277 Commits

Author	SHA1	Message	Date
Enrico Toniato	405fac7a0b	Canary (#1116) ... * Dev inspector no-open (#1100) * fix(inspector): respect --no-open flag in dev mode standalone The inspector standalone server.ts (used in dev mode) was ignoring the --no-open flag and always opening the browser. This fix: 1. Adds hasNoOpenFlag() helper function to utils.ts to check for --no-open flag 2. Updates server.ts to check for --no-open before auto-opening browser in dev mode 3. Also adds --no-open support to cli.ts for consistency Fixes MCP-1406 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: add changeset for inspector --no-open fix Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Hono express middleware types (#1101) * fix: Add proper TypeScript types for Express middleware in Hono server - Added ExpressMiddleware and ExpressErrorMiddleware type definitions - Created ExtendedHonoUse type that accepts both Hono and Express middleware - Updated createHonoProxy return type to HonoWithExpressMiddleware - Removed (app as any) type assertions and used proper types - Fixes type errors when passing Express middleware to server.use() Resolves MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * test: Add Express middleware example and type tests - Created example demonstrating Express and Hono middleware compatibility - Example includes: Express middleware, Hono middleware, MCP tool, GET route, POST route - Added unit tests for Express middleware type compatibility - Example successfully runs and demonstrates all features - Added README with usage instructions Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * refactor: Use real npm middleware packages and remove type annotations - Replaced mock Express middleware with real packages: morgan and express-rate-limit - Removed all TypeScript type annotations from example code - Updated tests to use real npm packages - Updated README with correct usage examples - Server successfully runs with morgan logger and rate limiting Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * docs: Update documentation for Express middleware support - Updated architecture.md to show Express middleware is now supported - Updated tools.md note about Express middleware compatibility - Added Express middleware examples to api-reference.mdx - Enhanced middleware section in configuration.mdx with Express examples - Clarified that Express middleware is auto-detected and adapted Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: Add changeset and improve Express middleware detection robustness - Added changeset for Express middleware type fix - Improved middleware detection with pattern matching for both Express and Hono patterns - Added verification for 3-4 param functions to check Express patterns - Added Hono pattern detection for 2-param functions - Updated documentation to reflect more robust detection mechanism - Ran pnpm lint and pnpm format (all passed) Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * Tar package deprecation (#1102) * fix: remove deprecated @types/tar and update tar to latest version - Remove @types/tar from packages/cli (tar now includes its own types) - Remove @types/tar from packages/create-mcp-use-app - Update tar in create-mcp-use-app from ^7.4.3 to ^7.5.9 Resolves MCP-1428 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: add changeset for tar deprecation fix Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(typescript): add client-side completion support (#1056) * feat(typescript): add client-side completion support Add complete() method to BaseConnector, MCPSession, and useMcp hook to enable requesting autocomplete suggestions for prompt arguments and resource template URIs. Key changes: - Add complete() method to BaseConnector wrapping SDK client.complete() - Add complete() method to MCPSession with delegation to connector - Add complete() method to useMcp React hook with proper state management - Fix resourceTemplates state population (was exposed but never populated) - Add refreshResourceTemplates() method to useMcp hook - Update refreshAll() to include resource templates - Add comprehensive unit and integration tests - Add detailed documentation in docs/typescript/client/completion.mdx - Update docs/typescript/client/usemcp.mdx with new methods This enables users to request autocomplete suggestions from servers that provide completion callbacks via completable() in prompt schemas and resource templates. Closes #969 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(auth): resolve OAuth flow for WorkOS across client, server, and inspector (#1058) * add proactive token refresh and credential invalidation to BrowserOAuthClientProvider * fix OAuth token refresh by removing static Authorization header from transport config * add changeset * update refresh to use official mcp sdk methods * update workos to always use proxy method since its an external provider * update autoConnect to always include proxyAddress even without bearer tokens * run format * update changeset * chore: update pnpm-lock.yaml after rebase onto main --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * improvement(auth): accept full AuthKit domain in WorkOS subdomain config (#1057) * change subdomain to include authkit.app * add changeset * chore(typescript): version packages (canary) * Fix/inspector/first render (#1060) * fix(tsconfig): include .mcp-use directory in TypeScript configuration for starter and blank templates * fix(package.json): update postinstall script to remove fallback for generate-types in mcp-apps template * fix(MessageList): enhance tool metadata retrieval by normalizing tool names for consistency with API responses * feat(inspector): enhance MCPApps components with required props handling and improved UI feedback - Added `requiredProps` to `MCPAppsDebugControls` to auto-open a popover when required props are missing, providing users with a clear indication of necessary inputs. - Updated `MCPAppsRenderer` and `MessageList` to support cancellation state, allowing for better user experience during tool execution. - Enhanced `PropsConfigDialog` to detect and display required props from widget schemas, improving the configuration process. - Introduced utility functions in `usePropsLLM` for better JSON extraction from LLM responses, ensuring accurate prop generation. * feat(inspector): enhance IframeConsole with expandable log entries and improved log formatting - Added expandable functionality to log entries, allowing users to view detailed logs on click. - Introduced a copy button for logs, enabling easy copying of log content to the clipboard. - Improved log formatting and display, including inline previews and better handling of log levels. - Updated UI elements with new icons and styles for a more intuitive user experience. * feat(inspector): add clientOptions to InspectorDashboard for enhanced capabilities - Introduced `clientOptions` with `capabilities` to support new extensions in the InspectorDashboard component. - This enhancement allows for better integration with the MCP application protocol, improving overall functionality. * feat(inspector): refine Layout component by updating validTabs and adding clientOptions - Updated the `validTabs` array in the Layout component to remove the "playground" tab. - Added `clientOptions` with specific capabilities to enhance integration with MCP application protocol, improving functionality. * feat(types): enhance type definitions with detailed documentation and examples - Updated `MCPServerClass` tool and prompt definitions to include more specific type constraints for better type safety. - Enhanced `ServerConfig`, `InputDefinition`, and various resource and tool interfaces with comprehensive JSDoc comments, including examples for clarity. - Improved overall type definitions for widgets and tools, ensuring better integration and usability within the MCP framework. - Added missing descriptions and examples to several interfaces, improving developer experience and documentation quality. * feat(mcp-apps): update server and widget integration for enhanced functionality - Refactored the MCP server setup to improve integration with MCP Apps, including updated descriptions and documentation links. - Introduced a new search tool for fruits, allowing users to filter results and display them in a visual widget. - Enhanced the product search result widget with improved loading states and detail views for selected fruits. - Removed unused dependencies and components to streamline the project structure. - Updated README files to reflect changes and provide clearer guidance for users. * feat(inspector): enhance MCPAppsRenderer and ui-resource-registration for improved widget re-initialization and metadata handling - Added logic in MCPAppsRenderer to re-read `prefersBorder` from the server upon widget re-initialization, improving responsiveness to metadata changes. - Implemented detection of widget re-initialization to ensure tool input is correctly sent to new widget instances after events like HMR page reloads. - Refactored resource registration in ui-resource-registration to dynamically resolve the latest enriched definitions, ensuring accurate metadata is used during HMR updates. - Updated read callbacks to handle dynamic URIs and maintain consistency in resource handling, enhancing overall widget functionality. * feat(widget): enhance useWidget hook and documentation for improved functionality - Updated the `useWidget` hook to support additional generic parameters for better type safety and flexibility. - Introduced new props for real-time streaming and external link handling, enhancing widget capabilities. - Improved documentation in SKILL.md and ui-widgets.mdx to clarify usage of new features, including partial argument streaming and external navigation. - Removed deprecated dependencies from package.json files across templates to streamline project setup. - Enhanced various components to utilize new props and improve user experience during tool interactions. * feat(tsconfig): enhance TypeScript configuration and widget functionality - Updated TypeScript configurations across multiple templates to include incremental builds and build info file paths, improving build performance and efficiency. - Modified the `useWidget` hook to streamline state management and enhance type safety by refining generic parameters. - Simplified the `ProductSearchResult` component by reducing unnecessary generic parameters, improving code clarity and maintainability. - Adjusted helper functions to ensure consistent type handling across the widget framework. * feat(update-check): implement update notification for mcp-use CLI - Added a new utility to check for updates of the mcp-use package and notify users if a newer version is available. - Integrated the update check into the CLI's pre-action hook, ensuring users are informed before executing commands. - Created a caching mechanism to minimize unnecessary network requests and improve performance. * feat(inspector): add file utilities for client file management - Introduced a new `file-utils.ts` module containing functions to determine content types based on file extensions, check for the existence of client files, and retrieve the client distribution path. - Updated the middleware to utilize these new utilities for improved handling of client files, including warnings when files are not found. * feat(inspector): update TypeScript and MCPApps components for improved functionality - Added TypeScript version 5.9.3 to the pnpm-lock.yaml for enhanced type safety and features. - Enhanced MCPAppsDebugControls to prevent auto-application of localStorage presets in tool context. - Refactored MCPAppsRenderer to optimize state management and prevent unnecessary re-renders, including the use of refs for tool input and output. - Improved OpenAIComponentRenderer with better state handling and batching of updates to prevent double renders. - Updated ToolsTab to streamline resource pre-fetching and reduce unnecessary renders during tool execution. - Enhanced ToolResultRenderer and ToolResultDisplay for better memoization and performance. - Introduced a new RelativeTimeDisplay component to manage time updates without affecting parent re-renders. * chore: update pnpm-lock.yaml after rebase onto main Co-authored-by: Cursor <cursoragent@cursor.com> * fix: update postinstall script in package.json templates to prevent failure on type generation * Potential fix for code scanning alert no. 81: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * feat(inspector): add HTML escaping function for safe user input handling - Introduced a new `escapeHtml` function to sanitize user input in responses, preventing potential XSS vulnerabilities. - Updated the CDN server response to utilize the `escapeHtml` function when returning 404 error messages. * chore: update TypeScript version to 5.9.3 across multiple packages and enhance component functionality - Added TypeScript version 5.9.3 to pnpm-lock.yaml and various package.json files for improved type safety. - Enhanced OpenAIComponentRenderer to optimize state updates and prevent redundant dispatches. - Updated ResourceResultDisplay to include a data-testid for better testing capabilities. - Improved debugging tools to scope props dialog interactions to the correct resource widget preview. * format * refactor(tests): update widget integration and data flow tests to align with SEP-1865 specifications - Adjusted tests to verify that widget metadata is now located on tool definitions rather than in tool call results, as per SEP-1865. - Updated assertions to check for structured content in results instead of relying on metadata properties. - Enhanced test coverage for tool invocation and output structure to ensure compliance with new standards. * package * test(widget-helper): enhance integration tests for tool metadata validation - Updated assertions to ensure manual and auto tools are defined before checking metadata properties. - Improved handling of auto tool metadata to account for potential absence of _meta. - Enhanced regex checks for output templates to ensure proper formatting and compliance with widget standards. * changeset --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): enhance MCPApps components and improve widget handling (#1063) * feat(inspector): enhance MCPApps components and improve widget handling - Added a new test_app configuration in pnpm-lock.yaml with updated dependencies for better development support. - Updated InspectorDashboard to set a default MCP_URL when not provided. - Refined ProductSearchResult and CarouselItem components to use a consistent text-danger class for better styling. - Improved error handling in InspectorDashboard for connection retries. - Streamlined MCPAppsRenderer to enhance widget re-initialization and metadata handling. - Removed deprecated dev widget endpoints and related logic to simplify the codebase. - Enhanced FormattedContentDisplay to allow toggling between formatted and plain text for better user experience. - Updated PropsConfigDialog and ResourceResultDisplay to utilize standardized metadata paths for improved prop detection. This commit focuses on enhancing the overall functionality and user experience of the MCPApps components and related widgets. * feat(inspector): enhance ToolsTab and ToolExecutionPanel for improved field handling - Introduced state management for tracking fields that should be sent as empty, allowing for explicit control over empty values in tool arguments. - Updated ToolsTab to initialize and manage sets of fields, enhancing the handling of tool input schemas. - Enhanced ToolExecutionPanel to accept and utilize the new payload structure, ensuring accurate representation of data sent during tool execution. - Added toggle functionality in ToolInputForm for explicitly sending empty objects and arrays, improving user experience and flexibility in input handling. This commit focuses on refining the input handling process within the inspector, providing users with better control over the data they send. * feat(widget): enhance useWidget hook to unwrap CallToolResult envelope - Updated the useWidget hook to unwrap the CallToolResult envelope when the OpenAI provider is used, allowing for direct access to structured content. - Improved handling of toolOutput to ensure compatibility with hosts that pass the full tool-result parameters. - Enhanced documentation comments to clarify the changes and improve understanding of the new logic. This commit focuses on refining the output handling within the useWidget hook, improving type safety and usability for developers. * feat(inspector): enhance CSP handling and widget re-execution logic - Updated the Inspector components to improve handling of Content Security Policy (CSP) settings, ensuring that widget metadata is correctly enriched with CSP directives. - Introduced logic to re-execute widgets when CSP mode changes, allowing for dynamic updates to the widget's execution context. - Enhanced the MCPAppsDebugControls and MCPAppsRenderer to better manage CSP violations and provide clearer user feedback on required props. - Refactored the PropsConfigDialog to utilize standardized metadata paths for improved prop detection and configuration. This commit focuses on refining the CSP management and widget lifecycle within the inspector, enhancing overall functionality and user experience. * refactor(tests): update weather-display widget tests for props handling - Modified tests in `aaa-ui-widgets.test.ts` to check for visibility of props wall text instead of iframe visibility, ensuring that the widget's required props are correctly validated. - Removed unnecessary iframe visibility checks in `debugger-tools.test.ts` to streamline the test flow and focus on props configuration. - Updated `navigateToResourcesAndSelectWeather` helper function to wait for props wall text, enhancing clarity on widget requirements during testing. This commit enhances the accuracy of widget tests by focusing on required props visibility, improving overall test reliability. * chore(typescript): version packages (canary) * docs: add completion page to nav and McpClientProvider example * feat(examples): add completion server and client example - Add completion server with static list, dynamic callback, and resource template - Add Node client example demonstrating prompt and resource completions - Add example:server:completion, example:client:completion, example:completion scripts - Update completion docs with run instructions --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Sidharth Shambu <sshambu@MacBookPro.lan> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(mcp-use): enhance host information and capabilities handling (#1082) * feat(mcp-use): enhance host information and capabilities handling - Added `hostInfo` and `hostCapabilities` properties to `McpAppsBridge` for storing host details during initialization. - Implemented `getHostInfo` and `getHostCapabilities` methods to retrieve host information. - Updated `useWidget` to manage and expose host information and capabilities state. - Enhanced `UseWidgetResult` type to include `hostInfo` and `hostCapabilities` for better integration with widgets. - Introduced `ClientCapabilityChecker` interface to provide structured access to client capabilities and information in the context. * feat(mcp-use): enhance client information handling and context management - Introduced `ctx.client.info()` and `ctx.client.supportsApps()` methods for improved client identification and MCP Apps support checks. - Updated `useWidget` to include `hostInfo` and `hostCapabilities` properties, enhancing widget integration with MCP Apps. - Enhanced context management in `mcp-server.ts` to provide a structured client capability checker, ensuring consistent access to client capabilities across different handlers. - Improved documentation to reflect new client and host information features, providing clearer guidance for developers. * feat(mcp-use): enhance user context handling and capabilities integration - Introduced `UserContext` to extract and normalize end-user metadata from request-level parameters, improving personalization and context awareness in tools. - Updated `createEnhancedContext` to include user context, allowing tools to access user-specific information such as locale and location. - Enhanced `toolRegistration` and `createEnhancedContext` methods to handle user metadata, ensuring consistent access across different handlers. - Improved documentation to reflect new user context features and their usage in tools and resources. * chore(typescript): version packages (canary) * feat(inspector): enhance logger middleware to filter noisy API endpoints (#1104) - Updated logger middleware to filter out noisy endpoints (telemetry, RPC stream/log) to reduce log spam. - Introduced a list of noisy paths and modified the logger function to skip logging for these paths, improving log clarity and relevance. * chore(typescript): version packages (canary) * feat(docs): add per-server elicitation and sampling callbacks examples - Introduced documentation for per-server elicitation and sampling callbacks, allowing different MCP servers to define their own callback functions. - Added TypeScript examples demonstrating how to configure `onElicitation` and `onSampling` for individual servers, enhancing flexibility in handling user interactions. - Updated precedence order tables for both elicitation and sampling to clarify callback resolution hierarchy. * fix(react): make health check and reconnection intervals configurable (fix #985) (#994) * feat(mcp-use): enhance reconnection and health check options - Updated `autoReconnect` configuration to support detailed options for reconnection and health checks, including initial delay, health check interval, and timeout settings. - Introduced `reconnectionOptions` for controlling the retry behavior of the underlying transport, allowing for more granular control over reconnection strategies. - Enhanced documentation to clarify the new configuration options and their usage, improving developer experience and flexibility in managing connections. * changeset --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(widget): enhance sendFollowUpMessage to support content block arrays (#1085) - Updated the `sendFollowUpMessage` method to accept both string shorthand and an array of `MessageContentBlock` objects, allowing for richer message content per the SEP-1865 `ui/message` specification. - Modified documentation and examples across various files to reflect the new functionality, including usage of text, image, and resource blocks. - Ensured compatibility with the ChatGPT Apps SDK, clarifying that only text blocks are utilized in that context. * chore(typescript): version packages (canary) * feat(mcp-use): add proxy server functionality and documentation (#1113) - Introduced a new `proxy` method in the `MCPServerClass` to allow mounting multiple MCP clients onto a single server, enhancing server capabilities. - Updated documentation to include a new "Proxy Servers" section, detailing usage examples and configuration options for the proxy feature. - Added relevant entries in the pnpm-lock.yaml to support the new proxy functionality, ensuring all dependencies are correctly managed. - Enhanced the `index.mdx` file to reflect the addition of the proxy server feature, improving clarity for developers on available functionalities. * chore(typescript): version packages (canary) * Feat/dashboard/embedded (#1115) * feat(inspector): enhance inspector components and improve type handling - Updated `tsup.client.ts` to include new external dependencies for better integration. - Enhanced `index.ts` by adding `InspectorProvider` and related types for improved context management. - Modified `PromptResultDisplay.tsx` to ensure error messages are returned as strings for consistency. - Changed `ListItem.tsx` to allow `description` prop to accept `ReactNode` for more flexible content. - Improved `MarkdownRenderer.tsx` to adjust list styling for better visual presentation. - Updated `RpcPanel.tsx` to include an effect for collapsing the panel on mount and refined resizing logic for better user experience. This commit focuses on enhancing the functionality and usability of the inspector components. * fix(chat): remove background styling from ChatHeader component - Updated the ChatHeader component to remove the background styling for improved visual consistency. - This change enhances the overall appearance of the chat interface by simplifying the design. * feat(inspector): fix build to allow inspector embedding - Added a changeset for the minor version update of the "@mcp-use/inspector" package. - Improved the build process to support embedding of the inspector, enhancing its integration capabilities. * chore(typescript): version packages (canary) * feat(deploy): update dashboard URL construction to use dynamic web URL (#1117) * chore(typescript): version packages (canary) * chore(changelog): update changelogs for inspector and typescript packages - Added new entries for version v0.24.0 in the inspector changelog, highlighting embedding support, logger improvements, and updates to mcp-use. - Updated typescript changelog for version v1.21.0, detailing new proxy server functionality, client-side completion support, and various enhancements and fixes. * fix(tests): update inspector and debugger tools tests for improved reliability (#1120) - Commented out modal closing logic in connection tests due to focus issues requiring multiple ESC presses. - Enhanced debugger tools tests by refining navigation and visibility checks for resource widgets and props popovers, ensuring more stable interactions. - Adjusted helper functions to prevent unnecessary button clicks when popovers are already visible, improving test performance. * chore(typescript): version packages (canary) * chore(docs): update links in README and changelogs for improved navigation - Updated documentation links in README.md and various changelogs to point to the correct URLs, enhancing accessibility to resources. - Ensured consistency across documentation by replacing relative links with absolute URLs for better clarity and user experience. * fix(widgets): update metadata handling for widget registration (#1121) - Adjusted the logic for setting widget metadata to ensure it only includes enriched CSP metadata when available, preventing undefined values. - Enhanced the registration process by refining how metadata is merged, improving overall reliability and consistency in widget definitions. * chore(typescript): version packages (canary) * feat(server): enhance landing page generation with favicon and icon support (#1122) - Added favicon and icon configuration options to the MCPServer setup, improving visual branding. - Updated landing page generation to include tools, prompts, and resources, enhancing the user experience with more detailed information. - Introduced HTML escaping function to prevent XSS vulnerabilities in user-provided content. * chore(typescript): version packages (canary) * feat(auth): enhance OAuth flow and CORS handling (#1128) * feat(auth): enhance OAuth flow and CORS handling - Introduced PKCE verifier management to prevent drift during overlapping auth attempts. - Updated CORS middleware to explicitly allow Authorization headers, ensuring compatibility with browser security policies. - Refined OAuth proxy URL inference logic to handle gateway connections more effectively. - Improved error handling for missing code verifiers during authentication state restoration. * fix(auth): improve OAuth metadata handling and logging - Updated the OAuth flow to enhance metadata resource handling, ensuring the correct resource is used for SDK validation. - Introduced logging for connection URLs and metadata responses to aid in debugging and monitoring. - Adjusted the handling of connection URLs to prevent issues with local proxy URLs during callback flows. - Enhanced error handling for metadata fetching and improved fallback mechanisms for OAuth proxy URLs. * chore(typescript): version packages (canary) * fix: use Node.js telemetry in server-side code instead of browser stub (#1086) * fix: use Node.js telemetry in server-side code instead of browser stub Server-side code was importing Telemetry from the barrel file (telemetry/index.js) which re-exports the browser implementation. The browser Telemetry class detects Node.js as "unknown" runtime and silently disables all telemetry, meaning no server events were being sent to PostHog or Scarf. Changed 6 server-side files to import from telemetry-node.js directly. Also updated the unit test mock path to match the new import. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: split tsup build to prevent telemetry-node from leaking into browser bundle mcp_agent.ts and connectors/base.ts are exported from src/browser.ts but now import from telemetry-node.ts (which contains require("node:fs/os/path/crypto")). Without a split build, these require() calls would be inlined into dist/src/browser.js, causing webpack/Vite to emit errors or polyfill Node.js built-ins in browser targets. Split tsup.config.ts into two configs: - Node/server entries: no substitution, telemetry-node.ts imports unchanged - Browser entries (src/browser.ts, src/react/index.ts): esbuild plugin transparently rewrites any telemetry-node import to telemetry-browser at build time Also removed duplicate "@modelcontextprotocol/sdk" entry in external list. * fix: preserve src/ prefix in browser build output paths tsup infers output paths from the common root of all entry points. When browser entries were split into a separate config containing only src/browser.ts and src/react/index.ts, the common root became src/, causing output to land at dist/browser.js and dist/react/index.js instead of dist/src/browser.js and dist/src/react/index.js. package.json exports expect the src/-prefixed paths, so the inspector build (and any consumer importing mcp-use/react or mcp-use/browser) would fail with ENOENT. Fix: use tsup object entry syntax with explicit output keys to force the correct dist/src/ output paths regardless of common-root inference. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(mcp-use): resolve autoReconnect issues and enhance server management (#1130) * fix(mcp-use): resolve autoReconnect issues and enhance server management - Disabled unwanted GET polling when autoReconnect is false by setting maxRetries to 0. - Improved getServer() logic to correctly handle server configurations in React StrictMode, preventing duplicate server warnings. - Added a new example for dynamically adding an MCP server post-authentication, demonstrating the use of getServer guard. - Updated logging levels for server addition to reduce noise in debug output. * refactor(mcp-use): simplify server addition logic and update documentation - Removed the getServer guard from the ProtectedRoute example, as addServer is now idempotent and handles duplicate calls silently. - Updated the McpClientContextType interface to clarify that addServer can be called multiple times with the same id without issues. - Streamlined the addServer implementation to enhance readability and maintainability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Sidharth Shambu <49567934+shambu2k@users.noreply.github.com> Co-authored-by: Sidharth Shambu <sshambu@MacBookPro.lan> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Ashutosh Kumar Singh <161562995+Ashutosh0x@users.noreply.github.com> Co-authored-by: Luigi Pederzani <luigipederzani@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 21:16:38 +01:00
Pietro Zullo	869e56fcf4	fix(python): register debug routes when debug=True passed to run() (#1114) ... * fix(python): register debug routes when debug=True passed to run() When MCPServer was created with debug=False (default) and run(debug=True) was called, debug routes (/docs, /inspector, /openmcp.json) were never registered because _add_dev_routes() only ran during __init__. Now run(debug=True) calls _add_dev_routes() and rebuilds the Starlette app so routes are available. Also removes dead code in ServerRunner that could never execute due to the same ordering issue. Closes #1099 * docs: regenerate API reference after removing debug from ServerRunner.run() The debug parameter was removed from ServerRunner.run() since debug mode is now fully handled in MCPServer.run() before the runner is invoked.	2026-02-27 15:32:04 +01:00
Yuuki	8ce409948d	docs(python): fix incorrect parameter name in quickstart server example (#1108) ... Changed 'description' to 'instructions' in MCPServer constructor to match the actual API signature.	2026-02-27 12:40:21 +01:00
Joaquin Coromina	a3fd6a55dd	update all docs to fix guidance on workos subdomain (#1076)	2026-02-20 14:57:26 -08:00
Enrico Toniato	4546a8c5b4	Canary (#1073) ... * fix(create-mcp-use-app): unify logo usage across all entry paths (#1070) * fix: unify logo display across all CLI entry paths * add changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Fix/hack/2 (#1071) * feat(inspector): enhance MCPAppsDebugControls and sandbox-proxy for improved CSP handling - Updated MCPAppsDebugControls to dynamically adjust violation indicators based on CSP mode, providing clearer user feedback. - Introduced a function in sandbox-proxy.html to strip existing CSP meta tags, ensuring that the injected permissive CSP is not overridden by restrictive policies. - Enhanced comments for clarity on CSP handling logic, improving maintainability and understanding of the code. * feat(widget): introduce invoking and invoked status texts for improved user feedback - Added `invoking` and `invoked` properties to widget metadata, allowing for customizable status messages during tool execution. - Updated relevant components to display these status texts, enhancing user experience by providing real-time feedback on tool operations. - Adjusted default values for `invoking` and `invoked` to improve clarity and consistency across widgets. - Refactored documentation to reflect changes in widget metadata and usage patterns, ensuring developers have clear guidance on implementing these features. * fix(docs): remove BrowserRouter from McpUseProvider documentation and update related descriptions - Updated the `<McpUseProvider />` documentation to reflect the removal of `BrowserRouter` from its setup. - Adjusted descriptions and examples to clarify the new usage without `BrowserRouter`, ensuring accurate guidance for users. * fix(tests): update widget-helper integration tests for explicit auto-widget naming - Changed references from "auto-widget" to "explicit-auto-widget" in the integration tests to align with updated tool definitions. - Adjusted assertions to verify the correct metadata and URI format for the explicit auto-widget, ensuring compliance with the latest specifications. * chore(typescript): version packages (canary) --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-20 13:22:09 -08:00
Enrico Toniato	d6a55f24a3	chore(release): update changelog for v0.22.1 and v0.22.0 ... - Added details for v0.22.1, including new widget status texts, CSP handling improvements, and updates to mcp-use. - Documented v0.22.0 release with Iframe Console enhancements, new widget debug context, and CSP violations panel. - Updated McpUseProvider documentation to remove BrowserRouter inclusion, highlighting the breaking change in v1.20.1.	2026-02-20 13:17:20 -08:00
Enrico Toniato	4ae9369b2e	fix(docs): update OAuth link in configuration documentation for accuracy	2026-02-20 10:25:53 -08:00
Enrico Toniato	5a73b41355	Canary (#1062) ... * fix(auth): resolve OAuth flow for WorkOS across client, server, and inspector (#1058) * add proactive token refresh and credential invalidation to BrowserOAuthClientProvider * fix OAuth token refresh by removing static Authorization header from transport config * add changeset * update refresh to use official mcp sdk methods * update workos to always use proxy method since its an external provider * update autoConnect to always include proxyAddress even without bearer tokens * run format * update changeset * chore: update pnpm-lock.yaml after rebase onto main --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * improvement(auth): accept full AuthKit domain in WorkOS subdomain config (#1057) * change subdomain to include authkit.app * add changeset * chore(typescript): version packages (canary) * Fix/inspector/first render (#1060) * fix(tsconfig): include .mcp-use directory in TypeScript configuration for starter and blank templates * fix(package.json): update postinstall script to remove fallback for generate-types in mcp-apps template * fix(MessageList): enhance tool metadata retrieval by normalizing tool names for consistency with API responses * feat(inspector): enhance MCPApps components with required props handling and improved UI feedback - Added `requiredProps` to `MCPAppsDebugControls` to auto-open a popover when required props are missing, providing users with a clear indication of necessary inputs. - Updated `MCPAppsRenderer` and `MessageList` to support cancellation state, allowing for better user experience during tool execution. - Enhanced `PropsConfigDialog` to detect and display required props from widget schemas, improving the configuration process. - Introduced utility functions in `usePropsLLM` for better JSON extraction from LLM responses, ensuring accurate prop generation. * feat(inspector): enhance IframeConsole with expandable log entries and improved log formatting - Added expandable functionality to log entries, allowing users to view detailed logs on click. - Introduced a copy button for logs, enabling easy copying of log content to the clipboard. - Improved log formatting and display, including inline previews and better handling of log levels. - Updated UI elements with new icons and styles for a more intuitive user experience. * feat(inspector): add clientOptions to InspectorDashboard for enhanced capabilities - Introduced `clientOptions` with `capabilities` to support new extensions in the InspectorDashboard component. - This enhancement allows for better integration with the MCP application protocol, improving overall functionality. * feat(inspector): refine Layout component by updating validTabs and adding clientOptions - Updated the `validTabs` array in the Layout component to remove the "playground" tab. - Added `clientOptions` with specific capabilities to enhance integration with MCP application protocol, improving functionality. * feat(types): enhance type definitions with detailed documentation and examples - Updated `MCPServerClass` tool and prompt definitions to include more specific type constraints for better type safety. - Enhanced `ServerConfig`, `InputDefinition`, and various resource and tool interfaces with comprehensive JSDoc comments, including examples for clarity. - Improved overall type definitions for widgets and tools, ensuring better integration and usability within the MCP framework. - Added missing descriptions and examples to several interfaces, improving developer experience and documentation quality. * feat(mcp-apps): update server and widget integration for enhanced functionality - Refactored the MCP server setup to improve integration with MCP Apps, including updated descriptions and documentation links. - Introduced a new search tool for fruits, allowing users to filter results and display them in a visual widget. - Enhanced the product search result widget with improved loading states and detail views for selected fruits. - Removed unused dependencies and components to streamline the project structure. - Updated README files to reflect changes and provide clearer guidance for users. * feat(inspector): enhance MCPAppsRenderer and ui-resource-registration for improved widget re-initialization and metadata handling - Added logic in MCPAppsRenderer to re-read `prefersBorder` from the server upon widget re-initialization, improving responsiveness to metadata changes. - Implemented detection of widget re-initialization to ensure tool input is correctly sent to new widget instances after events like HMR page reloads. - Refactored resource registration in ui-resource-registration to dynamically resolve the latest enriched definitions, ensuring accurate metadata is used during HMR updates. - Updated read callbacks to handle dynamic URIs and maintain consistency in resource handling, enhancing overall widget functionality. * feat(widget): enhance useWidget hook and documentation for improved functionality - Updated the `useWidget` hook to support additional generic parameters for better type safety and flexibility. - Introduced new props for real-time streaming and external link handling, enhancing widget capabilities. - Improved documentation in SKILL.md and ui-widgets.mdx to clarify usage of new features, including partial argument streaming and external navigation. - Removed deprecated dependencies from package.json files across templates to streamline project setup. - Enhanced various components to utilize new props and improve user experience during tool interactions. * feat(tsconfig): enhance TypeScript configuration and widget functionality - Updated TypeScript configurations across multiple templates to include incremental builds and build info file paths, improving build performance and efficiency. - Modified the `useWidget` hook to streamline state management and enhance type safety by refining generic parameters. - Simplified the `ProductSearchResult` component by reducing unnecessary generic parameters, improving code clarity and maintainability. - Adjusted helper functions to ensure consistent type handling across the widget framework. * feat(update-check): implement update notification for mcp-use CLI - Added a new utility to check for updates of the mcp-use package and notify users if a newer version is available. - Integrated the update check into the CLI's pre-action hook, ensuring users are informed before executing commands. - Created a caching mechanism to minimize unnecessary network requests and improve performance. * feat(inspector): add file utilities for client file management - Introduced a new `file-utils.ts` module containing functions to determine content types based on file extensions, check for the existence of client files, and retrieve the client distribution path. - Updated the middleware to utilize these new utilities for improved handling of client files, including warnings when files are not found. * feat(inspector): update TypeScript and MCPApps components for improved functionality - Added TypeScript version 5.9.3 to the pnpm-lock.yaml for enhanced type safety and features. - Enhanced MCPAppsDebugControls to prevent auto-application of localStorage presets in tool context. - Refactored MCPAppsRenderer to optimize state management and prevent unnecessary re-renders, including the use of refs for tool input and output. - Improved OpenAIComponentRenderer with better state handling and batching of updates to prevent double renders. - Updated ToolsTab to streamline resource pre-fetching and reduce unnecessary renders during tool execution. - Enhanced ToolResultRenderer and ToolResultDisplay for better memoization and performance. - Introduced a new RelativeTimeDisplay component to manage time updates without affecting parent re-renders. * chore: update pnpm-lock.yaml after rebase onto main Co-authored-by: Cursor <cursoragent@cursor.com> * fix: update postinstall script in package.json templates to prevent failure on type generation * Potential fix for code scanning alert no. 81: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * feat(inspector): add HTML escaping function for safe user input handling - Introduced a new `escapeHtml` function to sanitize user input in responses, preventing potential XSS vulnerabilities. - Updated the CDN server response to utilize the `escapeHtml` function when returning 404 error messages. * chore: update TypeScript version to 5.9.3 across multiple packages and enhance component functionality - Added TypeScript version 5.9.3 to pnpm-lock.yaml and various package.json files for improved type safety. - Enhanced OpenAIComponentRenderer to optimize state updates and prevent redundant dispatches. - Updated ResourceResultDisplay to include a data-testid for better testing capabilities. - Improved debugging tools to scope props dialog interactions to the correct resource widget preview. * format * refactor(tests): update widget integration and data flow tests to align with SEP-1865 specifications - Adjusted tests to verify that widget metadata is now located on tool definitions rather than in tool call results, as per SEP-1865. - Updated assertions to check for structured content in results instead of relying on metadata properties. - Enhanced test coverage for tool invocation and output structure to ensure compliance with new standards. * package * test(widget-helper): enhance integration tests for tool metadata validation - Updated assertions to ensure manual and auto tools are defined before checking metadata properties. - Improved handling of auto tool metadata to account for potential absence of _meta. - Enhanced regex checks for output templates to ensure proper formatting and compliance with widget standards. * changeset --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): enhance MCPApps components and improve widget handling (#1063) * feat(inspector): enhance MCPApps components and improve widget handling - Added a new test_app configuration in pnpm-lock.yaml with updated dependencies for better development support. - Updated InspectorDashboard to set a default MCP_URL when not provided. - Refined ProductSearchResult and CarouselItem components to use a consistent text-danger class for better styling. - Improved error handling in InspectorDashboard for connection retries. - Streamlined MCPAppsRenderer to enhance widget re-initialization and metadata handling. - Removed deprecated dev widget endpoints and related logic to simplify the codebase. - Enhanced FormattedContentDisplay to allow toggling between formatted and plain text for better user experience. - Updated PropsConfigDialog and ResourceResultDisplay to utilize standardized metadata paths for improved prop detection. This commit focuses on enhancing the overall functionality and user experience of the MCPApps components and related widgets. * feat(inspector): enhance ToolsTab and ToolExecutionPanel for improved field handling - Introduced state management for tracking fields that should be sent as empty, allowing for explicit control over empty values in tool arguments. - Updated ToolsTab to initialize and manage sets of fields, enhancing the handling of tool input schemas. - Enhanced ToolExecutionPanel to accept and utilize the new payload structure, ensuring accurate representation of data sent during tool execution. - Added toggle functionality in ToolInputForm for explicitly sending empty objects and arrays, improving user experience and flexibility in input handling. This commit focuses on refining the input handling process within the inspector, providing users with better control over the data they send. * feat(widget): enhance useWidget hook to unwrap CallToolResult envelope - Updated the useWidget hook to unwrap the CallToolResult envelope when the OpenAI provider is used, allowing for direct access to structured content. - Improved handling of toolOutput to ensure compatibility with hosts that pass the full tool-result parameters. - Enhanced documentation comments to clarify the changes and improve understanding of the new logic. This commit focuses on refining the output handling within the useWidget hook, improving type safety and usability for developers. * feat(inspector): enhance CSP handling and widget re-execution logic - Updated the Inspector components to improve handling of Content Security Policy (CSP) settings, ensuring that widget metadata is correctly enriched with CSP directives. - Introduced logic to re-execute widgets when CSP mode changes, allowing for dynamic updates to the widget's execution context. - Enhanced the MCPAppsDebugControls and MCPAppsRenderer to better manage CSP violations and provide clearer user feedback on required props. - Refactored the PropsConfigDialog to utilize standardized metadata paths for improved prop detection and configuration. This commit focuses on refining the CSP management and widget lifecycle within the inspector, enhancing overall functionality and user experience. * refactor(tests): update weather-display widget tests for props handling - Modified tests in `aaa-ui-widgets.test.ts` to check for visibility of props wall text instead of iframe visibility, ensuring that the widget's required props are correctly validated. - Removed unnecessary iframe visibility checks in `debugger-tools.test.ts` to streamline the test flow and focus on props configuration. - Updated `navigateToResourcesAndSelectWeather` helper function to wait for props wall text, enhancing clarity on widget requirements during testing. This commit enhances the accuracy of widget tests by focusing on required props visibility, improving overall test reliability. * chore(typescript): version packages (canary) * refactor(docs): update documentation for MCP Apps and enhance content security policy (#1067) * refactor(docs): update documentation for MCP Apps and enhance content security policy - Changed "UI Widgets" group to "MCP Apps" in the documentation structure. - Added a new section on Content Security Policy (CSP) for MCP Apps, detailing configuration and automatic settings. - Updated references from "mcp-use Cloud" to "Manufact Cloud" across various documents for consistency. - Introduced a deprecation notice for the Apps SDK in the ChatGPT Apps flow guide. - Enhanced the inspector documentation to include CSP configuration and debugging tips. - Updated various SVG icons to a consistent color scheme and added a new Keycloak icon. - Refined CLI reference and quickstart guides to reflect changes in deployment terminology and commands. * refactor(inspector): enhance MCPApps components and improve widget handling - Updated Inspector components to refine handling of Content Security Policy (CSP) settings and widget re-execution logic. - Improved error handling in InspectorDashboard and streamlined MCPAppsRenderer for better widget re-initialization. - Enhanced PropsConfigDialog and ResourceResultDisplay to utilize standardized metadata paths for improved prop detection. - Updated various components to ensure better user experience and functionality, including state management for tool input schemas and improved logging in IframeConsole. * chore(typescript): version packages (canary) * refactor(typescript): improve create-mcp-use-app CLI prompts, install order, branding, and project structure output (#1068) * refactor: improve create-mcp-use-app CLI prompts, install order, branding, and project structure output Co-authored-by: Cursor <cursoragent@cursor.com> * add changeset * run format --------- Co-authored-by: Cursor <cursoragent@cursor.com> * chore(typescript): version packages (canary) --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	2026-02-20 10:24:32 -08:00
