mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
@mcp-use/cli@4.0.0-beta.13
35 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Enrico
|
2768f5bfec | Merge main into beta | ||
|
Enrico Toniato
|
23bba3bbf2 |
refactor(server): update tool context to RequestContext and enhance client metadata handling (#1972)
- Renamed `ToolContext` to `RequestContext` in documentation and code. - Updated the context object to provide enhanced client metadata, including user information and capabilities. - Improved examples and descriptions for clarity on client capabilities and request-scoped metadata. - Adjusted tests to reflect changes in client metadata handling and ensure type safety. |
||
|
Enrico Toniato
|
192d193803 |
feat(server): restore Hono HTTP surface and strict tool refs (#1969)
Bring back typed Hono routes/middleware with server.fetch as the serving boundary, restore deprecated response helpers for upgrades, and require useCallTool names to resolve against mcp-env.d.ts ToolRefs (with useDynamicTool + mcp-use typecheck as the escape hatch). |
||
|
Enrico
|
b5354b5285 | fix(docs): update Inspector URL references to /mcp/inspector | ||
|
Enrico Toniato
|
f952fe0226 |
Canary (#1945)
* fix(docs): repair dead links flagged by link checker (#1855) * fix(docs): repair dead links flagged by link checker - Point CLI client docs links at docs.mcp-use.com/typescript/tooling/client-cli (old typescript/client/cli path 404s) in the CLI example and skills - Remove the inspector README self-hosting link; that docs page does not exist - Point the python README 'what should we build next' link at GitHub issues (old mcp-use.com page returns 410 Gone) - Exclude generated package CHANGELOGs from lychee: historical release notes reference docs URLs that were valid at release time Closes #1838 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ci): escape and anchor lychee exclude_path regex patterns exclude_path values are regular expressions per lychee docs; escape the dots and anchor the patterns to match the style of existing exclude entries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: ayaanmacmini3 <ayaanmacmini3@ayaanmacmini3s-Mac-mini.local> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(react): point useMcp auto proxy fallback at live inspector host (#1798) The default autoProxyFallback proxy address was inspector.mcp-use.com, which now 301-redirects to inspector.manufact.com. Browsers treat a redirect on a CORS preflight as a hard failure, so the automatic direct→proxy fallback could never connect. Default now targets the live inspector.manufact.com proxy. * chore(typescript): version packages (canary) * fix(typescript): remove leftover resourceCallbacks debug log (#1878) Every resource template registration printed a bare "resourceCallbacks undefined" line to the console (introduced with the completion-callbacks work, #966/#970). With MCP Apps widgets this fires on every dev boot and every HMR reload, and the stray output actively misled a recent bug investigation (#1875, where it was flagged as a suspect). Remove the debug line; the value is still exercised immediately below when building the ResourceTemplate. Co-authored-by: ayaangazali <ayaan.gazly@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * fix: refresh OAuth tokens with resource --------- Co-authored-by: Ayaan Gazali <ayaangazali.work@gmail.com> Co-authored-by: ayaanmacmini3 <ayaanmacmini3@ayaanmacmini3s-Mac-mini.local> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: ayaangazali <ayaan.gazly@gmail.com> |
||
|
Enrico
|
d9c2023864 | manual commit | ||
|
Enrico
|
f25964142b |
Enhance MCP App Development Experience
- Updated documentation to clarify the use of `mcp-use dev --tunnel` and `mcp-use start --tunnel`, including automatic tunnel restart on registration drop. - Refined TypeScript API references for `allowedOrigins` and `cors` configurations to improve clarity on behavior. - Transitioned view-related files from `resources/` to `views/`, aligning with new authoring standards. - Introduced a new `mcp-env.d.ts` for type definitions and simplified favicon selection logic. - Enhanced the `create-mcp-use-app` template to support views, including a new fruit search example with improved UI components. - Added mock OpenAI file APIs for local development environments to facilitate testing. - Updated package.json descriptions and keywords for better clarity and alignment with project goals. |
||
|
Enrico
|
e6ce060a1b |
refactor(docs): update README and documentation for MCP SDK v2
- Improved formatting and consistency in README.md and various documentation files. - Updated import paths to reflect the new package structure for @mcp-use/client and @mcp-use/agent. - Enhanced examples and descriptions for MCPAgent and related components. - Cleaned up whitespace and formatting for better readability across multiple files. |
||
|
Enrico Toniato
|
0fb18685d3 |
feat(cli): servers update + branch-scoped env/deploy management (#1711) (#1712)
* feat(cli): servers update + branch-scoped env/deploy management (#1711) * feat(cli): add servers update + branch-scoped env/deploy management Adds `mcp-use servers update` to mutate server config in place (productionBranch, name, description, build/start commands) without delete/recreate, mapping flags to the backend UpdateServerBody (--branch -> productionBranch; build/start commands nested under config). Also completes MCP-1794 branch scoping: - deploy --branch (defaults to current git branch) scopes env sync to the branch's preview env - servers env list/add/update/rm --branch; update/rm accept a KEY resolved within the branch scope, not just a UUID - deployments restart --branch (defaults to the deployment's branch) Supersedes #1706 with the correct field mapping. Adds unit tests, README docs (flags + env naming mapping), and a changeset. * docs(skills): document servers update + branch-scoped env CLI commands Update the mcp-apps-builder and openapi-to-mcp skills for the new CLI surface: add the deploy `--branch` flag, document `servers update` and `servers env` for post-deploy config, and fix the stale `mcp-use deployments env set` reference (the real command is `mcp-use servers env add`). * feat(cli): map empty build/start flags to null for config unset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v9.0.1 and v1.31.1 releases - Added details for patch release v9.0.1 in the inspector changelog, noting the update to `mcp-use` v1.31.1 with no inspector-specific runtime changes. - Documented patch release v1.31.1 in the TypeScript changelog, highlighting workspace dependency alignment and new features in `@mcp-use/cli`, including server updates and branch-scoped environment management. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
