mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
@mcp-use/agent@2.0.0-beta.11
205 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Enrico
|
b5354b5285 | fix(docs): update Inspector URL references to /mcp/inspector | ||
|
Enrico Toniato
|
3aca19c1ab |
feat: prefer Bun over Yarn and opt-in build source maps (#1950)
Replace create-mcp-use-app --yarn with --bun, align docs/install hints, and gate mcp-use build source maps behind --source-maps. Keep workspace root TypeScript on 5.9 so eslint stays compatible. |
||
|
Enrico
|
78266950f9 | feat(server): add Next.js drop-in adapter and example suite | ||
|
Enrico
|
d9c2023864 | manual commit | ||
|
Andrew Khadder
|
6aa0857b34 |
feat(server): make MCP middleware type-safe by method (#1932)
* feat(server): make MCP middleware type-safe by method * fix(server): omit schema dialect from tool descriptors (#1931) * fix(server): forward list middleware params * fix(server): export MCP middleware adapters |
||
|
Enrico
|
f25964142b |
Enhance MCP App Development Experience
- Updated documentation to clarify the use of `mcp-use dev --tunnel` and `mcp-use start --tunnel`, including automatic tunnel restart on registration drop. - Refined TypeScript API references for `allowedOrigins` and `cors` configurations to improve clarity on behavior. - Transitioned view-related files from `resources/` to `views/`, aligning with new authoring standards. - Introduced a new `mcp-env.d.ts` for type definitions and simplified favicon selection logic. - Enhanced the `create-mcp-use-app` template to support views, including a new fruit search example with improved UI components. - Added mock OpenAI file APIs for local development environments to facilitate testing. - Updated package.json descriptions and keywords for better clarity and alignment with project goals. |
||
|
Enrico
|
15798394a4 |
chore(typescript): raise Node floor to 22.22.2 and CI to 22.23.1
Excludes pre–March 2026 security patches and satisfies npm 12 for trusted beta publishing. |
||
|
Enrico
|
b47e268f61 |
chore(typescript): raise Node.js engine floor to 22.13
Unblocks beta releases on pnpm 11.13 and aligns CI, Docker, build targets, and scaffolds with Maintenance LTS Node 22. |
||
|
Andrew Khadder
|
adebe07133 |
feat(server): proxy multiple MCP servers (#1892)
* feat(server): proxy multiple MCP servers * fix(server): address proxy review feedback * fix(server): preserve proxy lifecycle ordering * test(server): refresh proxy bundle budget |
||
|
Andrew Khadder
|
fa574030eb |
feat(server): add v2 server branding (#1920)
* feat(server): add v2 server branding * fix(server): address branding review feedback |
||
|
Andrew Khadder
|
eabae55ea4 | feat(server): add Better Auth OAuth provider (#1921) | ||
|
Andrew Khadder
|
9c77ee214a |
feat(server): add v2 landing page (#1916)
* feat(server): add v2 landing page * docs(examples): expose auth landing pages * test(server): account for merged bundle growth * fix(server): harden landing install metadata |
||
|
Enrico Toniato
|
6737ecc45d |
feat(server): MCP middleware, observer events, CORS, and universal getHandler (#1918)
Add fetch-native operation middleware (server.use), read-only events (server.on), optional ServerConfig.cors, FrameworkHandler duck-typing for Hono, and getNodeHandler for custom Node http.Server composition. |
||
|
Andrew Khadder
|
14ae280e46 |
Add ChatGPT file upload support (#1897)
* Add ChatGPT file upload hook * Add file upload example |
||
|
Andrew Khadder
|
3bffd70dfe | fix beta preview packaging and docs (#1913) | ||
|
Enrico
|
4f11e03942 |
feat(server): external view assets, CDN env, and CSP configuration
Revamp production view builds to emit hashed assets served over HTTP, add --with-inspector for build manifests, split MCP_URL from MCP_ASSETS_URL, and support global CSP env overrides. |
||
|
Enrico
|
003447ce94 | fix(inspector): update CDN asset resolution and modify server start command | ||
|
Enrico
|
289cf2cbcc | Merge branch 'v2-server-scaffold' into beta | ||
|
Enrico
|
3d32445913 |
feat(assets): update SVG logos and favicon for improved design consistency
- Replaced existing SVG logos and favicon with new designs featuring updated dimensions and styles. - Enhanced the visual representation of the assets to align with the current branding guidelines. - Added a new `langchain.ts` file to the agent package for LangChain integration, including necessary exports and configurations. - Updated package.json and tsup.config.ts to reflect new entry points and dependencies. |
||
|
Enrico
|
1e548836d8 |
feat(docs): add migration page and enhance documentation clarity
- Added a new migration page to the TypeScript client documentation for better guidance on transitioning between versions. - Updated descriptions in various documentation files to improve clarity and consistency, including the MCPClient and Code Mode sections. - Revised links and examples to ensure they reflect the latest structure and best practices for using the MCP client. |
||
|
Enrico
|
8843e2ef0d |
fix(ci): simplify version generation command in CI workflow
- Removed redundant version generation command for @mcp-use/client in the CI workflow. - Updated documentation links in code-mode.mdx and other files to reflect new paths. - Changed installation instructions from yarn to npm for consistency across documentation. - Enhanced error handling in client authentication and session management. - Added a utility function to compare semantic versions in telemetry. - Removed outdated unit tests for FileKVStore. |
||
|
Enrico
|
e6ce060a1b |
refactor(docs): update README and documentation for MCP SDK v2
- Improved formatting and consistency in README.md and various documentation files. - Updated import paths to reflect the new package structure for @mcp-use/client and @mcp-use/agent. - Enhanced examples and descriptions for MCPAgent and related components. - Cleaned up whitespace and formatting for better readability across multiple files. |
||
|
Enrico Toniato
|
7cc7598c57 |
Release v1.34.1 — hosted OAuth discovery through the proxy (#1844)
* fix(auth): re-anchor proxy-origin .well-known discovery onto the MCP server (#1843) * fix(auth): re-anchor proxy-origin .well-known discovery onto the MCP server MCP traffic must always go through the gateway/inspector proxy (browser CORS on direct connections cannot be guaranteed — edge errors bypass the gateway's CORS middleware). But with the transport connected to the proxy URL, the SDK derives /.well-known/* discovery URLs from the proxy origin whenever no resource_metadata hint is available (SSE EventSource cannot read WWW-Authenticate; token refresh runs without a 401 at hand). Discovery then failed on the proxy origin and the server was misclassified as "does not support OAuth", hiding the Authenticate button on gateway-hosted servers. BrowserOAuthClientProvider.getProxyFetch() now rewrites connection-origin .well-known lookups onto the actual MCP server before routing them through the OAuth proxy — reproducing exactly what a direct connection would request, including the RFC 8414 §3.1 / RFC 9728 §3.1 path-insertion form. * style: prettier format * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs(changelog): add v1.34.1 (hosted OAuth discovery through the proxy) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
dcd97d69e2 |
fix(client): wire oauthProxyUrl option + stop misclassifying discover… (#1841)
* fix(client): wire oauthProxyUrl option + stop misclassifying discovered OAuth servers (#1840) Hosted OAuth servers (e.g. gateway-fronted, custom-domain) were dropping to `failed` with "Server does not support OAuth", hiding the Authenticate button. Routing MCP traffic through the inspector proxy anchored OAuth discovery on the proxy origin; a secondary discovery pass (token refresh / SSE fallback) then hit an HTML/500 and matched isOAuthDiscoveryFailure(). - Fully wire UseMcpOptions.oauthProxyUrl through createBrowserOAuthProvider so OAuth traffic can be proxied for CORS while MCP stays direct (transparent proxy preserves RFC 8414 issuer validation). preventAutoAuth manual flow now always uses the scoped OAuth proxy fetch instead of the MCP gateway proxy. - useMcp: when a prepared authorization URL already exists (OAuth discovery succeeded on an earlier pass) and preventAutoAuth is set, surface `pending_auth` on a later failure instead of "server does not support OAuth". * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs: update changelogs for v12.0.0 and v1.34.0 releases - Added details for v12.0.0, highlighting improvements in hosted OAuth reliability and updates from `mcp-use` v1.34.0. - Included fixes for OAuth server failures and updates to peer dependencies in the inspector changelog. - Documented new features and fixes in the TypeScript changelog, emphasizing the introduction of `oauthProxyUrl` for enhanced OAuth proxying and reliability improvements. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Andrew Khadder
|
f7d3d10605 |
feat(typescript): scaffold @mcp-use/server v2 package (MCP-2601)
Greenfield v2 server SDK built on @modelcontextprotocol/server@2.0.0-beta.1 (stateless 2026-07-28 protocol) and Hono. SPEC.md in the package is the working contract: constructor-only config, raw SDK result shapes (no response helpers), compile-time structuredContent enforcement, Standard Schema inputs (zod v4 / ArkType / Valibot), secure-by-default listen(). Ships with type-level contract tests, an end-to-end smoke test, and Vercel/Railway example deployments. Private during development — no releases. Workspace changes: pnpm workspace + root tsconfig registration, scoped TSDoc/jsdoc lint gates in eslint.config.js, and removal of the old repo-level CLAUDE.md files in favor of per-package docs. Claude-Session: https://claude.ai/code/session_01B59sx2QJ6bBBwMevCCqkr4 |
||
|
Andrew Khadder
|
68afda5885 |
docs(typescript): review and rewrite TypeScript docs (MCP-2466) (#1780)
* docs: remove stale feedback block and orphaned anchor from docs.json * chore(docs): make Typescript more prominent * chore(docs): Update `welcome.mdx` * docs: rewrite TypeScript quickstart and welcome pages Refocus the quickstart on create-mcp-use-app (scaffold, run, and deploy a first MCP server) and drop the agent/client/server primer table and diagram. Convert the welcome page's server + widget example from Tabs to CodeGroup and tighten the intro wording. * docs: remove stale server templates page and fix its references Delete the typescript/server/templates page and repoint the home templates tip to the quickstart, which now covers create-mcp-use-app. * docs(typescript): fix dead example links to real example paths The 'see a full example' links pointed at GitHub folders that 404 or contain only a README. Corrected to the real runnable examples under libraries/typescript/packages/mcp-use/examples/, verified against origin/main (incl. matching cd commands): - installation: examples/server -> packages/.../examples/server - client-configuration: a .py link -> real TS multi-server example - code-mode: examples/client/* -> examples/agent/code-mode/* - elicitation, sampling, notifications: server/X -> server/features/X - supabase: server/supabase -> server/deployment/supabase - clerk: restore missing packages/mcp-use/ path segment Quickstart links were already fixed by the quickstart rewrite (e6903716). Part of the docs audit (MCP-2466). * docs(typescript): rewrite Agent and Client introduction pages Rewrite the Agent and Client intro pages to be task-oriented and scannable: concise feature lists with cross-links, runnable quick-start examples, and added API reference sections. Drop stale CodeSandbox embeds and outdated model names. * docs(typescript): fix MCPServer class name casing in server reference The API Reference heading, prose, and class signature used McpServer; the real SDK export is MCPServer. Corrected all three occurrences in server/index.mdx. * docs: add redirect for bare /typescript/server path Routes the bare /typescript/server path to its index page now that the server section has been restructured. Claude-Session: https://claude.ai/code/session_015uioJjKTAZXGQpbXHUHZWp * docs(typescript): fix broken code examples across MCP Server & Apps section Fix all 102 confirmed code defects found in the MCP Server & MCP Apps documentation audit (47 pages, 401 code blocks), verified against the mcp-use@1.32 SDK source. The recurring patterns that made copy-pasted examples fail to compile or run are now corrected everywhere they appeared: - server.start() -> await server.listen() (no start() method exists) - bare-object tool returns wrapped in object()/text() response helpers; catch blocks renamed so they no longer shadow the error() helper - prompt messages use role:"user" with typed { type:"text" } content instead of the invalid role:"system" + bare-string shape - auth reads ctx.auth.user.userId (not ctx.auth.userId); user fields live under ctx.auth.user, scopes/permissions stay top-level - security: remove verifyJwt: process.env.NODE_ENV === 'production' from all six OAuth provider pages (off-prod it skips signature verification and accepts forged tokens); rely on the secure default, with a warning never to disable it - correct import subpaths: Logger/MCPClient from mcp-use, response helpers and server symbols from mcp-use/server, MCPClient as BrowserMCPClient from mcp-use/browser; drop the unexported getMcpAppsBridge - useWidget generics use the real <TProps, TState, TOutput, ...> order; remove the non-existent notifyIntrinsicHeight (auto-size via McpUseProvider) - fix the deployment URL to <id>.run.mcp-use.com/mcp, add missing z/helper imports, add the --branch/--dockerfile CLI options, and clean up em dashes and bare/malformed code fences Each page was fixed and then independently re-verified against the SDK source, with a repo-wide pattern sweep confirming no instances remain. Structural IA changes (moving widget-components to /react/, orphan redirects) are intentionally deferred to the docs rewrite. * docs(typescript): restructure MCP Server & MCP Apps IA Promote MCP Apps to its own top-level section in the TypeScript SDK Docs tab and move the 9 React widget-component pages out of /server/widget-components/ into /typescript/react/. - Move 9 React component pages to typescript/react/ (git renames) with 9 redirects - Promote MCP Apps to a top-level group (Overview pages + React subgroup) - Remove the duplicate MCP Apps group from the Home product nav; rehome guides/chatgpt-apps-flow under MCP Apps so it no longer orphans - Move cli-reference out of MCP Server into a new Tooling group - Relocate response-helpers -> Core Components, openapi -> Advanced Features, nextjs-drop-in -> Deployment - Repoint all widget-components links to /typescript/react/ - Fix 3 broken anchor links (inspector CLI env var, mcp-apps metadata, auth providers) Structure-only change; no page content rewrites. Refs MCP-2466. * docs: refresh TypeScript server app docs * docs: add TypeScript API reference * docs: streamline TypeScript server navigation * docs: rewrite core TypeScript server guides * docs: rewrite advanced TypeScript server guides * docs: rewrite TypeScript server OAuth guides * docs: rewrite TypeScript server session storage guides * docs: rewrite MCP Apps section * docs: add TypeScript MCP client API reference * docs: add TypeScript MCP agent API reference * docs: reorder TypeScript API reference nav * docs: reorganize TypeScript tooling nav * docs: rewrite inspector guides * docs: rewrite MCP server tunneling guide * docs: rewrite CLI client and reference docs * docs: finalize TypeScript documentation rewrite * docs: move inspector updates under get started * Fix Mintlify validation errors * Fix Mintlify broken links * docs: update Manufact Cloud deployment guide * chore: retrigger Mintlify docs preview * Fix MDX comment syntax on home page * docs: rework TypeScript server examples * docs: fix server docs links * docs: restore SDK links in home sidebar * docs: move SDK links to end of home sidebar |
||
|
pietrozullo
|
ad42b4bb3e |
docs: noindex auto-generated Python API reference instead of searchable flag
The searchable: false approach on the API Reference tab was inert on visible tabs. Switch to per-page noindex: true frontmatter, which keeps pages in the sidebar but excludes them from search indexing (search engines, internal docs search, and AI context) so generic queries like "CLI" surface curated guides instead of the generated reference. Applied to all 73 existing reference pages and emitted by the generator on every regeneration. Closes MCP-2398 |
||
|
pietrozullo
|
648ac110b3 |
docs: exclude auto-generated Python API reference from docs search
Set searchable: false on the Python SDK API Reference tab so generic queries (e.g. "CLI") surface curated guides instead of the generated reference, while keeping the reference visible in the sidebar. The generator now emits this flag on every regeneration. Closes MCP-2398 |
||
|
Andrew Khadder
|
430178c9a3 |
Canary (#1757)