pietrozullo	7c3b6c2e1f	feat(docs): enhance Python server documentation with examples for tools, prompts, and resources ... - Added detailed examples for defining tools, prompts, and resources in Python, showcasing their usage with annotations and context. - Updated README to include a Python server example for weather information retrieval. - Improved clarity on prompt and resource definitions, including argument descriptions and JSON-RPC responses. - Enhanced documentation for better understanding of dynamic resources and tool functionalities.	2026-02-18 11:16:16 -08:00
Enrico Toniato	7ebe19a8b7	Canary (#1050) ... * fix(create-mcp-use-app): add missing @types/react and @types/react-dom to template devDependencies (#1049) * add @types/react and @types/react-dom to templates * add changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * add mcp-use skills add / mcp-use skills install commands (#1051) * chore(typescript): version packages (canary) --------- Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-17 18:31:02 -08:00
Joaquin Coromina	59d44ba59a	update docs to reflect hono server rather than express (#1044)	2026-02-17 09:40:38 -08:00
Enrico Toniato	179e8003b7	Canary (#1045) ... * feat(typescript): add everything-server example for compile-time type coverage of mcp-use APIs (#1040) * add everything-server example for compile-time type coverage of mcp-use APIs * add UseWidgetResult<Props> type annotation to validate useWidget() return type * add changeset * run format * move everything-typecheck to an independent workflow * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(inspector): enhance ToolsTab with bulk paste functionality and auto-fill dialog (#1043) * feat(inspector): enhance ToolsTab with bulk paste functionality and auto-fill dialog - Implemented bulk paste feature allowing users to paste JSON or JavaScript objects directly into input fields. - Added auto-fill dialog for confirming updates when pasted data would overwrite existing values, improving user experience. - Introduced utility functions for parsing pasted text and converting JavaScript object syntax to valid JSON. - Updated ToolInputForm and ToolExecutionPanel components to support new functionality and provide visual feedback for auto-filled fields. * feat(inspector): update ToolExecutionPanel to copy full tool definition fix(server): correctly convert nested inpout schema args for tools * chore(typescript): version packages (canary) * Fix/various (#1041) * refactor(inspector): improve MCPAppsRenderer loading logic and enhance useWidget for iframe handling (#1037) - Updated MCPAppsRenderer to replace `isReady` with `initCount` for better iframe loading state management, ensuring the spinner is hidden appropriately. - Enhanced loading logic to account for iframe initialization, improving user experience during rapid remounts. - Modified useWidget to handle transitional states in iframes without URL parameters, preventing premature rendering with empty props. * chore(typescript): version packages (canary) * feat(cli): add generate-types command for TypeScript type definitions - Introduced a new CLI command `generate-types` to generate TypeScript type definitions for tools, writing to `.mcp-use/tool-registry.d.ts`. - Added options for specifying the project directory and server entry file. - Implemented error handling for missing server files and type generation failures. - Updated `package.json` to include a post-install script that runs the `generate-types` command. - Modified `tsconfig.json` to include the generated type definitions in the TypeScript compilation process. * chore: remove outdated changeset files for inspector and mcp-use - Deleted changeset markdown files and pre.json related to previous enhancements in the inspector and mcp-use libraries to streamline the repository and eliminate deprecated entries. * chore: remove outdated changeset reference from pre.json - Deleted the "petite-rules-talk" changeset entry from pre.json to clean up the changeset list and maintain accuracy in the repository. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v0.21.0 and v0.20.1 releases - Added details for v0.21.0 including bulk paste functionality and tool definition enhancements. - Included v0.20.1 updates focusing on MCPApps and widget improvements. - Updated package versions for dependencies in both changelogs. --------- Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-16 22:57:12 -08:00
Enrico Toniato	f4e2a70bd6	Canary (#1024) ... * feat(typescript): add conformance client for client-side conformance testing (#1009) * feat(dns-rebinding): implement DNS rebinding protection and examples (#1001) - Added `allowedOrigins` configuration to the `MCPServer` for DNS rebinding protection, enabling host validation for specified origins. - Updated documentation to clarify the behavior of `allowedOrigins` in development and production environments. - Introduced a new example demonstrating DNS rebinding protection, including curl commands for testing. - Enhanced server methods and middleware to support the new host validation feature. - Refactored related documentation to improve clarity on middleware and configuration options. * chore: enter canary prerelease mode * feat(mcp): defer server callbacks to avoid render-phase updates (#1002) - Introduced a mechanism to collect callbacks for server state changes and defer their execution using `queueMicrotask`, preventing potential render-phase updates during state updates. - Updated the `McpClientProvider` to push `onServerAdded` and `onServerStateChange` callbacks into an array for deferred execution, enhancing performance and stability. * feat(inspector): enhance elicitation support with SEP-1330 enum schema variants (#1010) - Added detailed documentation for the Elicitation tab, outlining its features and supported schema patterns. - Implemented handling for various SEP-1330 enum schema variants in the client and server, including single-select and multi-select options. - Introduced new tests to validate the elicitation flow for all enum schema variants, ensuring correct rendering and submission behavior. - Updated examples and README files to reflect the new elicitation capabilities and SEP-1330 patterns. * feat(inspector): implement partial tool input handling for streaming arguments - Added support for partial tool input in the MCPAppsRenderer, allowing for real-time updates during LLM argument generation. - Enhanced MessageList and ToolResultRenderer components to accommodate new streaming states and partial arguments. - Updated useChatMessagesClientSide to handle streaming tool call arguments, improving user experience during interactions. - Introduced new types and state management in useWidget for tracking partial tool input and streaming status. * chore(typescript): version packages (canary) * feat(inspector): enhance tool argument handling with type coercion and schema resolution (#1013) - Introduced utility functions for coercing input values based on their expected types, improving the handling of boolean, array, and object parameters. - Updated ToolsTab and ToolInputForm components to utilize new schema utilities for resolving property types and extracting enum values. - Added a new server tool for validating argument typing, ensuring correct submission of typed values. - Enhanced end-to-end tests to verify the correct behavior of typed arguments in tool execution. * feat(docs): enhance documentation for streaming tool arguments and live previews - Updated guides and examples to include details on streaming tool arguments in widgets, enabling real-time updates during LLM interactions. - Added new sections in `useWidget` documentation to explain `partialToolInput` and `isStreaming` properties. - Included a new example demonstrating live previews while streaming tool arguments in the MCP Inspector and MCP Apps clients. * feat(typescript): add conformance client for client-side conformance testing Adds conformance-client.ts alongside the existing conformance server (no new packages — reuses the server's deps). - conformance-client.ts: handles initialize, tools_call, elicitation defaults, and sse-retry scenarios using MCPClient - run-conformance-client.sh: wrapper for the conformance runner - Updated CI workflow to run TS client conformance alongside Python client * fix(client): fix client oauth handling (#1015) * fix(docs): update links and references in documentation - Updated Discord link in SKILL.md to the new invite URL. - Corrected path for Apps SDK in examples/README.md to reflect the new directory structure. - Revised deployment instructions in cli/README.md for clarity on environment variable configuration. - Enhanced WorkOS OAuth example documentation with a link to the relevant settings screenshot. * refactor: update conformance workflow and documentation for TypeScript client - Adjusted paths in the conformance workflow to reflect the new directory structure for client features. - Enhanced documentation to clarify the configuration structure and options for the MCPClient, including root-level callbacks and examples. - Removed deprecated references and improved clarity in the elicitation and sampling sections. - Updated examples to demonstrate the new configuration options and usage patterns for the TypeScript client. * feat(client): enhance OAuth handling in conformance clients - Integrated automatic OAuth flow in TypeScript conformance clients (browser, node, and react). - Updated `headless-oauth-provider` to support token request preparation for authorization code exchange. - Modified `useMcp` to allow automatic triggering of OAuth authentication based on configuration. - Improved handling of authentication scenarios in the conformance test client. This update streamlines the authentication process, ensuring a smoother user experience during conformance testing. * feat(auth): add probeAuthParams for enhanced OAuth parameter handling - Introduced `probeAuthParams` to extract WWW-Authenticate parameters (scope, resource_metadata) from 401 responses. - Updated conformance clients (browser and node) to utilize `probeAuthParams` for improved OAuth flow. - Enhanced `useMcp` hook to support automatic probing of authentication parameters during the OAuth process. This update streamlines the authentication experience by ensuring necessary parameters are captured and utilized effectively. * feat(conformance): integrate pre-registration context in OAuth provider - Added `parseConformanceContext` function to extract pre-registration parameters from environment variables. - Updated conformance clients (browser, node, and react) to utilize the new context when creating the headless OAuth provider. - Enhanced `createHeadlessConformanceOAuthProvider` to accept an optional pre-registration context for improved OAuth handling. This update improves the flexibility and configurability of the OAuth flow in conformance testing scenarios. * feat(conformance): enhance OAuth flow for scope-step-up scenarios - Introduced `isScopeStepUpScenario` function to identify scenarios requiring special handling for OAuth authentication. - Updated conformance clients (browser, node, and react) to implement OAuth retry fetch for scope-step-up scenarios, ensuring the first token has limited scope. - Modified authentication logic to prevent pre-authentication in scope-step-up cases, allowing for proper token escalation. This update improves the OAuth handling in conformance testing, ensuring correct behavior during scope escalation scenarios. * feat(oauth): improve OAuth retry fetch and custom fetch support - Enhanced `createOAuthRetryFetch` to strip the `WWW-Authenticate` header, preventing unwanted auth flows during retries. - Added optional `fetch` property in `UseMcpOptions` to allow custom fetch functions for MCP HTTP requests, enabling better control over authentication logic. - Updated `useMcp` to pass the custom fetch function when provided, facilitating OAuth retry handling. This update enhances the flexibility and robustness of the OAuth flow in conformance testing scenarios. * chore: remove outdated changeset files for inspector and mcp-use - Deleted changeset files related to previous enhancements in the inspector and mcp-use libraries, including updates on argument handling and server callback deferral. - Cleared pre.json file and other changeset markdowns to streamline the repository and remove deprecated entries. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(create-mcp-use-app): add optional skills and package dependency installation steps (#998) * add install steps for skills and dependencies * fix tests to point at starter instead of ui and skip user interactive prompting * update docs for create-mcp-use-app * run format and lint * add changeset * fix user message * switch from vercel skills package to manual download and copy of skills folder * remove unnecessary early return if presets are empty * update pnpm-lock.yaml to add tar and @types/tar dependencies, and include minipass version 4.2.8 * change skills installation prompt to (Y/n) instead of selecting agents. add telemetry event to vercel for every download. update tests and docs * move InstallTelemetryData interface above where its used * remove helper text --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: correct mcp_apps MIME type & disable telemetry in tests (#1023) * fix: use correct MIME type for mcp_apps resource counting and disable telemetry in tests Replace hardcoded "text/html+mcp" with RESOURCE_MIME_TYPE from @modelcontextprotocol/ext-apps so mcp_apps_resources_number reports correctly. Add MCP_USE_ANONYMIZED_TELEMETRY=false to vitest configs to prevent telemetry during local test runs. * fix: disable telemetry in inspector e2e tests Set MCP_USE_ANONYMIZED_TELEMETRY=false in playwright.config.ts so the inspector's web server and test processes don't fire telemetry events. * chore: add changeset for MIME type fix and telemetry disable * chore(typescript): version packages (canary) * improvement(typescript): fix prompt method to use generic type inference for callback parameters (#1029) * test: trigger conformance badge update with new token Co-authored-by: Cursor <cursoragent@cursor.com> * test: trigger badge update with delay fix Co-authored-by: Cursor <cursoragent@cursor.com> * test: trigger badge update with delay fix Co-authored-by: Cursor <cursoragent@cursor.com> * improve type inference for prompt args in the callback fn * Remove test badge update fix comment Signed-off-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> * Remove comment from conformance.yml Remove comment about test badge update delay fix Signed-off-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> --------- Signed-off-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * fix(typescript): lint error when object() response helper added to mix() (#1025) * test: trigger conformance badge update with new token Co-authored-by: Cursor <cursoragent@cursor.com> * fix type issue when object() response helper is added in mix() --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * chore(typescript): version packages (canary) * feat(inspector): enhance ChatTab and related components with quick questions and followups (#997) * feat(inspector): enhance client package with new components and configuration options (#973) * feat(inspector): enhance client package with new components and configuration options - Added a new test_app configuration in pnpm-lock.yaml with updated dependencies for improved development. - Refactored build scripts in package.json to streamline client exports and ensure compatibility. - Introduced tsup.client.ts for better bundling configuration of client components. - Expanded the index.ts file to include new chat components and utility functions, enhancing the inspector's functionality. - Updated ChatTab and related components to support new props for better customization and control. - Added serverBaseUrl prop to various components to facilitate external API calls without relying on context. - Implemented new hooks and types for improved chat message handling and configuration management. - Introduced stubs for Node.js modules to ensure compatibility in browser environments. - Added rpc-log-bus for logging RPC events, enhancing debugging capabilities in server interactions. * feat(inspector): add new props for ChatTab, ChatHeader, and ChatLandingForm components - Introduced `clearButtonLabel`, `hideTitle`, and `hideModelBadge` props to enhance customization options for the ChatTab and ChatHeader components. - Updated the ChatLandingForm to conditionally render the model badge based on the new `hideModelBadge` prop. - Improved the display logic for the clear/new-chat button to utilize the `clearButtonLabel` prop, allowing for dynamic labeling. * feat(inspector): add hideServerUrl prop to ChatTab and ChatLandingForm components - Introduced `hideServerUrl` prop to both ChatTab and ChatLandingForm components, allowing for conditional rendering of the MCP server URL. - Updated documentation comments to reflect the new prop's functionality, enhancing customization options for users. * feat(hmr): enhance TypeScript support and registration synchronization - Updated the `tsImport` function to accept additional options for improved TypeScript handling, including cache busting and import callbacks. - Enhanced the `importServerModule` function to provide better warnings for module re-imports and instance management. - Refined the `syncRegistrationsFrom` method in `MCPServerClass` to return detailed change statistics for tools, prompts, and resources, improving change detection and logging. - Added debug logging for unchanged registrations to aid in troubleshooting during hot module reloading (HMR). - Wrapped handler functions with session context to maintain access to context features after HMR updates, ensuring consistent behavior. * feat(inspector): enhance tool change detection and metadata handling - Updated the `ToolsTab` component to include additional checks for changes in tool metadata, ensuring more accurate detection of updates. - Refined the handling of tool metadata during hot module reloading (HMR) to fully replace existing metadata instead of merging, improving consistency. - Added comprehensive E2E tests to validate tool handler logic changes after HMR, ensuring expected behavior for both text and widget outputs. - Adjusted the `McpClientProvider` to correctly pass metadata to tools, enhancing the overall functionality and user experience. * feat(inspector): enhance ChatTab and Layout components with new props and visibility controls - Added new props to `ChatTab` and `ChatHeader` for customizing the clear/new-chat button, including `clearButtonHideIcon`, `clearButtonHideShortcut`, and `clearButtonVariant`. - Updated `Layout` and `LayoutHeader` components to support single-tab mode and visibility of tabs based on the `embeddedConfig`, improving user experience in embedded scenarios. - Refactored tab rendering logic in `LayoutContent` to conditionally display tabs based on the `visibleTabs` configuration, enhancing flexibility for users. * feat(mcp): propagate widget resources to existing sessions - Added `propagateWidgetResourcesToSessions` method to `MCPServerClass` to ensure newly registered widget resources are available to existing sessions without requiring a reconnect. - Updated `uiResourceRegistration` to call the new method, allowing resource propagation regardless of tool registration status. - Enhanced logging for resource propagation to improve visibility during session updates. * fix(cli): increase chunk size warning limit for bundles * feat(inspector): add HMR regression test for widget resource propagation - Implemented a new E2E test to verify that dynamically added widget resources are correctly registered and propagated to existing sessions during hot module reloading (HMR). - Enhanced file utility functions to support writing and removing widget resource files, ensuring proper cleanup after tests. - Updated the MCPServerClass to track session references for resources, improving synchronization during HMR updates. * feat(logging): add conditional debug logging for widget operations - Introduced a `debugWidget` flag to control logging for widget-related operations in `shared-routes.ts`, `shared-utils.ts`, and `mount-mcp.ts`. - Enhanced logging statements to only execute when the `DEBUG` environment variable is set, improving performance and reducing noise in production logs. - Updated the `requestLogger` to skip logging for noisy GET requests, further optimizing log management. * chore(pnpm): remove test_app configuration and its dependencies from pnpm-lock.yaml * fix(inspector): update build configurations and improve type handling - Modified `package.json` to ensure proper declaration file generation during client exports. - Adjusted `tsconfig.client.json` to change the root directory and output directory for better organization. - Enhanced type handling in `McpUIRenderer.tsx` by using a more specific type for resource properties. - Updated `WidgetDebugContext.tsx` to define a `DeviceType` type for improved type safety. - Removed unused `rpc-log-bus` definitions to clean up the codebase. * feat(mcp): improve resource registration logic in MCPServerClass - Enhanced the resource registration process to skip adding resources that are already propagated to sessions, preventing duplicate registrations. - Updated logging to provide clearer feedback on resource addition and registration failures. - Refactored the handling of widget resource templates to ensure they are only registered if not already present in the session, improving efficiency and reducing potential errors. * feat(mcp): implement dynamic HMR port allocation for development servers - Added a function to find an available port for Hot Module Replacement (HMR), allowing multiple development servers to run concurrently without port conflicts. - Updated the Vite server configuration to use the dynamically allocated HMR port instead of a hardcoded value, enhancing flexibility in development environments. - Improved logging to reflect the dynamically chosen HMR port, ensuring better visibility during server setup. * fix(inspector): improve same-origin detection for widget iframes - Updated the logic for determining if the widget iframe is same-origin with the inspector page, enhancing console interception and debug controls. - Refactored the setting of `isSameOrigin` to use the new computed value, ensuring accurate cross-origin handling for both development and production environments. * fix(inspector): correct inspector API base URL handling - Updated the logic for determining the inspector API base URL to use relative URLs, ensuring that API calls target the correct origin of the inspector UI instead of the MCP server. - Removed the previous logic that derived the base from the MCP server URL, which caused issues when the server ran on a different port, improving cross-origin handling. * refactor(mcp-server): update syncRegistrationsFrom method to return detailed change summary - Modified the syncRegistrationsFrom method to return an object containing total changes and detailed counts for added, removed, and updated tools, prompts, and resources. - This enhancement improves the method's utility by providing comprehensive feedback on registration changes during synchronization. * fix(tests): enhance waitForHMR function to support no-change scenarios - Updated the waitForHMR function to accept an options parameter, allowing it to handle cases where no changes are detected during Hot Module Replacement (HMR). - Modified the integration test to utilize the new functionality, ensuring it can correctly resolve when no changes occur, improving test reliability. * feat(hmr-sync): add debug logging for HMR changes and improve resource key handling - Introduced a new function to check if debug logging is enabled, enhancing the visibility of changes during Hot Module Replacement (HMR). - Updated debug logging to conditionally display changes in configuration and handler, including previews of old and new handlers. - Refactored resource key handling in MCPServerClass to improve clarity and