mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
codex/oauth-proxy-example-docs
11 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Andrew Khadder
|
e17cd7b8ca |
Canary (#2216)
* feat(client): support mixed OAuth servers
* fix(inspector): pause mixed-auth tool calls
* Revert "fix(inspector): pause mixed-auth tool calls"
This reverts commit
|
||
|
Enrico
|
ac3d1eb3bb | fix(typescript): resolve CodeQL security alerts | ||
|
Andrew Khadder
|
68afda5885 |
docs(typescript): review and rewrite TypeScript docs (MCP-2466) (#1780)
* docs: remove stale feedback block and orphaned anchor from docs.json * chore(docs): make Typescript more prominent * chore(docs): Update `welcome.mdx` * docs: rewrite TypeScript quickstart and welcome pages Refocus the quickstart on create-mcp-use-app (scaffold, run, and deploy a first MCP server) and drop the agent/client/server primer table and diagram. Convert the welcome page's server + widget example from Tabs to CodeGroup and tighten the intro wording. * docs: remove stale server templates page and fix its references Delete the typescript/server/templates page and repoint the home templates tip to the quickstart, which now covers create-mcp-use-app. * docs(typescript): fix dead example links to real example paths The 'see a full example' links pointed at GitHub folders that 404 or contain only a README. Corrected to the real runnable examples under libraries/typescript/packages/mcp-use/examples/, verified against origin/main (incl. matching cd commands): - installation: examples/server -> packages/.../examples/server - client-configuration: a .py link -> real TS multi-server example - code-mode: examples/client/* -> examples/agent/code-mode/* - elicitation, sampling, notifications: server/X -> server/features/X - supabase: server/supabase -> server/deployment/supabase - clerk: restore missing packages/mcp-use/ path segment Quickstart links were already fixed by the quickstart rewrite (e6903716). Part of the docs audit (MCP-2466). * docs(typescript): rewrite Agent and Client introduction pages Rewrite the Agent and Client intro pages to be task-oriented and scannable: concise feature lists with cross-links, runnable quick-start examples, and added API reference sections. Drop stale CodeSandbox embeds and outdated model names. * docs(typescript): fix MCPServer class name casing in server reference The API Reference heading, prose, and class signature used McpServer; the real SDK export is MCPServer. Corrected all three occurrences in server/index.mdx. * docs: add redirect for bare /typescript/server path Routes the bare /typescript/server path to its index page now that the server section has been restructured. Claude-Session: https://claude.ai/code/session_015uioJjKTAZXGQpbXHUHZWp * docs(typescript): fix broken code examples across MCP Server & Apps section Fix all 102 confirmed code defects found in the MCP Server & MCP Apps documentation audit (47 pages, 401 code blocks), verified against the mcp-use@1.32 SDK source. The recurring patterns that made copy-pasted examples fail to compile or run are now corrected everywhere they appeared: - server.start() -> await server.listen() (no start() method exists) - bare-object tool returns wrapped in object()/text() response helpers; catch blocks renamed so they no longer shadow the error() helper - prompt messages use role:"user" with typed { type:"text" } content instead of the invalid role:"system" + bare-string shape - auth reads ctx.auth.user.userId (not ctx.auth.userId); user fields live under ctx.auth.user, scopes/permissions stay top-level - security: remove verifyJwt: process.env.NODE_ENV === 'production' from all six OAuth provider pages (off-prod it skips signature verification and accepts forged tokens); rely on the secure default, with a warning never to disable it - correct import subpaths: Logger/MCPClient from mcp-use, response helpers and server symbols from mcp-use/server, MCPClient as BrowserMCPClient from mcp-use/browser; drop the unexported getMcpAppsBridge - useWidget generics use the real <TProps, TState, TOutput, ...> order; remove the non-existent notifyIntrinsicHeight (auto-size via McpUseProvider) - fix the deployment URL to <id>.run.mcp-use.com/mcp, add missing z/helper imports, add the --branch/--dockerfile CLI options, and clean up em dashes and bare/malformed code fences Each page was fixed and then independently re-verified against the SDK source, with a repo-wide pattern sweep confirming no instances remain. Structural IA changes (moving widget-components to /react/, orphan redirects) are intentionally deferred to the docs rewrite. * docs(typescript): restructure MCP Server & MCP Apps IA Promote MCP Apps to its own top-level section in the TypeScript SDK Docs tab and move the 9 React widget-component pages out of /server/widget-components/ into /typescript/react/. - Move 9 React component pages to typescript/react/ (git renames) with 9 redirects - Promote MCP Apps to a top-level group (Overview pages + React subgroup) - Remove the duplicate MCP Apps group from the Home product nav; rehome guides/chatgpt-apps-flow under MCP Apps so it no longer orphans - Move cli-reference out of MCP Server into a new Tooling group - Relocate response-helpers -> Core Components, openapi -> Advanced Features, nextjs-drop-in -> Deployment - Repoint all widget-components links to /typescript/react/ - Fix 3 broken anchor links (inspector CLI env var, mcp-apps metadata, auth providers) Structure-only change; no page content rewrites. Refs MCP-2466. * docs: refresh TypeScript server app docs * docs: add TypeScript API reference * docs: streamline TypeScript server navigation * docs: rewrite core TypeScript server guides * docs: rewrite advanced