, supporting providers that don't support PKCE. * refactor(inspector): extract OAuthStaticConfig type and builder helper Replaces six inline copies of `{ clientId?; clientSecret?; scope? }` and two copy-pasted trim+spread builders with a shared `OAuthStaticConfig` type and `buildOAuthStaticConfig()` helper in connectionUpdates.ts. Also widens ServerConnectionModal's connection/onConnect types so the `as { oauth?: ... }` structural cast can go away (the modal was passing oauth in the spread without declaring it on the callback type). * docs: document pre-registered OAuth client credentials Updates client authentication, useMcp, and inspector connection-settings docs to cover the new oauth.{clientId, clientSecret, scope} option and the proxy-mode/confidential-client cases it unlocks. Replaces the inaccurate snake_case OAuth params table with the actual camelCase API shape. * chore(typescript): version packages (canary) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry (#1443) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry The env var previously disabled Node-side telemetry and the inspector's server-side proxy, but the in-browser posthog-js init triggered by useMcp still fired POSTs to https://eu.i.posthog.com that ad/tracker blockers flag. The inspector server now mirrors the env var into a runtime flag (window.__MCP_USE_ANONYMIZED_TELEMETRY__) and localStorage before the client bundle runs; both mcp-use's browser telemetry and the inspector's own client telemetry honor that flag, so a single env var disables every telemetry path. * fix(inspector): drop sticky localStorage write; honor opt-out in Vite dev The previous revision mirrored MCP_USE_ANONYMIZED_TELEMETRY=false into localStorage, which persisted across sessions even after the env var was unset. Switch to a per-page window flag only — unsetting the env var fully restores defaults on the next page load. Also extend the opt-out to pure-Vite dev mode via a transformIndexHtml plugin, so the env var works whether the inspector is served by the backend or by Vite directly. * chore(typescript): version packages (canary) * fix(inspector): drop trailing-slash regex flagged by CodeQL The /\/+$/ regex on user-supplied base URLs triggered js/polynomial-redos. Most servers normalize a double slash in `${baseUrl}/path` fine, so just drop the stripping rather than working around the alert. * docs(changelog): add v1.27.0 / inspector v5.0.0 release notes --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Siddhant Rai <47355538+siiddhantt@users.noreply.github.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> |
||
|
Luigi Pederzani
|
6b2db4a2b0 |
docs: reorganize docs and examples around MCP Servers + MCP Apps (#1363)
Reshape docs, examples, and indexes to mirror the README narrative:
MCP Servers + MCP Apps are primary; MCP Agent and MCP Client are
present but secondary. Remove duplicated concepts, deprecated pages,
and stale examples; add redirects for removed paths.
Docs
- Rewrite home/index.mdx: tagline + MCP Server / MCP App split cards,
quickstart tabs, MCP Apps widget snippet, Templates teaser, Inspector,
Deploy, Agent+Client in a collapsed accordion.
- New home/templates.mdx gallery (Chart Builder, Diagram Builder, Slide
Deck, Maps Explorer, Widget Gallery, and more) with demo URLs and
deploy buttons, mirroring the README.
- Simplify python/typescript welcome.mdx: drop duplicated "What is MCP?"
/ "Why mcp-use?" (single pointer to home/mcp101); server-first Next
Steps; fix broken Python links.
- docs.json: Home product reshaped (Welcome, MCP Apps, Templates, Dev
Tools + CLI reference, Concepts, Libraries, Misc). Python
Integrations collapsed into MCP Agents → LLM Adapters.
fastapi_mount added to Python MCP Server Overview. TS MCP Apps adds
creating-mcp-apps-server; OAuth Providers gets keycloak + custom.
Empty API Reference, misrouted Community, and Blog tabs removed from
TS SDK.
- Delete: ui-widgets.mdx, mcp-ui-resources.mdx,
comparison-with-other-implementations.mdx, api-reference.mdx (empty),
typescript/development/security.mdx, python/blog/middleware.mdx,
python/server/auth/index.mdx.
- Redirects: old paths → current equivalents.
- CLI reference: new "What's New" card group (HMR, --tunnel, skills
add, generate-types); cross-link from `start` to Tunneling guide.
Examples
- Rewrite libraries/typescript/.../examples/server/ui/mcp-ui/ as a
programmatic MCP Apps widget gallery (welcome-card, quick-poll,
task-card) using server.uiResource({ type: "mcpApps", htmlTemplate }).
Removes deprecated UIResource / rawHtml / remoteDom patterns.
- Delete empty server/ui/apps-sdk/.
- Fix stale docs URL in server/ui/mcp-apps/apps-sdk/index.ts.
- Update examples/README.md and TS examples README: add Templates
pointer (github.com/mcp-use/mcp-use#templates + docs/home/templates),
list previously-missing examples (mcp-apps, files, model-context,
middleware, session-management, better-auth, Python orphans), flag
apps-sdk as legacy.
|
||
|
Enrico Toniato
|
bdf9182fb2 |
fix(widgets): pre-warm Vite entries before registration to prevent fi… (#1426)
* fix(widgets): pre-warm Vite entries before registration to prevent first-render 504s (#1425) * fix(widgets): pre-warm Vite entries before registration to prevent first-render 504s When a widget is registered (initial boot, watcher add-file, or watcher add-folder), `mount-widgets-dev` now calls `viteServer.warmupRequest()` followed by `viteServer.waitForRequestsIdle()` for the widget's `entry.tsx` before exposing it to the inspector. This forces Vite's `depsOptimizer` to finish pre-bundling and stabilise its dependency hash before the browser starts requesting `/.vite/deps/*` modules. Previously the inspector iframe could fetch optimized dependencies (e.g. `mcp-use_react.js`) with a stale Vite hash while `depsOptimizer` was still re-bundling, surfacing as `504 Gateway Timeout` errors and a blank widget on first interaction in Vibe-created sandboxes. Each widget is warmed at most once per dev-server lifetime; failures fall back to a warning so registration never blocks. Made-with: Cursor * refactor(widgets): update warmWidgetEntry to use a current method for consistency Refactored the warmWidgetEntry variable to be an object with a current method, ensuring consistent usage across widget registration processes. This change updates all calls to warmWidgetEntry to use the new method, improving code clarity and maintainability. No functional changes were introduced; this refactor aims to streamline the widget warm-up process during development. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): update command-palette e2e test for new Settings dropdown trigger (#1428) * fix(inspector): update command-palette e2e test for new Settings dropdown trigger The command palette trigger button moved from a standalone header button into a Settings gear icon dropdown menu. The e2e test now opens the Settings dropdown first before clicking the trigger, and uses exact:true to disambiguate from the Edit connection settings button. Closes #1730 * chore: add changeset for command-palette e2e fix * Delete libraries/typescript/.changeset/fix-inspector-command-palette-e2e-test.md Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * feat(server): add MCP_DEBUG_LEVEL with info/debug/trace tiers (#1430) * feat(server): add MCP_DEBUG_LEVEL with info/debug/trace tiers (MCP-1569) Replaces the all-or-nothing DEBUG=1 flag with three explicit verbosity levels for HTTP request logs: - info (default): one compact, color-coded line per request, with session and client info inlined ([initialize: name/version] → session=<short>), tool name shown for tools/call, and OK/ERROR outcome with duration. - debug: same plus inline args=<json> for tools/call. - trace: same plus the legacy full request/response header and body dump (DEBUG=1 still works and maps to trace). Lifecycle Session initialized/closed lines are suppressed at info since the per-request line already conveys that. Errors are extracted from the response body (JSON-RPC error.message or tool result.isError text), handling both application/json and text/event-stream payloads. * docs(server): drop legacy DEBUG=1 reference from logging guide The MCP_DEBUG_LEVEL doc no longer surfaces the legacy DEBUG=1 flag. Back-compat handling remains in code, but the docs steer users to MCP_DEBUG_LEVEL exclusively. * feat(server): show resource URI and prompt name in request logs `resources/read` now logs `[resources/read: <uri>]` and `prompts/get` logs `[prompts/get: <name>]`, matching the existing `tools/call: <name>` treatment so the resource or prompt being accessed is visible at info level. * docs(server): replace DEBUG with MCP_DEBUG_LEVEL in env var table * style(server): apply prettier formatting to logging tests * chore(typescript): version packages (canary) * chore(inspector, typescript): update changelogs for v3.0.2 and v1.25.2 releases - Added changelog entry for inspector v3.0.2, detailing e2e alignment for the Settings dropdown and updates to mcp-use. - Updated typescript changelog for v1.25.2, including new MCP_DEBUG_LEVEL logging tiers, widget dev server improvements, and command palette e2e test adjustments. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> |
||
|
Enrico Toniato
|
806dbcaf50 |
Canary (#1401)
* fix(inspector): OAuth flow no longer leaves two tabs open (#1384) (#1391) * fix(inspector): OAuth flow no longer leaves two tabs open (#1384) Previously, the inspector opened the OAuth authorization page in a new tab (`target="_blank"` on the Authenticate anchor). After the auth server redirect to the callback URL, `Cross-Origin-Opener-Policy` typically stripped `window.opener`, so the callback took the `returnUrl` fallback branch and navigated the new tab back to the inspector — leaving the user with two inspector tabs. Changes: - Drop `target="_blank"` / `rel="noopener noreferrer"` on the Authenticate anchor so the click performs a same-tab navigation to the stored auth URL. - Set `useRedirectFlow: true` + `preventAutoAuth: true` on every server added from the inspector UI, so the stored OAuth state records `flowType: "redirect"` and the callback routes the current tab back to `returnUrl` instead of trying to close an already-navigated popup. - Propagate the same flags through every connection entry point (`handleAddConnection`, `Layout` adapter, and the `InspectorDashboard` adapter used by `handleUpdateConnection` URL edits and `useAutoConnect`) so the single-tab behavior holds across manual connect, URL edits, and shared-config auto-connect. The library primitives (`redirectToAuthorization`, `onMcpAuthorization`, `flowType`) already worked — this PR only wires the inspector to use them. Closes #1384 * chore: remove issue comments --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore: enter canary prerelease mode * docs(inspector): document --no-open CLI flag (#1397) * fix(inspector): hide free-tier upgrade UI when host app embeds ChatTab (#1399) ChatTab was deriving the Manufact free-tier "Model & usage" dialog from the mere presence of `managedLlmConfig`. The cloud dashboard embeds ChatTab with `managedLlmConfig` + `hideModelBadge=true`, but the badge and ConfigurationDialog treated the derived `freeTierInfo` as an override that forced the UI back on. Free-tier upgrade UI is now opt-in via a new `enableFreeTierUpgrade` prop on ChatTab (default false), plumbed through `EmbeddedConfig.chatEnableFreeTierUpgrade`. The hosted inspector auto-seeds it to true; host apps embedding ChatTab directly leave it off and their hide-* props are respected. * chore(typescript): version packages (canary) * fix(cli): keep mcp-use build non-fatal under bun runtime (#1382) * fix(cli): keep mcp-use build non-fatal under bun runtime `mcp-use build` was crashing during the tool-registry type-generation step on `oven/bun:alpine`. The step uses `tsx/esm/api`'s `tsImport`, which relies on Node's custom loader hooks that bun doesn't implement, so the exception killed the whole build. - Detect the bun runtime up front in `generateToolRegistryTypesForServer` and skip the `tsx/esm/api` path with a clear warning. - Wrap the build command's call in try/catch so any other import-time error is surfaced as a non-blocking warning rather than `exit 1`. - Invoke `tsc --noEmit` via `process.execPath` instead of hardcoding `node`, and drop `--max-old-space-size=4096` under bun (unsupported flag). `oven/bun:alpine` ships no `node` binary; bun runs tsc fine. Closes #1327 * fix(cli): distinguish skipped tool registry gen from errored Return "ok" | "failed" | "skipped" from generateToolRegistryTypesForServer so the bun-skip path no longer prints a misleading "had errors" warning after the "Skipping under bun runtime" notice. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): stop MCP App widget from overlaying chat header (#1407) The sandboxed iframe wrappers in MCPAppsRenderer (relative z-20) and OpenAIComponentRenderer (relative z-10) created stacking contexts that painted above the chat header's absolute z-10, making the header unreachable when scrolling. Drop the explicit z-index classes so widgets stack under the header; spinner/skeleton overlays still work via DOM order. Closes MCP-1741 * chore(typescript): version packages (canary) * fix(inspector): improve handling of client-side and managed LLM configurations in ChatTab (#1418) Updated logic to determine `effectiveClientSide` and `hideModelBadge` based on host embed configurations. Introduced `hostUsesServerManagedStream` to ensure correct behavior when using managed LLM settings, preventing fallback to client-side streaming in hosted environments. Adjusted `hideModelBadge` and `hideConfigButton` properties to respect these configurations, enhancing the user experience in embedded scenarios. * chore(typescript): version packages (canary) * fix(cli): bundle server entries so extensionless imports work under Node ESM (#1357) * fix(cli): bundle server entries with esbuild to resolve extensionless imports Scaffolded apps run under plain Node ESM, which rejects extensionless relative imports with ERR_MODULE_NOT_FOUND. Flip `transpileWithEsbuild` to `bundle: true` + `packages: "external"`: relatives get inlined at build time while third-party packages (mcp-use, react, zod, etc.) stay as external imports resolved from node_modules at runtime. Users can keep writing idiomatic TypeScript imports without .js suffixes. * test(cli): regression test for MCP-1733 build import resolution Asserts that `mcp-use build` produces output where bare package imports stay external and relative extensionless imports are inlined. Uses a non-matching entry name (main.ts) to skip the tool-registry type gen step so the test does not depend on mcp-use being installed in the fixture. * chore(typescript): version packages (canary) * fix(auth): redirect OAuth errors back to inspector instead of showing raw error page (#1381) * fix(auth): redirect OAuth errors back to inspector instead of showing raw error page When the OAuth callback receives an error (e.g. access_denied), the handler previously threw immediately before looking up stored state, so it couldn't find the returnUrl to redirect. This resulted in a raw error page with stack traces rendered into the DOM. Move the error check after the state lookup so we have access to returnUrl and flowType. Now OAuth errors use the same redirect/postMessage patterns as successful auth: - Redirect flow: navigates to returnUrl with auth_error params - Popup flow: posts message to opener with success:false - Fallback with returnUrl: redirects with error params Fixes mcp-use/mcp-use#1362 * chore: add changeset for oauth error redirect fix * feat(inspector): show toast notification on OAuth error redirect * style: fix prettier formatting in callback.ts * fix(inspector): lift OAuth error toast to App level The auth_error toast was buried inside useAutoConnect, which fires before <Toaster /> subscribes to sonner — sonner only notifies current subscribers, so the toast was dropped on the floor. Lift it to App.tsx so the effect runs after Toaster mounts, and make it persistent (duration: Infinity, closeButton: true) so users can read the failure. * chore(inspector): tighten OAuth error toast comment and changeset * refactor(auth): simplify OAuth error redirect handling Collapse duplicated redirect/fallback branches in the OAuth callback error handler into a single redirectWithError helper, drop narration comments, and reuse the existing parsed URLSearchParams in the inspector App effect. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): persist connection config in sessionStorage before OAuth redirect (#1404) Before this change, completing an OAuth flow without ?autoConnect in the URL left the inspector in a hanging state because useAutoConnect had no way to resume the connection on page reload. Now, clicking the Authenticate button writes the pending connection config to sessionStorage under INSPECTOR_RECONNECT_STORAGE_KEY — the same key already consumed by trySessionReconnect() in useAutoConnect. After the OAuth callback redirects back, the hook picks up the stored config and resumes the connection automatically. Inspector-only change; no library code modified. Closes #1389 * chore(typescript): version packages (canary) * fix(oauth): use OAuth 2.1 server endpoints for Supabase provider and clear up docs (#1422) Point getAuthEndpoint() and getTokenEndpoint() at /auth/v1/oauth/authorize and /auth/v1/oauth/token instead of the legacy /auth/v1/authorize and /auth/v1/token paths. Also restructure the Supabase provider docs around a Steps-based prerequisites block and link the new mcp-oauth-supabase-template. * chore(typescript): version packages (canary) * fix(cli): allow "." as project name to init in current directory (#1413) * fix(cli): allow "." as project name to init in current directory When running `npx create-mcp-use-app .` in an empty directory, the CLI now initializes the project in the current directory instead of erroring with "Directory already exists". - Detect "." as project name and resolve to cwd - Use basename(cwd) for package.json name and display output - Check that the directory is empty before proceeding - Update interactive input validator to accept "." Fixes #1406 * style: fix prettier formatting * fix(cli): address review feedback for dot-directory support - Sanitize basename for package.json name (lowercase, replace invalid chars, trim leading dots/dashes) - Allow known safe entries in empty-dir check (.git, .gitignore, LICENSE, README*, .DS_Store, .idea, .vscode, Thumbs.db) - Skip printing 'cd .' when useCurrentDir is true - Add unit tests for sanitizePackageName and isSafeEntry - Extract utils to separate module for testability * fix(cli): expand safe-entry allow list and improve clash error - Replace SAFE_DIR_ENTRIES with the create-next-app-style list (.claude, .cursor, .git*, .hg*, IDE dirs, CI configs, package-manager logs, docs, LICENSE, etc.). README is no longer auto-allowed since templates ship their own. - On clash, list the offending entries (one per line) instead of a generic "directory not empty" message, in both the non-interactive and interactive (Ink) paths. - Drop the unused sanitizePackageName re-export from index.tsx. - Update tests to match the new allow list. * refactor(cli): simplify dot-directory tests and rename trimmed var - Rename sanitizedProjectName -> trimmedProjectName at the call site; the variable is only .trim()'d, the npm-style sanitization happens inside deriveProjectInfo. - Trim isSafeEntry tests from 9 to 3 (the prior tests were enumerating the contents of SAFE_DIR_ENTRIES rather than the function's behavior). - Drop overlapping deriveProjectInfo cases already covered by the sanitizePackageName unit tests and the regression e2e test. - Switch the TS-string-literal sanitize test to property assertions so it stays resilient to regex-order tweaks. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): detect Hono via duck-typing, not instanceof (#1417) * fix(inspector): detect Hono via duck-typing, not instanceof mountInspector(app) chose between a fast Hono-direct path and a slower Express-compat bridge based on app instanceof Hono. That check is unreliable across a published library boundary: when this package and the host (e.g. mcp-use) resolve different Hono constructors -- common in monorepos where workspace deps hoist their own hono, when Node loads Hono's dual CJS+ESM builds from the same on-disk copy as two separate module records, or under bundler dedup -- instanceof returns false even for a real Hono app. The Express bridge then runs against a Hono Context and crashes on every request trying to read req.headers.host. Switch to a duck-type check: Hono apps expose .fetch(Request) => Response; Express apps don't. The check is unambiguous for the documented input set and works regardless of which physical hono module produced the app. * Remove em dashes from comment and changeset * Drop redundant instanceof Hono fast-path; duck-type covers both shapes * Narrow app type via isHonoApp guard so Express bridge type-checks * Empty commit to refresh pkg.pr.new PR-tag alias for Deno preview * chore(typescript): version packages (canary) * docs: add v1.25.1 and inspector v3.0.1 changelog entries --------- Co-authored-by: Ayaan Gazali <ayaangazali@gmail.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: Truffle <truffleagent@gmail.com> Co-authored-by: Kagura <kagura.agent.ai@gmail.com> Co-authored-by: Kagura <kagura.chen28@gmail.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> |
||
|
Pietro Zullo
|
b056f72e06 |
docs: add llms.txt directive to landing pages for agent readiness (#1419)
* docs: add llms.txt directive blockquote to landing pages Adds a blockquote pointing to /llms.txt at the top of the main landing pages so agents have a clear, page-level pointer to the documentation index. Addresses the LLMS TXT Directive check in agent-readiness audits. * docs: hide llms.txt directive from human readers via display:none The directive is for agents (which still see it in DOM/markdown export), not humans, so wrap each blockquote in a hidden div to remove visual noise from landing pages. * docs: use absolute URL for llms.txt directive Mintlify's broken-link checker validates relative paths against pages in docs.json, and /llms.txt is an auto-generated artifact at host root, not a navigation page. Switch to the absolute URL so CI passes; agents still see a same-host link. * docs: point llms.txt directive at canonical manufact.com URL Skips the 2 cross-host 301 hops from docs.mcp-use.com so agents reach the index in one request. * docs: remove redirect-audit.md from PR This was an internal diagnostic file accidentally bundled into the llms.txt directive PR. Keeping it locally for reference, not for shipping in docs. |
||
|
Andrew Khadder
|
1bdec92bae |
Canary (#1387)
* fix(cli): add auto-port discovery to mcp-use start command (#1377) * fix(cli): add auto-port discovery to mcp-use start command When port 3000 (or the configured port) is already in use, the start command now automatically finds and uses the next available port instead of failing silently — matching the behavior already present in dev. * chore: add changeset for auto-port discovery fix in cli * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(cli): add ORG column to deployments list (#1378) * feat(cli): add ORG column to deployments list output Closes #1673 * chore: add changeset for deployments list ORG column * chore(typescript): version packages (canary) * feat(cli): add --org flag to login for non-interactive org selection (#1379) * feat(cli): add --org flag to login for non-interactive org selection (MCP-1670) Agents invoking `mcp-use login` could authenticate in the browser but then got stuck on the post-login org picker because they have no way to write to the running process's stdin. `--org <slug|id|name>` now picks the organization up-front and skips the prompt, matching the resolver already used by `mcp-use deploy --org`. When login runs without a TTY and no `--org` is supplied, the command now fails fast with a message pointing at the flag instead of hanging. The org resolver is extracted into a pure `resolveOrgFromOption()` helper in `src/commands/auth.ts`, covered by real unit tests in `tests/auth.test.ts`. * refactor(cli): dedupe org-resolution logic via resolveOrgFromOption Reuse the helper added for `login --org` from `deploy --org` and `applyOrgOption` (used by `servers`/`logs`/`env`) so the slug/id/name matching lives in one place. Also tighten a JSDoc and fix a misleading test name. * style(cli): apply prettier formatting to resolveOrgFromOption * test(cli): use generic 'Personal' org name in auth test fixtures * fix(cli): surface org-selection errors from login instead of swallowing them The try/catch around testAuth also wrapped the new org-selection branches, silently eating the "--org not found" and "no TTY for interactive selection" throws and leaving the user logged in without an org. * chore(typescript): version packages (canary) * feat(cli): drop-in MCP server inside Next.js apps via --mcp-dir (#1332) * feat(typescript): Add scopes customization to oauth providers * refactor: move scopesSupported to BaseOAuthConfig and remove test file * feat(typescript): add scopesSupported to better auth provider * fix: return scopesSupported properly for Better Auth provider factory * docs(oauth): add scopesSupported to provider docs * chore: format * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): add missing fields to CustomProviderConfig to match docs (#1136) The Custom Provider docs show config fields (userInfoEndpoint, jwksUri, clientId, clientSecret, mode, scopes, audience) that don't exist in the code. This adds all documented fields to CustomProviderConfig and CustomOAuthConfig, implements the corresponding getters on CustomOAuthProvider, and resolves alias pairs (jwksUrl/jwksUri, scopes/scopesSupported). * style: fix prettier formatting in custom oauth provider * fix: add OAuthProvider interface methods and fix unsafe type casts - Add getClientId(), getUserInfoEndpoint(), getAudience() as optional methods on OAuthProvider interface so new CustomOAuthProvider getters are callable without type casting - Make CustomOAuthConfig.jwksUrl optional (users provide their own verifyToken, JWKS URL isn't always needed) - Fix jwksUrl fallback from empty string to undefined in factory to avoid silent runtime failures - Replace unsafe (provider as any).config?.clientId with type-safe provider.getClientId?.() in routes.ts - Add getClientId() to WorkOSOAuthProvider for the pre-registered client detection in direct mode metadata * fix(typescript): remove scopes alias from CustomProviderConfig in favor of scopesSupported * fix(typescript): remove jwksUri alias from CustomProviderConfig in favor of jwksUrl * chore: update changeset to reflect jwksUrl and scopesSupported field names * fix: inline jwksUrl and scopesSupported in CustomOAuthProvider constructor * fix: simplify oauthCustomProvider by spreading config into constructor * fix: remove redundant comments from CustomProviderConfig * chore(typescript): version packages (canary) * fix(inspector): hide thinking indicator when assistant message has parts (#1315) * fix(inspector): hide thinking indicator when assistant message has parts When streaming via the server-side path, content is delivered through the parts array while the message's content field stays empty until the stream reader fully closes. The isThinking check only looked at content, causing a window where the thinking indicator reappeared after the done event but before setIsLoading(false) ran in the finally block. Now we check parts first — if any parts exist, the model has produced output and we should not show the thinking indicator. * chore: add changeset for thinking indicator fix * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in Google provider (#1317) * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in JSON Schema output z.record() in @langchain/core's serializer emits a `propertyNames` keyword for constrained or enum key types. Google's Generative AI API rejects schemas containing `propertyNames`, breaking tool calls when using the Google provider. Switching to z.object({}).catchall() produces identical runtime behavior but serializes to clean `additionalProperties` without `propertyNames`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: add changeset for Google provider propertyNames fix --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(typescript): version packages (canary) * Major/cli/device flow (#1294) * fix(inspector): sync URL tab param on tab change to preserve state on refresh When switching tabs via header clicks, keyboard shortcuts, or command palette, only React state was updated but the URL was not. This meant refreshing the page would lose the active tab. Now all tab changes also update the ?tab= query parameter using navigate() with replace:true. Closes #1157 * fix: update import paths for Windows compatibility and modify postins… (#1255) * fix: update import paths for Windows compatibility and modify postinstall script in package.json templates - Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms. - Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation. * fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility - Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems. * changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: add changeset * chore(typescript): version packages (canary) * feat(auth): enhance login command with API key option and implement device code flow - Updated the login command to allow non-interactive login using an API key. - Introduced device code flow for authentication, including functions to request device codes and poll for access tokens. - Refactored API key creation to use access tokens and updated related utility functions for better authentication handling. * refactor(cli): improve code formatting and readability in authentication commands - Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks. - Removed unused import in `auth.ts` to clean up the codebase. - Enhanced error messages for clarity in authentication processes. * refactor(logging): change logger level from info to debug for various messages - Updated multiple logging statements across the codebase to use `logger.debug` instead of `logger.info` for routine messages, enhancing log clarity and reducing noise in production logs. - This change applies to session management, agent initialization, and connection handling, ensuring that only significant events are logged at the info level. * fix(oauth): correct Auth0 issuer handling and improve token validation - Updated the Auth0 issuer to include a trailing slash to comply with token validation requirements. - Separated baseUrl from issuer to prevent double-slash URLs in JWKS, auth, and token endpoints. - Added direct mode for the Auth0 provider to enable MCP clients to communicate directly for OAuth flows. - Enhanced protected resource metadata to include scopes_supported, ensuring clients request appropriate scopes during authorization. * update * lint --------- Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * refactor(cli): update authentication and organization handling (#1326) - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * fix(inspector): use correct OAuth callback URL when mounted at /inspector (#1323) * fix(inspector): use correct OAuth callback URL when mounted at /inspector The BrowserOAuthClientProvider defaulted redirect_uri to /oauth/callback but the React Router (basename="/inspector") only mounts OAuthCallback at /inspector/oauth/callback, causing a blank screen after auth. Root fix: add defaultCallbackUrl prop to McpClientProvider so the inspector declares the correct path once at the provider level. All addServer calls inherit it automatically — no per-connection wiring needed. Removes the "Redirect URL" field from the auth dialog: it was never actually passed to the connection and couldn't be set to a value the inspector would handle. * chore: bump mcp-use changeset to minor (new public API prop) * docs: document defaultCallbackUrl in McpClientProvider; remove redirectUrl from inspector connection-settings * chore(typescript): version packages (canary) * Device flow 2 (#1329) * refactor(cli): update authentication and organization handling - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * refactor(cli): streamline organization ID resolution in deploy command - Replaced the previous method of resolving the organization ID with a direct call to api.resolveOrganizationId() for improved clarity and efficiency. - Removed unnecessary comments and code related to organization ID handling, enhancing overall code readability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Fix/cli/git create (#1331) * refactor(cli): enhance deployment command and GitHub integration - Added new GitHub API methods for creating repositories and retrieving installation IDs. - Introduced git utility functions for initializing repositories, adding remotes, and committing changes. - Improved environment variable parsing and error handling in the deployment command. - Cleaned up code for better readability and maintainability. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deployment command options and improve code readability - Added a new option for specifying the deployment region in the CLI. - Rearranged and cleaned up command options for better organization. - Improved error handling and logging in the deployment process. - Refactored code for better readability and maintainability across several files. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(cli, mcp-use): drop-in MCP server inside Next.js apps Adds a --mcp-dir flag to `mcp-use dev/build/start` and matching mcp-use.config.json `mcpDir` option so a developer can drop a single `src/mcp/` folder into an existing Next.js repo and get a working MCP server + widgets — no sibling package, no restructure, no second codebase. CLI (@mcp-use/cli) - New `--mcp-dir <dir>` flag on dev/build/start. When set, defaults the server entry to `<dir>/index.ts` and the widgets dir to `<dir>/resources`. `mcp-use.config.json` supports the same value via a new `mcpDir` field. - Widget Vite builds now register `vite-tsconfig-paths` against the project's tsconfig when present, so widgets can `import '@/components/...'` and resolve through the app's own paths. Tailwind `@source` also scans the project's `src/` so classes on shared components come through. - Auto-shim Next.js server-runtime modules when `next` is detected in the project's package.json: `server-only`, `client-only`, `next/cache`, `next/headers`, `next/navigation`, `next/server`. Ships both an ESM loader (for `import`) and a CJS `Module._resolveFilename` patch (for the `require()` calls tsx emits when compiling TS in a non-`type: module` package). Covers both the HMR in-process path and the tsx-watch subprocess path via `NODE_OPTIONS`. - Loads Next.js's env cascade (`.env` / `.env.development` / `.env.local` / `.env.development.local`) so tools transitively imported from the app find the vars they expect without the user mirroring them by hand. - Replaces tsImport-with-namespace (which causes tsx's resolver to bail on transitive `@/*` imports) with a namespace-less tsx/esm + tsx/cjs register pair, then native dynamic `import()` with `?t=` cache-busting on reload. This is what finally makes `@/lib/...` imports resolve in HMR mode. mcp-use (runtime) - `mountWidgets` at both call sites in MCPServer now reads `process.env.MCP_USE_WIDGETS_DIR` (set by the CLI when --mcp-dir is used) as the default. Nothing in user code changes. - `mount-widgets-dev.ts` loads `vite-tsconfig-paths` from the user's project when a root tsconfig.json exists and installs it in front of the dev Vite server's plugin chain. The hardcoded `"@": resources` alias now only fires as a fallback. Tailwind `@source` auto-extends to scan `<projectRoot>/src` under the same conditions. Validated end-to-end against a real Next.js 16 + React 19 app: node .../cli/dist/index.cjs dev --mcp-dir src/mcp → tsx resolves @/lib/assistant/tools through project tsconfig → server-only / next/cache / next/headers shims pass → .env.local loads (FLAGS, Supabase keys) → tools/list returns both tools with correct Apps SDK widget metadata → tools/call returns structured props + text output → /mcp-use/widgets/contact_card/ serves the widget HTML with @/components resolved via the project's own tsconfig paths * fix(inspector): detect Hono via duck-typing, not instanceof `mountInspector(app)` chooses between a fast Hono-direct path and a slow Express-compat bridge based on `app instanceof Hono`. When the host (`mcp-use`) and `@mcp-use/inspector` resolve different copies of `hono` from `node_modules` — common in apps with deps that pin their own hono version (`@hono/node-server`, `@browserbasehq/stagehand`, etc.) — `instanceof` returns false even for a real Hono app. The Express bridge then runs against a Hono `Context` and crashes on every request trying to read `req.headers.host`. Switch to a duck-type check: Hono exposes `.fetch(Request) => Response`, Express does not. The check is unambiguous in practice and works regardless of which physical hono module produced the app. Surfaces in the new Next.js drop-in flow (--mcp-dir) because Next.js apps invariably have other deps that bundle hono. * fix(widgets): pin React across HMR reloads to keep hooks dispatcher alive When a widget lives in an existing app (the --mcp-dir drop-in flow), Vite's walk-up react resolution from `.mcp-use/<widget>/` could land on a different physical `node_modules/react` than the one item-brain's shared components see. After an HMR re-optimize, the new React module instance replaced the running one and React's hooks dispatcher snapped to null, producing "Cannot read properties of null (reading 'useState')" on the next render. First load was fine; only post-edit renders crashed. Pin react / react-dom / react/jsx-runtime / react/jsx-dev-runtime to the absolute paths of the user-project's installed copies via a tiny `resolveId` plugin scoped to client (browser) resolution only. SSR mode deliberately falls through to default resolution because the metadata- extraction pass uses `ssrLoadModule` and ESM-evaluating CJS `react/index.js` crashes with `module is not defined`. The plugin honors `options.ssr` and returns `null` in that case; SSR also gets react/react-dom marked as external for belt-and-braces. Validated on a real Next.js 16 + React 19 app: edit the widget tsx mid-flight → no React errors, widget HTML still serves 200, tools/call returns updated structuredContent. * fix(widgets): rely on Vite dedupe instead of pinning React paths The previous fix pinned `react` and `react-dom` to the user-project's absolute file paths via a custom `resolveId` plugin. That made Vite serve the raw CJS files via `@fs/`, skipping the optimizeDeps pre-bundling that converts them to ESM with named exports. Result: the browser failed with "does not provide an export named 'jsxDEV'" (the first React subpath it tried to load) and would have failed on `react/index.js` next ("module is not defined") because the raw CJS has no ESM default export. Drop the plugin and broaden Vite's `dedupe` list to cover every React entrypoint the widget code might import: react react-dom react/jsx-runtime react/jsx-dev-runtime react-dom/client `dedupe` ensures Vite resolves a single instance of each module regardless of importer location, which is what protects the hooks dispatcher across HMR cycles. The original concern (duplicate React post-edit producing "Cannot read properties of null (reading 'useState')") is the dedupe contract — `dedupe` is the supported way to enforce it, and it doesn't bypass optimizeDeps. Also drop the now-unused SSR external for React (added defensively when the alias was breaking SSR; no longer relevant). Verified end-to-end: react/react-dom/jsx-dev-runtime all serve from .vite/deps/*.js?v=<hash> (pre-bundled ESM), HMR cycle clean, no useState/jsxDEV errors after editing the widget mid-flight. * chore: address PR review + fix prettier/CI Prettier: - `prettier --write` on the three files flagged by format:check (cli/src/index.ts, cli/src/utils/project-config.ts, mcp-use/src/server/widgets/mount-widgets-dev.ts). No logic changes. project-config.ts: - `loadProjectConfig`: distinguish ENOENT from JSON parse errors. Malformed mcp-use.config.json now throws `Invalid JSON in <path>: <reason>` instead of being silently ignored. - `resolvePort`: validate each source (CLI flag, PORT env, config.port) against `Number.isInteger(…) && 0 ≤ n ≤ 65535`. Invalid values at one level fall through to the next, so `--port abc` or `PORT=abc` no longer advertise NaN. - Tests: add `tests/project-config.test.ts` — 23 unit tests covering `loadProjectConfig` (missing / valid / malformed), `resolveMcpDir`, `resolveWidgetsDir`, `resolveEntryFile` (every precedence level + mcpDir-specific errors + legacy fallback), and `resolvePort` (NaN handling + out-of-range + per-source fallthrough). mcp-server.ts: - `mountWidgets` call: match the comment's intent by only forwarding `resourcesDir` when `MCP_USE_WIDGETS_DIR` is set. When unset, `mountWidgets` applies its own default, so the spread pattern keeps the runtime behavior identical while letting future default-logic changes take effect. mount-widgets-dev.ts: - `vite-tsconfig-paths` resolution now falls back to `@mcp-use/cli`'s bundled copy when the user's project doesn't have it installed directly. pnpm/strict hoisting configurations couldn't resolve it through `userProjectRequire` alone, which silently dropped `@/*`-alias support for Next.js drop-in projects. - Extract the Tailwind `@source "<projectSrc>"` line computation into a module-level `computeProjectSrcSourceLine` helper. Both CSS generation sites (initial mount + on-the-fly HMR) now call the same function, which also fixes the indentation mismatch Copilot flagged in the second block. * fix(cli): drop shadowed require("node:url") in HMR onImport callback The outer destructure at the top of the HMR block already pulls in `fileURLToPath` from `node:url`. The inline `require("node:url")` inside the `onImport` callback re-declares it (making the outer binding unused) and uses CJS `require()` in an ESM file — tripping two eslint rules: - @typescript-eslint/no-unused-vars on the outer `fileURLToPath` - @typescript-eslint/no-require-imports on the inner require Use the outer binding directly. Functionally identical; eslint clean. * fix(cli): make `build` and `start` work for --mcp-dir projects Two shared failures for drop-in Next.js projects: 1. `generateToolRegistryTypesForServer` still used tsx's `tsImport`, which wraps tsx in a generated namespace. tsx's resolver then bails with `return nextResolve(...)` for any specifier whose parent URL doesn't carry that namespace — so transitive `@/lib/...` imports from the user entry never hit tsx's tsconfig-paths resolver and fail with `Cannot find package '@/lib'`. Mirror the dev-path fix: detect Next.js, install the server-runtime shims in-process, namespace-less `tsx/esm/api.register()` + `tsx/cjs/api.register()`, then native dynamic `import()`. 2. `transpileWithEsbuild(projectPath)` tried to walk every `.ts`/`.tsx` file in the project's `tsconfig.include` patterns. For a Next.js app that's `src/app/**/*`, `tailwind.config.ts`, RSC-only files, etc. — none of which are meant to be runtime-compiled by an MCP build. esbuild chokes on the first `require()` it sees in `tailwind.config.ts` and prints `Cannot find tsconfig file "tsconfig.json"`. Fix: in `--mcp-dir` mode, skip the full-project transpile and skip the `tsc --noEmit` type-check (the host Next.js app owns both). Record the `.ts` source as the entry point in the manifest. `mcp-use start` then runs it through tsx at boot — same setup as `mcp-use dev`, minus HMR — so the `@/*` aliases and the Next.js server-runtime shims are active in production too. Start's entry resolution now also includes `<mcpDir>/index.ts` / `.tsx` as fallback candidates, and spawns `node <tsx-bin> <file>` (with `withNextShimsEnv`) when the resolved entry is a TS file. Also: stop swallowing `findServerFile` errors silently. A misconfigured `--mcp-dir` previously cascaded into a manifest without an `entryPoint` and a confusing "No built server file found" at start time. Now it logs the underlying error immediately. * feat(inspector): improve navbar UX with smart tab collapsing, deploy button, settings menu, and expanded telemetry UI changes: - Move Chat tab to first position with always-expanded label and separator - Active tab label stays visible when navbar is collapsed - Add Deploy button linking to manufact.com/signup with inspector referrer - Move Tunnel button between Add to Client and Deploy, restyle with violet theme - Show Tunnel button in mobile layout - Consolidate theme toggle, command palette, and GitHub into a settings dropdown - Add "Report a Bug" menu item pre-filling GitHub issue with inspector label New telemetry events: - mcp_tunnel_action: track tunnel start/stop with success status - mcp_deploy_click: track Deploy button clicks with referrer - mcp_chat_configured: track chat API key setup (provider + model, no API key) - mcp_tab_navigation: track tab switches with previous/current tab - mcp_add_to_client: track which client users connect to (cursor, vscode, claude, etc.) - mcp_session_duration: fire on page unload with duration, tabs visited, tools executed Wired up existing unused events: - mcp_server_connection: fires when server transitions to ready (deduplicated) - mcp_server_removed: fires when user removes a server Engagement/retention metrics computable in PostHog from existing user_id (localStorage). * feat(inspector): add inspector environment to telemetry * chore: fix lint * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(react): restore window.fetch interceptor when useMcp unmounts (Via Proxy → Direct) (#1337) * fix(react): restore window.fetch interceptor when useMcp unmounts When a proxy-mode connection is torn down (e.g. switching from "Via Proxy" to "Direct" in the inspector), the BrowserOAuthClientProvider's window.fetch interceptor was never removed. The new direct connection would then route its OAuth discovery requests through the old proxy, which rewrites the `resource` field to the proxy URL, causing the "Protected resource does not match" error. Fix: call restoreFetch() in the useMcp useEffect cleanup so the interceptor is always torn down when the hook unmounts. Closes #1334 * chore: add changeset for proxy fetch interceptor teardown fix * fix(tests): count all console channels in useMcp logLevel isolation test The per-instance isolation test compared cumulative console.log counts before and after rendering a logLevel: "debug" instance. Debug-level output routes to console.debug, not console.log, so the counter never moved and `0 > 0` failed once .tsx tests started running. Snapshot log/info/debug/warn counts after the silent render (asserting all four are 0 — silent really is silent), then take the delta on log/info/debug after the debug render and assert > 0. * chore(typescript): version packages (canary) * refactor(cli): enhance deploy command with GitHub authorization handling (#1343) - Introduced GitHubAuthRequiredError to manage authorization requirements for personal accounts. - Updated deployCommand to handle repository creation errors and prompt for authorization when necessary. - Improved organization ID resolution and uncommitted changes checks during deployment. - Cleaned up code for better readability and maintainability. * chore(typescript): version packages (canary) * chore(cli): drop mcp-use.config.json, add shim tests + docs Remove the project-config.ts utility and mcp-use.config.json support — the --mcp-dir, --entry, and --widgets-dir CLI flags are sufficient, and the config file layer added maintenance surface without a clear user request. - Inline resolveEntryFile / resolveWidgetsDir into src/index.ts - Add unit tests for the Next.js shim noop exports (cache, headers, navigation, server) covering the contract those stubs promise to user code - Add unit tests for detectNextJsProject() and the loadNextJsEnvFiles() cascade ordering - Document --mcp-dir / --entry / --widgets-dir on dev/build/start in the CLI reference * chore(cli, mcp-use): centralize shim registry + guard widgets against server-only imports - Extract the Next.js server-runtime module list into `next-shims-registry.json`, loaded by both `next-shims-loader.mjs` (ESM) and `next-shims-cjs.cjs` (CJS). Adds a startup sanity check in the loader that throws if the registry and the per-module stub bodies drift out of sync. - Add a Vite plugin to both the CLI widget build (`buildWidgets`) and the `mount-widgets-dev` dev server that fails the build with an actionable error when a widget (or a module it transitively imports) pulls in a Next.js server-only specifier. The error names the offending specifier, the importing file, and points the user at moving the call into an MCP tool. * refactor(cli, mcp-use): replace vite-tsconfig-paths with Vite's native resolve.tsconfigPaths Vite 8 supports tsconfig paths resolution natively via `resolve.tsconfigPaths`, which makes the plugin redundant (and triggers a deprecation warning on every widget build/dev start). Drop the dependency and swap the plugin wiring for the native option at all three call sites: the metadata SSR server, the production widget build, and the dev mount in mcp-use. Also deletes the user-project-require / cli-fallback resolution dance in mount-widgets-dev.ts, which only existed to locate a copy of the plugin under pnpm strict-hoisting. Net -111 lines. * chore: remove changesets from PR * chore: restore next-js-drop-in changeset * fix(cli): fail `mcp-use build` when any widget fails Previously a widget whose Vite build threw (e.g. via the server-only guard) was caught, logged in red, and silently dropped from the result — the outer `build` command still printed `✓ Build complete!` and exited 0, emitting a manifest with zero widgets. CI couldn't tell a broken build from a widget-less project. Now `buildWidgets` tracks per-widget status and throws an aggregate error when any entry fails. The `build` command's outer try/catch turns that into `process.exit(1)` with a clear summary line ("N widget(s) failed to build: name1, name2"). Dev mode is unaffected — widget errors there surface in Vite's browser overlay as before. Regression test in tests/build-failure.test.ts spawns the real CLI against a fixture with a widget that imports a nonexistent module and asserts non-zero exit + no "Build complete" line. * chore: scope PR to next-js drop-in only Remove unrelated bleed that came in via the canary merge: - Revert CHANGELOG.md, package.json, and canary-side inspector/ mcp-use source changes to their origin/canary state. These are unrelated inspector UI work, proxy-fetch cleanup, and version bumps that belong to other PRs. - Delete changesets from other PRs (fix-proxy-fetch-interceptor-teardown, inspector-ui-improvements, late-lies-tan) and the stale pre.json — canary is no longer in pre-release mode. Net result: the PR diff against canary is now 16 files, all next-js drop-in scope (CLI, shims, tests, mcp-server widget env-var plumbing, dev-side widget guard, and docs). * fix(cli): surface git failures during deploy and normalize main (#1354) * refactor(cli): enhance deploy command with improved error handling and Git command execution - Introduced GitCommandError class for better error management during Git operations. - Updated deployCommand to handle Git initialization, adding remotes, and pushing changes with actionable error messages. - Refactored git utility functions to throw errors on failure, ensuring users receive clear feedback on issues encountered during deployment. * fix(cli): streamline error logging in deploy command for Git failures - Consolidated error logging for GitCommandError to improve readability. - Enhanced conditional checks for specific Git errors, ensuring clearer output for users during deployment failures. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Potential fix for pull request finding 'CodeQL / Uncontrolled command line' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deploy command with improved API session handling (#1356) - Introduced ApiUnauthorizedError for better error management during API authentication failures. - Added functions to prompt for reauthentication on 401 errors and ensure valid API sessions during deployment. - Updated GitHub connection status retrieval to handle reauthentication seamlessly. - Refactored deployCommand to improve organization ID resolution and error handling, enhancing overall user experience during deployment. * chore(typescript): version packages (canary) * feat: add copy/export chat button to MCPUse inspector (#1324) * feat: add copy/export chat button to MCPUse inspector * chore: copy/export chat button changeset * fix(inspector): improve copy/export chat UI and reliability * fix(inspector): fix blank assistant messages and polish chat export/copy format * fix(inspector): remove error role type * fix(inspector): skip any message copy that has no text content * fix(inspector): clean up chat export/copy implementation - Move changeset to correct location (out of copy/ subdirectory) - Use existing copyToClipboard and downloadJSON utilities - Remove includeToolCalls option; tools always included in markdown output - Render parts in order so tools appear inline with surrounding text - Replace ...m spread in JSON export with clean field projection - Remove <details> wrapper, fragile startsWith heuristic, and noise comments - Fix revokeObjectURL race condition with setTimeout in markdown export * test(inspector): add E2E tests for chat copy and export functionality Add data-testid attributes to copy/export buttons in ChatHeader and add three Playwright E2E tests covering copy to clipboard, export as JSON, and export as Markdown. * style(inspector): fix prettier formatting in ChatHeader --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(react): add colorScheme prop to McpUseProvider and ThemeProvider (#1365) - Introduced a new `colorScheme` prop in `McpUseProvider` to control the document's color scheme based on the active theme. - Updated `ThemeProvider` to apply the color scheme only when the `colorScheme` prop is enabled, preventing issues with iframe backgrounds when themes differ. - Enhanced documentation for both components to clarify the behavior and default values of the new prop. * chore(typescript): version packages (canary) * remove changeset * chore(release): release version 2.2.0 for @mcp-use/inspector and mcp-use - Enhanced chat functionality with "Copy Chat" and "Export Chat" buttons. - Removed hard dependencies on `@langchain/*` packages, allowing direct API calls. - Configured hosted chat URL to be set at runtime via `MANUFACT_CHAT_URL`. - Fixed issues with environment variable handling in server entrypoints. - Updated dependencies to latest versions, ensuring compatibility and stability. * feat: add Next.js drop-in feature to TypeScript server - Updated `docs.json` to include the new "nextjs-drop-in" feature in the TypeScript server documentation. - Enhanced `pnpm-lock.yaml` with dependencies for the Next.js drop-in feature, including `@tailwindcss/vite`, `@vitejs/plugin-react`, and `next`. - Added a new test application configuration in `pnpm-lock.yaml` to support the Next.js drop-in functionality. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: Andrew Khadder <andrew.khadder@gmail.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: pederzh <luigipederzani@gmail.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Pallavi Kumari <pallavilpmt1995@gmail.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): respect --org flag when a linked deployment exists in a different org (#1380) * fix(cli): respect --org flag when a linked deployment exists in a different org When `--org` is specified and a linked server exists in `.mcp-use/project.json`, check the server's organizationId before redeploying. If it belongs to a different org, skip the link and create a new server in the specified org instead of silently deploying to the wrong one. Closes MCP-1672 * fix(cli): name target org in linked-server mismatch warning Capture resolvedOrgName/resolvedOrgSlug in Step 2 and interpolate them into the Step 6 warning so users see which org the new server will be created in, not just "the specified org". * chore(cli): add changeset for --org linked-server override fix * chore(typescript): version packages (canary) * fix(cli): validate token on login and unify 401 handling (#1383) * fix(cli): validate token on login and handle 401s uniformly (MCP-1671) `mcp-use login` short-circuited on file presence alone, so a revoked or expired API key still produced "You are already logged in" and subsequent commands blew up with a raw 401 dump. Login now calls `testAuth()` after the `isLoggedIn()` check — on `ApiUnauthorizedError` it clears the stale config and falls through to the device-auth flow; network/other errors preserve the old message so offline users aren't forced through re-auth. Extracts a shared `handleCommandError(error, context)` helper in `utils/errors.ts` that converts `ApiUnauthorizedError` into a friendly "session expired — run `npx mcp-use login`" hint. Wired through `whoami`, `org`, `servers`, `deployments`, and `env` (which previously had no try/catch at all, so errors leaked as stack traces). `deploy`'s richer `promptReauthenticateOn401` flow is untouched. * refactor(cli): simplify login re-auth flow and chalk test mock Flatten the loginCommand re-auth branch in auth.ts to use an explicit needsReauth boolean instead of a try/catch with implicit fall-through and duplicated "already logged in" branches. Trim WHAT comments; keep the WHY on the catch (network/disk errors get the benefit of the doubt). Replace the Proxy-based chalk mock in errors.test.ts with a plain object covering the exact chains handleCommandError uses. Tighten the JSDoc on handleCommandError to drop the redundant "print a friendly error and exit" half. * fix(cli): send 401 re-auth hint to stderr The hint was going to stdout while the error header went to stderr, so `2>/dev/null` would swallow the header and leave a stray-looking success line, and scripts piping stdout would see noise after a failed command. Route both to stderr so they stay together. * chore(typescript): version packages (canary) * fix(inspector): add Open Graph and Twitter Card meta tags to hosted inspector (#1376) * fix(inspector): add Open Graph and Twitter Card meta tags to hosted inspector The hosted inspector at inspector.mcp-use.com was served with no og:*, twitter:*, or meta description tags, so links shared on Slack, X, LinkedIn, Discord, etc. had no preview card. Adds a description plus full OG and Twitter Card blocks to both the Vite-built index.html (what prod serves today) and the CDN shell path in shared-static.ts, along with a branded inspector-cover.png used as the social image. Closes MCP-1710 * refactor(inspector): ship OG cover image in inspector package Moves inspector-cover.png from docs/images/ to the inspector's public/ folder so it ships with @mcp-use/inspector via dist/web/. Adds a Hono route for /inspector/inspector-cover.png (registered ahead of SPA/CDN shell fallbacks and active in both modes) so the file is served with image/png instead of getting swallowed by the SPA fallback. Updates the og:image and twitter:image URLs in both the Vite build and the CDN shell path to the self-hosted https://inspector.mcp-use.com/inspector/ inspector-cover.png. * refactor(inspector): serve OG image from CDN instead of bundled file Point og:image and twitter:image meta tags to https://inspector-cdn.mcp-use.com/inspector-cover.png and remove the bundled public/inspector-cover.png and its local file-serving route. * chore(typescript): version packages (canary) * fix(inspector): preserve URL path in OAuth authorize redirect (#1360) * fix(inspector): preserve URL path in OAuth authorize redirect When an OAuth provider uses a basePath (e.g. /api/auth), the authenticate() function strips the URL to just the origin, causing the authorization redirect to go to the wrong URL. Preserve the pathname component when constructing baseUrl for the auth() call. Closes #1333 * chore: add changeset for oauth basepath fix * style: run prettier on useMcp.