c866bdaa7c |
Canary (#1695)
* feat(cli): managed (no-GitHub) deploy + device-code login (#1691) * feat(cli): add managed (no-GitHub) deploy and device-code login - `mcp-use deploy --managed` packs the local project into a tarball and uploads it to the platform-managed GitHub org, so users can deploy without connecting their own GitHub. Redeploys reuse the linked server. - `mcp-use login --device-code <code>` authenticates non-interactively with a pre-approved OAuth device code (used by the web onboarding flow), skipping the browser step. * feat(cli): auto-detect managed server on redeploy A project linked to a managed server now redeploys via the managed upload path without needing --managed again (detected from the server's connectedRepository.isManaged flag). * docs(skill): document managed deploy + device-code login Update the mcp-apps-builder deployment guide for `mcp-use deploy --managed` (no GitHub required) and non-interactive `mcp-use login --device-code`. * refactor(cli): rename managed deploy option to no-github Updated the CLI command from `--managed` to `--no-github` for deploying local sources without connecting to GitHub. This change clarifies the functionality and aligns with the new documentation. The deployment process remains unchanged, allowing users to upload their project source directly to the platform-managed organization. Additionally, updated related documentation to reflect this change. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): stop inspector widget status label blocking iframe i… (#1694) * feat(greeting-card): migrate greeting-card resource to React widget tool (#1659) * feat(greeting-card): migrate greeting-card resource to React widget tool (#1658) * chore(changeset): add changeset for greeting-card widget migration * fix(widget): disable prefersBorder for greeting-card to prevent double border and remove old changeset * fix(typescript): stop inspector widget status label blocking iframe interactions * chore(inspector): add changeset and pointer-events-none on Apps SDK label Add a patch changeset for @mcp-use/inspector and apply pointer-events-none to the OpenAIComponentRenderer status label for parity with MCPAppsRenderer. --------- Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: iframe collapse when widget renders null (#1693) Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> * chore(typescript): version packages (canary) * chore: update changelogs for v8.0.1 and v1.30.1 releases - Added details for v8.0.1, addressing the widget status label pointer-events issue in the inspector. - Documented v1.30.1 enhancements, including no-GitHub deployment and device-code login features, along with fixes for iframe interactions and zero-height collapse in the McpUseProvider. * feat(mcp): enhance error handling for MCP client readiness (#1528) * feat(mcp): enhance error handling for MCP client readiness - Introduced `formatMcpNotReadyReason` function to provide clearer error messages when MCP operations are attempted before the client is ready. - Updated error messages in `useMcp` to utilize the new formatting function, improving clarity on client state and connection status. * fix(mcp): refine disconnect logic to prevent race conditions - Updated `disconnect()` to only nullify `clientRef` when it points to the closing client and the connect epoch remains unchanged. This adjustment addresses scenarios where `connect()` reuses the same `BrowserMCPClient` instance for a new URL, enhancing error handling for MCP operations. - Introduced a `connectEpochRef` to track connection attempts and ensure proper client state management during disconnects. * fix(react,client): enhance disconnect logic to prevent session wipe on reconnect - Updated `disconnect()` to only nullify `clientRef` when it points to the closing client and the connect epoch remains unchanged, addressing race conditions during reconnections. - Modified `BaseMCPClient.closeSession()` to conditionally delete sessions, ensuring that a new session created during a disconnect does not get wiped, which improves error handling for MCP operations. * fix(react,client): guard disconnect state reset; test closeSession slot guard Address review follow-ups on the disconnect/reconnect race fix: - disconnect() now skips the state reset (setState("discovering") + list clearing) when superseded by a newer connect(), so a manual disconnect() racing a reconnect can no longer clobber the live connection's state. - Add a direct unit test for BaseMCPClient.closeSession's slot-equality guard (parallel createSession survives, normal delete still happens, delete still runs when disconnect() throws). * chore(typescript): version packages (canary) * chore: update changelog for v1.30.1 and enhance MCP client error handling - Documented patch release v1.30.1, including fixes for `McpUseProvider` zero-height collapse, `useMcp` disconnect/reconnect race conditions, and clearer error messages for client readiness. - Improved `useMcp` disconnect logic to prevent stale state issues during reconnections. - Minor formatting adjustment in `MCPAppsRenderer` for cleaner code. --------- Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: sonikagutha <gsonikachowdary@gmail.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Parship Chowdhury <parshipchowdhury@gmail.com> |
||
|
Andrew Khadder
|
83271e869f |
Canary (#1508)