maintainability. * feat(hmr): implement widget re-addition test and enhance resource cleanup - Added a new test to verify that deleting and re-adding a widget resource correctly re-registers it for the same session during Hot Module Replacement (HMR). - Enhanced the MCPServerClass to ensure proper cleanup of resources from both session and root native server states, preventing registration conflicts when re-adding widgets. * feat(inspector): enhance ChatTab and related components with quick questions and followups - Added support for `chatQuickQuestions` and `chatFollowups` props in `ChatTab`, `ChatLandingForm`, and `ChatInputArea` components to improve user interaction. - Implemented functionality to handle quick question and followup selection, enhancing the chat experience. - Updated `InspectorContext` to include new configuration options for quick questions and followups. - Enhanced message handling and event posting for better integration with the chat system. * feat(inspector): enhance error handling and logging for MCP Apps and OpenAI components - Implemented error logging functionality in MCPAppsRenderer and OpenAIComponentRenderer to capture and post error messages and stack traces to the parent window. - Added global error and unhandled promise rejection listeners in shared-utils to emit runtime errors with detailed context. - Enhanced console error handling in mcp-apps route to serialize and send console errors to the parent window, improving debugging capabilities. * refactor(inspector): replace isReady state with initCount in MCPAppsRenderer - Updated the MCPAppsRenderer component to replace the `isReady` state with `initCount` for better tracking of initialization events. - Adjusted related useEffect hooks to utilize `initCount` for conditional logic, improving clarity and functionality in widget initialization and message handling. * feat(mcp): implement direct stdio connector handling in Node.js client - Added support for handling the stdio connector directly within the Node.js MCPClient, allowing for command and argument configuration. - Updated the loadConfigFile function to dynamically import the fs module, preventing unnecessary inclusion in browser bundles. - Enhanced error handling to ensure that the stdio connector is only utilized in the appropriate environment, improving compatibility and clarity. * feat(inspector): add log copying functionality to IframeConsole and enhance theme handling in OpenAIComponentRenderer - Implemented a new feature in IframeConsole to copy all logs to the clipboard, providing users with an easy way to access console logs. - Enhanced OpenAIComponentRenderer to manage widget readiness state and apply theme changes dynamically, improving user experience and visual consistency. - Updated ThemeProvider to synchronize theme application with Tailwind dark mode and OpenAI Apps SDK design tokens, ensuring a seamless theme transition. - Added a message signaling to the parent window when the widget is ready, enhancing communication between components. * test: trigger badge update with delay fix Co-authored-by: Cursor <cursoragent@cursor.com> * feat(inspector): enhance ToolsList component with metadata display and add MCP/OpenAI icons - Updated ListItem component to conditionally render metadata. - Enhanced ToolsList to include tool metadata with icons for MCP and OpenAI, utilizing tool detection logic. - Introduced McpIcon and OpenAIIcon components for better visual representation of tool types. * feat(inspector): improve loading state and UI feedback in OpenAIComponentRenderer - Replaced shimmer animation with a Spinner component for a more consistent loading experience. - Introduced a skeleton loading state that only displays on the initial load of the widget. - Updated ToolResultDisplay to adjust the order of view checks for better clarity. - Enhanced ToolsList to conditionally display parameter counts based on tool input schemas. * fix(vitest): add support for additional file extensions in Vitest configuration (#1031) * Fix README formatting for test badge update Fix formatting of the test badge update section in README. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * fix(ChatLandingForm): update button text color for better visibility in light and dark modes * fix(changesets): clean up and complete changeset documentation - Removed 3 changesets from PR #973 that were already in canary (lazy-animals-feel, slow-otters-lick, sour-hoops-arrive) - Updated six-groups-fry.md to include full description of OpenAI renderer improvements - Added chatty-owls-glow.md for quick questions/followups feature - Added brave-lions-sleep.md for error handling and logging enhancements - Added tough-dragons-wave.md for IframeConsole log copying and theme handling - Added tiny-trains-smile.md for ToolsList metadata and icons - Added happy-sharks-dance.md for stdio connector support All code changes in this branch are now properly documented with changesets. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(mcp): normalize client info in stdio connector handling - Updated the MCPClient to use normalizeClientInfo for clientInfo when configuring the StdioConnector. - Removed dynamic require for StdioConnector, improving code clarity and maintainability. - Enhanced type definitions for stdioConfig to ensure better type safety and clarity in the configuration process. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(inspector): update frame-ancestors policy for improved security handling (#1032) - Simplified the logic for setting the frame-ancestors policy in the getWidgetSecurityHeaders function. - Enhanced the handling of the FRAME_ANCESTORS environment variable to allow for backward compatibility while defaulting to allow all origins when unset. - Updated comments for clarity on the behavior of frame-ancestors in different scenarios. * chore(typescript): version packages (canary) * feat(readme): add client conformance badges for Python and TypeScript - Introduced new conformance badges for Python and TypeScript client packages in the README to enhance visibility of project status and compliance. * feat: add logLevel option and silent mode to suppress console logging (fix #986) (#995) * feat: add logLevel option and silent mode to suppress console logging (fix #986) Changes: - Add 'silent' log level to LogLevel type; shouldLog() returns false for all levels when silent - Add logLevel option to UseMcpOptions; takes precedence over the debug boolean - Route addLog() through per-instance Logger instead of raw console[level]() calls - Fix global clobber: each useMcp instance creates its own named logger via Logger.get() so multiple instances don't overwrite each other's log levels - Migrate all console.* calls to logger.* in: - react/useMcp.ts - client/browser.ts - connectors/base.ts - connectors/http.ts - Export LogLevel type from browser entry point The mcp.log state array is still always populated for programmatic access. * feat: migrate McpClientProvider console.* to logger and deprecate debug attr * fix(react): complete logLevel migration and add comprehensive tests Completes the migration to respect logLevel configuration across all React client components by routing remaining console.* calls through the Logger class. Changes: - Route rpc-logger console calls through Logger.get('RpcLogger') - Route ErrorBoundary console.error through Logger.get('ErrorBoundary') - Remove debug console.log in ThemeProvider - Fix inconsistent logging in useMcp (use addLog instead of direct instanceLogger) Tests: - Add comprehensive Logger configuration tests (13 tests) - Silent mode suppression - Log level filtering - Per-instance loggers - Format styles (minimal, detailed, emoji) - Logger.setDebug() behavior - Add useMcp hook logLevel tests (6 tests) - logLevel option behavior - Silent mode with log state preservation - logLevel vs debug prop precedence - Per-instance logger isolation All tests passing, build succeeds. Related: PR #995, Issue #986 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(logging): enhance logging consistency and add tests for logLevel behavior - Improved logging consistency across React components by ensuring all console calls are routed through the Logger class. - Added comprehensive tests for Logger configuration, including log level filtering and silent mode behavior. - Updated useMcp hook tests to validate logLevel options and their interactions. All tests passing, build succeeds. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * chore(typescript): version packages (canary) * fix error() return type to be compatible with tool callbacks that use outputSchema (#1033) * chore(typescript): version packages (canary) * feat(inspector): enhance MCPAppsRenderer and OpenAIComponentRenderer with loading states and spinner (#1034) - Updated MCPAppsRenderer to include a loading spinner during widget initialization, improving user feedback. - Introduced a new `isReady` state to manage the loading state effectively. - Enhanced OpenAIComponentRenderer to adjust display properties based on the new configuration for better responsiveness. - Added a maximum width for the Picture-in-Picture mode in MCP_APPS_CONFIG for improved layout control. - Refactored iframe loading handling to ensure proper state management and user experience during loading phases. * chore(typescript): version packages (canary) * feat(inspector): release v0.20.0 with chat enhancements and improved UX - Introduced support for `chatQuickQuestions` and `chatFollowups` in ChatTab components. - Enhanced loading states in MCPAppsRenderer with a new spinner and skeleton loading for widgets. - Added global error listeners and improved error logging in widget components. - New feature to copy all logs to clipboard and enhanced theme handling in OpenAIComponentRenderer. - Updated dependencies, including mcp-use to v1.19.0. - Various fixes for CSP frame ancestors and MIME type handling. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Signed-off-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Luigi Pederzani <luigipederzani@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Ashutosh Kumar Singh <161562995+Ashutosh0x@users.noreply.github.com>	2026-02-16 14:04:22 -08:00
Pietro Zullo	cfeb41e3ea	docs(python): update LangChain examples to use 1.0+ API (#1022) ... Replace deprecated AgentExecutor/create_tool_calling_agent with the modern create_agent/init_chat_model API, matching the existing LangChain integration page and examples.	2026-02-15 19:04:25 -08:00
Enrico Toniato	3334a67769	Canary (#1012) ... * feat(dns-rebinding): implement DNS rebinding protection and examples (#1001) - Added `allowedOrigins` configuration to the `MCPServer` for DNS rebinding protection, enabling host validation for specified origins. - Updated documentation to clarify the behavior of `allowedOrigins` in development and production environments. - Introduced a new example demonstrating DNS rebinding protection, including curl commands for testing. - Enhanced server methods and middleware to support the new host validation feature. - Refactored related documentation to improve clarity on middleware and configuration options. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): enhance readiness state management and tool output handling - Added a useEffect hook in OpenAIComponentRenderer to reset the readiness state when the widget URL changes, ensuring proper updates for new iframes. - Updated shared-utils to improve handling of tool output and response metadata, facilitating smoother transitions of widget states from pending to ready. * feat(mcp): defer server callbacks to avoid render-phase updates (#1002) - Introduced a mechanism to collect callbacks for server state changes and defer their execution using `queueMicrotask`, preventing potential render-phase updates during state updates. - Updated the `McpClientProvider` to push `onServerAdded` and `onServerStateChange` callbacks into an array for deferred execution, enhancing performance and stability. * chore(typescript): version packages (canary) * feat(inspector): enhance elicitation support with SEP-1330 enum schema variants (#1010) - Added detailed documentation for the Elicitation tab, outlining its features and supported schema patterns. - Implemented handling for various SEP-1330 enum schema variants in the client and server, including single-select and multi-select options. - Introduced new tests to validate the elicitation flow for all enum schema variants, ensuring correct rendering and submission behavior. - Updated examples and README files to reflect the new elicitation capabilities and SEP-1330 patterns. * chore(typescript): version packages (canary) * feat(inspector): implement partial tool input handling for streaming arguments - Added support for partial tool input in the MCPAppsRenderer, allowing for real-time updates during LLM argument generation. - Enhanced MessageList and ToolResultRenderer components to accommodate new streaming states and partial arguments. - Updated useChatMessagesClientSide to handle streaming tool call arguments, improving user experience during interactions. - Introduced new types and state management in useWidget for tracking partial tool input and streaming status. * chore(typescript): version packages (canary) * feat(inspector): enhance tool argument handling with type coercion and schema resolution (#1013) - Introduced utility functions for coercing input values based on their expected types, improving the handling of boolean, array, and object parameters. - Updated ToolsTab and ToolInputForm components to utilize new schema utilities for resolving property types and extracting enum values. - Added a new server tool for validating argument typing, ensuring correct submission of typed values. - Enhanced end-to-end tests to verify the correct behavior of typed arguments in tool execution. * chore(typescript): version packages (canary) * changelog * feat(docs): enhance documentation for streaming tool arguments and live previews - Updated guides and examples to include details on streaming tool arguments in widgets, enabling real-time updates during LLM interactions. - Added new sections in `useWidget` documentation to explain `partialToolInput` and `isStreaming` properties. - Included a new example demonstrating live previews while streaming tool arguments in the MCP Inspector and MCP Apps clients. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-15 17:39:27 -08:00
Pietro Zullo	a9bc4db3ae	feat(python): add protocol handlers for logging, completions, subscriptions, and DNS protection (#1004) ... * feat(python): add protocol handlers for logging, completions, subscriptions, and DNS protection Server SDK changes: - logging/setLevel: stores client level, Context.log() filters by RFC 5424 severity - completion/complete: default empty handler, overridable via mcp.completion() - resources/subscribe + unsubscribe: tracks per-session subscriptions - notify_resource_updated(): broadcasts to all subscribed sessions via WeakSet - dns_rebinding_protection: explicit constructor parameter (default: False) - Capabilities patch for subscribe=True Middleware: - Added hooks: on_set_logging_level, on_subscribe_resource, on_unsubscribe_resource, on_complete Tests: - 9 unit tests for log level filtering (RFC 5424) - Updated DNS protection tests for explicit flag Docs: - logging.mdx: MCP protocol logging section with level filtering - resources.mdx: subscription section with example - middleware.mdx: new hooks documented Refs: - https://modelcontextprotocol.io/specification/2025-11-25/server/utilities/logging - https://modelcontextprotocol.io/specification/2025-11-25/server/resources#subscriptions * style: format adapter files for ruff 0.15	2026-02-14 18:53:30 -08:00
Enrico Toniato	32b19dc51b	Canary (#996) ... * feat(inspector): enhance client package with new components and configuration options (#973) * feat(inspector): enhance client package with new components and configuration options - Added a new test_app configuration in pnpm-lock.yaml with updated dependencies for improved development. - Refactored build scripts in package.json to streamline client exports and ensure compatibility. - Introduced tsup.client.ts for better bundling configuration of client components. - Expanded the index.ts file to include new chat components and utility functions, enhancing the inspector's functionality. - Updated ChatTab and related components to support new props for better customization and control. - Added serverBaseUrl prop to various components to facilitate external API calls without relying on context. - Implemented new hooks and types for improved chat message handling and configuration management. - Introduced stubs for Node.js modules to ensure compatibility in browser environments. - Added rpc-log-bus for logging RPC events, enhancing debugging capabilities in server interactions. * feat(inspector): add new props for ChatTab, ChatHeader, and ChatLandingForm components - Introduced `clearButtonLabel`, `hideTitle`, and `hideModelBadge` props to enhance customization options for the ChatTab and ChatHeader components. - Updated the ChatLandingForm to conditionally render the model badge based on the new `hideModelBadge` prop. - Improved the display logic for the clear/new-chat button to utilize the `clearButtonLabel` prop, allowing for dynamic labeling. * feat(inspector): add hideServerUrl prop to ChatTab and ChatLandingForm components - Introduced `hideServerUrl` prop to both ChatTab and ChatLandingForm components, allowing for conditional rendering of the MCP server URL. - Updated documentation comments to reflect the new prop's functionality, enhancing customization options for users. * feat(hmr): enhance TypeScript support and registration synchronization - Updated the `tsImport` function to accept additional options for improved TypeScript handling, including cache busting and import callbacks. - Enhanced the `importServerModule` function to provide better warnings for module re-imports and instance management. - Refined the `syncRegistrationsFrom` method in `MCPServerClass` to return detailed change statistics for tools, prompts, and resources, improving change detection and logging. - Added debug logging for unchanged registrations to aid in troubleshooting during hot module reloading (HMR). - Wrapped handler functions with session context to maintain access to context features after HMR updates, ensuring consistent behavior. * feat(inspector): enhance tool change detection and metadata handling - Updated the `ToolsTab` component to include additional checks for changes in tool metadata, ensuring more accurate detection of updates. - Refined the handling of tool metadata during hot module reloading (HMR) to fully replace existing metadata instead of merging, improving consistency. - Added comprehensive E2E tests to validate tool handler logic changes after HMR, ensuring expected behavior for both text and widget outputs. - Adjusted the `McpClientProvider` to correctly pass metadata to tools, enhancing the overall functionality and user experience. * feat(inspector): enhance ChatTab and Layout components with new props and visibility controls - Added new props to `ChatTab` and `ChatHeader` for customizing the clear/new-chat button, including `clearButtonHideIcon`, `clearButtonHideShortcut`, and `clearButtonVariant`. - Updated `Layout` and `LayoutHeader` components to support single-tab mode and visibility of tabs based on the `embeddedConfig`, improving user experience in embedded scenarios. - Refactored tab rendering logic in `LayoutContent` to conditionally display tabs based on the `visibleTabs` configuration, enhancing flexibility for users. * feat(mcp): propagate widget resources to existing sessions - Added `propagateWidgetResourcesToSessions` method to `MCPServerClass` to ensure newly registered widget resources are available to existing sessions without requiring a reconnect. - Updated `uiResourceRegistration` to call the new method, allowing resource propagation regardless of tool registration status. - Enhanced logging for resource propagation to improve visibility during session updates. * fix(cli): increase chunk size warning limit for bundles * feat(inspector): add HMR regression test for widget resource propagation - Implemented a new E2E test to verify that dynamically added widget resources are correctly registered and propagated to existing sessions during hot module reloading (HMR). - Enhanced file utility functions to support writing and removing widget resource files, ensuring proper cleanup after tests. - Updated the MCPServerClass to track session references for resources, improving synchronization during HMR updates. * feat(logging): add conditional debug logging for widget operations - Introduced a `debugWidget` flag to control logging for widget-related operations in `shared-routes.ts`, `shared-utils.ts`, and `mount-mcp.ts`. - Enhanced logging statements to only execute when the `DEBUG` environment variable is set, improving performance and reducing noise in production logs. - Updated the `requestLogger` to skip logging for noisy GET requests, further optimizing log management. * chore(pnpm): remove test_app configuration and its dependencies from pnpm-lock.yaml * fix(inspector): update build configurations and improve type handling - Modified `package.json` to ensure proper declaration file generation during client exports. - Adjusted `tsconfig.client.json` to change the root directory and output directory for better organization. - Enhanced type handling in `McpUIRenderer.tsx` by using a more specific type for resource properties. - Updated `WidgetDebugContext.tsx` to define a `DeviceType` type for improved type safety. - Removed unused `rpc-log-bus` definitions to clean up the codebase. * feat(mcp): improve resource registration logic in MCPServerClass - Enhanced the resource registration process to skip adding resources that are already propagated to sessions, preventing duplicate registrations. - Updated logging to provide clearer feedback on resource addition and registration failures. - Refactored the handling of widget resource templates to ensure they are only registered if not already present in the session, improving efficiency and reducing potential errors. * feat(mcp): implement dynamic HMR port allocation for development servers - Added a function to find an available port for Hot Module Replacement (HMR), allowing multiple development servers to run concurrently without port conflicts. - Updated the Vite server configuration to use the dynamically allocated HMR port instead of a hardcoded value, enhancing flexibility in development environments. - Improved logging to reflect the dynamically chosen HMR port, ensuring better visibility during server setup. * fix(inspector): improve same-origin detection for widget iframes - Updated the logic for determining if the widget iframe is same-origin with the inspector page, enhancing console interception and debug controls. - Refactored the setting of `isSameOrigin` to use the new computed value, ensuring accurate cross-origin handling for both development and production environments. * fix(inspector): correct inspector API base URL handling - Updated the logic for determining the inspector API base URL to use relative URLs, ensuring that API calls target the correct origin of the inspector UI instead of the MCP server. - Removed the previous logic that derived the base from the MCP server URL, which caused issues when the server ran on a different port, improving cross-origin handling. * refactor(mcp-server): update syncRegistrationsFrom method to return detailed change summary - Modified the syncRegistrationsFrom method to return an object containing total changes and detailed counts for added, removed, and updated tools, prompts, and resources. - This enhancement improves the method's utility by providing comprehensive feedback on registration changes during synchronization. * fix(tests): enhance waitForHMR function to support no-change scenarios - Updated the waitForHMR function to accept an options parameter, allowing it to handle cases where no changes are detected during Hot Module Replacement (HMR). - Modified the integration test to utilize the new functionality, ensuring it can correctly resolve when no changes occur, improving test reliability. * feat(hmr-sync): add debug logging for HMR changes and improve resource key handling - Introduced a new function to check if debug logging is enabled, enhancing the visibility of changes during Hot Module Replacement (HMR). - Updated debug logging to conditionally display changes in configuration and handler, including previews of old and new handlers. - Refactored resource key handling in MCPServerClass to improve clarity and maintainability. * feat(hmr): implement widget re-addition test and enhance resource cleanup - Added a new test to verify that deleting and re-adding a widget resource correctly re-registers it for the same session during Hot Module Replacement (HMR). - Enhanced the MCPServerClass to ensure proper cleanup of resources from both session and root native server states, preventing registration conflicts when re-adding widgets. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore(inspector): update changelog for v0.18.9 and v1.17.4 - Added details for v0.18.9 focusing on log noise reduction and dependency alignment. - Included v1.17.4 updates addressing widget resource propagation and further log noise reduction. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-14 17:29:21 -08:00