TypeScript server guides * docs: rewrite TypeScript server OAuth guides * docs: rewrite TypeScript server session storage guides * docs: rewrite MCP Apps section * docs: add TypeScript MCP client API reference * docs: add TypeScript MCP agent API reference * docs: reorder TypeScript API reference nav * docs: reorganize TypeScript tooling nav * docs: rewrite inspector guides * docs: rewrite MCP server tunneling guide * docs: rewrite CLI client and reference docs * docs: finalize TypeScript documentation rewrite * docs: move inspector updates under get started * Fix Mintlify validation errors * Fix Mintlify broken links * docs: update Manufact Cloud deployment guide * chore: retrigger Mintlify docs preview * Fix MDX comment syntax on home page * docs: rework TypeScript server examples * docs: fix server docs links * docs: restore SDK links in home sidebar * docs: move SDK links to end of home sidebar |
||
|
Andrew Khadder
|
430178c9a3 |
Canary (#1757)
* chore(deps): bump hono in /libraries/typescript/packages/mcp-use (#1755) Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.23...v4.12.25) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.25 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore: add hono changeset * chore(typescript): version packages (canary) * Fix Codex skills install path (#1756) * chore(typescript): version packages (canary) * chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript (#1742) * chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.8 to 8.0.16. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.16 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * Handle inspector CLI version and unknown options (#1722) * Handle inspector CLI version and unknown options * Keep inspector version in sync with package metadata --------- Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * Make MCP Apps primary widget runtime & Apply Host Context Styles (#1739) * Make MCP Apps primary widget runtime * Format MCP Apps runtime changes * Remove unused OpenAI globals event types * Apply MCP Apps host style variables * fix host style variable application * fix(react): avoid light fallback for missing host theme * Preserve model context when widget state updates * Remove obsolete MCP Apps runtime theme tests * Format MCP Apps runtime tests * chore(typescript): version packages (canary) * fix(cli): surface GitHub App install URL up front on deploy (#1761) * fix(cli): surface GitHub App install URL up front on deploy When `mcp-use deploy` detects the GitHub App is not connected or lacks access to the target repo, it now prints the install URL before any prompt. In a non-interactive context (an agent or CI, without `--yes`) it prints the URL and next steps and exits cleanly instead of hanging on an unanswerable prompt. Interactive and `--yes` flows are unchanged. * test(cli): simplify GitHub install-flow tests; tidy deploy no_access branch - Collapse redundant gitHubInstallUrl cases into one - Mock `open` and assert the non-interactive path never launches a browser - Extract a `noAccess` local in promptGitHubInstallation for readability * fix(cli): unexport internal-only GitHubInstallation type to satisfy knip GitHubInstallation is only referenced within api.ts (via GitHubConnectionStatus), so the export was dead and failed the knip check. * fix(cli): unexport internal-only InstallFlowMode type to satisfy knip InstallFlowMode is only used within deploy.ts as resolveInstallFlowMode's return type; the test imports the function, not the type. Verified with the full `knip --no-progress` run (exit 0), which CI uses. * chore(typescript): version packages (canary) * fix(cli): preserve deployment list sort order (#1752) * fix(cli): preserve deployment list sort order * chore(cli): add changeset for deployment list sort order fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): stop prompting signed-in users to log in (MCP-2142) (#1767) The hosted inspector showed the "free tier — Sign in to increase your limits" CTA to every managed-LLM visitor, even when already authenticated. ChatTab now resolves the shared Manufact session via a new useHostedSession hook (also adopted by HostedUserMenu) and hides the free-tier sign-in/upgrade chrome for authenticated users. The visibility rule is extracted into a pure shouldShowFreeTierUpgrade helper with unit tests. * chore(typescript): version packages (canary) * fix(typescript): pass the cwd field (#1785) * fix: pass the cwd field Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * fix: add changeset Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * doc: add documentation of cwd field Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> --------- Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * chore(typescript): version packages (canary) * fix(inspector): replace stale auto-connect transports (#1792) * chore(typescript): version packages (canary) * fix(templates): score 100% on publishing checklist (MCP-2260) (#1772) * fix(templates): score 100% on publishing checklist (MCP-2260) Auto-derive openai/widgetDescription from the widget description in the Apps SDK adapter so hosts always see a widget description, and fill the small metadata gaps the templates were missing: - starter: fetch-weather declares a title + outputSchema (returns matching structuredContent). - mcp-apps: search-tools and get-fruit-details declare a title; the product-search-result widget declares a domain (widgetDescription is now auto-derived from its description). Adds a unit test for the widgetDescription default. * feat(server): enforce outputSchema at the tool return position (MCP-2260) Type-check a tool's outputSchema through the existing object()/widget() calls with no new API: - Content helpers (text, markdown, image, ...) now return a content-only ToolContentResult (structuredContent?: never), so they're always allowed. - widget() is generic over its props, which become the result's structuredContent — so widget({ props }) is checked against outputSchema. - The tool callback return type is TypedCallToolResult<TOutput> | ToolContentResult, making object({ wrong })/widget({ props: wrong }) a compile-time error. Adds a type-level test (npm run test:types) and removes an internal template comment. Edge cases that now error against a tool with outputSchema: mix() carrying structured content, or a raw literal with a mismatched structuredContent. * fix(templates): remove hardcoded widget domain Keep the generated MCP Apps template client-neutral so deployers can set their own production widget origin. * chore(typescript): update knip.json to include additional ignore patterns and entry points - Added "test_app" to the ignoreWorkspaces list. - Included "tests/types/**/*.ts" in the entry patterns for type checking. - Removed redundant "scripts/**/*.{js,mjs,ts}" from the entry list in the create-mcp-use-app package. * chore(typescript): version packages (canary) * feat(cli): expose monorepo auto-deploy trigger config (#1793) Add --watch-paths/--wait-for-ci to `mcp-use deploy` and --watch-paths/--deploy-branches/--wait-for-ci/--root-dir to `mcp-use servers update`, and surface the effective trigger config in `servers get`/`update`. Closes the gap where the Cloud API accepted these fields but the CLI could not set them, so monorepo apps can be scoped to only redeploy on relevant changes (#1547). Updates the deployment + CLI reference docs accordingly. * chore(typescript): version packages (canary) * fix(mcp-use): restore Apps SDK compatibility in useWidget as a fallback (#1794) Keep the MCP Apps bridge as the primary widget runtime, but use window.openai (Apps SDK) as a compatibility fallback when the bridge does not connect, instead of dropping it entirely. #1739 made the MCP Apps bridge the sole iframe runtime, which left any Apps SDK-only host (e.g. a ChatGPT widget without MCP Apps support) stuck on the loading spinner forever. A connected MCP Apps bridge still always wins, so ChatGPT keeps using MCP Apps as the source of truth. Also fixes two pre-existing issues in the scroll-to-bottom chat e2e test (strict-mode locator + measuring the animated scroll synchronously). * chore(typescript): version packages (canary) * feat(inspector, typescript): release v11.0.0 and v1.33.0 with MCP Apps as primary widget runtime - Introduced MCP Apps as the primary widget runtime, enhancing style variable application. - Fixed issues with auto-connect entries, user prompts for free-tier, and CLI version handling. - Updated dependencies including `vite` and `mcp-use`. - Added monorepo auto-deploy controls and improved CLI documentation for new flags. See changelogs for detailed updates and fixes. * fix(inspector): scope OAuth proxy fetch per server configuration (#1770) * fix(inspector): scope OAuth proxy fetch per server configuration The browser OAuth provider installed a global window.fetch interceptor to route OAuth requests through the inspector proxy. With multiple servers, connecting one server "Via Proxy" mutated fetch for the entire page, so other servers (including "Direct" ones) and unrelated requests were affected, and switching a server from "Via Proxy" back to "Direct" could leave a stale interceptor behind. BrowserOAuthClientProvider now exposes a scoped getProxyFetch() that returns a fetch confined to a single provider. It is passed only to that server's SDK transport and auth() calls (via the SDK's fetch / fetchFn options), so OAuth-proxy behavior is scoped to the selected server's connection and the global fetch is never mutated. Closes #1766 Co-authored-by: Cursor <cursoragent@cursor.com> * chore: remove redundant OAuth cleanup comment --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * Adopt auto connection mode in inspector docs and UI (#1795) * Adopt auto connection mode in inspector docs and UI * Fix embedded inspector auto proxy fallback * chore(typescript): version packages (canary) * docs: update TypeScript release changelogs --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Ghost Monkey <haugun79@gmail.com> Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com> Co-authored-by: 落尘 <cuidong111@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Dr. Carsten Leue <55989662+Carsten-Leue@users.noreply.github.com> Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: Hemant Krishnakumar <51333870+hemant1026@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
78cfc8a74d |
Canary (#1434)
* feat(mcp-use): add Clerk OAuth provider for TypeScript (#1429) * feat(mcp-use): add Clerk OAuth provider * docs: add Clerk OAuth provider documentation page * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(cli): propagate --env/--env-file to server on deploy redeploys (#1433) The deploy command only forwarded `--env`/`--env-file` values when creating a brand-new server (where they ride on the createServer body). On redeploys to an existing linked server, env vars were parsed and shown in the preview, then silently dropped before createDeployment. Now upserts each entry against /api/v1/servers/{id}/env-variables (PATCH for existing keys, POST for new ones) before triggering the deployment. Closes MCP-1995 * chore(typescript): version packages (canary) * chore(typescript): adopt Knip to find and remove unused code (#1359) * chore(typescript): adopt knip at workspace root Add Knip as a dev dependency at the TypeScript workspace root with a root-level knip.json covering all packages. Consolidates the existing per-package Knip setup