* chore(deps): bump hono in /libraries/typescript/packages/mcp-use (#1755) Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.23...v4.12.25) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.25 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore: add hono changeset * chore(typescript): version packages (canary) * Fix Codex skills install path (#1756) * chore(typescript): version packages (canary) * chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript (#1742) * chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.8 to 8.0.16. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.16 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * Handle inspector CLI version and unknown options (#1722) * Handle inspector CLI version and unknown options * Keep inspector version in sync with package metadata --------- Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * Make MCP Apps primary widget runtime & Apply Host Context Styles (#1739) * Make MCP Apps primary widget runtime * Format MCP Apps runtime changes * Remove unused OpenAI globals event types * Apply MCP Apps host style variables * fix host style variable application * fix(react): avoid light fallback for missing host theme * Preserve model context when widget state updates * Remove obsolete MCP Apps runtime theme tests * Format MCP Apps runtime tests * chore(typescript): version packages (canary) * fix(cli): surface GitHub App install URL up front on deploy (#1761) * fix(cli): surface GitHub App install URL up front on deploy When `mcp-use deploy` detects the GitHub App is not connected or lacks access to the target repo, it now prints the install URL before any prompt. In a non-interactive context (an agent or CI, without `--yes`) it prints the URL and next steps and exits cleanly instead of hanging on an unanswerable prompt. Interactive and `--yes` flows are unchanged. * test(cli): simplify GitHub install-flow tests; tidy deploy no_access branch - Collapse redundant gitHubInstallUrl cases into one - Mock `open` and assert the non-interactive path never launches a browser - Extract a `noAccess` local in promptGitHubInstallation for readability * fix(cli): unexport internal-only GitHubInstallation type to satisfy knip GitHubInstallation is only referenced within api.ts (via GitHubConnectionStatus), so the export was dead and failed the knip check. * fix(cli): unexport internal-only InstallFlowMode type to satisfy knip InstallFlowMode is only used within deploy.ts as resolveInstallFlowMode's return type; the test imports the function, not the type. Verified with the full `knip --no-progress` run (exit 0), which CI uses. * chore(typescript): version packages (canary) * fix(cli): preserve deployment list sort order (#1752) * fix(cli): preserve deployment list sort order * chore(cli): add changeset for deployment list sort order fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): stop prompting signed-in users to log in (MCP-2142) (#1767) The hosted inspector showed the "free tier — Sign in to increase your limits" CTA to every managed-LLM visitor, even when already authenticated. ChatTab now resolves the shared Manufact session via a new useHostedSession hook (also adopted by HostedUserMenu) and hides the free-tier sign-in/upgrade chrome for authenticated users. The visibility rule is extracted into a pure shouldShowFreeTierUpgrade helper with unit tests. * chore(typescript): version packages (canary) * fix(typescript): pass the cwd field (#1785) * fix: pass the cwd field Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * fix: add changeset Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * doc: add documentation of cwd field Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> --------- Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * chore(typescript): version packages (canary) * fix(inspector): replace stale auto-connect transports (#1792) * chore(typescript): version packages (canary) * fix(templates): score 100% on publishing checklist (MCP-2260) (#1772) * fix(templates): score 100% on publishing checklist (MCP-2260) Auto-derive openai/widgetDescription from the widget description in the Apps SDK adapter so hosts always see a widget description, and fill the small metadata gaps the templates were missing: - starter: fetch-weather declares a title + outputSchema (returns matching structuredContent). - mcp-apps: search-tools and get-fruit-details declare a title; the product-search-result widget declares a domain (widgetDescription is now auto-derived from its description). Adds a unit test for the widgetDescription default. * feat(server): enforce outputSchema at the tool return position (MCP-2260) Type-check a tool's outputSchema through the existing object()/widget() calls with no new API: - Content helpers (text, markdown, image, ...) now return a content-only ToolContentResult (structuredContent?: never), so they're always allowed. - widget() is generic over its props, which become the result's structuredContent — so widget({ props }) is checked against outputSchema. - The tool callback return type is TypedCallToolResult<TOutput> | ToolContentResult, making object({ wrong })/widget({ props: wrong }) a compile-time error. Adds a type-level test (npm run test:types) and removes an internal template comment. Edge cases that now error against a tool with outputSchema: mix() carrying structured content, or a raw literal with a mismatched structuredContent. * fix(templates): remove hardcoded widget domain Keep the generated MCP Apps template client-neutral so deployers can set their own production widget origin. * chore(typescript): update knip.json to include additional ignore patterns and entry points - Added "test_app" to the ignoreWorkspaces list. - Included "tests/types/**/*.ts" in the entry patterns for type checking. - Removed redundant "scripts/**/*.{js,mjs,ts}" from the entry list in the create-mcp-use-app package. * chore(typescript): version packages (canary) * feat(cli): expose monorepo auto-deploy trigger config (#1793) Add --watch-paths/--wait-for-ci to `mcp-use deploy` and --watch-paths/--deploy-branches/--wait-for-ci/--root-dir to `mcp-use servers update`, and surface the effective trigger config in `servers get`/`update`. Closes the gap where the Cloud API accepted these fields but the CLI could not set them, so monorepo apps can be scoped to only redeploy on relevant changes (#1547). Updates the deployment + CLI reference docs accordingly. * chore(typescript): version packages (canary) * fix(mcp-use): restore Apps SDK compatibility in useWidget as a fallback (#1794) Keep the MCP Apps bridge as the primary widget runtime, but use window.openai (Apps SDK) as a compatibility fallback when the bridge does not connect, instead of dropping it entirely. #1739 made the MCP Apps bridge the sole iframe runtime, which left any Apps SDK-only host (e.g. a ChatGPT widget without MCP Apps support) stuck on the loading spinner forever. A connected MCP Apps bridge still always wins, so ChatGPT keeps using MCP Apps as the source of truth. Also fixes two pre-existing issues in the scroll-to-bottom chat e2e test (strict-mode locator + measuring the animated scroll synchronously). * chore(typescript): version packages (canary) * feat(inspector, typescript): release v11.0.0 and v1.33.0 with MCP Apps as primary widget runtime - Introduced MCP Apps as the primary widget runtime, enhancing style variable application. - Fixed issues with auto-connect entries, user prompts for free-tier, and CLI version handling. - Updated dependencies including `vite` and `mcp-use`. - Added monorepo auto-deploy controls and improved CLI documentation for new flags. See changelogs for detailed updates and fixes. * fix(inspector): scope OAuth proxy fetch per server configuration (#1770) * fix(inspector): scope OAuth proxy fetch per server configuration The browser OAuth provider installed a global window.fetch interceptor to route OAuth requests through the inspector proxy. With multiple servers, connecting one server "Via Proxy" mutated fetch for the entire page, so other servers (including "Direct" ones) and unrelated requests were affected, and switching a server from "Via Proxy" back to "Direct" could leave a stale interceptor behind. BrowserOAuthClientProvider now exposes a scoped getProxyFetch() that returns a fetch confined to a single provider. It is passed only to that server's SDK transport and auth() calls (via the SDK's fetch / fetchFn options), so OAuth-proxy behavior is scoped to the selected server's connection and the global fetch is never mutated. Closes #1766 Co-authored-by: Cursor <cursoragent@cursor.com> * chore: remove redundant OAuth cleanup comment --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * Adopt auto connection mode in inspector docs and UI (#1795) * Adopt auto connection mode in inspector docs and UI * Fix embedded inspector auto proxy fallback * chore(typescript): version packages (canary) * docs: update TypeScript release changelogs --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Ghost Monkey <haugun79@gmail.com> Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com> Co-authored-by: 落尘 <cuidong111@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Dr. Carsten Leue <55989662+Carsten-Leue@users.noreply.github.com> Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: Hemant Krishnakumar <51333870+hemant1026@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
efa7fe78b2 |
Canary (#1719)
* fix(cli): update EnvVariable type to allow null values for sensitive rows (#1717) - Modified the `value` property in the `EnvVariable` interface to accept `null`, indicating write-only sensitive rows where the stored value is withheld by the API. - Adjusted the `printEnvVar` function to handle cases where `value` is `null`, ensuring proper display of sensitive information. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(server): add outgoing notification logging (#1674) * chore(typescript): version packages (canary) * fix(server): mount RFC 8414 canonical well-known paths for path-suffix issuers (#1684) * fix(server): mount RFC 8414 canonical well-known paths for path-suffix issuers Construct upstream OAuth/OIDC metadata URLs per RFC 8414 and OIDC Discovery, and mount canonical path-suffixed routes on the MCP server when the upstream issuer includes a path component. Fixes #1576 Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> * fix(server): mount OIDC discovery at root only; stop leaking error detail Remove the unreachable, malformed OIDC path-suffix local mount (OIDC Discovery appends the well-known segment to the issuer, so there is no canonical form under the openid-configuration prefix, and no client flow reaches a path-suffixed local route). Keep the RFC 8414 OAuth path-suffix mount. Return a generic error_description to clients and log the raw exception server-side instead of echoing it. * style: apply prettier formatting --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(server/oauth): broker upstream OAuth callback through /oauth/callback (#1728) In proxy mode the server was forwarding each MCP client's redirect_uri straight to the upstream provider, which forced every client's callback (Claude, ChatGPT, the inspector, ...) to be pre-registered on the provider. Instead, /authorize now sends the upstream the server's own /oauth/callback and packs the client's redirect_uri + state into the upstream `state` (base64url JSON, stateless). A new GET /oauth/callback restores them and forwards the code (or upstream error) to the client's original callback. /token rewrites redirect_uri to the brokered callback so it matches the authorize request (RFC 6749 §4.1.3). PKCE passes through untouched. Also: jwksVerifier now rejects opaque (non-JWT) access tokens with an actionable message pointing at the missing `audience`, instead of jose's cryptic "Invalid Compact JWS". Only `<server-domain>/oauth/callback` needs registering upstream now. Closes MCP-2170 * fix(inspector): route localhost MCP servers through client-side chat (MCP-2419) (#1736) * fix(inspector): route localhost MCP servers through client-side chat (MCP-2419) In hosted mode the Chat tab streams through the managed cloud backend (chatApiUrl), which connects to the MCP server server-side and cannot reach a user's localhost server. The request 502s and, lacking CORS headers, surfaces in the browser as an opaque "Failed to fetch" / CORS error. Loopback server URLs now fall back to client-side (in-browser) chat streaming, which already holds a direct session to the localhost server. The configure-key empty state shows an explanatory notice telling the user the managed key can't reach their machine and that a personal API key is needed — only in hosted mode; the local inspector is unchanged. The localhost check is extracted into a shared serverUrl util (with IPv6 [::1] bracket handling) plus unit tests, and e2e tests cover the hosted+localhost fallback, the no-cloud-call guarantee, and the notice's presence/absence. * fix(inspector): address PR review on MCP-2419 localhost chat fix - serverUrl: detect the full 127.0.0.0/8 loopback range (not just 127.0.0.1), anchored so "127.example.com" is not a false positive - serverUrl tests: cover 127.0.0.0/8 and near-loopback negatives - e2e: stub the hosted `/api/auth/get-session` endpoint in enableHostedChatMode so HostedUserMenu never hits the real cloud backend (avoids CI flakiness/slowness) - changeset: fix grammar * style(inspector): prettier formatting for e2e test helpers * chore(typescript): version packages (canary) * fix(cli): use authoritative GitHub repo-access check for deploy (MCP-2467) (#1737) The `mcp-use deploy` pre-flight repo-access check listed an installation's repos and matched the target locally. That only inspected the first page, so repos on later pages were wrongly reported inaccessible (MCP-2467); fully paginating it (the prior behavior) hung on very large orgs. Replace it with a single authoritative question per installation via the new backend `GET /github/installations/:installationId/repos/:owner/:repo/access` endpoint (a `repos.get` probe). The installation whose account matches the repo owner is checked first, falling back to the others, preserving the across-installations fix from MCP-2358 without paginating. * chore(typescript): version packages (canary) * chore(deps): bump esbuild from 0.27.1 to 0.28.1 in /libraries/typescript (#1734) * chore(deps): bump esbuild from 0.27.1 to 0.28.1 in /libraries/typescript Bumps [esbuild](https://github.com/evanw/esbuild) from 0.27.1 to 0.28.1. - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](https://github.com/evanw/esbuild/compare/v0.27.1...v0.28.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(typescript): silence dev widget logs when project has no widgets (#1730) * chore(typescript): version packages (canary) * feat : inspector add scroll-to-bottom button (#1538) * inspector: add scroll-to-bottom button * fix(inspector): center chat scroll button --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): cleanly unsubscribe on Ctrl+C (SIGINT) (#1687) * fix(cli): add SIGINT handler to cleanly unsubscribe from resource Addresses #1686 * chore: add cli changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): update emulate oauth callback (#1743) * refactor: centralize screenshot handling and add REPL screenshot support (#1592) * refactor: centralize screenshot handling and add REPL screenshot support * chore: fix knip checks * chore: drop knip version ignore --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(api): update base URL for remote API calls to manufact.com (#1745) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * fix(api): update base URL for remote API calls to manufact.com - Changed the default base URL from 'https://cloud.mcp-use.com' to 'https://cloud.manufact.com' across multiple files, including MCPAgent and RemoteAgent initializations, ensuring consistency in API endpoint references. * chore(typescript): version packages (canary) * feat(cli): add support for custom Dockerfile path in deployment options (#1746) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * feat(cli): add support for custom Dockerfile path in deployment options - Introduced a new CLI option `--dockerfile` to specify a non-default Dockerfile path relative to the project root. - Updated the `DeployOptions` interface to include the `dockerfile` property. - Enhanced deployment command output to display the specified Dockerfile path, improving user feedback during deployment processes. * refactor(cli): improve console log formatting for Dockerfile output - Reformatted the console log statement for the Dockerfile option in the deploy command to enhance readability by breaking it into multiple lines. This change aims to maintain consistent code style and improve maintainability. * chore(typescript): version packages (canary) * Remove obsolete OAuth proxy callback changeset * chore(typescript): version packages (canary) * docs: update canary changelogs * fix(cli): allow empty env var updates (#1750) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * fix(cli): allow empty env var updates * Add changeset for empty env value updates --------- Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(deps): bump tar from 7.5.11 to 7.5.16 in /libraries/typescript (#1744) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * chore(deps): bump tar from 7.5.11 to 7.5.16 in /libraries/typescript Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-tar/compare/v7.5.11...v7.5.16) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.16 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Dhruv Tiwari <144548881+dhruvtiwari6@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kalpchaniyara <kalpchaniyara.2006@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: 落尘 <cuidong111@gmail.com> |
||
|
Enrico Toniato
|
5b4afc845c |
Add client auth info retrieval to useMcp (#1715)
* feat(auth): add getTokenEndpoint method for OAuth token discovery (#1714) * feat(auth): add getTokenEndpoint method for OAuth token discovery - Implemented `getTokenEndpoint` in `BrowserOAuthClientProvider` and `OAuthSessionStore` to resolve and cache the OAuth token endpoint via server metadata discovery. - Updated `UseMcpResult` type to include `token_endpoint` for consumers to persist the endpoint alongside tokens. - Enhanced `useMcp` to utilize the new method for proactive token refresh. - Added unit tests to verify the functionality of the `getTokenEndpoint` method, including caching behavior and error handling. * refactor(auth): improve code formatting in OAuthSessionStore and related tests - Reformatted code in `OAuthSessionStore` for better readability by breaking long lines into multiple lines. - Updated unit tests for `OAuthSessionStore` to enhance clarity by applying similar formatting improvements. - These changes aim to enhance maintainability and readability of the codebase. * feat(auth): add getClientCredentials method for OAuth client information retrieval - Implemented `getClientCredentials` in `BrowserOAuthClientProvider` and `OAuthSessionStore` to allow consumers to retrieve stored OAuth client credentials, facilitating server-side token refresh. - Updated `UseMcpResult` type to include `client_id` and `client_secret` for better token management. - Enhanced `useMcp` to utilize the new method for proactive token refresh, ensuring smoother authentication flows. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v9.0.2 and v1.32.0 releases - Added details for patch release v9.0.2 in the inspector changelog, noting the update to `mcp-use` v1.32.0 with no inspector-specific runtime changes. - Documented minor release v1.32.0 in the TypeScript changelog, highlighting the introduction of OAuth token endpoint discovery and new methods for retrieving client credentials, along with an update to `@mcp-use/inspector`. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
0fb18685d3 |
feat(cli): servers update + branch-scoped env/deploy management (#1711) (#1712)