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(inspector): inline elicitation requests in chat thread (#1336) * feat(inspector): add InlineElicitationCard component for chat-inline elicitation * feat(inspector): render inline elicitation cards in MessageList * feat(inspector): pass elicitation handlers from ChatTab to MessageList * feat(inspector): suppress elicitation toast when chat tab is active * chore: format InlineElicitationCard and add changeset * refactor(inspector): extract shared elicitation form primitives Deduplicate form-rendering logic between ElicitationRequestDisplay (panel) and InlineElicitationCard (chat) by extracting a shared module: - schemaHelpers: enum/one-of/any-of choice parsing - useElicitationForm: form state, schema-default init, required-field validation - ElicitationFormFields: parameterized field renderer (boolean, number, select, enum, multi-select, textarea, input) Both callers now consume these pieces while keeping their distinct chrome (panel header/footer/toast vs. compact card + collapsed-after-response). Test IDs preserved so e2e coverage is unaffected. * chore: apply prettier formatting to shared elicitation primitives * chore(typescript): version packages (canary) * feat(skills): consolidate deprecated mcp-builder and chatgpt-app-builder skills (#1375) * feat(skills): consolidate mcp-builder and chatgpt-app-builder into mcp-apps-builder content Replace deprecated redirect stubs with the full mcp-apps-builder skill content so both skills work standalone without requiring users to install a separate skill. * feat(create-mcp-use-app): only copy mcp-apps-builder skill during project setup Skip deprecated mcp-builder and chatgpt-app-builder skills when installing skills into new projects. * feat(skills): replace deprecated reference files with mcp-apps-builder references Old flat references/ folders in mcp-builder and chatgpt-app-builder are stale and incompatible with the updated SKILL.md. Replace them with the full mcp-apps-builder reference structure so all links resolve correctly. * chore(changeset): patch create-mcp-use-app for deprecated skill skip * chore(typescript): version packages (canary) * refactor(mcp-use): Typescript OAuth Providers (#1321) * refactor(mcp-use): remove proxy mode from built-in OAuth providers All built-in providers are now DCR-direct only. The MCP server proxies metadata discovery to the upstream and verifies bearer tokens; clients register and authenticate directly with the upstream authorization server. Removed from the public interface: - `OAuthMode` type and `OAuthProvider.getMode/getClientId/getRegistrationEndpoint` - `CustomProviderConfig`: `mode`, `clientId`, `clientSecret` - `WorkOSProviderConfig`: `clientId`, `apiKey` - `BetterAuthProviderConfig`: `clientId` - Env vars: `MCP_USE_OAUTH_WORKOS_CLIENT_ID`, `MCP_USE_OAUTH_WORKOS_API_KEY`, `MCP_USE_OAUTH_BETTER_AUTH_CLIENT_ID` are no longer read by providers Routes: deleted proxy-mode branching; extracted `createAuthorizeHandler` and `createTokenHandler` as exported factories (dormant under DCR-direct, retained for the forthcoming `oauthProxyProvider`). Metadata passthrough now always returns the upstream body including `registration_endpoint`. Docs and examples updated to reflect the single DCR flow. WorkOS example renames the API-call key to the user-owned `WORKOS_API_KEY`. Auth0 README replaces the proxy architecture diagram and flow description with DCR-direct. A dedicated `oauthProxyProvider` will follow in a future release for users who need an MCP-server-mediated OAuth flow. BREAKING CHANGE: proxy mode config fields and env vars removed; see above. * feat(mcp-use): add OAuth proxy support Adds OAuthProxyProvider enabling servers to delegate OAuth flows to an external proxy, and refactors OAuth routes/middleware/setup to support the new provider type alongside the existing built-in providers. * feat(mcp-use): add Auth0 OAuth proxy example Demonstrates using OAuthProxyProvider with Auth0 as the upstream identity provider, showing how to configure and run the proxy server. * feat(mcp-use): add jwksVerifier helper and make verifyToken explicit Replaces the implicit `jwksUrl` config field on `oauthProxy` with an explicit `verifyToken` function. Ships a built-in `jwksVerifier()` helper that covers the standard JWT+JWKS case (Auth0, Okta, Google, etc.) while leaving the door open for non-JWT providers (e.g. GitHub opaque tokens). * docs: add custom OAuth provider to sidebar navigation * docs: rewrite OAuth provider authentication docs * chore: add changeset for OAuth provider refactor * chore: format * fix(oauth): normalize Supabase provider to use verifyJwt instead of skipVerification Aligns Supabase with Auth0, WorkOS, Keycloak, and Better Auth which all use the verifyJwt boolean convention. * fix(oauth): remove clientId from Keycloak provider, add audience field Keycloak DCR-based flows never expose the client_id to the MCP server — it is issued to the OAuth client during registration. The MCP server validates tokens against issuer + JWKS only; audience should be the MCP server URL (set via Keycloak audience mapper on client scopes), not clientId. - Replace `clientId` with `audience` in KeycloakOAuthConfig and KeycloakProviderConfig - Use `audience` (not clientId) for JWT `aud` claim verification - Remove client-specific role extraction via resource_access[clientId] - Add MCP_USE_OAUTH_KEYCLOAK_AUDIENCE env var (replaces MCP_USE_OAUTH_KEYCLOAK_CLIENT_ID) * docs(oauth): rename oauthProxyProvider to oauthProxy in changeset and docstring * chore: format * fix(oauth): accept JSON and parse form-encoded token responses in proxy GitHub's /login/oauth/access_token returns application/x-www-form-urlencoded by default, which made the proxy's token handler throw "Unexpected token 'a', 'access_tok'... is not valid JSON". Send `Accept: application/json` upstream and parse the response based on its Content-Type so both JSON and form-encoded providers work. * fix(oauth): override client_id at /authorize in proxy mode The authorize handler was forwarding the incoming client_id to the upstream as-is, while /token already overrode it with proxy.clientId. Stale DCR cache on the MCP client (e.g. a synthetic UUID from a prior issuer) would reach the upstream and produce a generic 404. In proxy mode only the configured client_id is valid upstream, so enforce it here the same way /token does. * chore: drop stale inspector reference from oauth-refactor changeset * docs(oauth): flesh out Supabase example with consent page and anon sign-in Adds an auth-routes module that hosts the consent screen Supabase redirects to after /authorize, including an anonymous sign-in flow for zero-config demos. Fixes the example's package name, validates SUPABASE_PROJECT_ID at startup, and documents the dashboard setup in .env.example. * chore: changeset to minor * docs(oauth): add Keycloak example using DCR-direct provider Mirrors the Auth0 example layout (server.ts, package.json, tsconfig, README, .env.example) and wires the new oauthKeycloakProvider against a locally-hosted Keycloak realm. The example runs without additional plumbing once the companion keycloak-auth-server docker setup is up, exposing get-user-info and get-keycloak-userinfo tools over an MCP-over-HTTP server with JWT verification via the realm's JWKS. * docs(oauth): drop private-repo references from Keycloak example README The README pointed at a companion keycloak-auth-server repo that isn't being published alongside this example. Rewrite the prerequisites as a BYO-Keycloak checklist (DCR, Trusted Hosts, web-origins policies), and drop the testuser/testpassword references that only made sense inside that other repo's seeded realm. * chore: fix readme * docs(oauth): modernize Supabase example to use supabase-js SDK Replaces raw fetch with @supabase/supabase-js methods (signInAnonymously, auth.oauth.getAuthorizationDetails, approveAuthorization, denyAuthorization). Renames the anon key env var to MCP_USE_OAUTH_SUPABASE_PUBLISHABLE_KEY and drops the legacy MCP_USE_OAUTH_SUPABASE_JWT_SECRET from the example — the provider continues to accept a jwtSecret for legacy HS256 projects, but new projects use ES256+JWKS automatically. * docs(oauth): refresh TypeScript OAuth provider guides Update provider docs to reflect the refactored TypeScript OAuth providers, and trim the Keycloak guide to assume an existing instance rather than walking through Docker setup. * docs(skills): align authentication references with new OAuth provider guidelines Rewrite the authentication reference set shared across mcp-apps-builder, mcp-builder, and chatgpt-app-builder to match the refactored TypeScript OAuth providers: remote-auth vs oauthProxy split, oauthProxy + jwksVerifier recipes, Supabase publishable keys + SDK pattern, verifyJwt rename, and first-class Auth0 and Keycloak guides. * docs(oauth): add dedicated OAuth Proxy provider page Splits the OAuth Proxy content out of custom.mdx and the authentication overview into its own provider page covering Google, Okta, Azure AD, Auth0 (non-DCR), and GitHub. custom.mdx now focuses on DCR-capable providers and links to the new page; the overview links to it too. * chore(typescript): version packages (canary) * docs(changelog): document v1.25.0 / inspector v3.0.0 release wave Add Mintlify changelog entries for the canary release wave: mcp-use v1.25.0 (OAuth DCR-direct refactor, Next.js drop-in), @mcp-use/cli v3.1.0, @mcp-use/inspector v3.0.0 (inline elicitation, OG meta tags), and create-mcp-use-app v0.14.9. * chore(typescript): add experimental option for peer dependency updates Updated the TypeScript changeset configuration to include an experimental option for controlling peer dependency updates, allowing only updates when out of range. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: pederzh <luigipederzani@gmail.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Pallavi Kumari <pallavilpmt1995@gmail.com> Co-authored-by: Kagura <kagura.chen28@gmail.com> |
||
|
Enrico Toniato
|
e9c4bd0150 |
fix(cli): surface git failures during deploy and normalize main (#1354) (#1355)
* fix(cli): surface git failures during deploy and normalize main (#1354) * refactor(cli): enhance deploy command with improved error handling and Git command execution - Introduced GitCommandError class for better error management during Git operations. - Updated deployCommand to handle Git initialization, adding remotes, and pushing changes with actionable error messages. - Refactored git utility functions to throw errors on failure, ensuring users receive clear feedback on issues encountered during deployment. * fix(cli): streamline error logging in deploy command for Git failures - Consolidated error logging for GitCommandError to improve readability. - Enhanced conditional checks for specific Git errors, ensuring clearer output for users during deployment failures. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Potential fix for pull request finding 'CodeQL / Uncontrolled command line' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deploy command with improved API session handling (#1356) - Introduced ApiUnauthorizedError for better error management during API authentication failures. - Added functions to prompt for reauthentication on 401 errors and ensure valid API sessions during deployment. - Updated GitHub connection status retrieval to handle reauthentication seamlessly. - Refactored deployCommand to improve organization ID resolution and error handling, enhancing overall user experience during deployment. * chore(typescript): version packages (canary) * feat: add copy/export chat button to MCPUse inspector (#1324) * feat: add copy/export chat button to MCPUse inspector * chore: copy/export chat button changeset * fix(inspector): improve copy/export chat UI and reliability * fix(inspector): fix blank assistant messages and polish chat export/copy format * fix(inspector): remove error role type * fix(inspector): skip any message copy that has no text content * fix(inspector): clean up chat export/copy implementation - Move changeset to correct location (out of copy/ subdirectory) - Use existing copyToClipboard and downloadJSON utilities - Remove includeToolCalls option; tools always included in markdown output - Render parts in order so tools appear inline with surrounding text - Replace ...m spread in JSON export with clean field projection - Remove <details> wrapper, fragile startsWith heuristic, and noise comments - Fix revokeObjectURL race condition with setTimeout in markdown export * test(inspector): add E2E tests for chat copy and export functionality Add data-testid attributes to copy/export buttons in ChatHeader and add three Playwright E2E tests covering copy to clipboard, export as JSON, and export as Markdown. * style(inspector): fix prettier formatting in ChatHeader --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(react): add colorScheme prop to McpUseProvider and ThemeProvider (#1365) - Introduced a new `colorScheme` prop in `McpUseProvider` to control the document's color scheme based on the active theme. - Updated `ThemeProvider` to apply the color scheme only when the `colorScheme` prop is enabled, preventing issues with iframe backgrounds when themes differ. - Enhanced documentation for both components to clarify the behavior and default values of the new prop. * chore(typescript): version packages (canary) * Feat/inspector/login (#1368) * feat(inspector): enhance chat functionality and UI - Added support for a new `LoginModal` to handle user authentication when rate limits are hit. - Updated `ChatTab` to manage client-side and server-side chat configurations more effectively. - Introduced `HostedUserMenu` in `LayoutHeader` for user session management. - Enhanced `InspectorContext` to include new properties for chat API configuration, stream protocol, and credentials handling. - Updated `LayoutContent` to pass new props related to chat streaming. - Added deduplication for React instances in `vite.config.ts` to prevent conflicts. These changes improve user experience by providing better handling of authentication and chat interactions. * refactor(inspector): improve code formatting and error handling - Enhanced code readability by adjusting formatting in `ChatTab`, `LoginModal`, and `ChatHeader` components. - Improved error handling in `LoginModal` and `useChatMessages` by restructuring try-catch blocks for better clarity. - Updated server response handling in `useChatMessages` to ensure consistent formatting and error logging. These changes contribute to a cleaner codebase and improved maintainability. * refactor(inspector): remove agent logging from useChatMessages - Eliminated redundant logging code from the `useChatMessages` hook to streamline functionality and improve code clarity. - This change enhances maintainability by reducing unnecessary network requests and simplifying the component's logic. * fix(inspector): resolve TS strict errors on feat/inspector/login - Remove duplicate hideConfigButton prop in ChatTab (merge artifact) - Wrap getPrompt in LayoutContent so callPrompt matches Record<string, unknown> - Mark unused App/IframeConsole/PromptResultDisplay/SavedPromptsList/useAutoConnect bindings - Drop unused modelPreferences local in useSamplingLLM Made-with: Cursor --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * Feat/server landing/deeplinks (#1369) * feat(landing): add Manufact Inspector deep link and update landing page content - Introduced a deep link to the hosted Manufact Inspector with pre-filled MCP server URL and selected Chat tab. - Updated landing page generation to include Manufact Inspector in the list of supported clients. - Added new styles for a call-to-action button to open the Manufact Inspector. * feat(landing): enhance landing page with Manufact Inspector deep link and content updates - Added a deep link to the Manufact Inspector with pre-filled MCP server URL and selected Chat tab. - Updated landing page content to include Manufact Inspector in the supported clients list. - Introduced new styles for a call-to-action button to access the Manufact Inspector. * Enhance chat configuration handling in Inspector (#1370) - Updated `InspectorContext` to improve chat URL configuration, allowing for runtime and build-time environment variable support. - Modified `registerStaticRoutes` to accept a new `manufactChatUrl` parameter, enabling dynamic chat endpoint configuration. - Enhanced `RuntimeConfig` interface to include `manufactChatUrl`, facilitating better integration of hosted chat features. These changes streamline the setup for the hosted inspector and improve flexibility for deployment configurations. * chore(typescript): version packages (canary) * Fix/inspector/remove langchain (#1372) * feat(inspector): add environment variable management to server commands - Introduced new API methods for managing environment variables, including listing, creating, updating, and deleting variables. - Updated the server command interface to include commands for environment variable management. - Enhanced the Inspector's chat functionality to support environment variable interactions, improving the overall user experience and flexibility in server configurations. * refactor(inspector): improve code formatting and readability across multiple files - Adjusted formatting in various TypeScript files to enhance readability, including consistent indentation and line breaks. - Refactored function signatures and console log statements for better clarity. - Improved the structure of object types in function parameters to align with best practices. - These changes contribute to a cleaner codebase and improved maintainability. * refactor(inspector): streamline chat function signatures for improved readability - Simplified the function signature of the `chat` function across multiple provider files by removing unnecessary line breaks. - This change enhances code clarity and maintains consistency in the function definitions, contributing to a cleaner codebase. * chore(typescript): version packages (canary) * Update inspector and typescript changelogs for releases v2.2.0 and v1.24.2, detailing new features such as first-party LLM providers, chat export functionality, and enhancements to the MCP use CLI. Include fixes for OAuth login behavior and improvements to the color scheme handling in the McpUseProvider. * Enhance static route registration in Inspector server to support dynamic chat URL configuration. The `registerStaticRoutesWithDevProxy` function now accepts a `manufactChatUrl` parameter, allowing the hosted chat URL to be set at runtime based on the deployment environment. (#1373) * chore(typescript): version packages (canary) --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Pallavi Kumari <pallavilpmt1995@gmail.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> |