in @mcp-use/inspector into the shared config and delegates its check-deps script to the root install. Adds `pnpm knip`, `pnpm knip:deps`, and `pnpm knip:production` scripts and documents them in the TypeScript README. Baseline configuration suppresses known false positives (build-generated version.js, Tailwind/ Scarf deps, nested example and template workspaces, test helpers and servers). Actual dead-code removal is deferred to follow-up PRs. Refs MCP-1707 * ci: add warning-only Knip step Runs `pnpm knip --no-exit-code --no-progress` on TypeScript-affecting PRs/pushes and writes the report to the GitHub Actions step summary. Stays non-blocking by design — tighten to a failing check once the baseline cleanup PRs land. * chore(inspector): drop redundant check-deps script Root-level pnpm knip:deps already covers all workspaces, so the inspector-only wrapper just duplicated the same delegation. Devs needing scoped output can use pnpm knip --workspace packages/inspector. * chore(typescript): drop changeset for dev-only knip adoption * feat(inspector): support custom base URL for OpenAI-compatible providers (#1437) * feat(inspector): support custom base URL for OpenAI-compatible providers * feat(inspector): add support for OpenAI-compatible providers with configurable base URL Co-authored-by: Copilot <copilot@github.com> * refactor(inspector): simplify openai-compatible plumbing - Widen ProviderName union to include "openai-compatible" and drop the resolveProvider helper; the providers dispatcher fall-throughs from "openai-compatible" to the openai impl, so callers can pass the UI provider name straight through. - openai.ts: extract buildEndpoint/buildHeaders, strip trailing slashes on baseUrl, and skip Authorization header when apiKey is empty. - ConfigurationDialog: defensive parsing of /models response, surface CORS hint on fetch failure, mention CORS requirement in helper text, move "OpenAI Compatible" to end of dropdown. - useConfig: persist openai-compatible base URL per-provider in localStorage (mirrors api keys), restore on switch + cross-tab sync. - Drop openai-compatible logo references in ChatHeader / ChatLandingForm / ConfigurationDialog dropdown. * style(inspector): apply prettier formatting * chore(changeset): bump @mcp-use/inspector to minor for openai-compatible provider --------- Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat: integrate OpenRouter as a first-class LLM provider (fixes #1402) (#1403) * feat(inspector): integrate OpenRouter as a first-class LLM provider Adds OpenRouter to the inspector chat configuration. Selecting OpenRouter routes through the existing OpenAI provider with an override base URL and the required HTTP-Referer / X-Title headers, so users get multi-model access (OpenAI, Anthropic, Google, etc.) from a single API key without duplicating provider plumbing. Co-authored-by: Andrew Khadder <andrew@mcp-use.com> Closes #1402 * fix(inspector): use inspector.mcp-use.com as OpenRouter HTTP-Referer * feat(inspector): swap OpenRouter favicon.ico for inline gray SVG Drops the runtime fetch to openrouter.ai/favicon.ico in favor of an inline data-URL'd SVG with a neutral #94A3B8 fill. Follow-up will lift this onto the provider CDN alongside the other provider marks. * fix(inspector): stop OpenRouter SVG curves from being implicitly filled The two arrow-body paths are open curves; with the parent svg's fill set, the browser implicitly closed them and filled the resulting region, producing visual artifacts at small sizes. Mark those two paths fill="none" so only their strokes render. * fix(inspector): use OpenRouter SVG in ChatLandingForm chip The landing-form provider chip was hardcoded to the CDN png URL, which 404s for the openrouter provider and rendered a broken-image blob clipped by rounded-full styling. Match the ChatHeader behavior and fall back to OPENROUTER_ICON_URL. * fix(inspector): set OpenRouter X-Title to mcp-use Inspector * refactor(inspector): drop OpenRouter baseUrl path special-case Set OpenRouter's baseUrl to the API root (/api/v1) and let buildEndpoint append /chat/completions like the rest of the OpenAI-compatible flow, removing the includes("/chat/completions") short-circuit that only existed to defuse the path baked into the override. * style(inspector): apply prettier formatting * chore(inspector): drop redundant baseUrl jsdoc comment --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(auth): pre-registered OAuth client credentials and scopes in Inspector (#1400) * feat(auth): pre-registered OAuth client credentials and scopes Wires clientId, clientSecret, and scope end-to-end from the Inspector's Authentication dialog through useMcp into BrowserOAuthClientProvider's staticClientInfo. When clientId is set the SDK skips Dynamic Client Registration (required for proxy-mode servers like Slack/WorkOS that strip registration_endpoint). When clientSecret is also set, the SDK auto-switches token-endpoint auth from "none" to client_secret_basic / client_secret_post, supporting providers that don't support PKCE. * refactor(inspector): extract OAuthStaticConfig type and builder helper Replaces six inline copies of `{ clientId?; clientSecret?; scope? }` and two copy-pasted trim+spread builders with a shared `OAuthStaticConfig` type and `buildOAuthStaticConfig()` helper in connectionUpdates.ts. Also widens ServerConnectionModal's connection/onConnect types so the `as { oauth?: ... }` structural cast can go away (the modal was passing oauth in the spread without declaring it on the callback type). * docs: document pre-registered OAuth client credentials Updates client authentication, useMcp, and inspector connection-settings docs to cover the new oauth.