* feat(cli): servers update + branch-scoped env/deploy management (#1711) * feat(cli): add servers update + branch-scoped env/deploy management Adds `mcp-use servers update` to mutate server config in place (productionBranch, name, description, build/start commands) without delete/recreate, mapping flags to the backend UpdateServerBody (--branch -> productionBranch; build/start commands nested under config). Also completes MCP-1794 branch scoping: - deploy --branch (defaults to current git branch) scopes env sync to the branch's preview env - servers env list/add/update/rm --branch; update/rm accept a KEY resolved within the branch scope, not just a UUID - deployments restart --branch (defaults to the deployment's branch) Supersedes #1706 with the correct field mapping. Adds unit tests, README docs (flags + env naming mapping), and a changeset. * docs(skills): document servers update + branch-scoped env CLI commands Update the mcp-apps-builder and openapi-to-mcp skills for the new CLI surface: add the deploy `--branch` flag, document `servers update` and `servers env` for post-deploy config, and fix the stale `mcp-use deployments env set` reference (the real command is `mcp-use servers env add`). * feat(cli): map empty build/start flags to null for config unset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v9.0.1 and v1.31.1 releases - Added details for patch release v9.0.1 in the inspector changelog, noting the update to `mcp-use` v1.31.1 with no inspector-specific runtime changes. - Documented patch release v1.31.1 in the TypeScript changelog, highlighting workspace dependency alignment and new features in `@mcp-use/cli`, including server updates and branch-scoped environment management. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
4d00a1ffc4 |
Canary (#1704)
* fix(mcp-use): move chalk to regular dependencies (#1702) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(cli): enhance deployment and server management feedback (#1703) * feat(cli): enhance deployment and server management feedback - Added server ID retrieval during deployment to provide clearer context. - Improved user messaging for deployments without a GitHub remote, clarifying the source location. - Updated server information display to indicate when a repository is platform-managed. - Enhanced the `removeServer` function to optionally clear OAuth credentials, allowing for explicit logout actions. This update aims to improve user experience by providing more informative feedback during deployment and server management operations. * refactor(cli, mcp-use): improve code formatting and readability - Simplified console log formatting in `getServerCommand` for better clarity. - Enhanced type definition formatting in `pushSourceToServer` for improved readability. - Streamlined conditional checks in `runAuthPopup` and `useMcp` to follow consistent formatting. - Updated test utility for dispatching messages to enhance clarity. These changes aim to improve code maintainability and readability across the CLI and MCP use libraries. * delete(tests): remove obsolete diag test file - Eliminated the `diag.test.ts` file as it is no longer needed. This cleanup helps maintain a more relevant and streamlined test suite. * chore(typescript): version packages (canary) * feat(auth): enhance popup authentication flow with grace period and return URL - Added a `returnUrl` parameter to the `renderCloseWindowMessage` function to provide users a way back to the app when popups cannot be closed. - Implemented a grace period in `runAuthPopup` to handle scenarios where the popup reports closed before tokens are received, improving reliability during cross-origin navigation. - Updated tests to validate the new grace period behavior and ensure successful resolution of authentication when tokens arrive during this window. These changes aim to enhance user experience and reliability in the authentication process. * chore(changelog): update changelogs for v9.0.0 and v1.31.0 releases - Added details for major release v9.0.0 in the inspector changelog, highlighting OAuth credential lifecycle improvements and updates to peer dependencies. - Included patch release v1.31.0 in the TypeScript changelog, focusing on OAuth popup reliability and credential lifecycle enhancements, along with updates to dependencies. - Updated mcp-use version references in both changelogs to reflect the latest changes. * chore(changelog): update TypeScript changelog for v1.30.2 release - Removed outdated entries for v1.30.2, including the chalk CJS compatibility fix and updates to @mcp-use/inspector and @mcp-use/cli. - Added a fix for downgrading chalk to v4 to resolve compatibility issues with CJS server bundles on Node ≥ 22. This update ensures the changelog accurately reflects the latest changes and fixes. --------- Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
c866bdaa7c |
Canary (#1695)
* feat(cli): managed (no-GitHub) deploy + device-code login (#1691) * feat(cli): add managed (no-GitHub) deploy and device-code login - `mcp-use deploy --managed` packs the local project into a tarball and uploads it to the platform-managed GitHub org, so users can deploy without connecting their own GitHub. Redeploys reuse the linked server. - `mcp-use login --device-code <code>` authenticates non-interactively with a pre-approved OAuth device code (used by the web onboarding flow), skipping the browser step. * feat(cli): auto-detect managed server on redeploy A project linked to a managed server now redeploys via the managed upload path without needing --managed again (detected from the server's connectedRepository.isManaged flag). * docs(skill): document managed deploy + device-code login Update the mcp-apps-builder deployment guide for `mcp-use deploy --managed` (no GitHub required) and non-interactive `mcp-use login --device-code`. * refactor(cli): rename managed deploy option to no-github Updated the CLI command from `--managed` to `--no-github` for deploying local sources without connecting to GitHub. This change clarifies the functionality and aligns with the new documentation. The deployment process remains unchanged, allowing users to upload their project source directly to the platform-managed organization. Additionally, updated related documentation to reflect this change. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): stop inspector widget status label blocking iframe i… (#1694) * feat(greeting-card): migrate greeting-card resource to React widget tool (#1659) * feat(greeting-card): migrate greeting-card resource to React widget tool (#1658) * chore(changeset): add changeset for greeting-card widget migration * fix(widget): disable prefersBorder for greeting-card to prevent double border and remove old changeset * fix(typescript): stop inspector widget status label blocking iframe interactions * chore(inspector): add changeset and pointer-events-none on Apps SDK label Add a patch changeset for @mcp-use/inspector and apply pointer-events-none to the OpenAIComponentRenderer status label for parity with MCPAppsRenderer. --------- Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: iframe collapse when widget renders null (#1693) Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> * chore(typescript): version packages (canary) * chore: update changelogs for v8.0.1 and v1.30.1 releases - Added details for v8.0.1, addressing the widget status label pointer-events issue in the inspector. - Documented v1.30.1 enhancements, including no-GitHub deployment and device-code login features, along with fixes for iframe interactions and zero-height collapse in the McpUseProvider. * feat(mcp): enhance error handling for MCP client readiness (#1528) * feat(mcp): enhance error handling for MCP client readiness - Introduced `formatMcpNotReadyReason` function to provide clearer error messages when MCP operations are attempted before the client is ready. - Updated error messages in `useMcp` to utilize the new formatting function, improving clarity on client state and connection status. * fix(mcp): refine disconnect logic to prevent race conditions - Updated `disconnect()` to only nullify `clientRef` when it points to the closing client and the connect epoch remains unchanged. This adjustment addresses scenarios where `connect()` reuses the same `BrowserMCPClient` instance for a new URL, enhancing error handling for MCP operations. - Introduced a `connectEpochRef` to track connection attempts and ensure proper client state management during disconnects. * fix(react,client): enhance disconnect logic to prevent session wipe on reconnect - Updated `disconnect()` to only nullify `clientRef` when it points to the closing client and the connect epoch remains unchanged, addressing race conditions during reconnections. - Modified `BaseMCPClient.closeSession()` to conditionally delete sessions, ensuring that a new session created during a disconnect does not get wiped, which improves error handling for MCP operations. * fix(react,client): guard disconnect state reset; test closeSession slot guard Address review follow-ups on the disconnect/reconnect race fix: - disconnect() now skips the state reset (setState("discovering") + list clearing) when superseded by a newer connect(), so a manual disconnect() racing a reconnect can no longer clobber the live connection's state. - Add a direct unit test for BaseMCPClient.closeSession's slot-equality guard (parallel createSession survives, normal delete still happens, delete still runs when disconnect() throws). * chore(typescript): version packages (canary) * chore: update changelog for v1.30.1 and enhance MCP client error handling - Documented patch release v1.30.1, including fixes for `McpUseProvider` zero-height collapse, `useMcp` disconnect/reconnect race conditions, and clearer error messages for client readiness. - Improved `useMcp` disconnect logic to prevent stale state issues during reconnections. - Minor formatting adjustment in `MCPAppsRenderer` for cleaner code. --------- Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: sonikagutha <gsonikachowdary@gmail.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Parship Chowdhury <parshipchowdhury@gmail.com> |
||
|
Andrew Khadder
|
25ae46eb6a |
Canary (#1657)
* Add MCP server instructions to TypeScript docs and templates (#1601) * Add MCP server instructions to TypeScript docs and templates * Address MCP instructions review feedback * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Potential fix for code scanning alert no. 78: Incomplete string escaping or encoding (#1661) * Potential fix for code scanning alert no. 78: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * fix(inspector): enhance user experience with copy button for messages Added a copy button to user messages in the inspector, improving usability by allowing users to easily copy message content. This change addresses user feedback for better interaction within the chat interface. Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(mcp-use): bump hono to 4.12.23 for CVE-2026-47674 (#1663) Address Dependabot alert #222 by upgrading the direct hono dependency and raising the pnpm override floor to the patched release. * chore(typescript): version packages (canary) * Handle paginated cloud lists (#1619) * chore(typescript): version packages (canary) * Add OpenAPI-based server generation to the TypeScript SDK (#1583) * Add OpenAPI constructor to MCPServer * Add OpenAPI server example * Simplify OpenAPI example run instructions * Format OpenAPI server generation files * Use live weather.gov OpenAPI spec in example * Clarify weather.gov example path selection * Document OpenAPI server generation * Fix OpenAPI docs example and sidebar placement * Add OpenAPI server tool generation * chore(typescript): version packages (canary) * Fix idle cleanup of session refs (#1624) Co-authored-by: Deepak kudi <deepakkudi23@adsl-172-10-9-116.dsl.sndg02.sbcglobal.net> * chore(typescript): version packages (canary) * fix(cli): check repo access across all GitHub installations (#1629) * fix(cli): check repo access across all GitHub installations getGitHubRepos() only fetched repos from the first installation linked to the organization, so deploys of repos owned by any other installation failed the access check with "GitHub App doesn't have access" even when the app had all-repositories access. Aggregate repos across every installation instead, tolerating per-installation fetch errors. Fixes MCP-2358 * chore(changeset): add changeset for cli repo access fix * chore(typescript): version packages (canary) * docs: add v1.30.0 and inspector v8.0.0 changelog entries Document the canary release wave covering OpenAPI server generation, MCP instructions, session cleanup, and CLI fixes. Co-authored-by: Cursor <cursoragent@cursor.com> * test(agent): skip MCPAgent Quick Start when OPENAI_API_KEY is unset Conditionally skip the docs example test in fork PR CI where secrets are unavailable, with Prettier-correct indentation for describe.skipIf. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(openapi): prevent ReDoS in slugifyToolName regex Split the ambiguous leading/trailing underscore trim pattern and cap input length before regex processing to satisfy CodeQL js/polynomial-redos. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(openapi): remove polynomial regex in slugifyToolName Replace the end-anchored `_+$` trim (and `^_+`) with single-character `_$`/`^_` trims. Because underscore runs are already collapsed to a single `_` by the preceding replace, the edge trims never need a quantifier, eliminating the O(n^2) backtracking that CodeQL flagged as js/polynomial-redos. Drop the now-unnecessary length cap. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(openapi): remove explanatory comment in slugifyToolName Co-authored-by: Cursor <cursoragent@cursor.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Rohith Matam <81304757+Rohithmatham12@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Puneet Dixit <puneetdixit4321@gmail.com> Co-authored-by: Deepak kudi <deepakkudi23@adsl-172-10-9-116.dsl.sndg02.sbcglobal.net> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
d7f44dd31a | chore: update context7 claim (#1666) | ||
|
Andrew Khadder
|
feb8f09b6e |
Canary (#1616)
* chore(deps): bump hono from 4.12.12 to 4.12.18 in /libraries/typescript/packages/mcp-use (#1615) * chore(deps): bump hono in /libraries/typescript/packages/mcp-use Bumps [hono](https://github.com/honojs/hono) from 4.12.12 to 4.12.18. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.12...v4.12.18) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix: require bearer auth on /sse MCP transport (#1628) The MCP JSON-RPC handler is mounted on both /mcp and /sse, but the OAuth bearer-auth middleware was only applied to /mcp/*, leaving /sse reachable without a token on OAuth-protected servers. Apply the middleware to /sse and /sse/* as well, and advertise RFC 9728 path-scoped protected-resource metadata for /sse. Adds a regression test exercising setupOAuthForServer. * chore: update dependencies in TypeScript libraries (#1626) - Bump versions of `react-router`, `react-router-dom`, and `qs` in package.json and pnpm-lock.yaml. - Update `hono`, `dompurify`, and `axios` to their latest versions. - Add new dependencies: `protobufjs`, `@protobufjs/utf8`, `vitest`, `ws`, `uuid`, `fast-uri`, `ip-address`, `postcss`, `langsmith`, `follow-redirects`, and `better-auth` to package.json. - Update `@vitest/coverage-v8` to version ~4.1.0 in mcp-use package.json. * chore(typescript): version packages (canary) * chore(deps-dev): bump oauth2-mock-server in /libraries/typescript (#1650) Bumps [oauth2-mock-server](https://github.com/axa-group/oauth2-mock-server) from 8.2.1 to 8.2.2. - [Release notes](https://github.com/axa-group/oauth2-mock-server/releases) - [Changelog](https://github.com/axa-group/oauth2-mock-server/blob/master/CHANGELOG.md) - [Commits](https://github.com/axa-group/oauth2-mock-server/compare/v8.2.1...v8.2.2) --- updated-dependencies: - dependency-name: oauth2-mock-server dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump eslint-import-resolver-typescript (#1643) Bumps [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript) from 4.4.4 to 4.4.5. - [Release notes](https://github.com/import-js/eslint-import-resolver-typescript/releases) - [Changelog](https://github.com/import-js/eslint-import-resolver-typescript/blob/master/CHANGELOG.md) - [Commits](https://github.com/import-js/eslint-import-resolver-typescript/compare/v4.4.4...v4.4.5) --- updated-dependencies: - dependency-name: eslint-import-resolver-typescript dependency-version: 4.4.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump vitest from 4.0.18 to 4.1.0 in /libraries/typescript (#1600) * chore(deps-dev): bump vitest in /libraries/typescript Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.0.18 to 4.1.0. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * docs: add v1.29.1 and v7.0.1 changelog entries Document the OAuth /sse bearer-auth fix and workspace security dependency bumps on the docs site ahead of the canary release wave. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: update changelog --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
83271e869f |
Canary (#1508)