Enrico Toniato	af55041eac	fix(inspector): reset readiness state on widget URL change and enhanc… (#991) ... * fix(inspector): reset readiness state on widget URL change and enhance tool output handling (#990) - Added a useEffect hook in OpenAIComponentRenderer to reset the readiness state when the widget URL changes, ensuring proper re-triggering of updates for new iframes. - Updated shared-utils to handle tool output and response metadata updates, improving the transition of widget states from pending to ready. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): enhance iframe global updates handling and cleanup (#992) - Introduced a new type `IframeGlobalUpdates` to manage iframe state updates more effectively. - Refactored the `updateIframeGlobals` function to queue updates until OpenAI globals are available, improving reliability. - Removed outdated comments and code related to tool output and response metadata handling in `shared-utils.ts`, streamlining the update process. - Added cleanup logic for animation frames to prevent memory leaks during component unmounting. * chore(typescript): version packages (canary) * chore(changelog): update changelog for v0.18.8, v0.18.7, v0.18.6, and v1.17.3 releases - Added details for v0.18.8 focusing on widget readiness and iframe global sync fixes. - Included v0.18.7 updates addressing chat conversion and error copy improvements. - Documented v0.18.6 for dependency updates. - Updated v1.17.3 to align TypeScript packages with inspector reliability enhancements. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-12 20:13:22 -08:00
Enrico Toniato	3d787bab34	Canary (#970) ... * feat(inspector): add environment variable for iframe embedding configuration (#965) * feat(inspector): add environment variable for iframe embedding configuration - Introduced `MCP_INSPECTOR_FRAME_ANCESTORS` environment variable to control which origins can embed the inspector widget in iframes, enhancing security and flexibility for both development and production environments. - Updated documentation to include usage examples and best practices for setting the variable, ensuring clarity for users embedding the inspector in their applications. - Refactored server routes and utilities to utilize the new environment variable for setting Content Security Policy (CSP) headers, improving security measures against unauthorized embedding. * feat(server): enhance tool and resource change handling - Added logic to ensure tool request handlers are registered on the SDK server, improving initialization for sessions with no tools. - Updated change detection for tools, prompts, resources, and templates to include removal events, ensuring accurate notifications for list changes. - Enhanced session server communication by sending updates when tools, prompts, resources, or templates are added or removed, improving responsiveness and user experience. * feat(server): pre-initialize request handlers for improved error handling - Added pre-initialization logic for tool, prompt, and resource request handlers on the SDK server to ensure they are available even when starting with zero registrations. - This change prevents -32601 "Method not found" errors on clients by ensuring that necessary handlers are set up during server initialization. * feat(inspector): implement localhost URL conversion for server-side fetches - Added a new utility function `toLocalhostUrl` to convert external proxy URLs to localhost for server-side fetches, ensuring correct content retrieval when running behind reverse proxies. - Updated the inspector's route handling to utilize the new function, improving reliability of widget content fetching. - Enhanced handling of asset URLs to ensure they are correctly rewritten for both external and localhost scenarios, addressing potential issues with proxy catch-all routes. - Configured Vite middleware to allow all hosts, facilitating smoother operation behind various reverse proxies. * feat(inspector): enhance widget URL handling and logging - Improved URL rewriting logic for widget assets to ensure correct resolution both locally and behind reverse proxies. - Added debug logging for fetching and processing widget HTML, aiding in troubleshooting and development. - Introduced a new global variable `__mcpServerUrl` for widgets to dynamically reference the server origin in API calls, enhancing flexibility. - Updated handling of asset paths to preserve query parameters, ensuring accurate resource fetching from the development server. * feat(server): enhance Vite HMR WebSocket support and MCP_URL handling - Updated MCP_URL assignment to only set if not provided by the user, allowing for external proxy configurations. - Implemented WebSocket proxy setup for Vite HMR, enabling hot module reloading through reverse proxies. - Added optional httpServer parameter in ServerConfig for Vite HMR WebSocket support. - Improved WebSocket upgrade request handling to ensure compatibility with various deployment scenarios. * feat(server): enhance HMR support for custom routes and widget management - Introduced a new `shouldRemove` predicate in the sync options to prevent the removal of specific items during HMR, protecting widget-registered tools. - Added a mutable `_customRoutes` registry in the MCP server to manage custom HTTP route handlers, enabling HMR for routes without re-registering. - Implemented a middleware to dispatch custom route handlers from the mutable map, ensuring compatibility with Hono's routing system. - Updated widget tool management to return a boolean indicating existence, allowing for fallback registration if tools are removed during HMR sync. - Enhanced resource directory handling in the widget mounting process to ensure directories are created dynamically for Vite file watching. * feat(inspector): enhance runtime configuration for inspector middleware - Added new configuration options to `mountInspector` for `devMode` and `sandboxOrigin`, allowing for improved handling of development environments and reverse proxy setups. - Updated `registerStaticRoutes` to inject runtime configuration into the HTML, enabling client-side components to access these settings. - Modified the inspector UI mounting process to utilize the new configuration options, enhancing flexibility and usability in various deployment scenarios. * fix(widget-handling): refine widget type determination logic - Updated widget type assignment to prioritize `appsSdk` when only `appsSdkMetadata` is present, ensuring accurate widget classification. - Enhanced metadata handling in widget registration to default to an empty object for `ui` when no metadata is available, improving robustness in widget rendering. * Enhance reverse proxy support and widget handling in inspector - Introduced `MCP_URL` environment variable to allow users to set an external proxy URL, ensuring correct widget asset URLs and HMR WebSocket connections. - Updated `mountInspector` configuration options to include `devMode` and `sandboxOrigin`, improving flexibility for development environments. - Added support for dynamic widget creation and improved HMR reliability, allowing for seamless integration behind reverse proxies. - Documented best practices for using `MCP_URL` and reverse proxy setups, ensuring clarity for users. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(typescript): add completion support to resource templates and publish completion capabilities (#966) * add util for normalizing list callback completions for resource templates * add resource template completion and publish completion capabilites * add tests for toResourceTemplateCompleteCallbacks * add docs for resource templates completion * add changeset * update typescript conformance test server to include prompts and resource templates completion examples * revert default values for arg1 and arg2 and z.string().optional(), change to callback fn * run lint * chore(typescript): version packages (canary) * refactor(tests): remove serial mode configuration from E2E tests for UI widgets, chat, command palette, and setup * fix(inspector): update sandbox permissions for McpUIRenderer and MCPUIResource components (#974) - Removed 'allow-same-origin' and 'allow-popups-to-escape-sandbox' from sandbox permissions to enhance security and simplify iframe configurations. * chore(typescript): version packages (canary) * feat(inspector, typescript): release v0.18.5 and v1.17.0 with iframe embedding, reverse proxy support, and resource template completion - Introduced `MCP_INSPECTOR_FRAME_ANCESTORS` for iframe embedding control. - Enhanced `mountInspector` with `devMode` and `sandboxOrigin` options. - Added runtime config injection for improved deployment flexibility. - Improved server-side widget fetches and asset URL handling for reverse proxies. - Released v1.17.0 with resource template variable completion and custom route HMR support. - Updated dependencies to ensure compatibility with new features. * fix(tests): update hmr test prompts to use completable for default values --------- Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com>	2026-02-09 17:08:47 -08:00
Enrico Toniato	ac3e2166aa	feat(inspector): add comprehensive E2E testing infrastructure and wid… (#957) ... * feat(inspector): add comprehensive E2E testing infrastructure and widget lifecycle improvements (#936) * Fix/mcp-use/pending-state (#931) * feat(inspector): enhance widget support and lifecycle management - Updated MCPAppsRenderer and OpenAIComponentRenderer to handle tool output and metadata more effectively, allowing for immediate rendering of widgets even when results are pending. - Implemented pre-fetching of widget resources in ToolsTab to improve loading states and user experience. - Added utility functions for widget detection and pre-rendering capabilities based on tool metadata. - Enhanced MessageList and ToolResultRenderer to support immediate rendering of widget tools, improving responsiveness during tool execution. - Introduced a delayed weather tool in the example server to demonstrate widget lifecycle management. These changes address Issue #930, ensuring widgets can display loading states and update seamlessly upon tool completion. * fix(inspector): emulate pending state for widgets to align with ChatGPT behavior - Added logic to ensure that the pending state is accurately reflected for widgets, enhancing user experience during tool execution. - Removed unnecessary console logs and warnings in ToolResultRenderer for cleaner code and improved performance. * feat(server): add delayed weather tool to test widget lifecycle - Introduced a new tool, `get-weather-delayed`, which simulates a 5-second delay before returning weather data. This addition aims to test and demonstrate the widget lifecycle management, addressing Issue #930. - Updated documentation to include usage instructions for the new tool, enhancing the example server's functionality. * docs(inspector): update inspector references and enhance widget lifecycle testing documentation - Changed references from "MCP Inspector" to "mcp-use Inspector" for consistency. - Added detailed instructions for testing widget lifecycle, including `isPending` transitions and console log verification. - Updated links and sections to improve clarity and usability in the documentation. * feat(inspector): enhance server connection handling in Layout component (#932) * feat(inspector): enhance server connection handling in Layout component - Added logic to redirect to the autoConnect parameter if a server URL is provided but no matching connection exists. - Updated dependencies in the useEffect hook to include connections and navigate for improved functionality. * feat(inspector): add url-parameters to inspector documentation - Included "inspector/url-parameters" in the documentation index to enhance the inspector's reference materials. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(inspector): add comprehensive E2E testing infrastructure This PR introduces a complete Playwright-based E2E testing suite for the inspector with enhanced testing capabilities across all major features. Major Changes: - Add Playwright E2E testing infrastructure with test fixtures and helpers - Implement comprehensive test coverage for: - Chat functionality and message handling - Connection management and authentication flows (OAuth, API key, custom headers) - HMR (Hot Module Reload) for tools, prompts, and resources - UI widgets and lifecycle states - Command palette and debugger tools - Add data-testid attributes across all UI components for reliable testing - Enhance ToolResultDisplay with widget props support - Add refresh functionality to inspector tabs with unique keys Testing Infrastructure: - New test helpers for connection, auth, and debugger tools - Test matrix for parameterized test scenarios - File utilities for test setup and cleanup - Mock servers for OAuth and custom authentication - Comprehensive E2E testing documentation Widget Examples: - Create widget examples for conformance testing (weather-display, status-card, etc.) - Add delayed weather tool to conformance server for lifecycle testing Breaking Changes: None * chore: update dependencies and enhance ToolsTab functionality - Updated various package versions in pnpm-lock.yaml for improved compatibility and performance. - Added new end-to-end testing scripts in inspector's package.json to facilitate Playwright testing. - Enhanced ToolsTab component to include a refresh feature, allowing for dynamic updates of tools with improved user experience. - Updated dependencies in mcp-use package.json for better stability and functionality. * fix(server): change default port from 3001 to 3000 for server startup * feat(inspector): implement E2E testing workflow and enhance component testing - Added a new GitHub Actions workflow for running Playwright E2E tests across multiple modes (mix, prod, builtin) to validate the Inspector package. - Updated Playwright configuration to improve timeout settings for CI environments and ensure reliable test execution. - Enhanced FullscreenNavbar and MCPAppsDebugControls components with data-testid attributes for better testability. - Refactored MCPAppsRenderer to support custom props and improved display mode handling. - Updated various components to include data-testid attributes for consistent testing practices. - Improved error handling and logging in sampling request display for better debugging during tests. - Adjusted test cases to accommodate longer execution times and ensure stability in E2E tests. * fix(server): refine port assignment logic for server startup - Updated the port assignment logic to ensure the correct default port is used based on command line arguments and development mode. This change clarifies the conditions under which the server will use port 3001 or 3000. * fix(inspector): enhance widget pending state emulation and improve rendering - Updated MCPAppsRenderer and OpenAIComponentRenderer for better handling of tool output and metadata, allowing immediate widget rendering during pending states. - Enhanced MessageList and ToolResultRenderer to support responsive rendering of widget tools. - Introduced a delayed weather tool example in the conformance server to demonstrate widget lifecycle management. - Updated documentation for inspector and widget lifecycle testing, including debugging guides for ChatGPT Apps. Addresses Issue #930. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(typescript): update pnpm-lock.yaml and pre.json for package versions * chore(typescript): update package versions in pnpm-lock.yaml and package.json for improved compatibility (#958) * chore(typescript): version packages (canary) * chore(docs): streamline documentation structure and enhance CLI reference (#960) - Consolidated page entries in docs.json for improved readability. - Added comprehensive CLI reference documentation, detailing installation, commands, and usage examples for the @mcp-use/cli tool. - Updated changelog entries for Inspector and TypeScript to reflect recent enhancements and fixes. * chore(typescript): version packages (canary) * chore(docs): format pages in docs.json for improved readability - Reformatted the "pages" entries in docs.json to use a consistent multi-line structure for better clarity and maintainability. * chore(deps): upgrade @modelcontextprotocol/sdk to 1.26.0 (#961) - Updated SDK from ^1.25.3 to ^1.26.0 in mcp-use and inspector packages - Applied the same Zod 4 compatibility patch to SDK 1.26.0 - Patch fixes safeParse/safeParseAsync to use schema methods instead of top-level functions - Renamed patch file from version-specific to version-agnostic naming - Added changeset documenting the upgrade The SDK still requires the Zod 4 compatibility patch as the upstream fix has not been released yet. This is a drop-in replacement with no breaking changes. * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-04 14:19:49 -08:00
Enrico Toniato	59030e972f	chore(release): update changelog for v0.18.2 and v1.16.2 ... - Added changelog entries for Inspector v0.18.2, including fixes for widget behavior and URL handling. - Updated changelog for TypeScript v1.16.2, addressing widget pending state emulation and dependency updates.	2026-02-02 08:16:44 -08:00
Enrico Toniato	53ae49d153	Canary (#933) ... * Fix/mcp-use/pending-state (#931) * feat(inspector): enhance widget support and lifecycle management - Updated MCPAppsRenderer and OpenAIComponentRenderer to handle tool output and metadata more effectively, allowing for immediate rendering of widgets even when results are pending. - Implemented pre-fetching of widget resources in ToolsTab to improve loading states and user experience. - Added utility functions for widget detection and pre-rendering capabilities based on tool metadata. - Enhanced MessageList and ToolResultRenderer to support immediate rendering of widget tools, improving responsiveness during tool execution. - Introduced a delayed weather tool in the example server to demonstrate widget lifecycle management. These changes address Issue #930, ensuring widgets can display loading states and update seamlessly upon tool completion. * fix(inspector): emulate pending state for widgets to align with ChatGPT behavior - Added logic to ensure that the pending state is accurately reflected for widgets, enhancing user experience during tool execution. - Removed unnecessary console logs and warnings in ToolResultRenderer for cleaner code and improved performance. * feat(server): add delayed weather tool to test widget lifecycle - Introduced a new tool, `get-weather-delayed`, which simulates a 5-second delay before returning weather data. This addition aims to test and demonstrate the widget lifecycle management, addressing Issue #930. - Updated documentation to include usage instructions for the new tool, enhancing the example server's functionality. * docs(inspector): update inspector references and enhance widget lifecycle testing documentation - Changed references from "MCP Inspector" to "mcp-use Inspector" for consistency. - Added detailed instructions for testing widget lifecycle, including `isPending` transitions and console log verification. - Updated links and sections to improve clarity and usability in the documentation. * feat(inspector): enhance server connection handling in Layout component (#932) * feat(inspector): enhance server connection handling in Layout component - Added logic to redirect to the autoConnect parameter if a server URL is provided but no matching connection exists. - Updated dependencies in the useEffect hook to include connections and navigate for improved functionality. * feat(inspector): add url-parameters to inspector documentation - Included "inspector/url-parameters" in the documentation index to enhance the inspector's reference materials. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-02-01 09:48:01 -08:00
Enrico Toniato	e0aead0f74	docs: backfill missing changelog entries for v1.15.0-v1.16.1 ... Backfilled documentation changelog entries for 6 missing TypeScript package versions (v1.15.0 through v1.16.1) and 6 missing Inspector versions (v0.17.0 through v0.18.1) that were already released to the main branch.	2026-01-30 15:11:10 -08:00
Enrico Toniato	32f2113124	Canary (#916) ... * feat(inspector): add support for prompts (without args) to inspector chat (#884) * add prompts support to inspector chat * fix format * add changeset for minor version bump * refactor clearing prompts dropdown UI state * refactor inspector documentation for improved readability and structure - Enhanced formatting and layout for better clarity. - Added new sections for using prompts in chat, including dropdown navigation and execution details. - Updated various text blocks for consistency and readability throughout the document. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(typescript): add completable() helper for prompt argument autocomplete (#899) * add prompt argument completion support * update docs to include completable() * add changeset * feat(completion): enhance prompt argument completion with language support - Added `language` parameter to the review code prompt, allowing users to specify the programming language for code reviews. - Introduced `completable` type and `CompletionContext` interface to support contextual completion suggestions in the completion helpers. - Updated the `completable` function to handle callback context, improving dynamic completion capabilities. - Enhanced unit tests to cover new functionality, including handling of null/undefined values and callback errors. These changes improve the usability and flexibility of the prompt system, enabling more tailored code review experiences. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): add support for file attachments in chat messages (#912) - Introduced functionality to handle image attachments in chat messages, allowing users to send and display images alongside text. - Updated message handling to support multimodal content, including the conversion of messages with attachments to the LangChain format. - Enhanced the user interface to display attachments in the chat, ensuring a seamless experience when sending and receiving messages with images. - Implemented validation for file types and sizes to maintain performance and user experience. These changes significantly improve the chat functionality, enabling richer interactions through multimedia support. * chore(typescript): version packages (canary) * feat(inspector, mcp-use): enhance request origin handling and security headers (#915) - Introduced `getRequestOrigin` function to extract the request origin from headers, supporting proxy-aware configurations. - Updated `getWidgetSecurityHeaders` to include the dynamic request origin in CSP configurations, enhancing security for widget connections. - Modified `registerInspectorRoutes` to utilize the new request origin handling, ensuring proper security headers are set based on the request context. - Refactored UI resource registration to enrich widget definitions with server origin for improved asset loading and API connectivity. These changes improve the security and flexibility of widget interactions within the inspector and MCP applications. * chore(typescript): version packages (canary) * Revert "feat(inspector, mcp-use): enhance request origin handling and securit…" (#917) This reverts commit 3e2821fee8. * chore(typescript): version packages (canary) * feat(cli): enhance server exit handling and introduce gateway URL builder (#920) - Updated server process exit handling to ensure cleanup is performed before exiting the CLI. - Added a centralized function to construct gateway URLs, improving maintainability and consistency in URL generation for deployments. --------- Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-01-30 10:29:03 -08:00
pietrozullo	36e1ac012d	docs(python): document mcpclient constructor	2026-01-29 15:50:39 +01:00