||
|
Enrico Toniato
|
4070f26294 |
Canary (#1320)
* feat(typescript): Add scopes customization to oauth providers * refactor: move scopesSupported to BaseOAuthConfig and remove test file * feat(typescript): add scopesSupported to better auth provider * fix: return scopesSupported properly for Better Auth provider factory * docs(oauth): add scopesSupported to provider docs * chore: format * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): add missing fields to CustomProviderConfig to match docs (#1136) The Custom Provider docs show config fields (userInfoEndpoint, jwksUri, clientId, clientSecret, mode, scopes, audience) that don't exist in the code. This adds all documented fields to CustomProviderConfig and CustomOAuthConfig, implements the corresponding getters on CustomOAuthProvider, and resolves alias pairs (jwksUrl/jwksUri, scopes/scopesSupported). * style: fix prettier formatting in custom oauth provider * fix: add OAuthProvider interface methods and fix unsafe type casts - Add getClientId(), getUserInfoEndpoint(), getAudience() as optional methods on OAuthProvider interface so new CustomOAuthProvider getters are callable without type casting - Make CustomOAuthConfig.jwksUrl optional (users provide their own verifyToken, JWKS URL isn't always needed) - Fix jwksUrl fallback from empty string to undefined in factory to avoid silent runtime failures - Replace unsafe (provider as any).config?.clientId with type-safe provider.getClientId?.() in routes.ts - Add getClientId() to WorkOSOAuthProvider for the pre-registered client detection in direct mode metadata * fix(typescript): remove scopes alias from CustomProviderConfig in favor of scopesSupported * fix(typescript): remove jwksUri alias from CustomProviderConfig in favor of jwksUrl * chore: update changeset to reflect jwksUrl and scopesSupported field names * fix: inline jwksUrl and scopesSupported in CustomOAuthProvider constructor * fix: simplify oauthCustomProvider by spreading config into constructor * fix: remove redundant comments from CustomProviderConfig * chore(typescript): version packages (canary) * fix(inspector): hide thinking indicator when assistant message has parts (#1315) * fix(inspector): hide thinking indicator when assistant message has parts When streaming via the server-side path, content is delivered through the parts array while the message's content field stays empty until the stream reader fully closes. The isThinking check only looked at content, causing a window where the thinking indicator reappeared after the done event but before setIsLoading(false) ran in the finally block. Now we check parts first — if any parts exist, the model has produced output and we should not show the thinking indicator. * chore: add changeset for thinking indicator fix * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in Google provider (#1317) * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in JSON Schema output z.record() in @langchain/core's serializer emits a `propertyNames` keyword for constrained or enum key types. Google's Generative AI API rejects schemas containing `propertyNames`, breaking tool calls when using the Google provider. Switching to z.object({}).catchall() produces identical runtime behavior but serializes to clean `additionalProperties` without `propertyNames`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: add changeset for Google provider propertyNames fix --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(typescript): version packages (canary) * Major/cli/device flow (#1294) * fix(inspector): sync URL tab param on tab change to preserve state on refresh When switching tabs via header clicks, keyboard shortcuts, or command palette, only React state was updated but the URL was not. This meant refreshing the page would lose the active tab. Now all tab changes also update the ?tab= query parameter using navigate() with replace:true. Closes #1157 * fix: update import paths for Windows compatibility and modify postins… (#1255) * fix: update import paths for Windows compatibility and modify postinstall script in package.json templates - Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms. - Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation. * fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility - Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems. * changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: add changeset * chore(typescript): version packages (canary) * feat(auth): enhance login command with API key option and implement device code flow - Updated the login command to allow non-interactive login using an API key. - Introduced device code flow for authentication, including functions to request device codes and poll for access tokens. - Refactored API key creation to use access tokens and updated related utility functions for better authentication handling. * refactor(cli): improve code formatting and readability in authentication commands - Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks. - Removed unused import in `auth.ts` to clean up the codebase. - Enhanced error messages for clarity in authentication processes. * refactor(logging): change logger level from info to debug for various messages - Updated multiple logging statements across the codebase to use `logger.debug` instead of `logger.info` for routine messages, enhancing log clarity and reducing noise in production logs. - This change applies to session management, agent initialization, and connection handling, ensuring that only significant events are logged at the info level. * fix(oauth): correct Auth0 issuer handling and improve token validation - Updated the Auth0 issuer to include a trailing slash to comply with token validation requirements. - Separated baseUrl from issuer to prevent double-slash URLs in JWKS, auth, and token endpoints. - Added direct mode for the Auth0 provider to enable MCP clients to communicate directly for OAuth flows. - Enhanced protected resource metadata to include scopes_supported, ensuring clients request appropriate scopes during authorization. * update * lint --------- Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * refactor(cli): update authentication and organization handling (#1326) - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * fix(inspector): use correct OAuth callback URL when mounted at /inspector (#1323) * fix(inspector): use correct OAuth callback URL when mounted at /inspector The BrowserOAuthClientProvider defaulted redirect_uri to /oauth/callback but the React Router (basename="/inspector") only mounts OAuthCallback at /inspector/oauth/callback, causing a blank screen after auth. Root fix: add defaultCallbackUrl prop to McpClientProvider so the inspector declares the correct path once at the provider level. All addServer calls inherit it automatically — no per-connection wiring needed. Removes the "Redirect URL" field from the auth dialog: it was never actually passed to the connection and couldn't be set to a value the inspector would handle. * chore: bump mcp-use changeset to minor (new public API prop) * docs: document defaultCallbackUrl in McpClientProvider; remove redirectUrl from inspector connection-settings * chore(typescript): version packages (canary) * Device flow 2 (#1329) * refactor(cli): update authentication and organization handling - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * refactor(cli): streamline organization ID resolution in deploy command - Replaced the previous method of resolving the organization ID with a direct call to api.resolveOrganizationId() for improved clarity and efficiency. - Removed unnecessary comments and code related to organization ID handling, enhancing overall code readability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Fix/cli/git create (#1331) * refactor(cli): enhance deployment command and GitHub integration - Added new GitHub API methods for creating repositories and retrieving installation IDs. - Introduced git utility functions for initializing repositories, adding remotes, and committing changes. - Improved environment variable parsing and error handling in the deployment command. - Cleaned up code for better readability and maintainability. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deployment command options and improve code readability - Added a new option for specifying the deployment region in the CLI. - Rearranged and cleaned up command options for better organization. - Improved error handling and logging in the deployment process. - Refactored code for better readability and maintainability across several files. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(inspector, typescript): update changelogs for v2.0.0 and v1.24.0 releases - Added details for the major release v2.0.0 of the inspector, highlighting improvements in OAuth handling, chat UI, and tab persistence. - Documented the minor release v1.24.0 of mcp-use, featuring OAuth scope customization, telemetry support, and device-flow authentication enhancements. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: Andrew Khadder <andrew.khadder@gmail.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Enrico Toniato
|
6d7fd2e137 |
feat(mcp-use): add telemetry support and update dependencies (#1307) (#1308)
* feat(mcp-use): add telemetry support and update dependencies (#1307) - Introduced a new `tel-fetch` module under `mcp-use/telemetry` for enhanced telemetry functionality. - Updated import paths in `shared-routes.ts` to reflect the new module structure. - Added `test_app` configuration in `pnpm-lock.yaml` with necessary dependencies including React, TailwindCSS, and Zod. - Updated `package.json` to include new telemetry module paths and adjusted `tsup.config.ts` to build the new module. - Enhanced error handling in `mount.ts` to provide better logging during inspector UI mounting failures. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
6d7c4df9ef |
Canary (#1290)
* fix(inspector): sync URL tab param on tab change to preserve state on refresh
When switching tabs via header clicks, keyboard shortcuts, or command palette,
only React state was updated but the URL was not. This meant refreshing the
page would lose the active tab. Now all tab changes also update the ?tab=
query parameter using navigate() with replace:true.
Closes #1157
* feat(inspector): add editable MCP server aliases in connection settings
* fix(inspector): avoid reconnecting on alias-only edits
* chore: add changeset for server alias and updateServerMetadata
* docs: document updateServerMetadata in useMcpClient API reference
* fix: update import paths for Windows compatibility and modify postins… (#1255)
* fix: update import paths for Windows compatibility and modify postinstall script in package.json templates
- Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms.
- Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation.
* fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility
- Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems.
* changeset
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore: add changeset
* chore(typescript): version packages (canary)
* chore(deps): bump hono from 4.12.8 to 4.12.12 in /libraries/typescript (#1284)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* chore(deps): bump hono from 4.12.8 to 4.12.12 in /libraries/typescript
Bumps [hono](https://github.com/honojs/hono) from 4.12.8 to 4.12.12.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.8...v4.12.12)
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.12
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* chore(deps): bump vite from 8.0.0 to 8.0.5 in /libraries/typescript (#1280)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* chore(deps): bump vite from 8.0.0 to 8.0.5 in /libraries/typescript
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.0 to 8.0.5.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite)
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* Update architecture.md
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* Update server routing and middleware references
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* feat(chat): add disabledTools prop to ChatTab and useChatMessages for enhanced tool management (#1291)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* feat(chat): add disabledTools prop to ChatTab and useChatMessages for enhanced tool management
- Introduced a new `disabledTools` prop in both `ChatTab` and `useChatMessages` to allow users to specify tools that should be excluded from the chat session.
- Updated the handling of chat messages to accommodate the new `disabledTools` feature, ensuring proper communication with the server.
* chore(typescript): version packages (canary)
* feat(auth): enhance login command with API key option and implement device code flow (#1292)
* feat(auth): enhance login command with API key option and implement device code flow
- Updated the login command to allow non-interactive login using an API key.
- Introduced device code flow for authentication, including functions to request device codes and poll for access tokens.
- Refactored API key creation to use access tokens and updated related utility functions for better authentication handling.
* refactor(cli): improve code formatting and readability in authentication commands
- Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks.
- Removed unused import in `auth.ts` to clean up the codebase.
- Enhanced error messages for clarity in authentication processes.