* chore: remove unused mcp-use source files (#1476) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs(cli): clarify inspector skipped-in-production log + start section (#1505) * docs(cli): clarify inspector skipped-in-production log + start section The runtime log "[INSPECTOR] Skipped in production (use --with-inspector flag during build)" reads as if the flag can be passed to `mcp-use start`, which it can't (the flag is only registered under `build`). The new wording spells out the rebuild command, and `cli-reference.mdx` gains a short note under `start` pointing at the build flag for inspector-in-production. Closes #1495 * docs(cli): apply reviewer reword on inspector note * chore(typescript): version packages (canary) * chore(inspector): remove unused source files (#1510) Drops the 18 inspector files reported by `pnpm knip` from libraries/typescript and stops generating the unused client-side version.ts (the client reads the version from the window.__INSPECTOR_VERSION__ global injected by the server). Part of #1446. * chore(typescript): version packages (canary) * chore(typescript): prune 187 unused exports and 161 unused export types flagged by knip (#1511) * chore(typescript): prune 161 unused exported types flagged by knip Phase 2 of #1450: remove or de-export types that knip flags as unused. Skipped tuning knip.json (Phase 1) — focused only on the type cleanup. For each flagged type: - Used only within its source file → drop `export` - Re-exported through a barrel but never imported downstream → remove the re-export - Genuinely dead → delete No public-API removals: types exposed through the `mcp-use`, `@mcp-use/cli`, `@mcp-use/inspector`, or `create-mcp-use-app` package entry points remain exported. `client.ts` switches from inline `import("...")` to a top-level import so knip can see the `ToolSearchResponse` usage. Verified `pnpm knip` reports 0 unused types (down from 161) and `pnpm build` passes across all packages. * chore(typescript): prune 187 unused exports flagged by knip Closes #1450. * chore(typescript): fix prettier formatting * chore(typescript): delete orphaned PropsSelect.tsx Removing the unused barrel re-export in the prior commit left this file with no consumers. * chore(typescript): version packages (canary) * ci(knip): enforce knip and clear final baseline findings (#1512) * chore(knip): clear remaining baseline findings so knip passes clean - Mark `src/index.tsx` as an entry for create-mcp-use-app so its CLI dependencies (chalk, commander, ink, ora, tar, react, etc.) stop being flagged as unused. - Add `lsof`, `sleep`, and `dev` to ignoreBinaries for the mcp-use workspace — these appear in example scripts and are either system utilities or pnpm script names, not npm-resolvable binaries. - Turn off the `optionalPeerDependencies` rule. Optional peer deps (langchain/langfuse/e2b/etc.) are loaded conditionally by design; flagging them as referenced is noise. After this change `pnpm exec knip` exits 0 against canary. * ci(knip): enforce knip in CI The baseline is now clean (canary + previous PRs cleared all findings), so drop `--no-exit-code` and let the job fail when knip reports issues. Also generate `packages/mcp-use/src/version.ts` before knip runs so the gitignored `version.js` imports resolve. * chore(deps): bump better-auth in /libraries/typescript (#1515) Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.1 to 1.6.11. - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.6.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: tighten PR readiness and docs hygiene (#1509) * docs: tighten review readiness and doc links * docs: anchor api-reference redirect and fix missed node note Move the /typescript/server/api-reference target from a bare redirect to an anchored one (#mcpserver-api-reference) so existing "API Reference" links land on the renamed section directly. Drop the self-link in server/index.mdx and bring the commonjs example's Node note in line with the package engines range. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * feat(server/oauth): allow Supabase URL override for self-hosted/local instances (#1517) * feat(server/oauth): allow overriding Supabase URL for self-hosted/local instances `oauthSupabaseProvider` previously hardcoded `https://${projectId}.supabase.co`, preventing use against local Supabase (`http://localhost:54321`) or self-hosted deployments — even though those instances expose the same OAuth 2.1 server. Add an optional `supabaseUrl` config (and `MCP_USE_OAUTH_SUPABASE_URL` env var) that overrides the projectId-derived URL. `projectId` is now optional when `supabaseUrl` is set; hosted-project users are unaffected. Closes mcp-use/mcp-oauth-supabase-template#2 * test(server/oauth): trim supabase provider tests to factory contract Drop low-value string-concatenation and pre-existing-behavior tests; keep the two that cover the new behavior (supabaseUrl alone is accepted; empty config throws). Isolate process.env in the factory describe so the "throws when neither configured" assertion isn't defeated by local MCP_USE_OAUTH_SUPABASE_* env vars. * docs(server/oauth): document supabaseUrl override for local/self-hosted Supabase * chore(typescript): version packages (canary) * chore: use cross-platform clean commands (#1523) * chore: use cross-platform clean commands * chore: add empty changeset for cross-platform clean scripts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy (#1483) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy The DCR-direct metadata proxy was string-concatenating a path onto the issuer, which canonically ends with a trailing slash: `${issuer}/.well-known/oauth-authorization-server` // → "https://tenant.auth0.com//.well-known/oauth-authorization-server" Auth0 returns 404 for any path starting with "//", which broke OAuth discovery end-to-end against real Auth0 tenants in DCR-direct mode. new URL(path, base) normalizes the join regardless of trailing slash, so this works for any provider whose canonical issuer ends with "/". Fixes #1482. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(server/oauth): normalize issuer trailing slash instead of using URL constructor `new URL("/.well-known/...", issuer)` resolves the leading-slash path against the issuer's origin, stripping any path on the issuer. That breaks providers like Supabase whose issuer is `https://<project>.supabase.co/auth/v1`. Replace with a trailing-slash-stripping template literal, which handles both Auth0 (issuer ends with `/`) and Supabase (issuer has a path). * chore(changeset): trim oauth metadata fix entry * chore(changeset): drop issue reference --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * test(inspector): add OAuth e2e against emulated Google issuer (#1481) * test(inspector): add OAuth e2e test using emulated Google issuer Covers the inspector's OAuth redirect flow end-to-end against an `emulate`-backed Google issuer + MCP server in oauthProxy mode, run twice across the Direct and Via Proxy connection-type matrix. Both variants share one fixture in serial mode since the registered redirect URI pins the MCP server to a fixed port. * test(inspector): switch loop to factory to satisfy no-loop-func The for-loop variant captured the mutable `fixture` binding from beforeAll, which eslint's no-loop-func flags. Hoisting the body into a small factory keeps the shared fixture without the closure-over-loop pattern. * test(inspector): close emulator if MCPServer setup fails Wrap post-createEmulator work in try/catch so the emulator port doesn't stay bound when MCPServer construction or listen() throws. * chore(typescript): version packages (canary) * fix(inspector): surface MCP server auth failures with reconnect banner (#1485) * fix(inspector): surface MCP server auth failures with reconnect banner (MCP-2111) When the hosted inspector's chat backend returns 401 because the upstream MCP server rejected the user's OAuth token (e.g. Linear token expired), the inspector previously threw a generic `HTTP error! status: 401` and the cloud response misleadingly pointed users at the Manufact account login. The chat now recognises the cloud's `{ error: "mcp_auth_required", mcpServerUrl }` response and renders an inline banner above the input ("Reconnect to <server>") with a button that calls `connection.authenticate()`. Reconnect refreshes the OAuth token in localStorage; the banner clears on success and chat resumes. Pairs with a cloud-side change that drops the misleading `loginUrl` field from the 401 response. * fix(inspector): harden mcp_auth_required handling - Drop the no-op setMessages filter in the 401 branch; the optimistic assistant message is only added after the response check, so there's nothing to remove. - Guard `new URL(serverUrl)` in McpReconnectBanner so a malformed URL falls back to the raw string instead of crashing the chat tab. * refactor(inspector): rename mcpAuthRequired to mcpServerAuthRequired The hook's internal state was already named `mcpServerAuthRequired`, but the returned key and clear callback used the shorter `mcpAuthRequired`, forcing the ChatTab consumer to re-alias them. The shorter name was also ambiguous in a codebase that has two distinct auth flows: the Manufact account login (429 path) and the upstream MCP server OAuth (401 path). Align the public surface of `useChatMessages` with the internal state and the consumer's local name. The backend wire value `"mcp_auth_required"` is unchanged. * chore(inspector): remove mcpServerAuthRequired comment * chore(typescript): version packages (canary) * fix(inspector): keep tab count badges visible in collapsed mode (#1490) * fix(inspector): keep tab count badges visible in collapsed mode * Keep tab badges aligned in collapsed mode * extract TabCountBadge and fix badge visibility * chore(typescript): version packages (canary) * fix(inspector): drop unused TabCountBadge barrel re-export (#1533) The only consumer (LayoutHeader.tsx) imports TabCountBadge directly from ./shared/TabCountBadge, so the re-export in shared/index.ts is unused. Knip flagged it and started failing CI on canary after the TabCountBadge change landed. * chore(typescript): version packages (canary) * feat(inspector): add local LLM provider support for chat in Inspector (#1395) * feat(inspector): integrate ollama provider * feat(inspector): integrate lmstudio provider * fix(inspector): preserve no-icon behavior for openai-compatible provider * refactor(inspector): remove LM Studio provider and address PR feedback * fix(inspector): remove duplicate ollama union members Collapses the accidental `"ollama" | "ollama"` duplicates in ProviderName, MCPChatMessageEventData, and LLMConfig. * refactor(inspector): drop LLM proxy and call Ollama directly Ollama allows localhost origins by default, so the inspector talks to the daemon over CORS and skips the server-side proxy entirely. Surface an OLLAMA_ORIGINS hint when the browser fetch fails so tunneled or remote setups know what to configure. Theme the Ollama logo and tighten its size so the non-circular mark sits cleanly next to the other provider icons. * chore(inspector): revert gratuitous field reorders Restore original ordering of temperature/baseUrl and useCallback deps; remove stray blank line in vite.config.ts to keep the diff focused. * test(inspector): add unit tests for parseNDJSON * refactor(inspector): tighten Ollama provider integration - Guard Ollama streamChat against duplicate tool-call emissions when a chunk's tool_calls are repeated by proxies/forks - Key the models cache on (provider, baseUrl) for any base-url provider so openai-compatible no longer serves stale entries on URL changes; normalize Ollama variants (trailing slash, /api suffix) to one entry - Move OllamaCorsError into the Ollama provider module - Replace hand-written provider unions in telemetry events and server shared-utils with ProviderName - Single-source DEFAULT_OLLAMA_BASE_URL from ollama/utils.ts - Drop the unrelated tempApiKey/tempModel trim() drift in saveLLMConfig - Make OPENROUTER_ICON_URL module-private, clean up merge-artifact blank lines * chore: simplify changeset * style(inspector): apply prettier to shared-utils * fix(inspector): drop unused export on DEFAULT_BASE_URLS DEFAULT_BASE_URLS is only consumed by getDefaultBaseUrl in the same module. Knip flagged the export as unused and failed CI. * ci: retrigger after canary knip fix (#1533) --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): resolve CodeQL polynomial-regex alert in Ollama url normalizer (#1534) * fix(inspector): replace trailing-slash regex in Ollama url normalizer CodeQL flagged `/\/+$/` in `normalizeOllamaBaseUrl` as a polynomial regular expression on uncontrolled input. Swap the regex for an explicit linear scan and add unit tests covering the trimming behaviour plus a pathological-input case. * chore: drop unit test for trivial regex refactor * chore: drop accidentally committed .antigravitycli symlink * chore(typescript): version packages (canary) * chore: remove dead typescript-format-and-lint pre-commit hook (#1541) The hook entry pointed to `.git/hooks/typescript-pre-commit.sh`, a path that is never tracked and was never populated by any setup step, so the hook could not run for anyone. TypeScript formatting and linting are already handled by Husky (libraries/typescript/.husky/pre-commit), installed automatically via `pnpm install`'s `prepare` script. Closes #1536 * fix(inspector): stop ToolInputForm from mutating live tool inputSchema (#1545) * fix(inspector): stop ToolInputForm from mutating live tool inputSchema `ToolInputForm` was writing `required: boolean` onto each property of the live tool inputSchema during render. `required` is not valid as a per- property boolean — it belongs on the parent object as a `string[]`. Anthropic's draft 2020-12 validator rejected the resulting payload with `tools.0.custom.input_schema invalid`, breaking the Inspector chat after any tool had been opened in the Tools tab. Replace the mutation with a local `isRequired` const used only for the `*` indicator render. Fixes MCP-1970. * chore(inspector): trim comment on schema-mutation fix * chore: remove verbose comment * style(inspector): apply prettier to ToolInputForm * chore(typescript): version packages (canary) * Improve tab switch animation timing (#1544) * chore(ui): improve tab switch animation timing * chore(changeset): add changeset for tab animation improvement * chore(typescript): version packages (canary) * fix(inspector): propagate server alias updates through mcp server wrapper (#1539) * fix(inspector): propagate server alias updates through McpServerWrapper onUpdate * chore: add changeset for mcp-use server alias propagation fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * chore(typescript): add 3-day install cooldown via pnpm minimumReleaseAge (#1516) Blocks `pnpm install` from fetching npm versions published less than 3 days ago, mitigating supply-chain attacks where a malicious release is typically yanked within hours of discovery. The setting (introduced in pnpm 10.16) lives in pnpm-workspace.yaml — in modern pnpm only auth/registry config is read from .npmrc, so putting it there would be silently ignored. Workspace-published names (`mcp-use`, `@mcp-use/*`, `create-mcp-use-app`) are exempted so the cooldown never interferes with local development or fresh releases of our own packages. * fix(react): improve server management in McpClientProvider (#1561) Refactor server removal and update logic to use a ref for synchronous access to the latest server state. This change prevents React's warning about updating a component during rendering by ensuring that teardown side effects (`disconnect()` and `clearStorage()`) are executed outside of the state updater functions. The ref is updated in a useEffect hook to maintain the latest server state for event handlers. * chore(typescript): version packages (canary) * fix(inspector): forward MCP image tool results as image content (#1487) * fix(inspector): forward MCP image tool results as image content (MCP-1941) Previously, the inspector's chat loop and provider adapters serialized MCP tool results with JSON.stringify, which buried the base64 `data` field of `image` content blocks inside a text payload. Vision-capable models received a wall of base64 text instead of the image. Extract MCP `content` blocks into provider-neutral `ContentPart[]` and route image bytes through each provider's vision channel: - Anthropic: image blocks inside `tool_result.content` (base64 source). - OpenAI: tool role keeps text; image bytes forwarded as a follow-up user turn with `image_url` parts. - Google: `functionResponse.response` keeps text/metadata; image bytes forwarded as a follow-up user turn with `inlineData` parts. Text-only tool results keep the legacy `content: string` path on every provider. * style(inspector): apply prettier formatting * chore(inspector): drop unused export on collapseToString Only called internally by toolResultToContent — knip flagged it as an unused export. * fix(inspector): propagate MCP isError flag and fix image example tools - Add isToolResultError() helper and use it in toolLoop + replay so tool calls that return { isError: true } are flagged the same as thrown errors on both live and saved-conversation paths. - Pick a no-content fallback for OpenAI's tool role when there are no image parts to forward. - Replace via.placeholder.com URLs in the everything example with real base64-encoded bytes fetched from picsum.photos, since the image() helper expects MCP ImageContent base64 data, not URLs. * style(inspector): apply prettier formatting * chore(typescript): version packages (canary) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL (#1552) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL Browsers cannot resolve 0.0.0.0 as a destination, and the MCP SDK's OAuth resource validator does strict origin equality — so the inspector auto-connecting to http://0.0.0.0:PORT/mcp mismatches the resource metadata published as http://localhost:PORT (which goes through normalizeUrlHost in server-helpers.ts). Result: OAuth-protected mcp-use apps fail at the inspector's post-callback validation with "Protected resource X does not match expected Y". Mirror the existing normalization for the autoConnect URL and the banner log so both reflect the browser-reachable host. Closes #1551 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: add changeset for inspector autoConnect loopback normalization --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): align widget Vite base with /mcp-use/widgets (#1560) * fix(cli): align widget Vite base with /mcp-use/widgets/ when MCP_URL is set * chore: add changeset for cli widget base path fix * chore: format widget-paths.