Enrico Toniato	1dcba404b4	Feat/mcp apps 2 (#886) (#887) ... * Feat/mcp apps 2 (#886) * feat(mcp-use): implement dual-protocol support for MCP Apps and ChatGPT widgets - Added support for the MCP Apps Extension (SEP-1865) in mcp-use, enabling widgets to function with both ChatGPT and MCP Apps-compatible clients. - Introduced a new `mcpApps` widget type, allowing unified widget definitions that automatically generate protocol-specific metadata. - Created protocol adapters for transforming widget definitions into formats compatible with both protocols. - Enhanced the server and client code to handle dual-protocol metadata generation and widget registration. - Updated documentation and examples to demonstrate the new functionality and usage patterns. This implementation improves compatibility and flexibility for developers creating widgets across different platforms. * feat(cli, mcp-use): implement Zod JIT compilation patching to prevent CSP violations - Added functionality to post-process JavaScript bundles and patch Zod's JIT compilation to avoid CSP eval violations in sandboxed iframes. - Introduced a new plugin in mcp-use to transform Zod's globalConfig, ensuring compatibility with strict CSP requirements. - Enhanced error handling for asset processing to gracefully manage missing directories. These changes improve security and compatibility for applications using Zod in restricted environments. * feat(inspector): add MCP Apps debugging support and UI Playground - Implemented comprehensive debugging capabilities for MCP Apps (SEP-1865) in the inspector, including a new `MCPAppsRenderer` for rendering widgets. - Introduced a `WidgetDebugContext` to manage widget state, CSP violations, and playground settings. - Added a UI Playground tab for testing widgets with device emulation, CSP mode switching, and traffic logs. - Enhanced existing components to support the new debugging features and integrated CSP violation tracking. - Updated package dependencies to include `@modelcontextprotocol/ext-apps@^0.4.1` for improved functionality. These changes enhance the developer experience by providing robust tools for testing and debugging MCP Apps alongside existing widgets. * feat(cli, inspector, mcp-use): enhance widget metadata and logging capabilities - Updated CLI to allow the server host to default to "0.0.0.0" for broader interface listening. - Enhanced `MCPAppsRenderer` to include a console logging handler for improved debugging of MCP logging notifications. - Refactored `WeatherDisplay` widget to utilize additional user agent and context information, improving display accuracy. - Introduced new properties in `useWidget` and `widget-types` for maximum width and timezone support, enhancing widget adaptability. - Improved server helper functions to normalize URLs and manage X-Frame-Options for cross-origin iframe embedding. These changes collectively enhance the developer experience by providing better logging, improved widget context handling, and more flexible server configurations. * feat(inspector): add MCP Apps support in ResourceResultDisplay - Integrated MCP Apps detection and rendering into the ResourceResultDisplay component. - Implemented logic to check for MCP Apps resources and display corresponding badges. - Enhanced the rendering flow to prioritize MCP Apps over other widget types, improving user experience and functionality. These changes enhance the inspector's capability to handle MCP Apps, aligning with ongoing development efforts for better widget integration. * feat(inspector): enhance inspector with new components and constants for MCP Apps - Updated `tsconfig.client.json` to include constants directory for better module resolution. - Refactored `LayoutContent` to improve the handling of prompt calls with enhanced argument processing. - Introduced `PopoverSelect` and `SafeAreaInsetsEditor` components for reusable UI elements in the inspector. - Added `debug-options` and `iframe` constants for improved configuration management. - Enhanced `MCPAppsDebugControls` and `MCPAppsRenderer` to utilize new constants and improve widget rendering. - Implemented dual-protocol support in various components to streamline widget integration. These changes collectively enhance the inspector's functionality and maintainability, aligning with ongoing development efforts for better widget integration. * feat(cli): normalize browser host for server connections - Introduced a `normalizeBrowserHost` function to convert "0.0.0.0" to "localhost" for browser connections, ensuring compatibility. - Updated CLI logging to reflect the normalized host for local connections, enhancing user experience. - Refactored MCP endpoint and inspector URL generation to utilize the normalized host. These changes improve the reliability of server connections from browsers and streamline the logging output in the CLI. * refactor(inspector): optimize playground handling in OpenAIComponentRenderer - Removed stale closure handling for playground settings by directly capturing the playground state at effect run time. - Enhanced logging to provide better visibility into the stored widget data and playground configuration. - Updated comments for clarity on the handling of dynamic updates to iframe globals without reloading the widget. These changes improve the efficiency and maintainability of the OpenAIComponentRenderer component. * refactor(inspector): remove unused SearchableSelect and UIPlaygroundTab components - Deleted the SearchableSelect component, which was not utilized in the codebase, streamlining the component library. - Removed the UIPlaygroundTab component, consolidating playground functionality and reducing code complexity. These changes enhance maintainability by eliminating redundant components from the inspector package. * refactor(docs): streamline documentation for dual-protocol widget support - Consolidated and clarified documentation across various guides to emphasize dual-protocol support for MCP Apps and ChatGPT Apps SDK. - Updated descriptions and examples to reflect the latest features and best practices for widget development. - Enhanced the inspector documentation to provide clearer instructions for debugging and testing widgets in both protocols. - Removed redundant content and improved organization for better user navigation. These changes improve the overall clarity and usability of the documentation, aiding developers in leveraging the dual-protocol capabilities effectively. * refactor(inspector): optimize MCPAppsRenderer and ToolResultDisplay components - Replaced useState with useRef for containerRef in MCPAppsRenderer to prevent unnecessary state updates during ref callback. - Updated effect dependencies in MCPAppsRenderer to remove unused variables, enhancing performance. - Memoized onSendFollowUp callback in ToolResultDisplay to prevent infinite re-render loops, improving efficiency. - Enhanced WidgetDebugProvider by using useMemo for context value to minimize re-renders and added a ref for accessing current state without causing updates. These changes collectively improve the performance and maintainability of the inspector components. * feat(mcp-use): add landing page generation for browser requests - Introduced a new `generateLandingPage` function to handle browser GET requests and serve a landing page. - Updated the `mountMcp` function to detect browser requests and return the generated landing page with appropriate headers. These changes enhance user experience by providing a dedicated landing page for browser users, improving accessibility and engagement. * refactor(docs): update documentation for dual-protocol widget migration - Enhanced documentation to clarify the migration process from `appsSdk` to `mcpApps`, emphasizing the new `metadata` format. - Added examples demonstrating the updated widget registration and metadata structure for both protocols. - Included a migration checklist and field mapping reference to assist developers in transitioning to the dual-protocol support. These changes improve the clarity and usability of the documentation, aiding developers in effectively leveraging the new features. * refactor(mcp-use): map console log levels to RFC 5424 standards - Introduced a mapping of JavaScript console log levels to RFC 5424 log levels for improved logging consistency. - Updated the logging notification helper to utilize the new mapping, ensuring standardized log level reporting. These changes enhance the clarity and reliability of logging within the MCP Apps Bridge, aligning with best practices for log management. * refactor(docs): update documentation for MCP Apps migration and dual-protocol support - Enhanced the documentation to clarify the migration process from `appsSdk` to `mcpApps`, including updates to the `metadata` format. - Added detailed examples and a migration checklist to assist developers in transitioning to the new dual-protocol support. - Improved the organization and clarity of the documentation, making it easier for developers to understand and implement the changes. These updates aim to facilitate a smoother migration experience and better utilization of the new features in the MCP Apps framework. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * refactor: update templates and documentation for MCP Apps support (#888) * refactor: update templates and documentation for MCP Apps support - Replaced references from `apps-sdk` to `mcp-apps` across various files, including CI workflows, documentation, and template configurations. - Removed the deprecated `creating-apps-sdk-server` documentation and updated links to the new `creating-mcp-apps-server` guide. - Enhanced the README and other documentation files to reflect the new `mcp-apps` template usage and features. - Updated CLI commands and package.json scripts to align with the new template naming conventions. - Improved clarity in documentation regarding the migration from `apps-sdk` to `mcp-apps`, ensuring a smoother transition for developers. These changes collectively enhance the developer experience by providing clearer guidance and updated resources for working with MCP Apps. * chore: update pnpm-lock.yaml for package version adjustments and path corrections - Renamed the path for `mcp-apps` in the lock file to reflect the new directory structure. - Updated package versions for `vite` and related dependencies from 7.3.0 to 7.3.1, ensuring compatibility with the latest features. - Adjusted the path for `mcp-use` dependencies to maintain consistency with the new structure. * chore(typescript): version packages (canary) * Docs/update/fic (#889) * refactor(docs): format documentation page entries for consistency - Updated the `docs.json` file to format the `pages` entries as arrays for better readability and consistency across different groups. - Ensured that all `pages` attributes are uniformly structured, enhancing the overall organization of the documentation. * refactor(docs): improve documentation for dual-protocol widget migration - Updated documentation to clarify the migration process from `appsSdk` to `mcpApps`, including the new `metadata` format. - Added detailed examples and a migration checklist to assist developers in transitioning to the dual-protocol support. - Enhanced organization and clarity of the documentation for better usability. * chore(typescript): version packages (canary) * refactor(product-search-result): update widget descriptions for MCP Apps consistency (#890) - Revised text in the ProductSearchResult widget to replace references from "OpenAI apps sdk" to "mcp-apps specification" for clarity. - Updated the template title from "Apps SDK Template" to "MCP-Apps Template" and adjusted the description to reflect the new naming conventions, enhancing consistency across the documentation and user experience. * chore(typescript): version packages (canary) * refactor(product-search-result): update widget configuration and impr… (#891) * refactor(product-search-result): update widget configuration and improve HTML injection for MCP Apps - Cleared the connectDomains in the product search result widget to enhance security. - Removed the title prop from the Accordion component to simplify its usage. - Preserved devServerBaseUrl during HTML injection in shared routes for better compatibility with MCP Apps. - Enhanced the logging notification system in the MCP Apps Bridge to handle serialization of console arguments, improving error handling and preventing DataCloneError. - Updated protocol helpers to ensure proper merging of UI metadata, maintaining resourceUri integrity. These changes collectively improve the configuration and functionality of widgets within the MCP Apps framework, enhancing security and usability. * refactor(ci): update template configurations for consistency across workflows - Replaced the `mcp-ui` template with `blank` in CI workflows to streamline template options. - Removed outdated logging tips related to the `mcp-ui` template in the create-mcp-use-app package, enhancing clarity for developers. These changes improve the consistency and clarity of template usage in the CI processes and documentation. * refactor(inspector): enhance MCP Apps debugging and widget integration - Improved the MCPAppsRenderer and ToolResultDisplay components for better performance and maintainability. - Streamlined the handling of widget state and logging within the inspector, enhancing debugging capabilities for MCP Apps. - Updated documentation to clarify the dual-protocol support and provide clearer instructions for developers. These changes collectively enhance the developer experience by optimizing component performance and improving the clarity of documentation for MCP Apps integration. * chore(typescript): version packages (canary) * chore(package): add lodash override to package.json templates * chore(typescript): version packages (canary) * feat(mount-mcp): add helper function to construct full URL with proxy headers - Introduced `getFullUrl` function to handle URL construction considering proxy headers, improving compatibility for production deployments. - Updated landing page generation to use the constructed full URL instead of the raw request URL, enhancing accuracy in response handling. * refactor(weather): simplify weather response in starter template - Updated the weather response in the starter template to return a static sunny message instead of fetching real-time data, streamlining the functionality for demonstration purposes. * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-01-26 16:41:17 -08:00
pietrozullo	49926b7bbf	chore(docs): linking does not work in docs and results in 404 page. remove updates page from main navigation	2026-01-25 11:46:01 +01:00
Enrico Toniato	e463f68bf7	fix(docs): update GitHub Issues link for telemetry documentation	2026-01-22 15:10:28 +01:00
pietrozullo	6f5b47b21d	chore(docs): fixes and logo update	2026-01-22 14:05:54 +01:00
pietrozullo	cd6408069f	docs(python): revamp getting started pages to match TypeScript style ... - Add welcome page with py_welcome.png image - Rewrite quickstart with Agent/Client/Server sections and mermaid diagram - Simplify installation page (single package, no separate sections) - Add updates symlink to changelog in getting-started - Remove configuration overview page, update broken links to specific pages - Update changelog title to "Updates"	2026-01-22 13:38:01 +01:00
Enrico Toniato	8326a667c1	Fix/inspector/header-dialog (#874) (#875) ... * Fix/inspector/header-dialog (#874) * feat(inspector): enhance CustomHeadersEditor with focus management and title prop * feat(inspector): enhance widget security headers with frame domain support - Added `frame_domains` to the `widgetCSP` interface to specify allowed domains for iframe embeds. - Updated `getWidgetSecurityHeaders` function to include `frame_domains` in the Content Security Policy, ensuring compatibility with OpenAI specifications. - Enhanced CSP handling in `OpenAIComponentRenderer` to prioritize metadata from tool results and resources for improved security management. * refactor(inspector): standardize proxy configuration and enhance connection handling - Renamed `customHeaders` to `headers` in `InspectorDashboard` and `ServerConnectionModal` for consistency. - Removed unused state management for connecting servers in `InspectorDashboard`. - Improved server connection handling by introducing a `handleReconnect` function to manage reconnection attempts. - Updated UI elements to reflect connection states more accurately, including hover effects and error displays. - Enhanced error handling for unauthorized connections, providing clearer user feedback. These changes aim to streamline the connection management process and improve the overall user experience in the inspector interface. * feat(inspector): add state management for connecting servers in InspectorDashboard - Introduced a new state variable `_connectingServers` in the InspectorDashboard component to manage the connection status of servers. - This enhancement lays the groundwork for improved server connection handling and user feedback in the inspector interface. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(cli): pass environment variables during redeployment (#837) * fix(cli): pass environment variables during redeployment Previously, when redeploying an existing deployment with `--env-file`, the environment variables were parsed and displayed in the CLI output but not actually sent to the backend API. Changes: - Add RedeploymentConfig interface to api.ts with env, buildCommand, startCommand, and port fields - Update redeployDeployment() to accept either a config object or file path (backward compatible) - Pass redeploymentConfig with env vars when calling redeployDeployment in deploy.ts - Add tests for redeployment with environment variables Note: The backend API endpoint (/deployments/{id}/redeploy) also needs to be updated to process these environment variables and pass them to the cloud provider. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor(cli): update redeployment configuration to conditionally include port - Modified the redeployment configuration in deploy.ts to only include the port if it is explicitly provided, preventing the override of existing custom ports. - Cleaned up comments in api.ts for better clarity and consistency. This change enhances the flexibility of the redeployment process by allowing users to maintain their custom port settings. * chore(typescript): version packages (canary) * fix(docs): update sessionIdleTimeoutMs default value in documentation and code (#876) - Updated the default value of `sessionIdleTimeoutMs` from 5 minutes (300000 ms) to 1 day (86400000 ms) across various documentation files and code implementations. - Adjusted related comments and descriptions to reflect the new default session timeout duration for better clarity and consistency. * chore(typescript): version packages (canary) * Fix/server/default-widget-domain (#877) * chore(docs): update changelog for v0.16.2 and v0.16.1 releases - Added details for v0.16.2 including UI enhancements, widget security improvements, and connection handling updates. - Included v0.16.1 changes focusing on tool output display fixes and session timeout adjustments. - Updated dependency alignment for both versions. * docs: enhance Apps SDK metadata documentation and clarify defaults - Added details about default Apps SDK metadata values, including `openai/widgetDomain` and its requirement for app submission. - Updated the `creating-apps-sdk-server.mdx` file to clarify the automatic generation of metadata. - Included examples for customizing Apps SDK metadata in the `ui-widgets.mdx` file. * chore(typescript): version packages (canary) * feat(server): enhance favicon handling and public route setup (#880) - Introduced a new function `selectFaviconFromIcons` to automatically select a favicon based on priority from the provided icons array. - Updated the MCPServerClass to use the new favicon selection logic when initializing the server. - Added a `publicRoutesMode` property to track the setup state of public routes, allowing for conditional setup in development and production modes. - Modified widget mounting functions to respect the `publicRoutesMode` and prevent redundant route setups. - Ensured that public routes and favicon routes are only set up if not already configured, improving efficiency and clarity in route management. * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: soltomm <146624575+soltomm@users.noreply.github.com>	2026-01-22 13:30:36 +01:00
pietrozullo	be5f4d7490	python/release1.6.0	2026-01-22 12:58:01 +01:00
Pietro Zullo	d789a92b4b	feat(server): Bearer Token authentication for Python MCP server (#841) ... * Fix DNS rebinding protection for cloud/proxy deployments - Add host/port parameters to MCPServer.__init__() and pass to FastMCP - Default host to "0.0.0.0" (cloud-friendly, disables DNS protection) - "127.0.0.1" auto-enables DNS protection (handled by FastMCP) - run() can override host/port, falls back to __init__ values - Add comprehensive docstring to __init__() explaining parameters - Update documentation This fixes 421 Misdirected Request errors when running behind reverse proxies (Cloudflare, nginx, etc.) where the Host header doesn't match the auto-configured allowed_hosts for localhost. * Fix DNS rebinding protection for cloud/proxy deployments - Add host/port parameters to MCPServer.__init__() and pass to FastMCP - Default host to "0.0.0.0" (cloud-friendly, disables DNS protection) - "127.0.0.1" auto-enables DNS protection (handled by FastMCP) - run() can override host/port and reconfigures DNS protection accordingly - Rebuild app when host changes in run() to apply new security settings - Add comprehensive docstring to __init__() explaining parameters - Add unit tests for host/port configuration and run() overrides - Update documentation This fixes 421 Misdirected Request errors when running behind reverse proxies (Cloudflare, nginx, etc.) where the Host header doesn't match the auto-configured allowed_hosts for localhost. * ruff lint * Bump mcp minimum version to 1.23.0 Required for TransportSecuritySettings and DNS rebinding protection auto-configuration feature that was added in v1.23.0. * feat(server): add bearer token authentication for Python MCP server Add HTTP-layer bearer token authentication that returns proper 401 responses. - BearerAuthProvider: abstract base class with verify_token() method - AccessToken: model with token, claims, and scopes fields - AuthMiddleware: Starlette middleware returning HTTP 401 for invalid tokens - get_access_token() / require_auth(): context helpers for tools Usage: ```python class MyAuth(BearerAuthProvider): async def verify_token(self, token: str) -> AccessToken | None: if token != "secret": return None return AccessToken(token=token, claims={"user": "alice"}) server = MCPServer(name="my-server", auth=MyAuth()) ``` Closes #840 * autogenerate docs * test(server): add unit and integration tests for bearer token auth Unit tests: - AccessToken model creation and serialization - BearerAuthProvider abstract class and subclassing - get_access_token/require_auth context helpers - AuthMiddleware 401 responses, path exclusion, CORS Integration tests: - MCPClient connecting to bearer auth server with valid token - Connection failure with invalid/missing token - Tool access to user claims and scopes * fix(server): address code review feedback for bearer auth - Fix CORS security: allow_credentials=False with allow_origins=["*"] - Remove dead try/except import for auth module - Remove PII (email) from debug logs - Add comment explaining broad exception handling in verify_token - Add /openmcp.json to docs excluded paths list - Remove set_access_token from public API (internal only) - Create AuthenticationError instead of using ValueError - Skip middleware tests on older httpx versions (TestClient compat) * docs: update API documentation for auth module * fix(server): address Copilot review feedback - Fix bearer.mdx: require_auth raises AuthenticationError, not ValueError - Fix API docs: claims and scopes are optional with defaults, not required - Remove deprecated SSE transport from bearer_auth_server.py test server * autogenerate docs * fix(server): address renvins review feedback - Improve bearer.mdx claims documentation with explanation and examples - Remove unnecessary cast() for AuthMiddleware in server.py - Refactor auth tests to use pytest fixtures for cleaner setup/teardown * docs(auth): clarify that all MCP endpoints are automatically protected - Add "What Gets Protected" section explaining automatic protection - Clarify that get_access_token/require_auth are for accessing token data, not protection - Update examples to show proper usage pattern - Improve Note at bottom to be clearer * fix(auth): prevent path prefix bypass in auth middleware Security fix: Use exact path matching or segment-based prefix matching instead of simple startswith() to prevent auth bypass attacks. Before: /docs-secret would bypass auth because it starts with /docs After: Only /docs and /docs/* bypass auth, /docs-secret requires auth Added tests for path matching security edge cases. * refactor(auth): update import paths for authentication components - Changed import statements in multiple documentation files and source files to reflect the new structure, moving authentication-related imports to the `auth` submodule. - Updated examples to ensure clarity and consistency in usage patterns for `BearerAuthProvider`, `AccessToken`, `get_access_token`, and `require_auth`.	2026-01-21 17:53:38 +01:00