* chore: remove unused mcp-use source files (#1476) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs(cli): clarify inspector skipped-in-production log + start section (#1505) * docs(cli): clarify inspector skipped-in-production log + start section The runtime log "[INSPECTOR] Skipped in production (use --with-inspector flag during build)" reads as if the flag can be passed to `mcp-use start`, which it can't (the flag is only registered under `build`). The new wording spells out the rebuild command, and `cli-reference.mdx` gains a short note under `start` pointing at the build flag for inspector-in-production. Closes #1495 * docs(cli): apply reviewer reword on inspector note * chore(typescript): version packages (canary) * chore(inspector): remove unused source files (#1510) Drops the 18 inspector files reported by `pnpm knip` from libraries/typescript and stops generating the unused client-side version.ts (the client reads the version from the window.__INSPECTOR_VERSION__ global injected by the server). Part of #1446. * chore(typescript): version packages (canary) * chore(typescript): prune 187 unused exports and 161 unused export types flagged by knip (#1511) * chore(typescript): prune 161 unused exported types flagged by knip Phase 2 of #1450: remove or de-export types that knip flags as unused. Skipped tuning knip.json (Phase 1) — focused only on the type cleanup. For each flagged type: - Used only within its source file → drop `export` - Re-exported through a barrel but never imported downstream → remove the re-export - Genuinely dead → delete No public-API removals: types exposed through the `mcp-use`, `@mcp-use/cli`, `@mcp-use/inspector`, or `create-mcp-use-app` package entry points remain exported. `client.ts` switches from inline `import("...")` to a top-level import so knip can see the `ToolSearchResponse` usage. Verified `pnpm knip` reports 0 unused types (down from 161) and `pnpm build` passes across all packages. * chore(typescript): prune 187 unused exports flagged by knip Closes #1450. * chore(typescript): fix prettier formatting * chore(typescript): delete orphaned PropsSelect.tsx Removing the unused barrel re-export in the prior commit left this file with no consumers. * chore(typescript): version packages (canary) * ci(knip): enforce knip and clear final baseline findings (#1512) * chore(knip): clear remaining baseline findings so knip passes clean - Mark `src/index.tsx` as an entry for create-mcp-use-app so its CLI dependencies (chalk, commander, ink, ora, tar, react, etc.) stop being flagged as unused. - Add `lsof`, `sleep`, and `dev` to ignoreBinaries for the mcp-use workspace — these appear in example scripts and are either system utilities or pnpm script names, not npm-resolvable binaries. - Turn off the `optionalPeerDependencies` rule. Optional peer deps (langchain/langfuse/e2b/etc.) are loaded conditionally by design; flagging them as referenced is noise. After this change `pnpm exec knip` exits 0 against canary. * ci(knip): enforce knip in CI The baseline is now clean (canary + previous PRs cleared all findings), so drop `--no-exit-code` and let the job fail when knip reports issues. Also generate `packages/mcp-use/src/version.ts` before knip runs so the gitignored `version.js` imports resolve. * chore(deps): bump better-auth in /libraries/typescript (#1515) Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.1 to 1.6.11. - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.6.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: tighten PR readiness and docs hygiene (#1509) * docs: tighten review readiness and doc links * docs: anchor api-reference redirect and fix missed node note Move the /typescript/server/api-reference target from a bare redirect to an anchored one (#mcpserver-api-reference) so existing "API Reference" links land on the renamed section directly. Drop the self-link in server/index.mdx and bring the commonjs example's Node note in line with the package engines range. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * feat(server/oauth): allow Supabase URL override for self-hosted/local instances (#1517) * feat(server/oauth): allow overriding Supabase URL for self-hosted/local instances `oauthSupabaseProvider` previously hardcoded `https://${projectId}.supabase.co`, preventing use against local Supabase (`http://localhost:54321`) or self-hosted deployments — even though those instances expose the same OAuth 2.1 server. Add an optional `supabaseUrl` config (and `MCP_USE_OAUTH_SUPABASE_URL` env var) that overrides the projectId-derived URL. `projectId` is now optional when `supabaseUrl` is set; hosted-project users are unaffected. Closes mcp-use/mcp-oauth-supabase-template#2 * test(server/oauth): trim supabase provider tests to factory contract Drop low-value string-concatenation and pre-existing-behavior tests; keep the two that cover the new behavior (supabaseUrl alone is accepted; empty config throws). Isolate process.env in the factory describe so the "throws when neither configured" assertion isn't defeated by local MCP_USE_OAUTH_SUPABASE_* env vars. * docs(server/oauth): document supabaseUrl override for local/self-hosted Supabase * chore(typescript): version packages (canary) * chore: use cross-platform clean commands (#1523) * chore: use cross-platform clean commands * chore: add empty changeset for cross-platform clean scripts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy (#1483) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy The DCR-direct metadata proxy was string-concatenating a path onto the issuer, which canonically ends with a trailing slash: `${issuer}/.well-known/oauth-authorization-server` // → "https://tenant.auth0.com//.well-known/oauth-authorization-server" Auth0 returns 404 for any path starting with "//", which broke OAuth discovery end-to-end against real Auth0 tenants in DCR-direct mode. new URL(path, base) normalizes the join regardless of trailing slash, so this works for any provider whose canonical issuer ends with "/". Fixes #1482. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(server/oauth): normalize issuer trailing slash instead of using URL constructor `new URL("/.well-known/...", issuer)` resolves the leading-slash path against the issuer's origin, stripping any path on the issuer. That breaks providers like Supabase whose issuer is `https://<project>.supabase.co/auth/v1`. Replace with a trailing-slash-stripping template literal, which handles both Auth0 (issuer ends with `/`) and Supabase (issuer has a path). * chore(changeset): trim oauth metadata fix entry * chore(changeset): drop issue reference --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * test(inspector): add OAuth e2e against emulated Google issuer (#1481) * test(inspector): add OAuth e2e test using emulated Google issuer Covers the inspector's OAuth redirect flow end-to-end against an `emulate`-backed Google issuer + MCP server in oauthProxy mode, run twice across the Direct and Via Proxy connection-type matrix. Both variants share one fixture in serial mode since the registered redirect URI pins the MCP server to a fixed port. * test(inspector): switch loop to factory to satisfy no-loop-func The for-loop variant captured the mutable `fixture` binding from beforeAll, which eslint's no-loop-func flags. Hoisting the body into a small factory keeps the shared fixture without the closure-over-loop pattern. * test(inspector): close emulator if MCPServer setup fails Wrap post-createEmulator work in try/catch so the emulator port doesn't stay bound when MCPServer construction or listen() throws. * chore(typescript): version packages (canary) * fix(inspector): surface MCP server auth failures with reconnect banner (#1485) * fix(inspector): surface MCP server auth failures with reconnect banner (MCP-2111) When the hosted inspector's chat backend returns 401 because the upstream MCP server rejected the user's OAuth token (e.g. Linear token expired), the inspector previously threw a generic `HTTP error! status: 401` and the cloud response misleadingly pointed users at the Manufact account login. The chat now recognises the cloud's `{ error: "mcp_auth_required", mcpServerUrl }` response and renders an inline banner above the input ("Reconnect to <server>") with a button that calls `connection.authenticate()`. Reconnect refreshes the OAuth token in localStorage; the banner clears on success and chat resumes. Pairs with a cloud-side change that drops the misleading `loginUrl` field from the 401 response. * fix(inspector): harden mcp_auth_required handling - Drop the no-op setMessages filter in the 401 branch; the optimistic assistant message is only added after the response check, so there's nothing to remove. - Guard `new URL(serverUrl)` in McpReconnectBanner so a malformed URL falls back to the raw string instead of crashing the chat tab. * refactor(inspector): rename mcpAuthRequired to mcpServerAuthRequired The hook's internal state was already named `mcpServerAuthRequired`, but the returned key and clear callback used the shorter `mcpAuthRequired`, forcing the ChatTab consumer to re-alias them. The shorter name was also ambiguous in a codebase that has two distinct auth flows: the Manufact account login (429 path) and the upstream MCP server OAuth (401 path). Align the public surface of `useChatMessages` with the internal state and the consumer's local name. The backend wire value `"mcp_auth_required"` is unchanged. * chore(inspector): remove mcpServerAuthRequired comment * chore(typescript): version packages (canary) * fix(inspector): keep tab count badges visible in collapsed mode (#1490) * fix(inspector): keep tab count badges visible in collapsed mode * Keep tab badges aligned in collapsed mode * extract TabCountBadge and fix badge visibility * chore(typescript): version packages (canary) * fix(inspector): drop unused TabCountBadge barrel re-export (#1533) The only consumer (LayoutHeader.tsx) imports TabCountBadge directly from ./shared/TabCountBadge, so the re-export in shared/index.ts is unused. Knip flagged it and started failing CI on canary after the TabCountBadge change landed. * chore(typescript): version packages (canary) * feat(inspector): add local LLM provider support for chat in Inspector (#1395) * feat(inspector): integrate ollama provider * feat(inspector): integrate lmstudio provider * fix(inspector): preserve no-icon behavior for openai-compatible provider * refactor(inspector): remove LM Studio provider and address PR feedback * fix(inspector): remove duplicate ollama union members Collapses the accidental `"ollama" | "ollama"` duplicates in ProviderName, MCPChatMessageEventData, and LLMConfig. * refactor(inspector): drop LLM proxy and call Ollama directly Ollama allows localhost origins by default, so the inspector talks to the daemon over CORS and skips the server-side proxy entirely. Surface an OLLAMA_ORIGINS hint when the browser fetch fails so tunneled or remote setups know what to configure. Theme the Ollama logo and tighten its size so the non-circular mark sits cleanly next to the other provider icons. * chore(inspector): revert gratuitous field reorders Restore original ordering of temperature/baseUrl and useCallback deps; remove stray blank line in vite.config.ts to keep the diff focused. * test(inspector): add unit tests for parseNDJSON * refactor(inspector): tighten Ollama provider integration - Guard Ollama streamChat against duplicate tool-call emissions when a chunk's tool_calls are repeated by proxies/forks - Key the models cache on (provider, baseUrl) for any base-url provider so openai-compatible no longer serves stale entries on URL changes; normalize Ollama variants (trailing slash, /api suffix) to one entry - Move OllamaCorsError into the Ollama provider module - Replace hand-written provider unions in telemetry events and server shared-utils with ProviderName - Single-source DEFAULT_OLLAMA_BASE_URL from ollama/utils.ts - Drop the unrelated tempApiKey/tempModel trim() drift in saveLLMConfig - Make OPENROUTER_ICON_URL module-private, clean up merge-artifact blank lines * chore: simplify changeset * style(inspector): apply prettier to shared-utils * fix(inspector): drop unused export on DEFAULT_BASE_URLS DEFAULT_BASE_URLS