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(cli): headless screenshot with auto-sizing and external MCP server support (#1579) * feat(cli): headless screenshot command with auto-sizing and external MCP server support - Make width/height optional; when omitted, clips to the widget's natural rendered size by reading body[data-view-*] rect attrs set by the preview page - Add useBundleReadinessSignal in ViewPreview that uses ResizeObserver to wait for the iframe to stabilize before setting data-view-ready, serializing the iframe's bounding rect so the CLI can clip tightly instead of capturing the full viewport - Switch ViewPreviewBundle to displayMode="inline" so widgets auto-size to content height - Add inlineWidthOverride prop to MCPAppsRenderer to bypass the 768px inline cap when screenshotting at an explicit width - Fix extractViewName to handle external MCP server URIs (ui://<server>/<name>.html) by flattening to <server>-<name>; previously only ui://widget/ was handled, causing React Router to fail to match the preview route for third-party servers like Excalidraw * chore: add changeset for screenshot auto-sizing and external MCP fix * fix(cli): unexport CaptureScreenshotResult to satisfy knip * chore(typescript): version packages (canary) * feat(auth): enhance OAuth callback handling with improved state management and user feedback (#1580) * feat(auth): enhance OAuth callback handling with improved state management and user feedback - Introduced a module-level cache for in-flight authorization promises to prevent duplicate network requests during the same page load. - Added utility functions to determine if the current window is a popup and to render user-friendly messages for closing the window after authentication. - Improved handling of redirect flows and popup scenarios to ensure a seamless user experience, including error handling and messaging for lost opener situations. * fix(auth): BroadcastChannel fallback when popup opener is severed Popup callback now broadcasts success/failure over a same-origin BroadcastChannel("mcp_auth_callback") in the lost-opener branch, and useMcp subscribes to that channel alongside the existing window.message listener. Without this, popups whose window.opener was severed by COOP or cross-origin intermediate redirects would save tokens but leave the parent stuck in `authenticating`. Matches the dual-transport pattern used by oidc-client-ts and MSAL.js for the same COOP scenario. * chore(auth): unexport MCP_AUTH_BROADCAST_CHANNEL to satisfy knip It's only used inside callback.ts; the parent side hard-codes the same string in useMcp.ts. Removing the export drops knip's "unused export" finding while keeping a single source-of-truth comment that links the two files. * fix(mcp-use): split langchain agents out of mcp-use/browser entry Move MCPAgent, RemoteAgent, adapters, and observability to mcp-use/browser/agent so Next.js clients importing MCPClient only no longer pull @langchain/* into the browser bundle. * chore: format browser bundle test file * chore(typescript): version packages (canary) * fix(inspector): add copy button to user messages (#1556) * fix(inspector): add copy button to user messages Extract CopyButton into a shared component and add it to UserMessage, matching the existing assistant message UX. Resolves #1555 * chore: add inspector copy button changeset --------- Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(server): add publicLandingPage option for OAuth-protected servers (#1550) * feat(server): add publicLandingPage option for OAuth-protected servers * fix(server): keep public landing auth gate in oauth setup * docs(server): add public landing page example * chore(server): format mcp endpoint * chore(server): simplify accept header lookup * chore(server): restore mcp mount diff * fix(server): align oauth exports with canary * chore(server): format oauth exports * fix(server): remove unused oauth barrel exports --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * Move mcp-apps template pnpm settings to workspace config (#1602) * fix(inspector): widget fullscreen above embedded host chrome (MCP-2181) (#1605) * fix(inspector): portal widget fullscreen above host chrome MCP-2181: cloud chat headers at z-50 covered the fullscreen exit control because the overlay used z-40 inside a nested stacking context. Portals the fullscreen shell to document.body at z-[100], sets data-mcp-widget-fullscreen for hosts, and shows the Apps SDK exit navbar in CSS fullscreen fallback. * fix(inspector): native fullscreen first, no portal remount (MCP-2181) Revert conditional createPortal that remounted widgets on fullscreen toggle. Use requestFullscreen() as the primary path; apply CSS z-[100] overlay only when the API fails. Keep exit navbar and data-mcp-widget-fullscreen for both. * refactor(inspector): consolidate widget fullscreen into shared hook Extract useWidgetFullscreenControls for native-first fullscreen + CSS fallback. Removes duplicated handlers, unused helpers, and OpenAI edge-case branches from MCPAppsRenderer and OpenAIComponentRenderer. * fix(inspector): preserve widget state when entering fullscreen (MCP-2181) Route ui/request-display-mode through native fullscreen handling, target requestFullscreen on the iframe wrapper, and avoid resetting load state on display-mode-only changes. Stabilize OpenAI iframe listeners so chat re-renders do not flash the skeleton. * style(inspector): format OpenAIComponentRenderer for Prettier * fix(inspector): fullscreen shell includes navbar and fills viewport Promote the outer widget shell via requestFullscreen so FullscreenNavbar stays visible and bg-background fills the screen instead of browser black letterboxing around a nested iframe wrapper. * fix(inspector): PiP portal and sandbox remount bridge reconnect (MCP-2181) Port PiP to document.body with z-[100]. Re-run AppBridge when the sandbox iframe remounts; keep the host spinner until initCount recovers. Unify display-mode document attributes for optional host chrome hiding. * fix(inspector): resend widget data after PiP remount * chore(typescript): version packages (canary) * Hash Claude resource domains from authored ui.domain (#1599) * Apply Claude resource domain hashing for UI metadata * chore: format Claude domain helper * fix(inspector): drop unused widget-fullscreen exports to satisfy knip (#1607) widget-fullscreen.ts (added in #1605) exported several symbols that nothing outside the file consumes, plus pre-emptive @deprecated aliases for an API that never shipped. Only useWidgetDisplayModeControls is used (by MCPAppsRenderer and OpenAIComponentRenderer). - Unexport internal-only constants, the WidgetDisplayMode type, and the useWidgetDisplayModeDocumentChrome helper - Remove the dead useWidgetFullscreenControls / useWidgetFullscreenDocumentChrome aliases * test(agent): drop live Langfuse API integration tests (#1608) The observability integration tests queried the live Langfuse REST API (via getRecentTraces) to verify traces landed. cloud.langfuse.com has been returning 403 Forbidden for both ingestion and queries, failing the 'should send traces to Langfuse when observability is enabled' test and reddening canary CI. Remove the two tests that depend on the live API (the failing test and the already-skipped manual-trace test) plus the now-unused getRecentTraces helper. Keep the two tests that verify observability enable/disable behavior locally with no network dependency. * chore(typescript): version packages (canary) * fix(oauth): redact token verification errors (#1573) * fix(oauth): redact token verification errors * chore: add oauth error redaction changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): skip emulate oauth tests in builtin e2e (#1609) * chore: add codex to gitignore (#1612) * fix(docs): update server API reference links (#1611) * fix(mcp-use): pin published dependency versions (#1610) * docs(changelog): document v1.29.0 / inspector v7.0.0 release TypeScript changelog gains a v1.29.0 entry (public landing pages, Supabase URL override, Claude UI-resource domain hashing, OAuth callback + React-provider hardening). Inspector changelog gains a major v7.0.0 entry (local Ollama provider, image tool results, MCP-server reconnect banner, widget fullscreen/PiP rework). * Fix builtin inspector auto-connect to use HTTP (#1613) * Switch builtin inspector auto-connect to HTTP * Use plain URL autoConnect in builtin e2e helper * Fix built-in inspector auto-connect to use HTTP * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: asim48-ctrl <asim48@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Truffle <truffleagent@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SSharma1103 <shivamsharma11032009@gmail.com> Co-authored-by: Polæ <steven@polae.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Udaykumar Dhokia <udaykumardhokia@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Jefsky Wong <hwj3344@hotmail.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Ritwij Aryan Parmar <88580521+RitwijParmar@users.noreply.github.com> |
||
|
pietrozullo
|
1092e1e5e9 | Remove launch week banner from docs | ||
|
Andrew Khadder
|
0a5c118bc3 | Add Context7 config for TypeScript docs (#1507) | ||
|
Andrew Khadder
|
1e9f1a0ec7 |
chore: host context7.json under Mintlify docs (#1506)
Mintlify serves static files (.json supported) from the docs/ directory at the docs site root. Adding docs/context7.json so the file is reachable at https://docs.mcp-use.com/context7.json for Context7 library verification. The existing context7.json at the repo root is unaffected. |
||
|
Pietro Zullo
|
8348c59a53 |
docs: reorganize, fix accuracy, and update for agent readability (#1502)
* docs: reorganize navigation and clean up content - Remove 'Misc' group with misplaced blog posts - Remove 'Libraries' redirect group from Home nav - Simplify 'Dev Tools' group (flatten Inspector, CLI, Tunneling) - Remove individual changelog versions from Python nav (keep summary) - Remove changelog from TypeScript 'Get Started' group - Remove tunneling duplicate from Python Development group - Rewrite mcp101 as clean MCP concepts page (was pitch deck) - Delete typescript/blog posts (not technical docs) - Add redirects for deleted blog post URLs * docs: fix content accuracy and remove sloppy language - Fix broken python/server/mcp-apps link in home page - Remove informal pitch-speak from python/server/index.mdx - Fix grammar error in typescript/server/index.mdx - Update typescript/client/logging.mdx: remove fake 'coming soon' API code - Fix non-existent model name gpt-5.1 in typescript quickstart - Fix mcp_use naming in development contributing guide * docs: fix incorrect TypeScript server API calls in inspector docs - Replace server.addTool() with server.tool() (correct mcp-use API) - Add missing zod import to debugging-chatgpt-apps example * docs: fix fake model names (gpt-5.1 → gpt-4o) in agent docs * docs: update model names, fix APIs, and add agent visibility hints - Replace all deprecated model names with latest: gpt-4.1, gpt-4.1-mini, claude-sonnet-4-6, claude-opus-4-7, gemini-2.5-flash across all docs - Fix TypeScript server.tool() API in installation.mdx (old positional string form) - Fix TypeScript agent.run() in quickstart.mdx (deprecated string form → object) - Remove broken manufact.com/docs/llms.txt hidden hints from 5 pages - Add <Visibility for="agents"> block to mcp101.mdx with install commands, key classes, and API signatures for agent-oriented navigation - Add LangChain provider install note to Python quickstart (mcp-use agent requires a separate langchain-* provider package) - Update model name cards in Python llm-integration.mdx * docs: clean up remaining stale model names and improve accuracy - Update supported model lists in Python and TypeScript llm-integration pages - Fix cost optimization table to use current model IDs - Update TypeScript agent overview supported providers list * docs: add LangChain provider install to TypeScript quickstart agent section The MCPAgent requires a separate @langchain/* provider package; this was not mentioned before the code example that imports from @langchain/openai. * docs: update to latest flagship model IDs (May 2026) - OpenAI: gpt-4.1 → gpt-5.5, gpt-4.1-mini → gpt-5.5-mini - Google: gemini-2.5-flash → gemini-3.1-flash, gemini-2.5-pro → gemini-3.1-pro - Groq: llama-3.1-* → llama-4-scout-17b-16e-instruct - Anthropic (claude-opus-4-7, claude-sonnet-4-6) already current, no change * docs: replace all em dashes with hyphens * docs: restore llms.txt hints using Visibility component * docs: simplify TypeScript logging page to unsupported notice only * docs: rewrite mcp101 to explain MCP protocol with mcp-use examples and doc links * docs: remove goal.md * docs: revert nav changes, keep only Misc group removal and blog redirects * docs: reorder mcp101 to Server/App -> Client/Inspector -> Agent, restore title * docs: add code examples for Resources and Prompts in mcp101 * docs: remove em dashes from mcp101 * docs: add MCPClient code examples to mcp101 * docs: add React client example to mcp101 * docs: add agent code examples to mcp101 * docs: expand MCP Apps section in mcp101 with example and links * docs: restore Contacts, Socials, and Founders sections to mcp101 * docs: add context-setting intro paragraph to mcp101 for new readers * docs: add MCP stores section to mcp101 intro with Claude, ChatGPT, Cursor * docs: fix Claude store link * docs: fix ChatGPT store link * docs: fix Cursor store link * docs: replace store Cards with linked image grid * docs: add captions to store images * docs: add Notifications to client primitives table in mcp101 * docs: add lead-in paragraph before resource cards at bottom of mcp101 * docs: move resource cards to end of page after Contacts/Socials/Founders * docs: demote Contacts/Socials/Founders to bold text to remove from TOC * docs: move Contacts/Socials/Founders to very end of mcp101 * docs: add Resources and Contacts section headers, link official MCP docs * chore(docs): update site metadata, footer links, and rename mcp_use to mcp-use * update docs metadata + images * docs: enhance MCP section by highlighting the reach of MCP stores with 1 billion weekly active users * api ref |
||
|
Andrew Khadder
|
46caf8059b |
Canary (#1473)
* chore(deps): bump next from 15.5.15 to 15.5.18 in /libraries/typescript (#1472)
* chore(deps): bump next from 15.5.15 to 15.5.18 in /libraries/typescript
Bumps [next](https://github.com/vercel/next.js) from 15.5.15 to 15.5.18.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/compare/v15.5.15...v15.5.18)
---
updated-dependencies:
- dependency-name: next
dependency-version: 15.5.18
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore(typescript): drop unused dependencies and dev dependencies (#14… (#1458)
* chore(typescript): drop unused dependencies and dev dependencies (#1447).
* docs(typescript): align CLAUDE.md pre-commit notes with husky hook
lint-staged was removed in this PR; the actual .husky/pre-commit
script runs `pnpm format` and `pnpm lint:fix` directly plus a
changeset presence check.
* chore(typescript): version packages (canary)
* docs(typescript): make response helpers discoverable in tool() and blank template (#1474)
* docs(typescript): make response helpers discoverable in tool() and blank template
MCPServer.tool() JSDoc examples called text()/error() with no import line,
so the hover doc gave no breadcrumb to mcp-use/server. The blank scaffold
template had the same gap — helpers appeared only inside commented-out
example blocks.
- Add import statements + a leading note to each @example block on tool()
- Replace the commented fetch-weather placeholder in the blank template
with a real, working echo tool that imports text from mcp-use/server
* docs(typescript): keep blank template empty, surface helper imports inside the commented examples
Revert the real echo tool — blank should stay actually blank. Instead, the
commented-out tool/resource/prompt blocks now contain their own `import` lines
for `text` / `object` / `z`, so an agent reading the file sees the complete
pattern (including where the helpers come from) without anything actually
being registered.
* chore(typescript): version packages (canary)
* chore(mcp-use): declare jsdom and @vitest/coverage-v8 as explicit devDependencies (#1454)
* feat(deps): add jsdom and vitest coverage dependencies
* chore(deps): pin @vitest/coverage-v8 to ~4.0.18
Aligns coverage-v8 with the installed vitest 4.0.18 to satisfy its exact
peer-dep constraint; previous ^4.0.17 let pnpm resolve 4.1.6 which peers
on vitest 4.1.6 and produced a lockfile mismatch.
* chore(changeset): add changeset for unlisted devDep declarations
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* refactor(auth): extract OAuthSessionStore from BrowserOAuthClientProvider (#1451)
* refactor(auth): extract OAuthSessionStore from BrowserOAuthClientProvider
Pulls token storage, JWT-expiry-driven refresh (with deduplication),
client-info validation, code-verifier handling, key hashing, and
authorization-state persistence into a new platform-neutral
`OAuthSessionStore` parameterized over a `KVStore`. The browser
provider now holds an `OAuthSessionStore` and delegates the SDK
`OAuthClientProvider` interface methods to it.
Browser-only concerns stay on `BrowserOAuthClientProvider`:
- popup/redirect flow + popup-blocker fallback
- fetch interceptor for OAuth-proxy CORS bypass
- inspector-proxy resource-param rewrite (now `rewriteResourceIfLocalProxy`)
- `clearStorage` / `getLastAttemptedAuthUrl` (kept on the provider until
a Node provider gives the abstraction a real second caller)
No behavior change. Prepares the ground for a future Node/CLI OAuth
provider built on the same session store.
* refactor(auth): simplify OAuthSessionStore — drop pendingCodeVerifier mirror, parallelize KV ops
- Remove `pendingCodeVerifier` in-memory mirror; read through KV store directly
- Parallelize independent KV writes/removes with `Promise.all` in `saveTokens`,
`invalidateCredentials("all")`, `clientInformation` redirect-mismatch path,
and `storeAuthorizationState` — preparing for the upcoming async file store
- Drop redundant `sanitizeUrl` in `redirectUrl` getter (constructor already sanitizes)
- Remove debug `console.log` and write-then-verify read in `storeAuthorizationState`
* chore: format
* chore: format
* refactor(auth): sequence KV writes in OAuthSessionStore
Replace Promise.all blocks with sequential awaits in saveTokens,
clientInformation mismatch invalidation, invalidateCredentials("all"),
and storeAuthorizationState. No behavior change for the browser path
(sync localStorage), but ordering now matters for the upcoming async
file-backed KVStore — saveTokens persists tokens before clearing the
verifier / last_auth_url so a failed write can't strand the auth flow,
and storeAuthorizationState persists the state record before
last_auth_url so a partial failure can't leave an auth URL whose state
has no backing record.
* chore(typescript): version packages (canary)
* feat(cli/auth): Node OAuth provider + agent-ready CLI client (#1452)
* feat(cli/auth): Node OAuth provider + agent-ready CLI client
Adds a real OAuth flow to the `mcp-use client` CLI so it works against
OAuth-protected MCP servers without requiring a browser harness, and
makes every one-shot client subcommand exit cleanly so headless agents
can drive it.
mcp-use:
- New `mcp-use/auth/node` entrypoint exporting `NodeOAuthClientProvider`,
`FileKVStore`, the `KVStore` type, and re-exporting the SDK's `auth`
and `UnauthorizedError`.
- `NodeOAuthClientProvider` implements `OAuthClientProvider`, owns a
loopback callback server (preferred port 33418, walks up to 33427 on
conflict, persisted across runs), and exposes `getAuthorizationCode()`
for the orchestrator pattern in `useMcp.ts`. Adds `hasPendingFlow` so
callers can detect when the SDK transport already triggered the
redirect on a 401 and skip straight to the code exchange.