{clientId, clientSecret, scope} option and the proxy-mode/confidential-client cases it unlocks. Replaces the inaccurate snake_case OAuth params table with the actual camelCase API shape. * chore(typescript): version packages (canary) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry (#1443) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry The env var previously disabled Node-side telemetry and the inspector's server-side proxy, but the in-browser posthog-js init triggered by useMcp still fired POSTs to https://eu.i.posthog.com that ad/tracker blockers flag. The inspector server now mirrors the env var into a runtime flag (window.__MCP_USE_ANONYMIZED_TELEMETRY__) and localStorage before the client bundle runs; both mcp-use's browser telemetry and the inspector's own client telemetry honor that flag, so a single env var disables every telemetry path. * fix(inspector): drop sticky localStorage write; honor opt-out in Vite dev The previous revision mirrored MCP_USE_ANONYMIZED_TELEMETRY=false into localStorage, which persisted across sessions even after the env var was unset. Switch to a per-page window flag only — unsetting the env var fully restores defaults on the next page load. Also extend the opt-out to pure-Vite dev mode via a transformIndexHtml plugin, so the env var works whether the inspector is served by the backend or by Vite directly. * chore(typescript): version packages (canary) * fix(inspector): drop trailing-slash regex flagged by CodeQL The /\/+$/ regex on user-supplied base URLs triggered js/polynomial-redos. Most servers normalize a double slash in `${baseUrl}/path` fine, so just drop the stripping rather than working around the alert. * docs(changelog): add v1.27.0 / inspector v5.0.0 release notes --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Siddhant Rai <47355538+siiddhantt@users.noreply.github.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> |
||
|
Enrico Toniato
|
4070f26294 |
Canary (#1320)
* feat(typescript): Add scopes customization to oauth providers * refactor: move scopesSupported to BaseOAuthConfig and remove test file * feat(typescript): add scopesSupported to better auth provider * fix: return scopesSupported properly for Better Auth provider factory * docs(oauth): add scopesSupported to provider docs * chore: format * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): add missing fields to CustomProviderConfig to match docs (#1136) The Custom Provider docs show config fields (userInfoEndpoint, jwksUri, clientId, clientSecret, mode, scopes, audience) that don't exist in the code. This adds all documented fields to CustomProviderConfig and CustomOAuthConfig, implements the corresponding getters on CustomOAuthProvider, and resolves alias pairs (jwksUrl/jwksUri, scopes/scopesSupported). * style: fix prettier formatting in custom oauth provider * fix: add OAuthProvider interface methods and fix unsafe type casts - Add getClientId(), getUserInfoEndpoint(), getAudience() as optional methods on OAuthProvider interface so new CustomOAuthProvider getters are callable without type casting - Make CustomOAuthConfig.jwksUrl optional (users provide their own verifyToken, JWKS URL isn't always needed) - Fix jwksUrl fallback from empty string to undefined in factory to avoid silent runtime failures - Replace unsafe (provider as any).config?.clientId with type-safe provider.getClientId?.() in routes.ts - Add getClientId() to WorkOSOAuthProvider for the pre-registered client detection in direct mode metadata * fix(typescript): remove scopes alias from CustomProviderConfig in favor of scopesSupported * fix(typescript): remove jwksUri alias from CustomProviderConfig in favor of jwksUrl * chore: update changeset to reflect jwksUrl and scopesSupported field names * fix: inline jwksUrl and scopesSupported in CustomOAuthProvider constructor * fix: simplify oauthCustomProvider by spreading config into constructor * fix: remove redundant comments from CustomProviderConfig * chore(typescript): version packages (canary) * fix(inspector): hide thinking indicator when assistant message has parts (#1315) * fix(inspector): hide thinking indicator when assistant message has parts When streaming via the server-side path, content is delivered through the parts array while the message's content field stays empty until the stream reader fully closes. The isThinking check only looked at content, causing a window where the thinking indicator reappeared after the done event but before setIsLoading(false) ran in the finally block. Now we check parts first — if any parts exist, the model has produced output and we should not show the thinking indicator. * chore: add changeset for thinking indicator fix * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in Google provider (#1317) * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in JSON Schema output z.record() in @langchain/core's serializer emits a `propertyNames` keyword for constrained or enum key types. Google's Generative AI API rejects schemas containing `propertyNames`, breaking tool calls when using the Google provider. Switching to z.object({}).catchall() produces identical runtime behavior but serializes to clean `additionalProperties` without `propertyNames`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: add changeset for Google provider propertyNames fix --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(typescript): version packages (canary) * Major/cli/device flow (#1294) * fix(inspector): sync URL tab param on tab change to preserve state on refresh When switching tabs via header clicks, keyboard shortcuts, or command palette, only React state was updated but the URL was not. This meant refreshing the page would lose the active tab. Now all tab changes also update the ?tab= query parameter using navigate() with replace:true. Closes #1157 * fix: update import paths for Windows compatibility and modify postins… (#1255) * fix: update import paths for Windows compatibility and modify postinstall script in package.json templates - Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms. - Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation. * fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility - Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems. * changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: add changeset * chore(typescript): version packages (canary) * feat(auth): enhance login command with API key option and implement device code flow - Updated the login command to allow non-interactive login using an API key. - Introduced device code flow for authentication, including functions to request device codes and poll for access tokens. - Refactored API key creation to use access tokens and updated related utility functions for better authentication handling. * refactor(cli): improve code formatting and readability in authentication commands - Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks. - Removed unused import in `auth.ts` to clean up the codebase. - Enhanced error messages for clarity in authentication processes. * refactor(logging): change logger level from info to debug for various messages - Updated multiple logging statements across the codebase to use `logger.debug` instead of `logger.info` for routine messages, enhancing log clarity and reducing noise in production logs. - This change applies to session management, agent initialization, and connection handling, ensuring that only significant events are logged at the info level. * fix(oauth): correct Auth0 issuer handling and improve token validation - Updated the Auth0 issuer to include a trailing slash to comply with token validation requirements. - Separated baseUrl from issuer to prevent double-slash URLs in JWKS, auth, and token endpoints. - Added direct mode for the Auth0 provider to enable MCP clients to communicate directly for OAuth flows. - Enhanced protected resource metadata to include scopes_supported, ensuring clients request appropriate scopes during authorization. * update * lint --------- Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * refactor(cli): update authentication and organization handling (#1326) - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * fix(inspector): use correct OAuth callback URL when mounted at /inspector (#1323) * fix(inspector): use correct OAuth callback URL when mounted at /inspector The BrowserOAuthClientProvider defaulted redirect_uri to /oauth/callback but the React Router (basename="/inspector") only mounts OAuthCallback at /inspector/oauth/callback, causing a blank screen after auth. Root fix: add defaultCallbackUrl prop to McpClientProvider so the inspector declares the correct path once at the provider level. All addServer calls inherit it automatically — no per-connection wiring needed. Removes the "Redirect URL" field from the auth dialog: it was never actually passed to the connection and couldn't be set to a value the inspector would handle. * chore: bump mcp-use changeset to minor (new public API prop) * docs: document defaultCallbackUrl in McpClientProvider; remove redirectUrl from inspector connection-settings * chore(typescript): version packages (canary) * Device flow 2 (#1329) * refactor(cli): update authentication and organization handling - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * refactor(cli): streamline organization ID resolution in deploy command - Replaced the previous method of resolving the organization ID with a direct call to api.resolveOrganizationId() for improved clarity and efficiency. - Removed unnecessary comments and code related to organization ID handling, enhancing overall code readability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Fix/cli/git create (#1331) * refactor(cli): enhance deployment command and GitHub integration - Added new GitHub API methods for creating repositories and retrieving installation IDs. - Introduced git utility functions for initializing repositories, adding remotes, and committing changes. - Improved environment variable parsing and error handling in the deployment command. - Cleaned up code for better readability and maintainability. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deployment command options and improve code readability - Added a new option for specifying the deployment region in the CLI. - Rearranged and cleaned up command options for better organization. - Improved error handling and logging in the deployment process. - Refactored code for better readability and maintainability across several files. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(inspector, typescript): update changelogs for v2.0.0 and v1.24.0 releases - Added details for the major release v2.0.0 of the inspector, highlighting improvements in OAuth handling, chat UI, and tab persistence. - Documented the minor release v1.24.0 of mcp-use, featuring OAuth scope customization, telemetry support, and device-flow authentication enhancements. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: Andrew Khadder <andrew.khadder@gmail.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Enrico Toniato
|
6d7c4df9ef |
Canary (#1290)
* fix(inspector): sync URL tab param on tab change to preserve state on refresh
When switching tabs via header clicks, keyboard shortcuts, or command palette,
only React state was updated but the URL was not. This meant refreshing the
page would lose the active tab. Now all tab changes also update the ?tab=
query parameter using navigate() with replace:true.