Enrico Toniato	fe72e7ed80	Canary (#849) ... * feat: enhance MCP server configuration with project name, icons, and website URL support (#844) * feat: enhance MCP server configuration with project name, icons, and website URL support - Added support for dynamic project names in MCP server configurations by replacing placeholders in templates. - Introduced new fields for website URL and icons in the MCP server configuration, allowing for better branding and information display. - Updated various templates to include favicon and icon SVG files for improved visual representation. - Enhanced the inspector UI to display website URLs and icons associated with the server. * feat: enhance MCP server documentation with server metadata and configuration details - Added examples for server metadata including title, icons, and website URL in the MCPServer configuration. - Updated the `ServerConfig` interface to include new fields for better branding and information display. - Clarified the automatic configuration of metadata fields when using `create-mcp-use-app` for improved user experience. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(inspector): add copy functionality for RPC messages in Prompts, Resources, and Tools tabs (#848) - Introduced a new "Copy" button to allow users to copy all RPC messages to the clipboard in the PromptsTab, ResourcesTab, and ToolsTab components. - Updated the JsonRpcLoggerView to include a button for copying individual message payloads. - Enhanced the user interface for better message management, including the addition of export functionality. * chore(typescript): version packages (canary) * Fix/widgets/hmr (#845) * feat(mcp-use): enhance widget tool management with HMR support - Added methods for adding, updating, and removing widget tools directly in active sessions to improve hot module replacement (HMR) functionality. - Updated the `uiResourceRegistration` to handle updates without re-registering tools, ensuring immediate visibility of changes. - Enhanced logging for better debugging during tool updates and resource management. - Updated dependencies in `pnpm-lock.yaml` and `package.json` for example projects to include new packages and versions. - Refactored `ToolsTab` component to clear selected tools when they are removed from the list. This commit improves the developer experience by streamlining widget tool management and enhancing the responsiveness of the MCP server during development. * feat(mcp-use): enhance tool and resource registration for Apps SDK widgets - Added functionality to register associated widget resources and templates during tool registration, ensuring they are queryable before notifications are sent. - Improved logging for resource and tool registration processes to aid in debugging. - Created a structured tool entry with additional fields for better management of tool states and updates. This update enhances the responsiveness and usability of the MCP server when handling widget tools and resources. * feat(mcp-use): improve widget tool registration and session management - Enhanced the registration process for widget tools to ensure better tracking and management of tool states. - Implemented new methods for managing widget tools within active sessions, improving the overall responsiveness of the MCP server. - Updated logging mechanisms to provide clearer insights during tool registration and session updates. This update aims to streamline the developer experience by optimizing widget tool management and enhancing session handling. * chore(pnpm-lock): update dependency versions and remove unused test_app section * fix(mcp-server): refine input schema handling and resource template registration - Updated input schema initialization to ensure it defaults to an empty object when no schema is provided, improving robustness. - Enhanced resource template registration by creating a new ResourceTemplate instance, ensuring proper handling of resource URIs. - Adjusted schema update checks to use 'in' operator for better clarity and reliability in determining schema presence. These changes aim to streamline the MCP server's handling of tool registration and input validation, enhancing overall stability and performance. * chore(typescript): version packages (canary) * chore: update dependencies and refactor ResizablePanelGroup usage (#846) * chore: update dependencies and refactor ResizablePanelGroup usage - Updated various dependencies in package.json files across multiple packages, including @types/node, @types/react, @typescript-eslint packages, and others. - Refactored ResizablePanelGroup components to use 'orientation' instead of 'direction' for better clarity in the inspector package. - Enhanced versioning for packages like esbuild, globby, and others to ensure compatibility and stability. * chore: clean up pnpm-lock.yaml by removing unused dependencies - Removed deprecated dependencies related to @ai-sdk packages and others from pnpm-lock.yaml to streamline the lock file and improve package management. - Updated snapshots to reflect the removal of these dependencies, ensuring consistency across the project. * fix(telemetry): update shutdown method for posthog-node compatibility - Changed the shutdown method in the telemetry client to return a Promise, aligning with posthog-node v5.22.0 requirements. - Ensured proper asynchronous handling to prevent test timeout issues during error scenarios. * refactor: update PromptsTab, ResourcesTab, and ToolsTab to use usePanelRef for panel management - Replaced useRef with usePanelRef in PromptsTab, ResourcesTab, and ToolsTab for improved panel handling. - Adjusted panel collapse and expand logic to accommodate new panel references. - Updated default sizes and minimum sizes for resizable panels to enhance layout consistency. - Refactored ResizablePanelGroup and ResizablePanel components to streamline usage and improve readability. * refactor(PromptsTab): replace promptParamsPanelRef with toolParamsPanelRef for improved panel management - Updated PromptsTab to utilize usePanelRef for toolParamsPanelRef, enhancing consistency in panel handling. - Adjusted collapse and expand logic to reflect the new reference, ensuring proper functionality of the UI components. * refactor: consolidate RPC message handling into a reusable RpcPanel component - Created a new RpcPanel component to manage JSON-RPC messages across PromptsTab, ResourcesTab, and ToolsTab. - Updated existing tabs to utilize the RpcPanel, simplifying the code and enhancing maintainability. - Ensured backward compatibility by checking both 'headers' and 'customHeaders' in relevant components. - Improved UI consistency and functionality for managing RPC messages, including clear and export actions. * feat(mcp-server): implement widget tool management with safety checks - Added methods for adding, updating, and removing widget tools in the MCPServerClass, ensuring tools can be managed dynamically. - Introduced safety checks to prevent prototype pollution when handling tool names. - Enhanced session management by ensuring tools and associated resources are immediately queryable across active sessions. - Updated notifications to inform clients of changes in tool and resource lists after modifications. * refactor(mcp-server): reorganize import statements for improved readability - Reformatted import statements in mcp-server.ts to enhance clarity and maintainability. - Grouped related imports together, ensuring a cleaner structure and easier navigation of dependencies. * chore(typescript): update @babel/parser and @babel/types to version 7.28.6 - Removed outdated versions of @babel/parser and @babel/types (7.28.5) from pnpm-lock.yaml. - Updated dependencies to ensure compatibility with the latest version (7.28.6) across relevant packages. * feat(tests): add timeout and disable retries for agent.streamEvents() test - Introduced a 5-second timeout to the agent.streamEvents() integration test to ensure faster failure on invalid API keys. - Disabled retries by setting maxRetries to 0, allowing for immediate feedback during test execution. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * refactor(widget-helpers): reorganize imports and enhance slugifyWidgetName function (#854) - Adjusted import statements for improved clarity and consistency. - Added input length validation to the slugifyWidgetName function to prevent ReDoS attacks by limiting the maximum length of the input string. - Refined the regex replacements in slugifyWidgetName for better readability and functionality. * chore(typescript): version packages (canary) * refactor(cli): streamline widget building process with parallel execution (#855) - Introduced a helper function to build individual widgets, improving code organization and readability. - Implemented parallel execution for building widgets, enhancing performance. - Filtered out failed builds to ensure only successful widget metadata is returned. * chore(typescript): version packages (canary) * docs(widget-lifecycle): add guidance on handling loading states in widgets (#856) - Updated documentation to emphasize the importance of checking the `isPending` state when rendering widgets. - Included examples demonstrating how to handle loading states effectively to prevent accessing undefined properties. - Enhanced clarity on the widget lifecycle, ensuring developers understand the rendering behavior before tool execution completes. * fix(inspector): resolve Anthropic tool_use.id required error (#857) Updates LangChain packages to fix the "messages.6.content.3.tool_use.id: Field required" error when using Anthropic provider in Inspector chat with tool calls. Changes: - Updated @langchain/anthropic to ^1.3.10 in inspector - Updated @langchain/core to ^1.1.15 in inspector - Added langchain ^1.2.10 as dependency in inspector - Updated peerDependencies in mcp-use package to match The latest @langchain/anthropic (1.3.10) includes proper tool_call ID generation, ensuring every tool_use block has a unique ID that matches Anthropic's API requirements. Fixes: MCP-1165 * chore(typescript): version packages (canary) * refactor(inspector): extract mcp prompts logic from PromptsTab to useMCPPrompts hook for reuse in ChatsTab (#852) * feat(mcp-use): add support for HEAD requests in mountMcp function (#858) * Update libraries/typescript/packages/mcp-use/src/react/widget-types.ts Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Update libraries/typescript/packages/mcp-use/examples/server/ui/apps-sdk/resources/product-search-result/widget.tsx Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Update libraries/typescript/packages/create-mcp-use-app/src/templates/apps-sdk/resources/product-search-result/widget.tsx Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Update libraries/typescript/packages/inspector/src/client/components/ToolsTab.tsx Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * Fix/server/metadata (#859) * feat(mcp-server): add additional configuration options for MCP server - Added support for title, websiteUrl, and icons in the createMCPServer function to enhance server configuration capabilities. * docs(api-reference): deprecate autoCreateSessionOnInvalidId in ServerConfig - Marked the autoCreateSessionOnInvalidId property as deprecated, advising users to use sessionStore for persistent sessions in future versions. * chore(typescript): version packages (canary) * chore(docs): update changelogs for v0.16.0 and v1.14.0 releases - Added details for v0.16.0 focusing on RPC message management and LangChain fixes, including new features and enhancements. - Updated v1.14.0 changelog to highlight server metadata support and widget enhancements, along with bug fixes and dependency updates. * feat(cli): enhance CLI to display package versions during dev and build commands (#861) * chore(typescript): version packages (canary) * Feature/mcp-986-resources-tab-should-allow-setting-props (#865) * refactor(inspector): enhance JSONDisplay and ToolExecutionPanel components - Updated JSONDisplay to improve line wrapping and font size for better readability. - Modified ToolExecutionPanel to include a collapsible description section and integrated JSONDisplay for tool metadata visualization. - Adjusted styles and structure for improved user experience and accessibility. * feat(inspector): add custom properties support across components - Introduced `customProps` to `McpUIRenderer`, `OpenAIComponentRenderer`, and `ResourceResultDisplay` for enhanced flexibility in rendering. - Updated `ResourcesTab` and `LayoutContent` to utilize `mcpServerUrl` and pass additional props. - Enhanced `ResourceResultDisplay` with a `PropsSelect` component for dynamic prop configuration. - Improved overall component integration and data handling for better user experience. * feat(cli): add MCP_URL environment variable for server configuration - Introduced MCP_URL to the environment variables for the server, allowing for easier access to the server's URL. - Updated the process environment setup to include MCP_URL in both development and fallback scenarios. * feat(mcp-proxy): enhance error logging for proxy requests - Improved error handling in the MCP Proxy middleware to provide better context in logs. - Added specific handling for connection refused errors, logging them as warnings. - Included target URL in error responses for easier debugging of proxy request failures. * feat(inspector): enhance resource properties management and improve UI components - Added support for custom properties in resources, including a new `PropsSelect` component and `PropsConfigDialog` with AI suggestions. - Introduced `usePropsLLM` and `useResourceProps` hooks for better state management. - Enhanced `JSONDisplay`, `ToolExecutionPanel`, and `ResourceResultDisplay` for improved usability and readability. - Updated `McpUIRenderer` and `OpenAIComponentRenderer` to support dynamic properties. * refactor(inspector): remove default auto reconnect setting in App component - Removed the `defaultAutoReconnect` property from the App component configuration to streamline connection management. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * Update libraries/typescript/packages/inspector/src/client/hooks/useMCPPrompts.ts Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * fix(cli): correct CLI message to accurately reflect package version display during dev and build commands * Remove unit tests for MCPServer host/port configuration from test_server_config.py * Add unit tests for MCPServer host/port configuration This commit introduces a new test suite for the MCPServer class, verifying default and custom host/port settings, DNS rebinding protection behavior, and the ability to override configurations during runtime. The tests ensure that the server's settings are correctly initialized and modified, enhancing the reliability of the MCPServer configuration. * Fix/inspector/unselect-prompt-if-removed (#866) * fix(cli): correct CLI message to accurately reflect package version display during dev and build commands * fix(inspector): handle prompt selection clearing when prompt no longer exists in the list * fix(inspector): improve handling of prompt selection clearing when prompts are removed from the list * chore(typescript): version packages (canary) * refactor(cli): enhance displayPackageVersions function to support project path resolution (#867) This update modifies the displayPackageVersions function to accept an optional projectPath parameter, allowing it to resolve package versions from a user's project node_modules for standalone installations. It also improves error handling by logging debug messages when packages are not found, aiding in troubleshooting. The CLI commands are updated to pass the projectPath when invoking this function. * chore(typescript): version packages (canary) * refactor(inspector): conditionally add temperature to llmOptions in usePropsLLM hook (#868) This update modifies the usePropsLLM hook to only include the temperature setting in llmOptions if it is explicitly configured in llmConfig. This change aims to prevent model-specific issues related to temperature settings, enhancing the flexibility and reliability of the configuration. * chore(typescript): version packages (canary) --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>	2026-01-21 13:12:45 +01:00
Enrico Toniato	21ca5d8013	fix(docs): update links in documentation for consistency and accuracy ... - Corrected the MCP Specification link in the TypeScript client documentation. - Updated relative paths to the CONTRIBUTING.md file in Python and TypeScript README files. - Adjusted links in various README files to ensure they point to the correct resources, including examples and specifications. - Removed outdated deployment instructions from the Inspector package README.	2026-01-20 11:21:45 +01:00
Pietro Zullo	79d017bdc2	fix(python): DNS rebinding protection for cloud/proxy deployments (#825) ... * Fix DNS rebinding protection for cloud/proxy deployments - Add host/port parameters to MCPServer.__init__() and pass to FastMCP - Default host to "0.0.0.0" (cloud-friendly, disables DNS protection) - "127.0.0.1" auto-enables DNS protection (handled by FastMCP) - run() can override host/port, falls back to __init__ values - Add comprehensive docstring to __init__() explaining parameters - Update documentation This fixes 421 Misdirected Request errors when running behind reverse proxies (Cloudflare, nginx, etc.) where the Host header doesn't match the auto-configured allowed_hosts for localhost. * Fix DNS rebinding protection for cloud/proxy deployments - Add host/port parameters to MCPServer.__init__() and pass to FastMCP - Default host to "0.0.0.0" (cloud-friendly, disables DNS protection) - "127.0.0.1" auto-enables DNS protection (handled by FastMCP) - run() can override host/port and reconfigures DNS protection accordingly - Rebuild app when host changes in run() to apply new security settings - Add comprehensive docstring to __init__() explaining parameters - Add unit tests for host/port configuration and run() overrides - Update documentation This fixes 421 Misdirected Request errors when running behind reverse proxies (Cloudflare, nginx, etc.) where the Host header doesn't match the auto-configured allowed_hosts for localhost. * ruff lint * Bump mcp minimum version to 1.23.0 Required for TransportSecuritySettings and DNS rebinding protection auto-configuration feature that was added in v1.23.0.	2026-01-19 15:32:58 +01:00
Enrico Toniato	b65d05d21e	Fix/cli/github-deployment (#834) (#835) ... * Fix/cli/github-deployment (#834) * refactor(auth): improve OAuth proxy URL handling and clarify connection URL logic (#831) - Changed `let` to `const` for `connectionUrl` to enforce immutability. - Enhanced logic for deriving `oauthProxyUrl` from the callback URL, including handling cases where the callback is at the root path. - Updated comments to clarify the distinction between `oauthProxyUrl` and `connectionUrl`, ensuring better understanding of their roles in the authentication flow. - Removed the clearing of OAuth storage before connecting to maintain valid tokens across sessions. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(cli): add .gitignore and CLAUDE.md for CLI documentation - Introduced a .gitignore file to exclude .mcp-use from version control. - Added CLAUDE.md to provide comprehensive guidance on using the CLI, including development commands, architecture details, and deployment instructions. - Enhanced authentication flow in auth.ts with CSRF protection and improved error handling for GitHub integration in deploy.ts. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * docs: update changelog with new patch releases for inspector and typescript - Added entries for versions v0.15.3, v0.15.2, and v0.15.1 in the inspector changelog, detailing dependency updates, OAuth proxy URL handling improvements, and localStorage enhancements. - Included entries for versions v1.13.5, v1.13.4, and v1.13.3 in the typescript changelog, highlighting CLI documentation enhancements, OAuth proxy improvements, and telemetry updates. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-01-17 14:00:50 +01:00
Enrico Toniato	5176e26589	docs: update installation instructions to include package installation commands ... - Added `npm install`, `pnpm install`, and `yarn install` commands to the installation sections in multiple documentation files to ensure users install dependencies after scaffolding a new MCP server project.	2026-01-15 12:57:48 +01:00
Enrico Toniato	0144a315fd	Canary (#815) ... * chore(deps): bump hono from 4.11.1 to 4.11.4 in /libraries/typescript (#810) * chore(deps): bump hono from 4.11.1 to 4.11.4 in /libraries/typescript Bumps [hono](https://github.com/honojs/hono) from 4.11.1 to 4.11.4. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.11.1...v4.11.4) --- updated-dependencies: - dependency-name: hono dependency-version: 4.11.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat(inspector): add stop functionality to inspector chat (#811) * add stop func to inspector chat * chore: apply formatting fixes and add changeset for stop functionality - Run prettier formatting on inspector files - Add changeset for stop functionality feature Co-authored-by: Joaquin Coromina <bjoaquinc@users.noreply.github.com> * fix(chat): handle cancellation of pending tool calls in MessageList and chat message hooks - Updated MessageList component to reflect tool invocation states: "error", "pending", and "result". - Implemented logic in useChatMessages and useChatMessagesClientSide hooks to mark pending tool calls as cancelled when the abort signal is triggered, updating the message state accordingly. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Joaquin Coromina <bjoaquinc@users.noreply.github.com> * Feat/cli/improve devx (#808) * feat(cli): enhance login and deployment commands with improved error handling and user prompts - Updated the login command to handle errors gracefully, providing user feedback on login failures. - Modified the deployment command to prompt users for login if not authenticated, enhancing user experience. - Removed the `fromSource` option from the deployment command, streamlining the deployment process. - Added checks for uncommitted changes in the git repository before deployment, ensuring users are aware of their current state. - Updated various commands to consistently use `npx mcp-use login` for login instructions, improving clarity. * refactor(inspector, multi-server-example): streamline authentication UI and logic - Simplified the authentication button logic in InspectorDashboard, consolidating the rendering of the authentication state and removing redundant elements. - Updated the multi-server example to directly link to the authentication URL, enhancing user experience by eliminating unnecessary prompts and improving clarity in the authentication process. * fix(multi-server-example): update Supabase URL to use placeholder for project reference - Changed the Supabase server URL in the multi-server example to use a placeholder `{PROJECT_REF}` instead of a hardcoded project reference, enhancing flexibility and usability for developers using the example. * feat(cli): enhance login and deployment commands; refactor authentication UI - Improved error handling in the login command and added user prompts for better feedback. - Updated the deployment command to prompt for login if not authenticated and removed the `fromSource` option. - Added checks for uncommitted changes before deployment. - Streamlined the authentication UI in InspectorDashboard and updated the multi-server example to link directly to the authentication URL. * feat(ci): add caching for Deno dependencies in CI workflow - Implemented a caching mechanism for Deno dependencies in the TypeScript PR preview workflow to reduce download timeouts during tests. - Added retry logic for caching attempts to enhance reliability and ensure tests can proceed even if caching fails. * fix(ServerDropdown, ShimmerButton): update theme handling and styling adjustments - Refactored theme handling in ShimmerButton to use `theme` instead of `resolvedTheme`, ensuring consistent color application based on the current theme. - Made minor styling adjustments in ServerDropdown to enhance button appearance, maintaining responsiveness and visual clarity across themes. * feat(typescript): add type definitions for React and ReactDOM - Added `@types/react` and `@types/react-dom` to the TypeScript package dependencies to improve type support for React components, enhancing development experience and type safety. * refactor(ui): enhance component type definitions and forward refs - Updated Badge and Button components to use React.forwardRef for improved ref handling. - Enhanced Checkbox and Popover components with explicit type definitions for better type safety. - Refactored DropdownMenu components to include type annotations, ensuring consistency and clarity in usage. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(logging): replace Winston with built-in SimpleConsoleLogger and enhance logging configuration - Removed the `winston` dependency, introducing a built-in logging system that works in both Node.js and browser environments. - Updated logging configuration in the server documentation to reflect the new logger's API and usage. - Enhanced RPC logging with new filtering capabilities and added migration guides for users transitioning from Winston. - Added `.gitignore` files to various templates to prevent unnecessary files from being included in version control. * feat(changelog): add release images for versions 1.12.0 to 1.1.0 - Included image frames for each release in the changelog, enhancing visual representation of updates from version 1.12.0 down to 1.1.0. - Each image corresponds to the respective release title and date, improving the overall presentation of the changelog. * feat(docs): update inspector and TypeScript changelogs with new features and enhancements - Added detailed release notes for versions 0.15.0 to 0.14.1 in the inspector changelog, highlighting new functionalities like chat stop capabilities and various enhancements. - Updated TypeScript changelog with entries for versions 1.13.2 to 1.12.1, including improvements in CLI commands, dependency updates, and security fixes. - Enhanced overall documentation clarity by including images for specific releases and restructuring content for better readability. * fix(docs): correct changelog formatting and enhance clarity (#817) - Fixed formatting issues in the TypeScript changelog by ensuring proper closing tags for update sections. - Improved overall readability and structure of the changelog entries for better user experience. * chore(typescript): version packages (canary) * refactor(docs): improve formatting of pages in documentation structure - Reformatted the pages array in the documentation JSON to enhance readability and maintain consistency across different sections. - Ensured that each page entry is on a new line for better clarity and easier future modifications. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Joaquin Coromina <bjoaquinc@users.noreply.github.com>	2026-01-15 11:53:35 +01:00