- `FileKVStore` writes tokens / client info / code verifiers to one file
per key under `~/.mcp-use/oauth/<urlHash>/` with `0o600` perms and
atomic rename on write.
@mcp-use/cli:
- `client connect <url>` auto-runs OAuth on `UnauthorizedError` when no
`--auth` is supplied. New flags: `--no-oauth`, `--auth-timeout`.
`isUnauthorized` also matches the rewrapped 401 the HttpConnector
throws (plain Error with `code = 401`) so the OAuth retry actually
triggers instead of `process.exit(1)`-ing before the browser callback
arrives.
- `client auth status|refresh|logout [session]` for token introspection,
forced refresh, and revocation.
- One-shot subcommands (`tools list/call/describe`, `resources
list/read`, `prompts list/get`, `auth *`) now close their in-memory
sessions and exit at the end so the underlying socket can't keep the
Node event loop alive. Long-running commands (`subscribe`,
`interactive`) are unchanged.
- Follow-up commands on OAuth sessions transparently refresh expiring
JWTs. If the refresh token itself is dead, the CLI prompts to re-auth
on TTY or prints the exact `connect` command on non-TTY.
* chore: fix http disconnect race condition
* chore(server): hint at mcp-use CLI client on startup
Print a one-line dim-gray tip after the existing Listening / Endpoints
lines so devs see how to connect with `mcp-use client connect <url>`
from the CLI client added in this branch.
* fix(cli): exit 1 when `client tools call` returns isError
The CLI printed "Tool execution failed" but still exited 0, so headless
agents couldn't tell a successful tool call apart from a failed one.
Honor `callResult.isError` and exit 1 in both default and --json modes;
the formatted output is still printed first so the failure detail stays
visible.
* feat(cli): borderless aligned-columns table rendering
Replace the box-drawing ASCII table in `mcp-use client {tools,resources,
prompts,sessions} list` with a gh/kubectl-style borderless layout: UPPERCASE
bold headers, two-space gutter, ANSI-stripped width math, ellipsis truncation
for long descriptions, sized to the terminal width (or 100 cols).
Tool rows now also show a MODE column (read-only / write / destructive,
derived from MCP tool annotations) and an ARGS column (required/total).
When stdout is not a TTY (pipes, agents, CI), every list command emits
tab-separated values with no header, no decorative banners, and no ANSI —
matching how the GitHub CLI behaves so the output is parseable by AI
agents and shell pipelines.
* fix(cli): skip auto-opening browser for OAuth in non-TTY contexts
When `mcp-use client connect` (or a session restore) hits an OAuth flow,
the CLI used to launch a browser unconditionally. That's surprising when
an agent or CI script runs the command — the agent can't see the
browser, and the user gets an unexpected window.
`stdout.isTTY` now gates the browser launch: TTY opens it as before;
non-TTY prints the authorization URL to stderr and waits on the loopback
callback. The leading message also flips to "OAuth authentication
required." in non-TTY mode so the log doesn't claim a browser was opened.
* fix(auth): real forceRefresh + HTML-escape OAuth loopback failure page
- `OAuthSessionStore.forceRefresh()` calls the dedup'd refresh path
directly. `NodeOAuthClientProvider.forceRefresh()` now delegates to
it. The previous "blank access_token and re-read" trick never
triggered a refresh because `tokens()` gates that path on a truthy
access_token, so `mcp-use client auth refresh` was a no-op.
- Escape both `error` and `error_description` in the loopback failure
HTML. The previous version stripped `<>&` from the description but
interpolated `error` unsanitized, allowing reflected XSS on the
localhost callback page.
* feat(cli): accept key=value args for `client tools call` and `client prompts get`
Replace the single JSON-string argument with variadic `key=value` positionals.
Values are type-coerced from the tool's input schema (number/integer/boolean/
array/object/nullable). `key:=<json>` (httpie convention) forces JSON parsing
for nested objects/arrays. A leading `--` on a key is stripped so flag-style
habits work. The legacy single-JSON-object form is still accepted when the
sole positional starts with `{`. Same syntax applies to `client prompts get`.
Errors print usage examples and the target tool's schema so agents can self-
correct.
* fix(cli): surface tool call error details in `client tools call`
Label error content explicitly, color text content red, render
`structuredContent` for both success and failure, and print a fallback
when the server returned neither. Connection-level failures also print
any attached `data` payload.
* chore(cli): satisfy lint+prettier on format.ts ANSI regex
* chore(typescript): version packages (canary)
* feat(cli): add mcp-use screenshot command for visual feedback loop (#1432)
* feat(cli): add mcp-use screenshot command for visual feedback loop
Implements `mcp-use screenshot` — a CLI command that renders an MCP Apps
view headlessly via Playwright and saves a PNG. Designed for AI agent
visual feedback loops where the assistant calls a tool, screenshots the
result, and self-corrects without human round-trips (MCP-1566).
- New `packages/cli/src/commands/screenshot.ts` with --tool, --args,
--width, --height, --theme, --output, --header, and --server flags
- Auto-spawns a dev server if none is running; probes /inspector/health
first and tears the child process down on exit
- Default output path: `./<view>-<hash>.png` (6-char stable hash of
props + theme so re-runs at the same inputs overwrite the same file)
- New `/inspector/preview/:view` client-side route in the inspector SPA
- New `<ViewPreview>` component wrapping `<MCPAppsRenderer>` in
fullscreen+chromeless mode; sets `data-view-ready` on body once the
AppBridge handshake completes and fonts are ready
- `MCPAppsRenderer` gains `onReady` and `chromeless` optional props;
`chromeless` suppresses the fullscreen navbar and top padding
- Playwright added as optional peer dep on `@mcp-use/cli`; missing
Playwright prints an install hint and exits non-zero
- Unit tests covering arg parsing, hash stability, error paths
- Example PNGs from weather-display view as end-to-end verification
* style: apply prettier formatting to screenshot command files
* fix(cli): use timestamp instead of hash in default screenshot filename
Replaces the sha256-based hash suffix with a YYYYMMDDTHHmmss timestamp so
saved screenshots are sorted chronologically and self-descriptive.
* feat(cli, inspector): drop Playwright, use system Chrome via CDP
Replaces the optional `playwright` peer dep + `--install` flow on the
`mcp-use screenshot` command with a hand-rolled minimal Chrome DevTools
Protocol client that drives the user's existing system Chrome / Chromium
/ Edge / Brave install. No new dependencies — uses the `ws` package the
CLI already shipped. CLI dist is unchanged at 1.7 MB; users no longer
need to download a ~170 MB Chromium binary or run a separate install
step before screenshotting.
CLI changes:
- New `src/utils/chrome-path.ts`: detect Chrome-family binaries on
macOS / Linux / Windows. Honors `MCP_USE_CHROME_PATH`,
`PUPPETEER_EXECUTABLE_PATH`, and `CHROME_PATH` overrides.
- New `src/utils/cdp-screenshot.ts`: minimal CDP client (~200 LOC).
Spawns Chrome with `--headless=new --remote-debugging-port=0`, parses
the WS URL from stderr, opens a target via `Target.createTarget` +
`Target.attachToTarget {flatten:true}`, applies viewport + theme via
`Emulation.setDeviceMetricsOverride` / `setEmulatedMedia`, polls
`Runtime.evaluate` for the readiness selector, captures via
`Page.captureScreenshot`. Cleans up child + temp `--user-data-dir`.
- Drop `--install` flag, `loadPlaywright`, `runInstall`, and the
`playwright` peer + dev dependency from `package.json`.
- Split `--server` into `--inspector` (SPA host) and `--mcp` (RPC
target) so a remote MCP can be rendered inside a local inspector.
- Add `--delay <ms>` so chart libraries that animate past the readiness
signal can settle before capture, and emulate
`prefers-reduced-motion: reduce` to suppress animations where
possible.
- New `tests/chrome-path.test.ts` covers env-var precedence, platform
fallthrough, and the throwing wrapper.
Inspector changes:
- `ViewPreview.tsx` reads a `?headers=<base64 JSON>` query param and
forwards it as `headers` to `addServer`, so the preview's MCP
connection authenticates against a remote server. Temporary plumb
until the auth-aware MCP client lands in the CLI.
Verified end-to-end against `mcp.manufact.com/mcp`'s
`get_server_client_breakdown` view rendered through a local inspector.
* feat(cli, inspector): screenshot uses CLI session, inject bundle via CDP
`mcp-use screenshot` now reuses the saved OAuth session from `mcp-use
client connect` instead of requiring `--auth <token>` and `--mcp <url>`
on every invocation. The CLI calls the tool and reads the widget
resource itself, then injects the result into Chrome via CDP
`Page.addScriptToEvaluateOnNewDocument` as `globalThis.__mcpUsePreviewBundle`
before navigating to the inspector preview route. The OAuth token never
enters the browser and there's only one MCP connection per screenshot
instead of two.
- New `cli/src/utils/session.ts` extracts `getOrRestoreSession`,
`cleanupAndExit`, `activeSessions`, and `getCliClientInfo` from
`client.ts` so screenshot can reuse them.
- `screenshot.ts` drops `--auth` and `--header`; adds `--session <name>`
(defaults to active session). `--mcp <url>` remains as an
unauthenticated escape hatch.
- `cdp-screenshot.ts` accepts an optional `bundle` and injects it
before any document scripts run.
- `ViewPreview.tsx` splits into a bundle-mode branch (no
`useMcpClient`, no live MCP connection) and the existing live branch
for interactive debugging. The shared body-styling and readiness
effects are factored into `usePreviewViewport` and
`usePreviewReadinessSignal`.
* feat(cli): auto-capture widget screenshot in `client tools call`
When `mcp-use client tools call <name>` invokes a tool that declares a UI
resource (`_meta.ui.resourceUri` or `openai/outputTemplate`), the CLI now
captures a widget screenshot using the same pipeline as `mcp-use screenshot`.
The tool result is reused (no double tool-call) and the dev server is
auto-spawned if needed.
`--no-screenshot` opts out, `--screenshot-output <path>` overrides the
default `./<view>-<timestamp>.png` path. Screenshot failures warn to stderr
but don't fail the tool call. The success line is also on stderr so
`--json` stdout stays a clean CallToolResult.
* chore: remove SPEC.md from PR
* chore: remove example screenshots from PR
* refactor(cli): always spawn fresh inspector for screenshot, strict health probe
The screenshot path now always spawns @mcp-use/inspector standalone on a free
port instead of probing localhost:3000 / falling back to `mcp-use dev`. Two
fixes in one:
- A Vite/SPA dev server returns 200+HTML for any path, so the prior probe
(res.ok only) misidentified unrelated dev servers as a valid inspector.
probeServer now requires JSON `{ status: "ok" }` on /inspector/health.
- Spawning the inspector directly removes the need to be in a project with
an MCP server entry, so `screenshot` works from any cwd against any
remote MCP. `--inspector <url>` still works for pointing at an existing
instance.
Drops the cliBin plumbing now that screenshot no longer shells out to
`mcp-use dev`.
* chore: format
* fix(cli): use posix path joining in findOnPath for cross-platform tests
`findOnPath` is only called from the Linux branch of `findChrome`, but
relied on host-OS `path.join`. On Windows CI, tests that mock
`process.platform = "linux"` saw `path.join("/usr/bin", "google-chrome")`
return `\usr\bin\google-chrome`, breaking the PATH-walk assertion.
Use `path.posix.join` and a `:` separator unconditionally so the function
behaves the same regardless of the host OS.
* chore(typescript): version packages (canary)
* feat(cli): support remote CDP browsers via --cdp-url in screenshot (#1477)
Adds a `--cdp-url <ws|wss>` flag to `mcp-use screenshot` so the
screenshot pipeline can drive a hosted Chromium (e.g. Notte) instead of
spawning a local Chrome. Useful for running the pipeline in sandboxed
environments where a local browser install isn't available.
When the flag is set, `captureScreenshot` skips Chrome spawn / temp
user-data-dir / stderr parsing and connects the existing CDP client
directly to the supplied WebSocket. To pick up a flat-mode page session
it uses `Target.setAutoAttach` and listens for the resulting
`Target.attachedToTarget` event — providers like Notte forbid explicit
`Target.attachToTarget`. The local-Chrome path is unchanged when
`--cdp-url` is omitted.
The hosted preview already supported via `--inspector <url>` pairs
naturally: point the remote browser at a publicly reachable inspector
deployment and the bundle-mode preview renders without any local
infrastructure.
* Fix/duplicate exports 1449 (#1453)
* chore(typescript): resolve duplicate exports flagged by Knip (#1449)
- Removed redundant JsonRpcLoggerView default export\n- Removed Tel alias in favor of canonical Telemetry class\n- Unified re-exports in mcp-use to a single canonical path\n- Added changeset for breaking change in mcp-use
* chore: restore Tel alias with @alias directive and downgrade changeset to patch
# Conflicts:
# libraries/typescript/.changeset/resolve-duplicate-exports.md
# libraries/typescript/packages/mcp-use/src/telemetry/telemetry-browser.ts
# libraries/typescript/packages/mcp-use/src/telemetry/telemetry-node.ts
* feat(telemetry): re-export Tel alias from public entrypoints
* fix(telemetry): add missing Tel export to telemetry entry point
* feat(telemetry): explicitly export Tel from browser and react entrypoints
* feat(telemetry): use Tel alias consistently across the codebase
* chore(telemetry): correct changeset description and revert nit comment churn
- Rewrite changeset to match the PR (the re-exports from mcp-use/react
and mcp-use/browser are not removed; only Tel alias is suppressed via
@alias and the canonical source path is unified).
- Align telemetry-browser.ts class docstring example to use Tel for
consistency with telemetry-node.ts.
- Restore the more informative comments on browser.ts, react/index.ts,
and tel-fetch.ts.
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* feat(cli): add --header/-H to mcp-use screenshot for authenticated --mcp servers (#1491)
Lets `mcp-use screenshot --mcp <url>` reach an authenticated MCP server
without running `mcp-use client connect` first. Repeatable `-H "Key: Value"`
flags (curl-style) are parsed into the ad-hoc client's headers; only
honored with `--mcp <url>` so misuse alongside `--session` errors clearly.
* chore(typescript): version packages (canary)
* fix(inspector): implement dark-mode aware scrollbars (#1484)
* fix(inspector): implement dark-mode aware scrollbars #1479
* Improve dark mode scrollbar styling and hover visibility
* Add changeset for inspector scrollbar improvements
* chore: rerun ci
* chore(typescript): version packages (canary)
* feat(cli): drop "active session" model — every client command takes a name (#1494)
* fix(cli): stop printing tool results twice when servers return structuredContent
Per the MCP spec, a tool that returns `structuredContent` SHOULD also serialize
the same JSON into a `TextContent` block for backwards compatibility. The
client was rendering both, so every call to a structured-output tool printed
the JSON payload twice. Treat `structuredContent` as the canonical form: when
it's present, the content block is suppressed and only the structured JSON is
shown.
* feat(cli)!: drop the "active session" model — every client command takes a name
The CLI used to track an implicit active client and let you switch between
saved clients with `client sessions switch`. Per-command flags like
`--session` and `--name` were sprinkled around to override it. The active
state was hidden, easy to get wrong, and forced every subcommand to handle
"no session" as a real case.
It's gone. The client name is now a required positional, and every
per-client command lives under `mcp-use client <name> <scope> <action>`.
BREAKING CHANGES:
- `client connect <url> --name <name>` → `client connect <name> <url>`
- `--session <name>` removed from every per-client subcommand
- `client sessions list` → `client list`
- `client sessions switch` removed (no active client to switch to)
- `client disconnect --all` removed; disconnect each client by name
- `mcp-use screenshot` no longer falls back to the active session;
pass `--session <name>` or `--mcp <url>` explicitly
Existing `~/.mcp-use/cli-sessions.json` files keep working; the unused
`activeSession` field is silently ignored on load. Docs and integration
tests are updated for the new shape, and the CLI gives clearer feedback
for the shape mistakes the new syntax invites.