Closes #1157
* feat(inspector): add editable MCP server aliases in connection settings
* fix(inspector): avoid reconnecting on alias-only edits
* chore: add changeset for server alias and updateServerMetadata
* docs: document updateServerMetadata in useMcpClient API reference
* fix: update import paths for Windows compatibility and modify postins… (#1255)
* fix: update import paths for Windows compatibility and modify postinstall script in package.json templates
- Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms.
- Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation.
* fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility
- Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems.
* changeset
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore: add changeset
* chore(typescript): version packages (canary)
* chore(deps): bump hono from 4.12.8 to 4.12.12 in /libraries/typescript (#1284)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* chore(deps): bump hono from 4.12.8 to 4.12.12 in /libraries/typescript
Bumps [hono](https://github.com/honojs/hono) from 4.12.8 to 4.12.12.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.8...v4.12.12)
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.12
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* chore(deps): bump vite from 8.0.0 to 8.0.5 in /libraries/typescript (#1280)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* chore(deps): bump vite from 8.0.0 to 8.0.5 in /libraries/typescript
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.0 to 8.0.5.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite)
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* Update architecture.md
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* Update server routing and middleware references
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* feat(chat): add disabledTools prop to ChatTab and useChatMessages for enhanced tool management (#1291)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* feat(chat): add disabledTools prop to ChatTab and useChatMessages for enhanced tool management
- Introduced a new `disabledTools` prop in both `ChatTab` and `useChatMessages` to allow users to specify tools that should be excluded from the chat session.
- Updated the handling of chat messages to accommodate the new `disabledTools` feature, ensuring proper communication with the server.
* chore(typescript): version packages (canary)
* feat(auth): enhance login command with API key option and implement device code flow (#1292)
* feat(auth): enhance login command with API key option and implement device code flow
- Updated the login command to allow non-interactive login using an API key.
- Introduced device code flow for authentication, including functions to request device codes and poll for access tokens.
- Refactored API key creation to use access tokens and updated related utility functions for better authentication handling.
* refactor(cli): improve code formatting and readability in authentication commands
- Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks.
- Removed unused import in `auth.ts` to clean up the codebase.
- Enhanced error messages for clarity in authentication processes.
* Revert "feat(auth): enhance login command with API key option and implement d…" (#1293)
This reverts commit
|
||
|
Enrico Toniato
|
2f89a3b7ea |
chore(deps): bump react-router from 7.10.1 to 7.12.0 in /libraries/ty… (#780)
* chore(deps): bump react-router from 7.10.1 to 7.12.0 in /libraries/typescript (#765) * chore(deps): bump react-router in /libraries/typescript Bumps [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) from 7.10.1 to 7.12.0. - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.12.0/packages/react-router) --- updated-dependencies: - dependency-name: react-router dependency-version: 7.12.0 dependency-type: direct:production ... * chore: add changeset for dependabot updates * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Fix/inspector/loop (#782) * feat(inspector): enhance auto-connect functionality and proxy handling - Added default auto proxy fallback configuration in the App component to streamline connection attempts. - Updated useAutoConnect hook to simplify connection logic by removing unnecessary state management and handling proxy fallback internally. - Improved error handling and user feedback during authentication processes in the multi-server example. - Enhanced OAuth flow management in the browser provider and callback handling to ensure better state management and user experience. These changes improve the overall reliability and usability of the connection process in the inspector. * feat(inspector): refactor connection handling and enhance theme toggling - Removed the temporary ConnectionTester component and integrated connection logic directly into the InspectorDashboard for improved clarity and performance. - Simplified connection management by consolidating state handling and removing unnecessary complexity. - Enhanced the theme toggling functionality with a dropdown menu for better user experience and accessibility. - Updated the LayoutHeader to support theme changes with visual transitions, improving the overall UI responsiveness. These changes streamline the connection process and enhance the user interface for theme management. * feat(inspector): enhance OAuth authentication flow and connection settings - Updated documentation to clarify the OAuth authentication process, emphasizing user-initiated actions and fallback options. - Refactored connection settings to default to manual authentication, requiring explicit user action to trigger OAuth. - Improved handling of auto-connection and proxy configurations across components, ensuring a consistent user experience. - Added comments and examples in the codebase to guide users on managing OAuth settings effectively. These changes improve the clarity and usability of the authentication process within the inspector. * fix(inspector): resolve OAuth flow looping issue by removing duplicate fallback logic - Added a changeset to document the patch for the inspector and mcp-use packages. - Refactored the useAutoConnect hook and other components to streamline connection handling and