* Revert "feat(auth): enhance login command with API key option and implement d…" (#1293)
This reverts commit
|
||
|
Enrico Toniato
|
6255bbdbce |
Canary (#1238)
* chore: clean up package dependencies in pnpm-lock.yaml and package.json files (#1236) - Removed unused dependencies from the `blank`, `mcp-apps`, and `starter` templates, including `@openai/apps-sdk-ui`, `@tanstack/react-query`, `cors`, `express`, and `@tailwindcss/vite`. - Added a new `test_app` template with its own set of dependencies and devDependencies, including `react`, `react-dom`, and `tailwindcss`. - Updated `package.json` files to reflect the removal of unnecessary dependencies while maintaining essential ones like `typescript` and `tsx`. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: update @mcp-ui/client to version 7.0.0 and refactor MCP UI rendering components (#1237) - Updated the version of @mcp-ui/client from 6.1.0 to 7.0.0 in package.json and pnpm-lock.yaml. - Refactored McpUIRenderer and MCPUIResource components to remove legacy remote-dom support, now rendering content via sandboxed iframes. - Enhanced resource handling in MCPUIResource to ensure proper rendering of UI resources. - Cleaned up unused imports and improved code readability. * chore(typescript): version packages (canary) * refactor(mcp-use): change _trackClientInit method visibility from private to protected (#1239) Updated the visibility of the _trackClientInit method in both MCPClient and BrowserMCPClient classes to protected, allowing for better extensibility in subclasses. * chore(typescript): version packages (canary) * fix(mcp-use): remove _trackClientInit from class .d.ts surface Move _trackClientInit from a protected class method to a standalone function in both MCPClient and BrowserMCPClient. This removes it from the emitted .d.ts files, fixing TS2322 errors when pnpm creates multiple peer-variant copies of the same mcp-use version (each copy had its own nominal declaration of the method, making them structurally incompatible). * chore(typescript): version packages (canary) * fix(inspector): move mcp-use to peerDependencies Move mcp-use from dependencies to peerDependencies in @mcp-use/inspector so consumers share a single copy of mcp-use types. This fixes TS2322 errors caused by pnpm creating multiple peer-variant copies with nominally-incompatible class declarations. Also: - Add stripInternal to mcp-use tsconfig.json - Mark internal protected members with @internal in BaseMCPClient, BrowserMCPClient, and MCPClient - Use structural MCPConnection type in ChatTab * chore(typescript): version packages (canary) * fix(mcp-use): revert stripInternal that broke tool handler type inference The stripInternal tsconfig option was stripping @internal JSDoc tags across the entire package, removing type information that tool handler callbacks relied on for parameter inference. The peer dep fix in @mcp-use/inspector is the correct solution for the pnpm type duplication issue. * chore(typescript): version packages (canary) * Merge pull request #1241 from mcp-use/alert-autofix-82 Potential fix for code scanning alert no. 82: Reflected cross-site scripting * chore(inspector, typescript): update changelogs for v0.26.0 and v1.22.2 releases - Added details for v0.26.0 focusing on peer dependency alignment and MCP UI v7 enhancements in the inspector changelog. - Updated v1.22.2 changelog to reflect type compatibility improvements and dependency updates, including fixes for TypeScript conflicts and upgrades to @mcp-ui/client. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
7d2112e89c |
Canary (#1228)
* feat(telemetry): integrate telFetch for improved data fetching (#1224) - Added `telFetch` to the telemetry utilities, enhancing data fetching capabilities. - Updated `registerInspectorRoutes` to utilize `telFetch` for PostHog and Scarf requests, ensuring consistent telemetry handling. - Removed error logging in telemetry catch blocks to maintain silent operation during failures. * chore: enter canary prerelease mode * chore: update flatted dependency version to 3.4.2 in package.json and pnpm-lock.yaml * feat(mcp-use): enhance middleware and type definitions (#1227) - Added new types for middleware context and parameters, including `ToolsCallParams`, `ResourcesReadParams`, and `PromptsGetParams`. - Introduced `McpMiddlewarePatternMap` and `McpMiddlewareFnFor` to improve type inference for middleware functions. - Updated `ResourceTemplateDefinition` and related types to support optional Zod schemas for parameter validation. - Enhanced `MCPServerClass` to utilize the new type definitions, ensuring better type safety and flexibility in middleware handling. * chore(typescript): version packages (canary) * Fix/ctx auth optional typing (#1229) * fix: make ctx.auth accessible when OAuth is not configured Change McpContextBase.auth from `never` to `AuthInfo | undefined` so that `ctx.auth` can be null-checked in tool callbacks even when OAuth is conditionally enabled via environment variables. * fix: singleton AsyncLocalStorage, safe Hono context extraction, auth propagation - context-storage: use globalThis to guarantee a single AsyncLocalStorage instance even when bundlers split the module into multiple chunks - tool-execution-helpers: replace Object.create(honoContext) with explicit property extraction to avoid Hono private field access errors (#req, #var) - mcp-server: forward mwCtx.auth and mwCtx.state to the enhanced tool context so HTTP middleware data reaches tool handlers * chore(typescript): version packages (canary) * feat: ErrorBoundary fallback/onError props, inspector fix, connector improvement (#1230) - ErrorBoundary: add `fallback` (ReactNode | (error) => ReactNode) and `onError` callback props for custom error UI and reporting - Update ErrorBoundary docs (errorboundary.mdx, api-reference.mdx) - Inspector: MCPAppsRenderer fix - Connectors: base.ts improvements * chore(typescript): version packages (canary) * feat(chat): enhance message conversion to support tool results and multimodal content (#1231) - Added functions to extract text content and serialize tool results. - Updated `convertMessagesToLangChain` to handle tool invocations and return structured messages, including `ToolMessage` for tool results. - Improved handling of user and assistant messages, ensuring proper context preservation across conversation turns. * chore(typescript): version packages (canary) * feat(org): add organization management commands and enhance deployment options (#1232) - Introduced new commands for managing organizations: `org list`, `org switch`, and `org current`. - Enhanced the `deploy` command to accept an `--org` option for specifying the target organization. - Implemented organization selection during login and updated user info display to include organization details. - Added utility functions for prompting organization selection and retrieving stored profile information. * chore(typescript): version packages (canary) * feat(cli): add --yes option to skip confirmation prompts during deployment (#1233) - Introduced a new `--yes` option to the deploy command, allowing users to bypass interactive confirmation prompts. - Updated the deployment process to handle non-interactive scenarios, improving usability in CI environments. - Enhanced related functions to respect the `yes` flag for GitHub setup and deployment confirmations. * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v0.25.1 and v1.22.1 releases - Added details for v0.25.1, highlighting improvements in chat history tool results and ErrorBoundary customization. - Included v1.22.1 changes, featuring CLI organization management, non-interactive deployments, and enhanced middleware context propagation. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
b76df332f6 |
Canary (#1218)
* ci: enhance CI workflow with tunnel testing for dev and start commands - Added new jobs to test the development and start commands with the `--tunnel` flag in the CI workflow. - Implemented logic to start the dev server and poll for the tunnel URL, ensuring it is generated successfully. - Included cleanup steps to terminate the server processes after testing. - Enhanced error handling to report if the tunnel URL is not found in the output logs. * docs: fix changelog order (newest first) * chore: move tunnel testing from create-mcp-use-app CI to inspector E2E - Remove tunnel steps from create-mcp-use-app-tests (dev --tunnel, start --tunnel) - Add run-tunnel-test.mjs (test_tunnel) in inspector E2E scripts - Add test:e2e:tunnel script and inspector-e2e-tunnel job * chore: enter canary prerelease mode * fix: prettier format run-tunnel-test.mjs * feat: add reconnection options to conformance client (#1212) * feat: add reconnection options to conformance client - Introduced `reconnectionOptions` with a `maxRetries` setting to enhance the conformance client’s ability to handle connection issues. * fix(tests): update prompt server path in test configuration - Modified the test configuration to use the correct path for the prompt server, ensuring that the tests can locate and execute the server script properly. * chore(typescript): version packages (canary) * chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 (#1209) * chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 - Bumped Vite version from ^7.3.0 to ^8.0.0 across multiple package.json files. - Updated @vitejs/plugin-react from ^5.1.4 to ^6.0.0 in various templates and packages. - Adjusted pnpm-lock.yaml to reflect these changes. - Modified build configurations to use 'rolldownOptions' instead of 'rollupOptions' for consistency. * fix: ensure consistent handling of TypeScript file paths across platforms - Updated path handling in TypeScript-related functions to ensure compatibility with Windows and other operating systems. - Refactored code to utilize `path.join` for constructing file paths, addressing issues with path separators. - Enhanced error handling in CLI tests to prevent failures due to missing build artifacts. * fix: prettier format run-tunnel-test.mjs * chore: update dependency versions in pnpm-lock.yaml and package.json - Changed the version specifier for `ai` from `^6.0.116` to `>=5.0.52`. - Updated `express-rate-limit` from `^7.5.1` to `>=8.2.2` in both `pnpm-lock.yaml` and `package.json`. - Adjusted the corresponding version in the lock file to reflect the new version of `express-rate-limit`. * test: enhance telemetry test stability with increased wait times - Updated `beforeEach` to include a delay for settling lingering telemetry. - Increased wait times from 100ms to 500ms in multiple test cases to ensure telemetry events are captured reliably. * chore(typescript): version packages (canary) * Feat/use-files (#1213) * feat(react): add useFiles hook with isSupported detection Adds useFiles() hook for file upload and download in widgets. File operations are only supported in the ChatGPT Apps SDK environment. The MCP Apps spec (SEP-1865) has deferred file handling, meaning MCP Apps clients (Claude, Goose, VS Code) do not support file operations. The hook exposes an isSupported flag computed from the presence of window.openai.uploadFile and window.openai.getFileDownloadUrl, letting widgets render graceful fallback UI in non-ChatGPT environments rather than throwing runtime errors. - isSupported: true only in ChatGPT Apps SDK hosts - upload(file): delegates to window.openai.uploadFile, returns FileMetadata - getDownloadUrl(file): delegates to window.openai.getFileDownloadUrl - Both throw a descriptive error when called with isSupported === false Also adds: - FileMetadata type ({ fileId: string }) in widget-types.ts - Optional uploadFile/getFileDownloadUrl on the API interface - examples/server/ui/files/ — file manager widget with upload, progress state, download URL retrieval, and isSupported-based fallback notice - docs/typescript/server/widget-components/usefiles.mdx — API reference with isSupported usage, FileMetadata type, and error handling guidance * feat(react): add modelVisible option to useFiles and unit tests Adds model visibility control to useFiles().upload() and 19 unit tests verifying the full hook behaviour. ### modelVisible option By default, uploaded files are tracked in widget state under `imageIds` so ChatGPT includes them in the model's conversation context (matching the post-fix behaviour of Skybridge PR #539 which fixed privateContent not being preserved during setWidgetState). Pass `{ modelVisible: false }` to upload privately — the file is still uploaded via window.openai.uploadFile but the fileId is not added to imageIds, so the model won't see it. ```ts // Model sees this (default) const { fileId } = await upload(file); // Model does not see this const { fileId } = await upload(file, { modelVisible: false }); ``` Existing imageIds and other widgetState fields are preserved when tracking a new fileId, so uploads never wipe non-file state. ### Tests (19) - isSupported: false when window/openai undefined or partial - upload() error when not supported (message includes isSupported) - upload() delegates to window.openai.uploadFile - upload() returns FileMetadata - upload() calls setWidgetState with updated imageIds - upload() appends to existing imageIds - upload() preserves other widgetState fields - upload({ modelVisible: false }) skips setWidgetState entirely - upload({ modelVisible: false }) still returns FileMetadata - getDownloadUrl() error when not supported - getDownloadUrl() delegates to window.openai.getFileDownloadUrl - getDownloadUrl() passes through fileId * docs(skill): add files reference to mcp-apps-builder skill Adds references/widgets/files.md covering: - useFiles() hook (isSupported, upload, getDownloadUrl) - isSupported guard pattern — always required, renders fallback in MCP Apps - Model visibility: modelVisible option (true = tracked in imageIds, false = private) - Storing fileId in widget state vs caching download URLs - Error handling patterns Also adds a navigation entry and decision tree node to SKILL.md. * chore(typescript): version packages (canary) * feat(mcp-use): add MCP operation-level middleware support (#1137) - Introduced a new middleware system for handling MCP operations, allowing for cross-cutting concerns like logging and authentication. - Updated `MCPServerClass` to register and manage middleware entries dynamically. - Enhanced documentation to include examples of using `server.use('mcp:...', handler)` for middleware registration. - Added new types and utility functions to support middleware composition and context management. This commit enhances the flexibility and functionality of the MCP framework by enabling developers to define custom middleware for various MCP operations. * chore(typescript): version packages (canary) * Feat/model-context (#1214) * feat(react): add ModelContext component and modelContext imperative API Adds two complementary APIs for annotating widget UI with contextual descriptions the AI model can see, without requiring explicit tool calls or storing data in developer-managed state. - <ModelContext content="..."> — lifecycle-tied React component that participates in a parent-child tree via React context (useId + ParentIdContext). Supports empty children (leaf nodes) and nesting. - modelContext.set(key, content) / .remove(key) / .clear() — module-level imperative API that works anywhere: event handlers, plain functions, outside React. Entries are always root-level nodes. Both APIs feed into a shared global registry that serializes the node tree into an indented markdown-like string on every change (batched via queueMicrotask). The string is pushed to the host via: - MCP Apps: ui/update-model-context (structuredContent.