is only consumed by getDefaultBaseUrl in the same module. Knip flagged the export as unused and failed CI. * ci: retrigger after canary knip fix (#1533) --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): resolve CodeQL polynomial-regex alert in Ollama url normalizer (#1534) * fix(inspector): replace trailing-slash regex in Ollama url normalizer CodeQL flagged `/\/+$/` in `normalizeOllamaBaseUrl` as a polynomial regular expression on uncontrolled input. Swap the regex for an explicit linear scan and add unit tests covering the trimming behaviour plus a pathological-input case. * chore: drop unit test for trivial regex refactor * chore: drop accidentally committed .antigravitycli symlink * chore(typescript): version packages (canary) * chore: remove dead typescript-format-and-lint pre-commit hook (#1541) The hook entry pointed to `.git/hooks/typescript-pre-commit.sh`, a path that is never tracked and was never populated by any setup step, so the hook could not run for anyone. TypeScript formatting and linting are already handled by Husky (libraries/typescript/.husky/pre-commit), installed automatically via `pnpm install`'s `prepare` script. Closes #1536 * fix(inspector): stop ToolInputForm from mutating live tool inputSchema (#1545) * fix(inspector): stop ToolInputForm from mutating live tool inputSchema `ToolInputForm` was writing `required: boolean` onto each property of the live tool inputSchema during render. `required` is not valid as a per- property boolean — it belongs on the parent object as a `string[]`. Anthropic's draft 2020-12 validator rejected the resulting payload with `tools.0.custom.input_schema invalid`, breaking the Inspector chat after any tool had been opened in the Tools tab. Replace the mutation with a local `isRequired` const used only for the `*` indicator render. Fixes MCP-1970. * chore(inspector): trim comment on schema-mutation fix * chore: remove verbose comment * style(inspector): apply prettier to ToolInputForm * chore(typescript): version packages (canary) * Improve tab switch animation timing (#1544) * chore(ui): improve tab switch animation timing * chore(changeset): add changeset for tab animation improvement * chore(typescript): version packages (canary) * fix(inspector): propagate server alias updates through mcp server wrapper (#1539) * fix(inspector): propagate server alias updates through McpServerWrapper onUpdate * chore: add changeset for mcp-use server alias propagation fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * chore(typescript): add 3-day install cooldown via pnpm minimumReleaseAge (#1516) Blocks `pnpm install` from fetching npm versions published less than 3 days ago, mitigating supply-chain attacks where a malicious release is typically yanked within hours of discovery. The setting (introduced in pnpm 10.16) lives in pnpm-workspace.yaml — in modern pnpm only auth/registry config is read from .npmrc, so putting it there would be silently ignored. Workspace-published names (`mcp-use`, `@mcp-use/*`, `create-mcp-use-app`) are exempted so the cooldown never interferes with local development or fresh releases of our own packages. * fix(react): improve server management in McpClientProvider (#1561) Refactor server removal and update logic to use a ref for synchronous access to the latest server state. This change prevents React's warning about updating a component during rendering by ensuring that teardown side effects (`disconnect()` and `clearStorage()`) are executed outside of the state updater functions. The ref is updated in a useEffect hook to maintain the latest server state for event handlers. * chore(typescript): version packages (canary) * fix(inspector): forward MCP image tool results as image content (#1487) * fix(inspector): forward MCP image tool results as image content (MCP-1941) Previously, the inspector's chat loop and provider adapters serialized MCP tool results with JSON.stringify, which buried the base64 `data` field of `image` content blocks inside a text payload. Vision-capable models received a wall of base64 text instead of the image. Extract MCP `content` blocks into provider-neutral `ContentPart[]` and route image bytes through each provider's vision channel: - Anthropic: image blocks inside `tool_result.content` (base64 source). - OpenAI: tool role keeps text; image bytes forwarded as a follow-up user turn with `image_url` parts. - Google: `functionResponse.response` keeps text/metadata; image bytes forwarded as a follow-up user turn with `inlineData` parts. Text-only tool results keep the legacy `content: string` path on every provider. * style(inspector): apply prettier formatting * chore(inspector): drop unused export on collapseToString Only called internally by toolResultToContent — knip flagged it as an unused export. * fix(inspector): propagate MCP isError flag and fix image example tools - Add isToolResultError() helper and use it in toolLoop + replay so tool calls that return { isError: true } are flagged the same as thrown errors on both live and saved-conversation paths. - Pick a no-content fallback for OpenAI's tool role when there are no image parts to forward. - Replace via.placeholder.com URLs in the everything example with real base64-encoded bytes fetched from picsum.photos, since the image() helper expects MCP ImageContent base64 data, not URLs. * style(inspector): apply prettier formatting * chore(typescript): version packages (canary) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL (#1552) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL Browsers cannot resolve 0.0.0.0 as a destination, and the MCP SDK's OAuth resource validator does strict origin equality — so the inspector auto-connecting to http://0.0.0.0:PORT/mcp mismatches the resource metadata published as http://localhost:PORT (which goes through normalizeUrlHost in server-helpers.ts). Result: OAuth-protected mcp-use apps fail at the inspector's post-callback validation with "Protected resource X does not match expected Y". Mirror the existing normalization for the autoConnect URL and the banner log so both reflect the browser-reachable host. Closes #1551 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: add changeset for inspector autoConnect loopback normalization --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): align widget Vite base with /mcp-use/widgets (#1560) * fix(cli): align widget Vite base with /mcp-use/widgets/ when MCP_URL is set * chore: add changeset for cli widget base path fix * chore: format widget-paths.