improve user experience. - Cleaned up code formatting and logging for better readability and maintainability. These changes enhance the reliability of the OAuth authentication process within the inspector. * fix: enhance OAuth flow and connection handling in inspector - Resolved OAuth flow looping issue by removing duplicate fallback logic in the useAutoConnect hook. - Simplified connection management and improved user experience through better state handling. - Enhanced auto-connect functionality and proxy handling, ensuring more reliable authentication processes. - Improved theme toggling with a dropdown menu for better accessibility and user interaction. - Updated OAuth flow management in the browser provider for better state management and error handling. * refactor(inspector): simplify URL protocol validation and connection error handling - Updated URL validation logic in InspectorDashboard and utility functions to only allow http and https protocols, enhancing clarity and security. - Modified error handling in the useAutoConnect hook to streamline connection failure notifications. - Improved example server configurations for better clarity and user experience in the multi-server example. These changes enhance the overall robustness and usability of the inspector's connection handling. * fix: improve URL availability checks in TypeScript PR preview workflow - Enhanced the script to check the availability of both PR and commit URLs on esm.sh, improving reliability in package readiness verification. - Adjusted retry logic to provide clearer output on the status of URL checks, including the number of attempts and readiness state. - Reduced the maximum retry count and increased the delay between attempts for better performance. These changes ensure that the workflow accurately waits for package availability before proceeding with tests. * chore(deps): update langchain and react-router dependencies in TypeScript packages (#781) - Bumped @langchain/core to version 1.1.8 and langchain to version 1.2.3. - Updated react-router and react-router-dom to version 7.12.0 across multiple packages. - Adjusted peer dependencies in cli, inspector, and mcp-use packages to reflect the new versions. * chore(typescript): version packages (canary) |
||
|
Enrico Toniato
|
198fffddc2 |
Canary (#777)
* feat(inspector): add reconnect functionality for failed connections (#768) * feat(inspector): add reconnect functionality for failed connections - Introduced a reconnect button in the InspectorDashboard for connections that fail, allowing users to attempt reconnection directly from the UI. - Enhanced the dropdown menu to include a reconnect option for failed connections, improving user experience and accessibility. - Updated HttpConnector to disable automatic reconnection, shifting the responsibility to higher-level logic for better control over connection management. * fix(http): enable automatic reconnection with maxRetries set to 2 - Updated the HttpConnector to allow automatic reconnection by setting maxRetries to 2, enhancing connection resilience. - This change shifts the reconnection logic back to the connector, improving overall connection management. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Fix/client-info-clean (#776) * fix: client info and inspector improvements * chore: update package versions to 0.14.2-canary.0 and 1.12.2-canary.0 * chore: update changelogs for @mcp-use/inspector and mcp-use to include reconnect functionality and dependency updates * feat(inspector): add OAuth proxy middleware and update server routes - Introduced `mountOAuthProxy` to handle OAuth flows at the inspector's designated path. - Updated `registerInspectorRoutes` to include the new OAuth proxy middleware. - Refactored example client code to comment out unused server configurations for clarity. * refactor: reorganize imports and clean up code structure - Adjusted import statements in `shared-routes.ts` for better organization. - Updated example client code to replace hardcoded API key with a placeholder for security. - Cleaned up type exports in `index.ts` for consistency and clarity. * refactor: standardize import formatting in shared-routes.ts and index.ts - Reformatted import statements in `shared-routes.ts` and `index.ts` for consistency. - Ensured trailing commas are uniformly applied to type exports for improved readability. * fix: update server name in multi-server example for clarity - Changed server name from "Invalid API Key (MCP Use)" to "No API Key (MCP Use)" in the multi-server example for better accuracy and understanding. * chore(typescript): version packages (canary) * refactor: update clientInfo parameter formatting in documentation - Changed the formatting of the `clientInfo` parameter values in the client configuration documentation to use quotes for consistency and clarity. * fix: update example in MCPAgent documentation to use stream_events method (#778) - Changed the example code in the MCPAgent documentation to reflect the updated method name from `stream` to `stream_events`, ensuring accuracy and clarity in usage. * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
be44c5f90a | chore: remove unuseful docs | ||
|
Enrico Toniato
|
a145cc7884 |
Docs/inspector (#492)
* refactor: reorganize documentation structure for Inspector and Dev Tools - Updated the docs.json file to consolidate Inspector and Tunneling pages under a new "Dev Tools" group. - Removed redundant entries for Inspector and Tunneling from the documentation structure. - Added a sidebar title for the Inspector page to enhance navigation. * docs: enhance Inspector documentation and add new CLI usage guides - Updated `docs.json` to include new pages for CLI usage, connection settings, keyboard shortcuts, command palette, integration, debugging ChatGPT apps, and development under the Inspector section. - Expanded the Inspector documentation to cover new features, including CLI usage and detailed guides for keyboard shortcuts and integration. - Improved the `self-hosting` documentation to reference the new CLI usage guide. - Enhanced the `apps-sdk-resources` documentation with additional details on widget state and testing procedures using the Inspector. * fix broken links |