* fix(cli): tests no longer touch the developer's real ~/.mcp-use directory
Two leaks are closed:
- `session-storage.test.ts` computed its target path from `os.homedir()` and
`rmSync`'d it in `beforeEach`/`afterEach`, so running `pnpm test` during
local development deleted any saved clients on disk. The tests now mock
`node:os.homedir` to a per-process temp directory.
- `cli-integration.test.ts` spawned the real CLI as a subprocess and so read
the developer's real `cli-sessions.json` when running `client list`.
`runCLI` now sets HOME (and USERPROFILE) to an isolated temp dir for
every spawn.
* fix(cli): friendlier `client <name>` help and rename saved-client copy to "server"
Two related polish fixes for the CLI:
- `mcp-use client <name>` (no subcommand, or with `--help`) used to fall
through to commander's per-server help even when the name wasn't a
saved server, leaking subcommand surface instead of telling the user
how to make the name resolve. It now prints `Server '<name>' not
found.` plus a `client connect <name> <url>` hint and exits non-zero.
Existing servers still get the full help.
- User-facing copy throughout the `client` subcommand tree (help text,
table headers, errors, REPL prompts, docs) referred to saved entries
as "clients" — but the CLI itself is the client, and the things it
connects to are servers. Renamed to "server" / "saved server"
consistently. The `mcp-use client` command name is unchanged, so no
scripts break.
* fix(cli): tighten client routing and trim review nits from prior commits
- index.ts: pin per-client routing to argv[2] instead of indexOf("client", 2),
which would otherwise match the literal "client" appearing later in argv
as someone's argument value and mis-route to a tailored error.
- index.ts: route the two routing-layer error prints through formatError for
style parity with the rest of the codebase.
- client-auth.ts: destructure { name, url } from `target` after the guard so
the `target!` non-null assertions disappear.
- session-storage.ts: drop the existsSync guard around mkdir (recursive mkdir
is already a no-op when the dir exists) and memoize the call.
- cli-integration.test.ts: prettier reflow that was missed in a prior commit.
* feat(cli): add `mcp-use client remove <name>` to drop a saved server
Saved servers could be added (`client connect`) and listed (`client list`),
but the only way to delete one was to hand-edit
`~/.mcp-use/cli-sessions.json`. `client remove <name>` now does this: it
errors if no server by that name exists, closes any in-process connection,
deletes the entry, and — for OAuth-authenticated servers — also revokes
the stored tokens for that URL. If another saved server still points at
the same URL the tokens are kept (they're URL-keyed, so wiping them would
break the sibling); the CLI prints which sibling is keeping them alive.
* fix(cli): stop auto-opening the browser during OAuth flows
When `mcp-use client` commands hit a 401 they would launch the user's
browser via the `open` package on TTYs, and only print the URL when stdout
wasn't a TTY. That was surprising in two directions: scripts that did
happen to inherit a TTY got pop-up windows, and the heuristic missed
plenty of agentic/CI environments that *do* keep a TTY attached. The CLI
now always prints the authorization URL and waits on the loopback
callback — the user opens the link themselves whenever it's convenient.
Other CLI surfaces that intentionally open a browser (`deploy --open`,
the `auth login` flow) are unchanged.
* fix(cli): address review feedback for client-name refactor
- formatToolCall: when structuredContent is present, suppress only the
duplicate TextContent blocks. Image/resource markers are kept since they
carry information the structured payload doesn't (and the terminal can
only render them as placeholders anyway).
- index.ts: attach a .catch() to the per-server routing IIFE so a rejection
from parseAsync surfaces a clean error message + exit 1 instead of an
UnhandledPromiseRejection trace.
- connectCommand: reject saved-server names that collide with per-server
scope tokens (tools, resources, prompts, auth, disconnect, interactive),
which would otherwise be silently unreachable through the new routing.
- session.ts: rename a stray "Failed to restore client" log to "server" to
match the rest of the renamed copy.
* chore(typescript): version packages (canary)
* feat(cli): move screenshot under client and require explicit session name (#1497)
* feat(cli): move screenshot under client and require explicit session name
The standalone `mcp-use screenshot` command is folded into `mcp-use client`:
- Saved-server form: `mcp-use client <name> screenshot --tool <tool>` reuses
the saved server's auth from `mcp-use client connect`. The `--session` flag
is removed — the server name is the positional, matching every other
per-client command.
- Ad-hoc form: `mcp-use client screenshot --mcp <url> --tool <tool>` keeps
`-H/--header` for one-off authenticated captures (programmatic / CI use
that doesn't want to save a server first).
`screenshot` becomes a reserved subcommand name under `client`.
* refactor(cli): lift session name out of ScreenshotOptions into a context arg
Replace the internal `session?` field on `ScreenshotOptions` (set via spread
into Commander's options bag) with a separate `ScreenshotContext` parameter
carrying `sessionName` and `usagePrefix`. Drop the default-value parameter
on `screenshotCommand` and strip redundant WHAT-comments in client.ts.
* chore(typescript): version packages (canary)
* feat(cli): add --device-scale-factor flag for high-DPI screenshots (#1498)
Exposes the previously-hardcoded CDP deviceScaleFactor on both the
dedicated `mcp-use screenshot` command (`--device-scale-factor <n>`)
and the auto-screenshot in `mcp-use client <name> tools call`
(`--screenshot-device-scale-factor <n>`). Defaults to 1, accepts
fractional values, bounded to (0, 4]. Closes MCP-2167.
* chore(typescript): version packages (canary)
* fix(cli): error when client screenshot omits required tool args (#1499)
* fix(cli): error when client screenshot omits required tool args
`mcp-use client screenshot --tool <tool>` silently produced a blank
PNG and exited 0 when the tool declared required arguments but none
were passed — the empty-args call reached the server, the iframe
rendered nothing, the readiness selector still flipped, and capture
proceeded. Mirror the `client tools call` validation: error with
"This tool requires arguments." plus the tool schema, exit 1,
skip the inspector/browser spawn.
* fix(cli): use context.usagePrefix in screenshot args error path
Typo introduced in
|
||
|
pietrozullo
|
7e8919bed3 | chore(docs): integration | ||
|
Enrico Toniato
|
ca1b34fa66 |
Canary (#1467)
* fix(create-mcp-use-app): add tool annotations and outputSchema for Ch… (#1466)
* fix(create-mcp-use-app): add tool annotations and outputSchema for ChatGPT
* fix(mcp-use): expose tool outputSchema in tools/list
* chore: format mcp-ui server example
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* fix(inspector): pin iframe width in inline chat mode (#1459) (#1462)
* fix(inspector): pin iframe width in inline mode, ignore widget-reported width
* fix(inspector): drop width from inline transition string; add changeset
* fix(inspector): drop trailing comment from self-documenting condition
* fix(inspector): drop unused width param from onsizechange destructure
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* docs(oauth examples): fix broken links in Clerk and WorkOS READMEs (#1465)
* docs(skills): add Clerk OAuth ref and link standalone provider templates (#1463)
Adds a Clerk authentication reference to the mcp-apps-builder skill (and
its mcp-builder / chatgpt-app-builder mirrors), and links the standalone
mcp-oauth-{provider}-template starter repos from each provider guide.
Closes MCP-2065
* docs(oauth/clerk): point Clerk Dashboard links to /sign-in (200 instead of 404)
* docs(oauth/workos): replace 404 quickstart URL with /docs/authkit (200)
---------
Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com>
* Revert "docs(oauth examples): fix broken links in Clerk and WorkOS READMEs (#…" (#1469)
This reverts commit
|
||
|
Andrew Khadder
|
78cfc8a74d |
Canary (#1434)
* feat(mcp-use): add Clerk OAuth provider for TypeScript (#1429) * feat(mcp-use): add Clerk OAuth provider * docs: add Clerk OAuth provider documentation page * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(cli): propagate --env/--env-file to server on deploy redeploys (#1433) The deploy command only forwarded `--env`/`--env-file` values when creating a brand-new server (where they ride on the createServer body). On redeploys to an existing linked server, env vars were parsed and shown in the preview, then silently dropped before createDeployment. Now upserts each entry against /api/v1/servers/{id}/env-variables (PATCH for existing keys, POST for new ones) before triggering the deployment. Closes MCP-1995 * chore(typescript): version packages (canary) * chore(typescript): adopt Knip to find and remove unused code (#1359) * chore(typescript): adopt knip at workspace root Add Knip as a dev dependency at the TypeScript workspace root with a root-level knip.json covering all packages. Consolidates the existing per-package Knip setup in @mcp-use/inspector into the shared config and delegates its check-deps script to the root install. Adds `pnpm knip`, `pnpm knip:deps`, and `pnpm knip:production` scripts and documents them in the TypeScript README. Baseline configuration suppresses known false positives (build-generated version.js, Tailwind/ Scarf deps, nested example and template workspaces, test helpers and servers). Actual dead-code removal is deferred to follow-up PRs. Refs MCP-1707 * ci: add warning-only Knip step Runs `pnpm knip --no-exit-code --no-progress` on TypeScript-affecting PRs/pushes and writes the report to the GitHub Actions step summary. Stays non-blocking by design — tighten to a failing check once the baseline cleanup PRs land. * chore(inspector): drop redundant check-deps script Root-level pnpm knip:deps already covers all workspaces, so the inspector-only wrapper just duplicated the same delegation. Devs needing scoped output can use pnpm knip --workspace packages/inspector. * chore(typescript): drop changeset for dev-only knip adoption * feat(inspector): support custom base URL for OpenAI-compatible providers (#1437) * feat(inspector): support custom base URL for OpenAI-compatible providers * feat(inspector): add support for OpenAI-compatible providers with configurable base URL Co-authored-by: Copilot <copilot@github.com> * refactor(inspector): simplify openai-compatible plumbing - Widen ProviderName union to include "openai-compatible" and drop the resolveProvider helper; the providers dispatcher fall-throughs from "openai-compatible" to the openai impl, so callers can pass the UI provider name straight through. - openai.ts: extract buildEndpoint/buildHeaders, strip trailing slashes on baseUrl, and skip Authorization header when apiKey is empty. - ConfigurationDialog: defensive parsing of /models response, surface CORS hint on fetch failure, mention CORS requirement in helper text, move "OpenAI Compatible" to end of dropdown. - useConfig: persist openai-compatible base URL per-provider in localStorage (mirrors api keys), restore on switch + cross-tab sync. - Drop openai-compatible logo references in ChatHeader / ChatLandingForm / ConfigurationDialog dropdown. * style(inspector): apply prettier formatting * chore(changeset): bump @mcp-use/inspector to minor for openai-compatible provider --------- Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat: integrate OpenRouter as a first-class LLM provider (fixes #1402) (#1403) * feat(inspector): integrate OpenRouter as a first-class LLM provider Adds OpenRouter to the inspector chat configuration. Selecting OpenRouter routes through the existing OpenAI provider with an override base URL and the required HTTP-Referer / X-Title headers, so users get multi-model access (OpenAI, Anthropic, Google, etc.) from a single API key without duplicating provider plumbing. Co-authored-by: Andrew Khadder <andrew@mcp-use.com> Closes #1402 * fix(inspector): use inspector.mcp-use.com as OpenRouter HTTP-Referer * feat(inspector): swap OpenRouter favicon.ico for inline gray SVG Drops the runtime fetch to openrouter.ai/favicon.ico in favor of an inline data-URL'd SVG with a neutral #94A3B8 fill. Follow-up will lift this onto the provider CDN alongside the other provider marks. * fix(inspector): stop OpenRouter SVG curves from being implicitly filled The two arrow-body paths are open curves; with the parent svg's fill set, the browser implicitly closed them and filled the resulting region, producing visual artifacts at small sizes. Mark those two paths fill="none" so only their strokes render. * fix(inspector): use OpenRouter SVG in ChatLandingForm chip The landing-form provider chip was hardcoded to the CDN png URL, which 404s for the openrouter provider and rendered a broken-image blob clipped by rounded-full styling. Match the ChatHeader behavior and fall back to OPENROUTER_ICON_URL. * fix(inspector): set OpenRouter X-Title to mcp-use Inspector * refactor(inspector): drop OpenRouter baseUrl path special-case Set OpenRouter's baseUrl to the API root (/api/v1) and let buildEndpoint append /chat/completions like the rest of the OpenAI-compatible flow, removing the includes("/chat/completions") short-circuit that only existed to defuse the path baked into the override. * style(inspector): apply prettier formatting * chore(inspector): drop redundant baseUrl jsdoc comment --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(auth): pre-registered OAuth client credentials and scopes in Inspector (#1400) * feat(auth): pre-registered OAuth client credentials and scopes Wires clientId, clientSecret, and scope end-to-end from the Inspector's Authentication dialog through useMcp into BrowserOAuthClientProvider's staticClientInfo. When clientId is set the SDK skips Dynamic Client Registration (required for proxy-mode servers like Slack/WorkOS that strip registration_endpoint). When clientSecret is also set, the SDK auto-switches token-endpoint auth from "none" to client_secret_basic / client_secret_post, supporting providers that don't support PKCE. * refactor(inspector): extract OAuthStaticConfig type and builder helper Replaces six inline copies of `{ clientId?; clientSecret?; scope? }` and two copy-pasted trim+spread builders with a shared `OAuthStaticConfig` type and `buildOAuthStaticConfig()` helper in connectionUpdates.ts. Also widens ServerConnectionModal's connection/onConnect types so the `as { oauth?: ... }` structural cast can go away (the modal was passing oauth in the spread without declaring it on the callback type). * docs: document pre-registered OAuth client credentials Updates client authentication, useMcp, and inspector connection-settings docs to cover the new oauth.{clientId, clientSecret, scope} option and the proxy-mode/confidential-client cases it unlocks. Replaces the inaccurate snake_case OAuth params table with the actual camelCase API shape. * chore(typescript): version packages (canary) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry (#1443) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry The env var previously disabled Node-side telemetry and the inspector's server-side proxy, but the in-browser posthog-js init triggered by useMcp still fired POSTs to https://eu.i.posthog.com that ad/tracker blockers flag. The inspector server now mirrors the env var into a runtime flag (window.__MCP_USE_ANONYMIZED_TELEMETRY__) and localStorage before the client bundle runs; both mcp-use's browser telemetry and the inspector's own client telemetry honor that flag, so a single env var disables every telemetry path. * fix(inspector): drop sticky localStorage write; honor opt-out in Vite dev The previous revision mirrored MCP_USE_ANONYMIZED_TELEMETRY=false into localStorage, which persisted across sessions even after the env var was unset. Switch to a per-page window flag only — unsetting the env var fully restores defaults on the next page load. Also extend the opt-out to pure-Vite dev mode via a transformIndexHtml plugin, so the env var works whether the inspector is served by the backend or by Vite directly. * chore(typescript): version packages (canary) * fix(inspector): drop trailing-slash regex flagged by CodeQL The /\/+$/ regex on user-supplied base URLs triggered js/polynomial-redos. Most servers normalize a double slash in `${baseUrl}/path` fine, so just drop the stripping rather than working around the alert. * docs(changelog): add v1.27.0 / inspector v5.0.0 release notes --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Siddhant Rai <47355538+siiddhantt@users.noreply.github.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> |
||
|
Vats Mishra
|
dbbd7bcf4a | docs: fixed logo and link mismatch in home page (#1444) | ||
|
Luigi Pederzani
|
6b2db4a2b0 |
docs: reorganize docs and examples around MCP Servers + MCP Apps (#1363)
Reshape docs, examples, and indexes to mirror the README narrative:
MCP Servers + MCP Apps are primary; MCP Agent and MCP Client are
present but secondary. Remove duplicated concepts, deprecated pages,
and stale examples; add redirects for removed paths.
Docs
- Rewrite home/index.mdx: tagline + MCP Server / MCP App split cards,
quickstart tabs, MCP Apps widget snippet, Templates teaser, Inspector,
Deploy, Agent+Client in a collapsed accordion.
- New home/templates.mdx gallery (Chart Builder, Diagram Builder, Slide
Deck, Maps Explorer, Widget Gallery, and more) with demo URLs and
deploy buttons, mirroring the README.
- Simplify python/typescript welcome.mdx: drop duplicated "What is MCP?"
/ "Why mcp-use?" (single pointer to home/mcp101); server-first Next
Steps; fix broken Python links.