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(cli): headless screenshot with auto-sizing and external MCP server support (#1579) * feat(cli): headless screenshot command with auto-sizing and external MCP server support - Make width/height optional; when omitted, clips to the widget's natural rendered size by reading body[data-view-*] rect attrs set by the preview page - Add useBundleReadinessSignal in ViewPreview that uses ResizeObserver to wait for the iframe to stabilize before setting data-view-ready, serializing the iframe's bounding rect so the CLI can clip tightly instead of capturing the full viewport - Switch ViewPreviewBundle to displayMode="inline" so widgets auto-size to content height - Add inlineWidthOverride prop to MCPAppsRenderer to bypass the 768px inline cap when screenshotting at an explicit width - Fix extractViewName to handle external MCP server URIs (ui://<server>/<name>.html) by flattening to <server>-<name>; previously only ui://widget/ was handled, causing React Router to fail to match the preview route for third-party servers like Excalidraw * chore: add changeset for screenshot auto-sizing and external MCP fix * fix(cli): unexport CaptureScreenshotResult to satisfy knip * chore(typescript): version packages (canary) * feat(auth): enhance OAuth callback handling with improved state management and user feedback (#1580) * feat(auth): enhance OAuth callback handling with improved state management and user feedback - Introduced a module-level cache for in-flight authorization promises to prevent duplicate network requests during the same page load. - Added utility functions to determine if the current window is a popup and to render user-friendly messages for closing the window after authentication. - Improved handling of redirect flows and popup scenarios to ensure a seamless user experience, including error handling and messaging for lost opener situations. * fix(auth): BroadcastChannel fallback when popup opener is severed Popup callback now broadcasts success/failure over a same-origin BroadcastChannel("mcp_auth_callback") in the lost-opener branch, and useMcp subscribes to that channel alongside the existing window.message listener. Without this, popups whose window.opener was severed by COOP or cross-origin intermediate redirects would save tokens but leave the parent stuck in `authenticating`. Matches the dual-transport pattern used by oidc-client-ts and MSAL.js for the same COOP scenario. * chore(auth): unexport MCP_AUTH_BROADCAST_CHANNEL to satisfy knip It's only used inside callback.ts; the parent side hard-codes the same string in useMcp.ts. Removing the export drops knip's "unused export" finding while keeping a single source-of-truth comment that links the two files. * fix(mcp-use): split langchain agents out of mcp-use/browser entry Move MCPAgent, RemoteAgent, adapters, and observability to mcp-use/browser/agent so Next.js clients importing MCPClient only no longer pull @langchain/* into the browser bundle. * chore: format browser bundle test file * chore(typescript): version packages (canary) * fix(inspector): add copy button to user messages (#1556) * fix(inspector): add copy button to user messages Extract CopyButton into a shared component and add it to UserMessage, matching the existing assistant message UX. Resolves #1555 * chore: add inspector copy button changeset --------- Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(server): add publicLandingPage option for OAuth-protected servers (#1550) * feat(server): add publicLandingPage option for OAuth-protected servers * fix(server): keep public landing auth gate in oauth setup * docs(server): add public landing page example * chore(server): format mcp endpoint * chore(server): simplify accept header lookup * chore(server): restore mcp mount diff * fix(server): align oauth exports with canary * chore(server): format oauth exports * fix(server): remove unused oauth barrel exports --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * Move mcp-apps template pnpm settings to workspace config (#1602) * fix(inspector): widget fullscreen above embedded host chrome (MCP-2181) (#1605) * fix(inspector): portal widget fullscreen above host chrome MCP-2181: cloud chat headers at z-50 covered the fullscreen exit control because the overlay used z-40 inside a nested stacking context. Portals the fullscreen shell to document.body at z-[100], sets data-mcp-widget-fullscreen for hosts, and shows the Apps SDK exit navbar in CSS fullscreen fallback. * fix(inspector): native fullscreen first, no portal remount (MCP-2181) Revert conditional createPortal that remounted widgets on fullscreen toggle. Use requestFullscreen() as the primary path; apply CSS z-[100] overlay only when the API fails. Keep exit navbar and data-mcp-widget-fullscreen for both. * refactor(inspector): consolidate widget fullscreen into shared hook Extract useWidgetFullscreenControls for native-first fullscreen + CSS fallback. Removes duplicated handlers, unused helpers, and OpenAI edge-case branches from MCPAppsRenderer and OpenAIComponentRenderer. * fix(inspector): preserve widget state when entering fullscreen (MCP-2181) Route ui/request-display-mode through native fullscreen handling, target requestFullscreen on the iframe wrapper, and avoid resetting load state on display-mode-only changes. Stabilize OpenAI iframe listeners so chat re-renders do not flash the skeleton. * style(inspector): format OpenAIComponentRenderer for Prettier * fix(inspector): fullscreen shell includes navbar and fills viewport Promote the outer widget shell via requestFullscreen so FullscreenNavbar stays visible and bg-background fills