__model_context) - ChatGPT Apps SDK: setWidgetState (__model_context merged into state) useWidget wires up a registerModelContextFlush handler on mount so annotations always reach the correct protocol channel. __model_context is filtered from the developer-facing state value returned by useWidget. setState preserves existing __model_context to prevent annotations from being wiped on state updates. Also adds: - examples/server/ui/model-context/ — interactive product browser example demonstrating nesting (<ModelContext>) and imperative (modelContext.set) usage with a visual context debug panel - docs/typescript/server/widget-components/modelcontext.mdx — API reference for both APIs, nesting behavior, serialization format, and comparison with setState * test(react): add model-context unit tests; expose test helpers Adds 25 unit tests covering the full ModelContext system: - Tree serialization: empty, single, multiple root entries, nesting, whitespace trimming, blank content skipped, upsert, remove, clear - modelContext imperative API: set/remove/clear, no-op on missing key - registerModelContextFlush: immediate notification on registration, deregistration stops calls, deregistering stale handler is safe - Batched flush: multiple synchronous mutations → single handler call - Context state passed to model: full integration of set + flush handler, update, remove, clear sequences Also exposes two @internal helpers required for testing module singletons: - _resetModelContextForTesting() — resets nodes/handler/flushScheduled - _getDescriptionForTesting() — returns the current serialized string without triggering a flush * docs(skill): add model-context reference to mcp-apps-builder skill Adds references/widgets/model-context.md covering: - When to use ModelContext vs setState - <ModelContext> component: nesting, siblings, leaf nodes, lifecycle - modelContext imperative API: set/remove/clear, cleanup rules - How the tree is serialized and sent to the model - Common patterns: tab-switching, selected item, multi-level dashboard Also adds a navigation entry and decision tree node to SKILL.md. * Update title in modelcontext.mdx Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: add changeset for useFiles and ModelContext minor features --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: prefix resource and prompt tool names to avoid collisions (#937) * fix: prefix resource and prompt tool names to avoid collisions (#910) When a resource and a prompt share the same name, the LangChain tools array sent to the API contains duplicate tool names, causing a 400 error. Prefix resource tools with `resource_` and prompt tools with `prompt_` to ensure unique names. * dynamic implementation to avoid prompt resource names collisions * fix: make reserveName collision-safe and sanitize prompt names - reserveName now checks the prefixed name for conflicts too, falling back to a numeric suffix when both base and prefixed names are taken. Previously a tool named resource_foo alongside a resource named foo would silently produce a duplicate tool name. - Prompt names are now sanitized through sanitizeToolName() for consistency with resource names. * chore: add changeset for tool name collision fix --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: map elicit result content to data for Zod validation (#1215) (#1216) * fix: map elicit result content to data for Zod validation The MCP SDK returns form data in result.content per the elicitation spec, but createElicitMethod was checking result.data which is always undefined. This caused Zod validation to never run, leaving result.data as undefined for tool callbacks that use ctx.elicit() with a Zod schema. Now checks result.content (SDK spec) with fallback to result.data for backward compatibility with custom handlers. Fixes #1215 * fix: also fix inspector and tests for elicit content/data mapping - Inspector: send `content` instead of `data` per MCP spec - Server: also map `content` to `data` for non-Zod-schema elicit calls (verbose API overload), so conformance server tools work correctly - Tests: update all integration test mocks to use spec-correct `content` field instead of non-standard `data`, and adjust validation error assertions to match SDK-level schema validation - Add changeset Follows up on the initial fix in b90ea51e. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): implement tunnel management functionality (#1222) - Added API endpoints for starting, stopping, and checking the status of a tunnel. - Integrated tunnel management into the Layout and LayoutHeader components, allowing users to start and stop tunnels directly from the UI. - Updated context to manage tunnel state, including a loading state for starting the tunnel. - Enhanced the user experience with visual feedback during tunnel operations and added instructions for using the tunnel URL in ChatGPT. This feature improves the overall functionality of the inspector by enabling real-time tunnel management. * chore(typescript): version packages (canary) * chore(changelog): update changelog for v0.25.0 and v1.22.0 releases - Added details for v0.25.0: introduced tunnel management for `mcp-use dev`, Vite 8 build stack, and aligned elicit payload with MCP spec. - Updated v1.22.0: included enhancements for MCP middleware, new React hooks, and fixes for elicit and adapter functionalities. - Updated dependencies for both releases. * fix(tests): update server-telemetry test to mock startServer return value - Modified the mock implementation of startServer to return an object containing close and forceClose functions, ensuring proper handling in tests. - This change prevents actual server startup during tests while maintaining the expected interface. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gab <86735558+gabrielekarra@users.noreply.github.com> Co-authored-by: guoyangzhen <upgyz@qq.com> |
||
|
Enrico Toniato
|
26ef6bebb9 | docs: fix changelog order (newest first) | ||
|
Enrico Toniato
|
d96f39ae42 | docs: backfill changelog entries for missing patch releases | ||
|
Enrico Toniato
|
ed0fadbb01 |
Canary (#1200)
* Fix/move-zod-to-peer (#1198) * chore: update pnpm-lock.yaml and package.json to include zod dependency in mcp-use package and test_app configuration * feat(cli): implement TypeScript file collection and transpilation with esbuild - Added `collectTsFiles` function to gather TypeScript files based on tsconfig patterns using Node.js built-ins. - Introduced `transpileWithEsbuild` function to handle TypeScript transpilation, improving performance and memory usage. - Updated build command to utilize esbuild for transpilation and added an option to skip TypeScript type checking with `--no-typecheck`. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: update package dependencies in TypeScript libraries (#1199) * chore: update package dependencies in TypeScript libraries - Bump `qs` version from `>=6.14.1` to `>=6.14.2`. - Add new dependencies: `flatted`, `tar`, `hono`, `@hono/node-server`, `express-rate-limit`, `dompurify`, `minimatch`, `rollup`, `@modelcontextprotocol/sdk`, `ai`, `ajv`, `axios`, `body-parser`, `brace-expansion`, `@isaacs/brace-expansion`, `form-data`, `lodash`, and `@eslint/plugin-kit`. - Update `tar` version from `^7.5.9` to `^7.5.11` in multiple packages. - Update `hono` version from `^4.11.10` to `^4.12.7` in relevant packages. - Update `@modelcontextprotocol/sdk` version from `^1.26.0` to `^1.27.1` in relevant packages. - Update `express-rate-limit` version from `^7.4.1` to `>=8.2.2` in the example server feature. * chore: remove ajv dependency from TypeScript libraries - Removed `ajv` dependency from `package.json` and `pnpm-lock.yaml`. - Updated peer dependencies for `ajv-formats` to use `^8.0.0` instead of `>=8.18.0`. - Added new dependencies: `fast-json-stable-stringify`, `json-schema-traverse`, and `uri-js` with their respective versions. * fix: ensure widget parameter is non-null in setupWidgetRoutes - Updated the widget parameter retrieval in setupWidgetRoutes to use a non-null assertion, ensuring that the widget variable is always defined when serving static assets and widget index.html files. * chore(typescript): version packages (canary) * fix(typescript): use file:// URL in tsImport to fix Windows crash (#1193) * fix(typescript): use file:// URL in tsImport to fix Windows crash The tsImport call was passing serverFilePath (raw OS path) instead of serverFileUrl (file:// URL), causing ERR_UNSUPPORTED_ESM_URL_SCHEME on Windows. Fixes #1171 * fix(typescript): also fix file:// URL in generate-types and add Windows CI The original fix addressed tsImport in the dev command but missed the same bug in generateToolRegistryTypesForServer (used by generate-types and postinstall). Also adds Windows to the CLI test matrix so platform-specific path issues are caught in CI. * fix(typescript): fix Windows path separator issues in CLI tests - display-package-versions: use path.join instead of hardcoded forward-slash path - tsx-resolution: use path.join in assertions to handle backslash separators - cli-integration: skip when dist/index.cjs build artifact is missing --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(workflows): enhance environment variable usage in GitHub Actions - Updated multiple workflow files to use environment variables for better readability and maintainability. - Replaced direct references to GitHub context variables with environment variables in `claude.yml`, `conformance.yml`, `create-app-e2e-canary.yml`, `railway-deploy.yml`, and `typescript-pr-preview.yml`. - Improved conditional checks in scripts to utilize these environment variables, streamlining the workflow logic. * refactor(tests): format playwrightArgs for better readability - Reformatted the addition of `--grep-invert` arguments in the run-test-matrix script to improve code clarity and maintainability. * refactor(cli, mcp-use): update type generation functions to return success status (#1201) - Modified `generateToolRegistryTypesForServer` and `generateToolRegistryTypes` to return a boolean indicating success or failure instead of void. - Updated CLI commands to handle and log success or error messages based on the type generation outcome. - Enhanced error handling in type generation to prevent server crashes while providing feedback on failures. * chore(typescript): version packages (canary) * chore(docs): update changelog for v0.24.5 and v1.21.5 releases - Added entries for v0.24.5, detailing dependency updates and fixes for security alerts. - Included v1.21.5 changes, highlighting Zod peer dependency adjustments, esbuild transpilation improvements, and Windows path handling fixes. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: guoyangzhen <upgyz@qq.com> |
||
|
Enrico Toniato
|
dd77c3c67e |
Canary (#1187)
* fix(cli): add process.exit(0) to build command to prevent hang (#1184) * fix(cli): add process.exit(0) to build command to prevent hang The build command imports the server file via tsImport for type generation, which creates active handles that keep the event loop alive. Without an explicit process.exit(0), the process hangs indefinitely after printing "Build complete!". Closes #1181 * chore: add changeset for build hang fix * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix: update stale mcp-use-ts references in READMEs (#1182) * fix: update stale mcp-use-ts references to mcp-use monorepo All README files had badge/image URLs pointing to the old mcp-use/mcp-use-ts repo. Updated to mcp-use/mcp-use so badges, stars, license shields, and logo images resolve correctly on npm and GitHub. Also updated the mcp-use package README to mirror the main repo README content, and fixed eslint config path. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: narrow eslint no-extraneous-dependencies glob to src files only The mcp-use package rule was matching all .ts files including tsup.config.ts, which caused a false positive since tsup is a workspace-level devDependency. Narrow the glob to src/**/*.ts and index.ts so config files are excluded. --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(server): wrap transport.handleRequest with runWithContext in mountMcp (#1185) * fix(server): wrap transport.handleRequest with runWithContext in mountMcp mountMcp() was calling transport.handleRequest() directly without wrapping it in runWithContext(), so getRequestContext() (AsyncLocalStorage) always returned undefined inside tool callbacks. This caused ctx.auth and all other request context properties to be undefined since 1.21.3. Wrap all five transport.handleRequest() call sites in mountMcp() with runWithContext(c, ...) so the Hono Context is available throughout the MCP request lifecycle. Closes #1183 * fix(server): pass sessionId to runWithContext in stateful paths Pass the known sessionId to runWithContext on the 3 stateful call sites (recovery, existing session, new session) so that getSessionId() returns the correct value inside tool callbacks alongside getRequestContext(). * fix(server): ensure correct sessionId handling in stateful paths Updated the handling of sessionId in stateful call sites (recovery, existing session, new session) to ensure that getSessionId() returns the correct value within tool callbacks. This change addresses issues with context retrieval in the server's request lifecycle. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(docs): update changelog for v0.24.3 and v0.24.4 releases - Added details for v0.24.3, including a fix for sandbox host derivation for cloud-embedded inspector pages and an update to mcp-use v1.21.3. - Added details for v0.24.4, highlighting a dependency update with mcp-use v1.21.4. --------- Co-authored-by: Luigi Pederzani <luigipederzani@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Enrico Toniato
|
8d55603972 |
Canary (#1166)
* feat(python): add E2E testing for Python server in CI workflow - Introduced a new job in the GitHub Actions workflow to run end-to-end tests against the Python MCP server. - Updated the inspector.py to allow overriding the CDN base URL via an environment variable. - Added a new script command for running Python E2E tests in the package.json. - Enhanced documentation to include instructions for running Python server E2E tests. * fix(inspector): skip proxy when inspector is served from the MCP server itself When the inspector is embedded in a Python (or other) MCP server, the window.location.origin matches the MCP server's origin, so /inspector/api/proxy doesn't exist there. Routing auto-connect through that missing proxy caused silent connection failures. Now proxyAddress is only set when the inspector origin differs from the target URL's origin (i.e. the inspector has its own server running). Also add echo tool to server_example.py so python.test.ts can pass. * fix(inspector): detect proxy availability via runtime config injection Inject window.__MCP_PROXY_URL__ from the inspector server when it serves the HTML. When served from a Python/custom MCP server (same origin), the flag is absent and autoProxyFallback is disabled so no proxy is used. - Add proxyUrl to RuntimeConfig in shared-static.ts - Default to /inspector/api/proxy when inspector server serves - Read __MCP_PROXY_URL__ in App.tsx and configure defaultAutoProxyFallback - Disable autoProxyFallback when no proxy is available (no hosted fallback) * ci: trigger inspector E2E workflow on PRs to canary/main * ci: temporarily disable mix/prod/builtin E2E jobs for Python testing * ci: re-enable all E2E jobs, workflow_dispatch only * ci: re-enable E2E jobs for Python testing in CI workflow * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): resolve auto-connect issues for embedded servers This patch release addresses the auto-connect functionality of the inspector when served from an MCP server. Key changes include skipping the proxy when the inspector's origin matches the MCP server's origin and detecting proxy availability through runtime configuration. Additionally, the mcp-use package has been updated to version 1.21.2. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