- docs.json: Home product reshaped (Welcome, MCP Apps, Templates, Dev
Tools + CLI reference, Concepts, Libraries, Misc). Python
Integrations collapsed into MCP Agents → LLM Adapters.
fastapi_mount added to Python MCP Server Overview. TS MCP Apps adds
creating-mcp-apps-server; OAuth Providers gets keycloak + custom.
Empty API Reference, misrouted Community, and Blog tabs removed from
TS SDK.
- Delete: ui-widgets.mdx, mcp-ui-resources.mdx,
comparison-with-other-implementations.mdx, api-reference.mdx (empty),
typescript/development/security.mdx, python/blog/middleware.mdx,
python/server/auth/index.mdx.
- Redirects: old paths → current equivalents.
- CLI reference: new "What's New" card group (HMR, --tunnel, skills
add, generate-types); cross-link from `start` to Tunneling guide.
Examples
- Rewrite libraries/typescript/.../examples/server/ui/mcp-ui/ as a
programmatic MCP Apps widget gallery (welcome-card, quick-poll,
task-card) using server.uiResource({ type: "mcpApps", htmlTemplate }).
Removes deprecated UIResource / rawHtml / remoteDom patterns.
- Delete empty server/ui/apps-sdk/.
- Fix stale docs URL in server/ui/mcp-apps/apps-sdk/index.ts.
- Update examples/README.md and TS examples README: add Templates
pointer (github.com/mcp-use/mcp-use#templates + docs/home/templates),
list previously-missing examples (mcp-apps, files, model-context,
middleware, session-management, better-auth, Python orphans), flag
apps-sdk as legacy.
|
||
|
Enrico Toniato
|
bdf9182fb2 |
fix(widgets): pre-warm Vite entries before registration to prevent fi… (#1426)
* fix(widgets): pre-warm Vite entries before registration to prevent first-render 504s (#1425) * fix(widgets): pre-warm Vite entries before registration to prevent first-render 504s When a widget is registered (initial boot, watcher add-file, or watcher add-folder), `mount-widgets-dev` now calls `viteServer.warmupRequest()` followed by `viteServer.waitForRequestsIdle()` for the widget's `entry.tsx` before exposing it to the inspector. This forces Vite's `depsOptimizer` to finish pre-bundling and stabilise its dependency hash before the browser starts requesting `/.vite/deps/*` modules. Previously the inspector iframe could fetch optimized dependencies (e.g. `mcp-use_react.js`) with a stale Vite hash while `depsOptimizer` was still re-bundling, surfacing as `504 Gateway Timeout` errors and a blank widget on first interaction in Vibe-created sandboxes. Each widget is warmed at most once per dev-server lifetime; failures fall back to a warning so registration never blocks. Made-with: Cursor * refactor(widgets): update warmWidgetEntry to use a current method for consistency Refactored the warmWidgetEntry variable to be an object with a current method, ensuring consistent usage across widget registration processes. This change updates all calls to warmWidgetEntry to use the new method, improving code clarity and maintainability. No functional changes were introduced; this refactor aims to streamline the widget warm-up process during development. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): update command-palette e2e test for new Settings dropdown trigger (#1428) * fix(inspector): update command-palette e2e test for new Settings dropdown trigger The command palette trigger button moved from a standalone header button into a Settings gear icon dropdown menu. The e2e test now opens the Settings dropdown first before clicking the trigger, and uses exact:true to disambiguate from the Edit connection settings button. Closes #1730 * chore: add changeset for command-palette e2e fix * Delete libraries/typescript/.changeset/fix-inspector-command-palette-e2e-test.md Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * feat(server): add MCP_DEBUG_LEVEL with info/debug/trace tiers (#1430) * feat(server): add MCP_DEBUG_LEVEL with info/debug/trace tiers (MCP-1569) Replaces the all-or-nothing DEBUG=1 flag with three explicit verbosity levels for HTTP request logs: - info (default): one compact, color-coded line per request, with session and client info inlined ([initialize: name/version] → session=<short>), tool name shown for tools/call, and OK/ERROR outcome with duration. - debug: same plus inline args=<json> for tools/call. - trace: same plus the legacy full request/response header and body dump (DEBUG=1 still works and maps to trace). Lifecycle Session initialized/closed lines are suppressed at info since the per-request line already conveys that. Errors are extracted from the response body (JSON-RPC error.message or tool result.isError text), handling both application/json and text/event-stream payloads. * docs(server): drop legacy DEBUG=1 reference from logging guide The MCP_DEBUG_LEVEL doc no longer surfaces the legacy DEBUG=1 flag. Back-compat handling remains in code, but the docs steer users to MCP_DEBUG_LEVEL exclusively. * feat(server): show resource URI and prompt name in request logs `resources/read` now logs `[resources/read: <uri>]` and `prompts/get` logs `[prompts/get: <name>]`, matching the existing `tools/call: <name>` treatment so the resource or prompt being accessed is visible at info level. * docs(server): replace DEBUG with MCP_DEBUG_LEVEL in env var table * style(server): apply prettier formatting to logging tests * chore(typescript): version packages (canary) * chore(inspector, typescript): update changelogs for v3.0.2 and v1.25.2 releases - Added changelog entry for inspector v3.0.2, detailing e2e alignment for the Settings dropdown and updates to mcp-use. - Updated typescript changelog for v1.25.2, including new MCP_DEBUG_LEVEL logging tiers, widget dev server improvements, and command palette e2e test adjustments. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> |
||
|
Enrico Toniato
|
806dbcaf50 |
Canary (#1401)
* fix(inspector): OAuth flow no longer leaves two tabs open (#1384) (#1391) * fix(inspector): OAuth flow no longer leaves two tabs open (#1384) Previously, the inspector opened the OAuth authorization page in a new tab (`target="_blank"` on the Authenticate anchor). After the auth server redirect to the callback URL, `Cross-Origin-Opener-Policy` typically stripped `window.opener`, so the callback took the `returnUrl` fallback branch and navigated the new tab back to the inspector — leaving the user with two inspector tabs. Changes: - Drop `target="_blank"` / `rel="noopener noreferrer"` on the Authenticate anchor so the click performs a same-tab navigation to the stored auth URL. - Set `useRedirectFlow: true` + `preventAutoAuth: true` on every server added from the inspector UI, so the stored OAuth state records `flowType: "redirect"` and the callback routes the current tab back to `returnUrl` instead of trying to close an already-navigated popup. - Propagate the same flags through every connection entry point (`handleAddConnection`, `Layout` adapter, and the `InspectorDashboard` adapter used by `handleUpdateConnection` URL edits and `useAutoConnect`) so the single-tab behavior holds across manual connect, URL edits, and shared-config auto-connect. The library primitives (`redirectToAuthorization`, `onMcpAuthorization`, `flowType`) already worked — this PR only wires the inspector to use them. Closes #1384 * chore: remove issue comments --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore: enter canary prerelease mode * docs(inspector): document --no-open CLI flag (#1397) * fix(inspector): hide free-tier upgrade UI when host app embeds ChatTab (#1399) ChatTab was deriving the Manufact free-tier "Model & usage" dialog from the mere presence of `managedLlmConfig`. The cloud dashboard embeds ChatTab with `managedLlmConfig` + `hideModelBadge=true`, but the badge and ConfigurationDialog treated the derived `freeTierInfo` as an override that forced the UI back on. Free-tier upgrade UI is now opt-in via a new `enableFreeTierUpgrade` prop on ChatTab (default false), plumbed through `EmbeddedConfig.chatEnableFreeTierUpgrade`. The hosted inspector auto-seeds it to true; host apps embedding ChatTab directly leave it off and their hide-* props are respected. * chore(typescript): version packages (canary) * fix(cli): keep mcp-use build non-fatal under bun runtime (#1382) * fix(cli): keep mcp-use build non-fatal under bun runtime `mcp-use build` was crashing during the tool-registry type-generation step on `oven/bun:alpine`. The step uses `tsx/esm/api`'s `tsImport`, which relies on Node's custom loader hooks that bun doesn't implement, so the exception killed the whole build. - Detect the bun runtime up front in `generateToolRegistryTypesForServer` and skip the `tsx/esm/api` path with a clear warning. - Wrap the build command's call in try/catch so any other import-time error is surfaced as a non-blocking warning rather than `exit 1`. - Invoke `tsc --noEmit` via `process.execPath` instead of hardcoding `node`, and drop `--max-old-space-size=4096` under bun (unsupported flag). `oven/bun:alpine` ships no `node` binary; bun runs tsc fine. Closes #1327 * fix(cli): distinguish skipped tool registry gen from errored Return "ok" | "failed" | "skipped" from generateToolRegistryTypesForServer so the bun-skip path no longer prints a misleading "had errors" warning after the "Skipping under bun runtime" notice. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): stop MCP App widget from overlaying chat header (#1407) The sandboxed iframe wrappers in MCPAppsRenderer (relative z-20) and OpenAIComponentRenderer (relative z-10) created stacking contexts that painted above the chat header's absolute z-10, making the header unreachable when scrolling. Drop the explicit z-index classes so widgets stack under the header; spinner/skeleton overlays still work via DOM order. Closes MCP-1741 * chore(typescript): version packages (canary) * fix(inspector): improve handling of client-side and managed LLM configurations in ChatTab (#1418) Updated logic to determine `effectiveClientSide` and `hideModelBadge` based on host embed configurations. Introduced `hostUsesServerManagedStream` to ensure correct behavior when using managed LLM settings, preventing fallback to client-side streaming in hosted environments. Adjusted `hideModelBadge` and `hideConfigButton` properties to respect these configurations, enhancing the user experience in embedded scenarios. * chore(typescript): version packages (canary) * fix(cli): bundle server entries so extensionless imports work under Node ESM (#1357) * fix(cli): bundle server entries with esbuild to resolve extensionless imports Scaffolded apps run under plain Node ESM, which rejects extensionless relative imports with ERR_MODULE_NOT_FOUND. Flip `transpileWithEsbuild` to `bundle: true` + `packages: "external"`: relatives get inlined at build time while third-party packages (mcp-use, react, zod, etc.) stay as external imports resolved from node_modules at runtime. Users can keep writing idiomatic TypeScript imports without .js suffixes. * test(cli): regression test for MCP-1733 build import resolution Asserts that `mcp-use build` produces output where bare package imports stay external and relative extensionless imports are inlined. Uses a non-matching entry name (main.ts) to skip the tool-registry type gen step so the test does not depend on mcp-use being installed in the fixture. * chore(typescript): version packages (canary) * fix(auth): redirect OAuth errors back to inspector instead of showing raw error page (#1381) * fix(auth): redirect OAuth errors back to inspector instead of showing raw error page When the OAuth callback receives an error (e.g. access_denied), the handler previously threw immediately before looking up stored state, so it couldn't find the returnUrl to redirect. This resulted in a raw error page with stack traces rendered into the DOM. Move the error check after the state lookup so we have access to returnUrl and flowType. Now OAuth errors use the same redirect/postMessage patterns as successful auth: - Redirect flow: navigates to returnUrl with auth_error params - Popup flow: posts message to opener with success:false - Fallback with returnUrl: redirects with error params Fixes mcp-use/mcp-use#1362 * chore: add changeset for oauth error redirect fix * feat(inspector): show toast notification on OAuth error redirect * style: fix prettier formatting in callback.ts * fix(inspector): lift OAuth error toast to App level The auth_error toast was buried inside useAutoConnect, which fires before <Toaster /> subscribes to sonner — sonner only notifies current subscribers, so the toast was dropped on the floor. Lift it to App.tsx so the effect runs after Toaster mounts, and make it persistent (duration: Infinity, closeButton: true) so users can read the failure. * chore(inspector): tighten OAuth error toast comment and changeset * refactor(auth): simplify OAuth error redirect handling Collapse duplicated redirect/fallback branches in the OAuth callback error handler into a single redirectWithError helper, drop narration comments, and reuse the existing parsed URLSearchParams in the inspector App effect. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): persist connection config in sessionStorage before OAuth redirect (#1404) Before this change, completing an OAuth flow without ?autoConnect in the URL left the inspector in a hanging state because useAutoConnect had no way to resume the connection on page reload. Now, clicking the Authenticate button writes the pending connection config to sessionStorage under INSPECTOR_RECONNECT_STORAGE_KEY — the same key already consumed by trySessionReconnect() in useAutoConnect. After the OAuth callback redirects back, the hook picks up the stored config and resumes the connection automatically. Inspector-only change; no library code modified. Closes #1389 * chore(typescript): version packages (canary) * fix(oauth): use OAuth 2.1 server endpoints for Supabase provider and clear up docs (#1422) Point getAuthEndpoint() and getTokenEndpoint() at /auth/v1/oauth/authorize and /auth/v1/oauth/token instead of the legacy /auth/v1/authorize and /auth/v1/token paths. Also restructure the Supabase provider docs around a Steps-based prerequisites block and link the new mcp-oauth-supabase-template. * chore(typescript): version packages (canary) * fix(cli): allow "." as project name to init in current directory (#1413) * fix(cli): allow "." as project name to init in current directory When running `npx create-mcp-use-app .` in an empty directory, the CLI now initializes the project in the current directory instead of erroring with "Directory already exists". - Detect "." as project name and resolve to cwd - Use basename(cwd) for package.json name and display output - Check that the directory is empty before proceeding - Update interactive input validator to accept "." Fixes #1406 * style: fix prettier formatting * fix(cli): address review feedback for dot-directory support - Sanitize basename for package.json name (lowercase, replace invalid chars, trim leading dots/dashes) - Allow known safe entries in empty-dir check (.git, .gitignore, LICENSE, README*, .DS_Store, .idea, .vscode, Thumbs.db) - Skip printing 'cd .' when useCurrentDir is true - Add unit tests for sanitizePackageName and isSafeEntry - Extract utils to separate module for testability * fix(cli): expand safe-entry allow list and improve clash error - Replace SAFE_DIR_ENTRIES with the create-next-app-style list (.claude, .cursor, .git*, .hg*, IDE dirs, CI configs, package-manager logs, docs, LICENSE, etc.). README is no longer auto-allowed since templates ship their own. - On clash, list the offending entries (one per line) instead of a generic "directory not empty" message, in both the non-interactive and interactive (Ink) paths. - Drop the unused sanitizePackageName re-export from index.tsx. - Update tests to match the new allow list. * refactor(cli): simplify dot-directory tests and rename trimmed var - Rename sanitizedProjectName -> trimmedProjectName at the call site; the variable is only .trim()'d, the npm-style sanitization happens inside deriveProjectInfo. - Trim isSafeEntry tests from 9 to 3 (the prior tests were enumerating the contents of SAFE_DIR_ENTRIES rather than the function's behavior). - Drop overlapping deriveProjectInfo cases already covered by the sanitizePackageName unit tests and the regression e2e test. - Switch the TS-string-literal sanitize test to property assertions so it stays resilient to regex-order tweaks. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): detect Hono via duck-typing, not instanceof (#1417) * fix(inspector): detect Hono via duck-typing, not instanceof mountInspector(app) chose between a fast Hono-direct path and a slower Express-compat bridge based on app instanceof Hono. That check is unreliable across a published library boundary: when this package and the host (e.g. mcp-use) resolve different Hono constructors -- common in monorepos where workspace deps hoist their own hono, when Node loads Hono's dual CJS+ESM builds from the same on-disk copy as two separate module records, or under bundler dedup -- instanceof returns false even for a real Hono app. The Express bridge then runs against a Hono Context and crashes on every request trying to read req.headers.host. Switch to a duck-type check: Hono apps expose .fetch(Request) => Response; Express apps don't. The check is unambiguous for the documented input set and works regardless of which physical hono module produced the app. * Remove em dashes from comment and changeset * Drop redundant instanceof Hono fast-path; duck-type covers both shapes * Narrow app type via isHonoApp guard so Express bridge type-checks * Empty commit to refresh pkg.pr.new PR-tag alias for Deno preview * chore(typescript): version packages (canary) * docs: add v1.25.1 and inspector v3.0.1 changelog entries --------- Co-authored-by: Ayaan Gazali <ayaangazali@gmail.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: Truffle <truffleagent@gmail.com> Co-authored-by: Kagura <kagura.agent.ai@gmail.com> Co-authored-by: Kagura <kagura.chen28@gmail.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> |