the screen instead of browser black letterboxing around a nested iframe wrapper. * fix(inspector): PiP portal and sandbox remount bridge reconnect (MCP-2181) Port PiP to document.body with z-[100]. Re-run AppBridge when the sandbox iframe remounts; keep the host spinner until initCount recovers. Unify display-mode document attributes for optional host chrome hiding. * fix(inspector): resend widget data after PiP remount * chore(typescript): version packages (canary) * Hash Claude resource domains from authored ui.domain (#1599) * Apply Claude resource domain hashing for UI metadata * chore: format Claude domain helper * fix(inspector): drop unused widget-fullscreen exports to satisfy knip (#1607) widget-fullscreen.ts (added in #1605) exported several symbols that nothing outside the file consumes, plus pre-emptive @deprecated aliases for an API that never shipped. Only useWidgetDisplayModeControls is used (by MCPAppsRenderer and OpenAIComponentRenderer). - Unexport internal-only constants, the WidgetDisplayMode type, and the useWidgetDisplayModeDocumentChrome helper - Remove the dead useWidgetFullscreenControls / useWidgetFullscreenDocumentChrome aliases * test(agent): drop live Langfuse API integration tests (#1608) The observability integration tests queried the live Langfuse REST API (via getRecentTraces) to verify traces landed. cloud.langfuse.com has been returning 403 Forbidden for both ingestion and queries, failing the 'should send traces to Langfuse when observability is enabled' test and reddening canary CI. Remove the two tests that depend on the live API (the failing test and the already-skipped manual-trace test) plus the now-unused getRecentTraces helper. Keep the two tests that verify observability enable/disable behavior locally with no network dependency. * chore(typescript): version packages (canary) * fix(oauth): redact token verification errors (#1573) * fix(oauth): redact token verification errors * chore: add oauth error redaction changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): skip emulate oauth tests in builtin e2e (#1609) * chore: add codex to gitignore (#1612) * fix(docs): update server API reference links (#1611) * fix(mcp-use): pin published dependency versions (#1610) * docs(changelog): document v1.29.0 / inspector v7.0.0 release TypeScript changelog gains a v1.29.0 entry (public landing pages, Supabase URL override, Claude UI-resource domain hashing, OAuth callback + React-provider hardening). Inspector changelog gains a major v7.0.0 entry (local Ollama provider, image tool results, MCP-server reconnect banner, widget fullscreen/PiP rework). * Fix builtin inspector auto-connect to use HTTP (#1613) * Switch builtin inspector auto-connect to HTTP * Use plain URL autoConnect in builtin e2e helper * Fix built-in inspector auto-connect to use HTTP * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: asim48-ctrl <asim48@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Truffle <truffleagent@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SSharma1103 <shivamsharma11032009@gmail.com> Co-authored-by: Polæ <steven@polae.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Udaykumar Dhokia <udaykumardhokia@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Jefsky Wong <hwj3344@hotmail.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Ritwij Aryan Parmar <88580521+RitwijParmar@users.noreply.github.com> |
||
|
Pietro Zullo
|
b7ec5c1cc4 |
Add openapi-to-mcp skill (#1530)
* Add openapi-to-mcp skill * Add LICENSE.txt to openapi-to-mcp skill * Fix: document direct tsx alternative to npm run load-spec * Fix: regenerate dereferenced spec at cloud build time |
||
|
Andrew Khadder
|
46caf8059b |
Canary (#1473)
* chore(deps): bump next from 15.5.15 to 15.5.18 in /libraries/typescript (#1472)
* chore(deps): bump next from 15.5.15 to 15.5.18 in /libraries/typescript
Bumps [next](https://github.com/vercel/next.js) from 15.5.15 to 15.5.18.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](https://github.com/vercel/next.js/compare/v15.5.15...v15.5.18)
---
updated-dependencies:
- dependency-name: next
dependency-version: 15.5.18
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore(typescript): drop unused dependencies and dev dependencies (#14… (#1458)
* chore(typescript): drop unused dependencies and dev dependencies (#1447).
* docs(typescript): align CLAUDE.md pre-commit notes with husky hook
lint-staged was removed in this PR; the actual .husky/pre-commit
script runs `pnpm format` and `pnpm lint:fix` directly plus a
changeset presence check.
* chore(typescript): version packages (canary)
* docs(typescript): make response helpers discoverable in tool() and blank template (#1474)
* docs(typescript): make response helpers discoverable in tool() and blank template
MCPServer.tool() JSDoc examples called text()/error() with no import line,
so the hover doc gave no breadcrumb to mcp-use/server. The blank scaffold
template had the same gap — helpers appeared only inside commented-out
example blocks.
- Add import statements + a leading note to each @example block on tool()
- Replace the commented fetch-weather placeholder in the blank template
with a real, working echo tool that imports text from mcp-use/server
* docs(typescript): keep blank template empty, surface helper imports inside the commented examples
Revert the real echo tool — blank should stay actually blank. Instead, the
commented-out tool/resource/prompt blocks now contain their own `import` lines
for `text` / `object` / `z`, so an agent reading the file sees the complete
pattern (including where the helpers come from) without anything actually
being registered.
* chore(typescript): version packages (canary)
* chore(mcp-use): declare jsdom and @vitest/coverage-v8 as explicit devDependencies (#1454)
* feat(deps): add jsdom and vitest coverage dependencies
* chore(deps): pin @vitest/coverage-v8 to ~4.0.18
Aligns coverage-v8 with the installed vitest 4.0.18 to satisfy its exact
peer-dep constraint; previous ^4.0.17 let pnpm resolve 4.1.6 which peers
on vitest 4.1.6 and produced a lockfile mismatch.