Pietro Zullo	d8d319c940	fix(python/server): improve debug and pretty_print_jsonrpc behavior (#814) ... * fix(python/server): improve debug and pretty_print_jsonrpc behavior - Make pretty_print_jsonrpc work independently of debug_level (previously required DEBUG=2 environment variable) - Rename run_debug to debug in server.run() for consistency - Make run(debug=True) override server's debug_level if it was 0 - Remove aggressive signal handlers that broke thread compatibility (uvicorn handles SIGINT/SIGTERM gracefully) - Update all documentation to use new debug parameter name * refactor(python/server): remove unused lupo_tool function from server_example.py * docs: update signals API reference after simplification * refactor: remove unused signals.py module uvicorn already handles SIGINT/SIGTERM gracefully, so custom signal handlers are unnecessary. Removed the signals.py file and all references to setup_signal_handlers(). * chore: remove analysis files	2026-01-14 18:43:25 +01:00
Vincenzo Reina	4997674559	feat(python): Intercept MCP handshake with on_initialize middleware (#769) ... * Wrap server session from MCP * Update server and middleware * Update middleware example * Fix formatting and linting * Update docs * Fix monkeypatch for tests * Update docs and remove comment * feat(python): add tests, docs, and docstrings for on_initialize middleware - Add 13 unit tests covering dispatch, chain order, rejection, and context enrichment - Rewrite middleware.mdx documentation with Mintlify components (Tabs, Tips, Cards) - Add comprehensive docstring to MiddlewareServerSession documenting single-server-per-process limitation - Add docs/CLAUDE.md with documentation improvement guidelines - Regenerate API documentation * docs: highlight typed context feature in middleware docs * example: add ClientCapabilitiesGuard demonstrating typed context * style: fix linting in middleware example * docs(examples): add comprehensive docstrings to middleware_example.py - Add module docstring explaining key concepts and middleware hooks - Document each middleware class with typed context details - Organize code with section headers (CONNECTION, REQUEST, TOOL-SPECIFIC) - Add ClientCapabilitiesGuard example showing typed context usage --------- Co-authored-by: pietrozullo <pietro.zullo@gmail.com>	2026-01-14 16:47:57 +01:00
pietrozullo	00d7599bfb	fix(docs): update image links in changelog to use CDN URLs ... Replaced local image paths with CDN links for releases 1.3.11, 1.3.12, 1.4.0, 1.4.1, 1.5.0, and 1.5.2 in the changelog files.	2026-01-13 09:23:04 +01:00
Enrico Toniato	bcdecd4921	fix(typescript): update documentation links to new domain for mcp-use… (#790) ... * fix(typescript): update documentation links to new domain for mcp-use (#789) * fix: update documentation links to new domain for mcp-use - Replaced all instances of old documentation URLs (https://docs.mcp-use.com) with the new domain (https://mcp-use.com/docs) across various files, ensuring consistency and accuracy in references. * fix: update documentation links to new domain for mcp-use - Replaced all instances of old documentation URLs (https://docs.mcp-use.com) with the new domain (https://mcp-use.com/docs) across various files, ensuring consistency and accuracy in references. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * Fix/oauth-flow-resource (#792) * feat(oauth): enhance proxy and metadata handling for OAuth flow - Added support for preserving the original host in the proxy configuration to facilitate OAuth resource URL rewriting. - Implemented logic to rewrite metadata URLs and resource parameters to ensure compatibility with the actual server URL during OAuth requests. - Updated the `BrowserOAuthClientProvider` to handle metadata discovery from the WWW-Authenticate header and fallback to standard paths if necessary. - Enhanced the `mountOAuthProxy` function to manage connection URLs and resource fields for improved SDK validation. This update improves the reliability of the OAuth flow and ensures proper handling of metadata and resource URLs in various scenarios. * feat(client): add clientInfo support for OAuth registration and server capabilities - Introduced a new `clientInfo` property in `McpClientProvider` and `McpServerWrapper` to allow for detailed client metadata, including name, version, website URL, and icons. - Enhanced the `App` component to provide specific client information for the inspector. - Updated the OAuth flow to utilize the new client information for improved registration and server capabilities. This update enhances the integration of client metadata into the OAuth process, improving user experience and server interactions. * feat(oauth): enhance token request handling in BrowserOAuthClientProvider - Added logic to rewrite the resource parameter in the body of token requests to ensure it points to the actual server URL. - Implemented error handling for the URL parameter rewriting process, improving robustness during OAuth interactions. - Enhanced logging to provide visibility into the resource parameter changes for better debugging. This update improves the accuracy of resource URL handling in the OAuth flow, ensuring compatibility with server requirements. * refactor(multi-server-example): remove unused server configuration - Eliminated the server configuration for "API Key Needed (Argile)" from the multi-server example, streamlining the code and reducing potential confusion. - Retained the configuration for "No API Key Needed (MCP Use)" to maintain example functionality. This change simplifies the example by focusing on the relevant server setup. * refactor(inspector): simplify server ID handling in Layout component - Removed unnecessary URL decoding for server ID retrieval, as `searchParams.get()` already handles this. - Streamlined the logic for updating the selected server ID and checking server connections, improving code clarity and maintainability. This change enhances the efficiency of server ID management in the Layout component. * feat(mcp-use): implement cached server metadata handling - Introduced `CachedServerMetadata` interface to store server metadata alongside configurations, including name, version, title, and icons. - Enhanced `LocalStorageProvider` and `MemoryStorageProvider` to support caching, retrieving, and removing server metadata. - Updated `McpClientProvider` to utilize cached metadata for initial server info and to save metadata on server updates. - Modified `useMcp` to initialize server info from cached metadata if available, improving user experience during server info fetching. This update enhances the efficiency of server metadata management, reducing unnecessary fetches and improving responsiveness. * feat(inspector): add logging middleware for API routes - Integrated logger middleware into the API routes to enable request and response logging, enhancing observability. - Updated the OAuth proxy configuration to enable logging for better tracking of API interactions. This update improves the debugging capabilities of the inspector by providing detailed logs for API requests. I don't understand why but this fixes the mounting of the proxy oauth apis in build vs dev, 4 hours wasted * fix(multi-server-example): update Supabase URL to use placeholder for project reference - Changed the Supabase server URL in the multi-server example to use a placeholder `{PROJECT_REF}` instead of a hardcoded project reference. This enhances flexibility and usability for developers using the example. This update improves the example's adaptability for different project configurations. * fix(oauth): add id field to initialize request in OAuth proxy - Updated the body of the minimal MCP request in the `mountOAuthProxy` function to include an `id` field, ensuring compliance with the JSON-RPC specification and improving request handling. This change enhances the functionality of the OAuth proxy by correctly formatting the initialization request. * feat(cli): add hot module reloading support and enhance server management (#791) * feat(cli): add hot module reloading support and enhance server management - Introduced a new option `--no-hmr` to disable hot module reloading, allowing users to opt for a full restart using `tsx watch`. - Implemented session management for registered tools, prompts, and resources to support hot reloading. - Enhanced server lifecycle management with cleanup functions for active sessions. - Improved error handling and logging during server startup and hot reload processes. - Added a new example tool for adding numbers in the basic server example. * docs: enhance Hot Module Reloading (HMR) documentation and server configuration - Updated documentation to clarify HMR functionality, including its benefits and how it allows for real-time updates without server restarts. - Added detailed CLI options for starting the development server with HMR, including the `--no-hmr` flag for fallback to `tsx watch`. - Improved explanations of what can be hot-reloaded and what requires a server restart, enhancing user understanding of the development process. * chore(typescript): version packages (canary) * feat(cli): enhance hot module reloading and server management (#794) * feat(cli): enhance hot module reloading and server management - Improved hot module reloading (HMR) support by allowing local `tsx` usage, falling back to `npx` if not found. - Updated server command execution to handle TypeScript imports more effectively. - Enhanced file watching capabilities to include `.ts` and `.tsx` files while ignoring unnecessary patterns. - Streamlined tool, prompt, and resource registration during HMR to directly inject into active sessions without removal, preserving existing configurations. - Added detailed logging for file changes and watcher readiness to improve developer experience. * feat(cli): add changeset for minor updates to hot module reloading and server management - Introduced enhancements to hot module reloading (HMR) with local `tsx` support and improved TypeScript import handling. - Enhanced file watching for `.ts` and `.tsx` files, optimizing developer experience with detailed logging for changes and watcher readiness. * refactor(cli, mcp-use): enhance error handling and improve tool registration - Updated the CLI to resolve the `tsx` binary path dynamically from `package.json`, improving compatibility and error messaging. - Enhanced error handling during tool, prompt, and resource registration in the MCP server, ensuring robust logging for failures. - Improved the favicon detection logic to normalize URLs and provide clearer debug messages when no non-default favicon is found. - Added manual handling of redirects in the MCP proxy to prevent ArrayBuffer detachment issues, ensuring reliable request forwarding. * chore(typescript): version packages (canary) * fix(favicon-detector): update subdomain level generation to exclude TLDs and ensure minimum two-part domains are returned * Fix/hmr/consistent order (#796) * fix: hmr * feat(hmr): enhance synchronization for tools, prompts, and resources - Implemented a generic synchronization mechanism for hot module replacement (HMR) that updates tools, prompts, and resources in active sessions without removal. - Added support for detecting changes in definitions, including renames and updates, ensuring seamless integration during HMR. - Improved logging for changes in registrations, enhancing developer visibility into updates during the HMR process. - Introduced a new file for HMR synchronization logic, centralizing the handling of updates across different primitive types. * fix(tests): update tsx binary path resolution and increase timeout for HMR tests - Modified the expectation in the tsx-resolution test to ensure the binary path resolves correctly to the node_modules directory. - Increased the timeout for HMR CLI integration tests to accommodate longer execution times, enhancing test reliability. * fix(tests): enhance HMR CLI integration tests with package.json setup and error handling - Added creation of a package.json file to enable module resolution during tests. - Implemented symlink creation for the mcp-use package in the test environment to ensure proper module loading. - Improved error handling in the test output by refining the data handlers for stdout and stderr streams, enhancing reliability in capturing error messages. * chore(typescript): version packages (canary) * fix(cli): update import path for getPackageVersion in client command (#800) * chore(typescript): version packages (canary) --------- Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-01-12 20:37:37 +01:00
Inchara J	c990faf76b	fix(python): add timeout mechanism to ConnectionManager.stop() (#726) ... * fix(python): add timeout mechanism to ConnectionManager.stop() Add timeout parameter (default: 30s) to stop() method to prevent infinite hangs during application shutdown. Resolves issue #562. Changes: - Add timeout parameter to stop() with 30 second default - Wrap task wait with asyncio.wait_for() to enforce timeout - Wrap cleanup event wait with asyncio.wait_for() to enforce timeout - Force cleanup on timeout by clearing connection and setting done event - Add appropriate warning/error logging on timeout Tests: - Add 10 comprehensive unit tests for timeout scenarios - All 158 unit tests pass - Manual end-to-end testing verified This ensures graceful shutdown even when cleanup hangs in production. * updated with copilot suggested edits * ruff checks passed * Improve timeout handling in ConnectionManager.stop() - Move 'import time' to module level - Use CancelledError consistently (Python 3.11+ style) - Treat timeout <= 0 or None as infinite wait (no timeout) - Add elapsed time to timeout warning logs - Add tests for negative/zero/None timeout behavior Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * docs: update ConnectionManager.stop() API reference with timeout parameter --------- Co-authored-by: pietrozullo <pietro.zullo@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-12 18:04:08 +01:00
pietrozullo	96cec626e5	chore(docs): update image links in changelog files to use CDN URLs ... - Replaced local image paths with CDN links for releases 1.3.11, 1.3.12, 1.4.0, 1.4.1, 1.5.0, and 1.5.2 in the changelog files. - Updated the changelog entries to ensure consistent image sourcing and improve loading performance.	2026-01-12 16:37:42 +01:00
pietrozullo	6d04f70106	release/python1.5.2	2026-01-12 13:50:07 +01:00
pietrozullo	043931dad9	feat(docs): add Contributors component to changelog files ... - Introduced a new Contributors component in the changelog files for releases 1.3.11, 1.3.12, 1.4.1, and 1.5.0 to acknowledge contributors in a consistent format. - Updated the changelog entries to include a list of contributors for each release, enhancing visibility and appreciation for their contributions.	2026-01-12 13:47:41 +01:00
Pietro Zullo	2c8a3f7d88	chore(python): docs update (#795) ... * chore(docs): remove Blog section from documentation - Eliminated the Blog tab and its associated group from the documentation structure, streamlining the content for better clarity and focus on relevant topics. * chore(docs): update image links in changelog and remove obsolete images - Replaced local image paths with CDN links for releases 1.3.11, 1.3.12, 1.4.0, 1.4.1, and 1.5.0 in the changelog files. - Deleted outdated image files for releases 1.3.11 and 1.3.12 to streamline documentation and reduce clutter. * fix(docs): update documentation link for logo reference - Changed the logo href from the main site to the documentation page for better navigation and user experience.	2026-01-12 12:09:47 +01:00
Luigi Pederzani	b45d9663ec	feat(python): introduce roots support in MCPClient and Server (#751) ... * fix(python): expose client capabilities to MCP servers Add list_roots_callback support to Python connectors to properly advertise the roots capability during MCP initialization handshake. Previously, the Python library was not exposing any client capabilities because the list_roots_callback was not being passed to ClientSession. This fix ensures the roots capability is always advertised, bringing the Python library in line with the TypeScript implementation. Changes: - Add roots and list_roots_callback params to BaseConnector - Add get_roots() and set_roots() methods for managing roots - Pass list_roots_callback to ClientSession in all connectors - Export Root type from connectors module - Update unit tests to expect list_roots_callback parameter Closes MCP-1063 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(python): add roots and list_roots_callback params to connectors - Add roots and list_roots_callback parameters to StdioConnector, HttpConnector, and SandboxConnector constructors - Add comprehensive unit tests for client capabilities exposure - Tests verify roots capability, get_roots(), set_roots(), and that all callbacks are correctly passed to ClientSession 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: fix import sorting and update API documentation - Fix import sorting in test_client_capabilities.py (ruff) - Regenerate API documentation for updated connector classes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat(python): add list_roots() method to server Context Allow MCP servers to request the list of roots from connected clients via ctx.list_roots(). This follows the same pattern as ctx.sample() and ctx.elicit() for server-to-client requests. * feat(python): add roots params to MCPClient and config - Add roots and list_roots_callback parameters to MCPClient.__init__, from_dict(), and from_config_file() methods - Update create_connector_from_config() to pass roots params to all connector types (Stdio, HTTP, Sandbox) - Allows clients to configure roots at the MCPClient level and have them propagate to all sessions * test(python): add get_client_roots tool to primitive server Add a tool that demonstrates the roots capability by requesting and returning the list of roots from the connected client. Used for integration testing of the roots feature. * test(python): add integration tests for roots capability Add comprehensive integration tests for the roots feature: - test_roots_capability: Verify server can request/receive roots - test_roots_empty_by_default: Verify empty roots when not provided - test_roots_with_custom_callback: Verify custom callback precedence - test_set_roots_updates_server_view: Verify dynamic root updates * test(python): update unit tests for roots parameters Update mock assertions in test_client.py to expect the new roots and list_roots_callback parameters in create_connector_from_config calls. * ci(python): add roots to primitive tests and README badge - Add roots to CI workflow primitive test matrix - Add roots to PR comment report primitives list - Add Roots badge to README Primitives row * feat(docs): enhance MCP client and server documentation for roots feature - Added `roots` and `list_roots_callback` parameters to MCP client initialization documentation. - Updated `create_connector_from_config` documentation to include new parameters. - Introduced `list_roots` method documentation in server context, detailing its usage and return values. - Improved overall clarity and completeness of API reference for better developer guidance. * feat(python): add get_client_roots tool to context example - Introduced a new tool, `get_client_roots`, to the context example, demonstrating how to retrieve and display the list of roots exposed by the client. - Updated documentation to include the new tool and its functionality, enhancing the example's coverage of context features. * feat(docs): add roots documentation for client and server - Introduced new documentation for the `roots` feature, detailing how clients can expose file system roots to MCP servers and how servers can access these roots. - Added examples for configuring roots in the MCP client and using the `list_roots()` method in the server context. - Enhanced overall clarity and usability of the documentation to support developers in implementing the roots functionality. --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: pietrozullo <pietro.zullo@gmail.com>	2026-01-12 11:16:09 +01:00
Vincenzo Reina	aca5f9c040	feat(python): Adapt OAuth to 2.1 version from new MCP spec (#518) ... * feat: Add PRM in the metadata discovery * fix: fallback anyway to PRM * feat: Implement complete discovery logic * feat: Final implementation of CIMD * feat: Implement PKCE * feat: Add scope from WWW-Authenticate * feat: Add all URLs possible styles * feat: Update tests and example * docs: Update docs * fix: linting * docs: update API documentation * fix: correct typos in OAuth metadata and error messages - Updated the comment in ProtectedResourceMetadata to use the correct abbreviation (PRM). - Fixed a typo in the OAuthAuthenticationError message regarding code challenge support. - Corrected the comment for legacy client paths to use "pre-registered" instead of "pre-reggistered". * feat: restructure authentication documentation and add new methods - Updated the authentication section in to group authentication methods under a new Authentication category with an icon. - Removed the old file and replaced it with new documentation files for Bearer Token, Custom Auth, and OAuth 2.1. - Introduced an overview page for authentication methods, detailing usage and configuration for each method. - Enhanced security best practices and examples for each authentication type to improve clarity and usability. * refactor: improve debug logging for OAuth metadata discovery - Updated debug messages to provide clearer context by specifying the issuer or host being queried during OAuth and OpenID Connect metadata discovery. - Enhanced error logging to remove redundant information, focusing on the failure reason without repeating the URL. * fix: correct abbreviation in ProtectedResourceMetadata documentation - Updated the abbreviation from PRC to PRM in the ProtectedResourceMetadata section to ensure accuracy in the documentation. * fix(oauth): correct RFC 8414 well-known URL construction for path-based issuers The OAuth metadata discovery was incorrectly constructing .well-known URLs by appending to the issuer instead of inserting between host and path. RFC 8414 specifies that for an issuer like https://github.com/login/oauth, the .well-known URL should be: https://github.com/.well-known/oauth-authorization-server/login/oauth We were incorrectly building: https://github.com/login/oauth/.well-known/oauth-authorization-server This fix: - Implements correct RFC 8414 URL construction (insert between host/path) - Supports OpenID Connect style as fallback (append to issuer) - Removes GitHub-specific hardcode since discovery now works correctly - Adds documentation comments explaining the two standards Ref: https://www.rfc-editor.org/rfc/rfc8414.html#section-3 * chore: oauth examples * docs: enhance OAuth endpoint discovery documentation - Updated the OAuth documentation to clarify how `mcp-use` discovers OAuth endpoints using both OAuth 2.0 and OpenID Connect standards. - Added a table detailing the URL construction methods for each standard. - Included examples for better understanding and a note on fallback behavior when the issuer has no path. * response to bs codeql * fix: update API URL Updated the GitHub API URL in the configuration to the correct endpoint for OAuth operations. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: pietrozullo <pietro.zullo@gmail.com>	2026-01-11 18:09:34 +01:00