* chore(changeset): add changeset for unlisted devDep declarations
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* refactor(auth): extract OAuthSessionStore from BrowserOAuthClientProvider (#1451)
* refactor(auth): extract OAuthSessionStore from BrowserOAuthClientProvider
Pulls token storage, JWT-expiry-driven refresh (with deduplication),
client-info validation, code-verifier handling, key hashing, and
authorization-state persistence into a new platform-neutral
`OAuthSessionStore` parameterized over a `KVStore`. The browser
provider now holds an `OAuthSessionStore` and delegates the SDK
`OAuthClientProvider` interface methods to it.
Browser-only concerns stay on `BrowserOAuthClientProvider`:
- popup/redirect flow + popup-blocker fallback
- fetch interceptor for OAuth-proxy CORS bypass
- inspector-proxy resource-param rewrite (now `rewriteResourceIfLocalProxy`)
- `clearStorage` / `getLastAttemptedAuthUrl` (kept on the provider until
a Node provider gives the abstraction a real second caller)
No behavior change. Prepares the ground for a future Node/CLI OAuth
provider built on the same session store.
* refactor(auth): simplify OAuthSessionStore — drop pendingCodeVerifier mirror, parallelize KV ops
- Remove `pendingCodeVerifier` in-memory mirror; read through KV store directly
- Parallelize independent KV writes/removes with `Promise.all` in `saveTokens`,
`invalidateCredentials("all")`, `clientInformation` redirect-mismatch path,
and `storeAuthorizationState` — preparing for the upcoming async file store
- Drop redundant `sanitizeUrl` in `redirectUrl` getter (constructor already sanitizes)
- Remove debug `console.log` and write-then-verify read in `storeAuthorizationState`
* chore: format
* chore: format
* refactor(auth): sequence KV writes in OAuthSessionStore
Replace Promise.all blocks with sequential awaits in saveTokens,
clientInformation mismatch invalidation, invalidateCredentials("all"),
and storeAuthorizationState. No behavior change for the browser path
(sync localStorage), but ordering now matters for the upcoming async
file-backed KVStore — saveTokens persists tokens before clearing the
verifier / last_auth_url so a failed write can't strand the auth flow,
and storeAuthorizationState persists the state record before
last_auth_url so a partial failure can't leave an auth URL whose state
has no backing record.
* chore(typescript): version packages (canary)
* feat(cli/auth): Node OAuth provider + agent-ready CLI client (#1452)
* feat(cli/auth): Node OAuth provider + agent-ready CLI client
Adds a real OAuth flow to the `mcp-use client` CLI so it works against
OAuth-protected MCP servers without requiring a browser harness, and
makes every one-shot client subcommand exit cleanly so headless agents
can drive it.
mcp-use:
- New `mcp-use/auth/node` entrypoint exporting `NodeOAuthClientProvider`,
`FileKVStore`, the `KVStore` type, and re-exporting the SDK's `auth`
and `UnauthorizedError`.
- `NodeOAuthClientProvider` implements `OAuthClientProvider`, owns a
loopback callback server (preferred port 33418, walks up to 33427 on
conflict, persisted across runs), and exposes `getAuthorizationCode()`
for the orchestrator pattern in `useMcp.ts`. Adds `hasPendingFlow` so
callers can detect when the SDK transport already triggered the
redirect on a 401 and skip straight to the code exchange.
- `FileKVStore` writes tokens / client info / code verifiers to one file
per key under `~/.mcp-use/oauth/<urlHash>/` with `0o600` perms and
atomic rename on write.
@mcp-use/cli:
- `client connect <url>` auto-runs OAuth on `UnauthorizedError` when no
`--auth` is supplied. New flags: `--no-oauth`, `--auth-timeout`.
`isUnauthorized` also matches the rewrapped 401 the HttpConnector
throws (plain Error with `code = 401`) so the OAuth retry actually
triggers instead of `process.exit(1)`-ing before the browser callback
arrives.
- `client auth status|refresh|logout [session]` for token introspection,
forced refresh, and revocation.
- One-shot subcommands (`tools list/call/describe`, `resources
list/read`, `prompts list/get`, `auth *`) now close their in-memory
sessions and exit at the end so the underlying socket can't keep the
Node event loop alive. Long-running commands (`subscribe`,
`interactive`) are unchanged.
- Follow-up commands on OAuth sessions transparently refresh expiring
JWTs. If the refresh token itself is dead, the CLI prompts to re-auth
on TTY or prints the exact `connect` command on non-TTY.
* chore: fix http disconnect race condition
* chore(server): hint at mcp-use CLI client on startup
Print a one-line dim-gray tip after the existing Listening / Endpoints
lines so devs see how to connect with `mcp-use client connect <url>`
from the CLI client added in this branch.
* fix(cli): exit 1 when `client tools call` returns isError
The CLI printed "Tool execution failed" but still exited 0, so headless
agents couldn't tell a successful tool call apart from a failed one.
Honor `callResult.isError` and exit 1 in both default and --json modes;
the formatted output is still printed first so the failure detail stays
visible.
* feat(cli): borderless aligned-columns table rendering
Replace the box-drawing ASCII table in `mcp-use client {tools,resources,
prompts,sessions} list` with a gh/kubectl-style borderless layout: UPPERCASE
bold headers, two-space gutter, ANSI-stripped width math, ellipsis truncation
for long descriptions, sized to the terminal width (or 100 cols).
Tool rows now also show a MODE column (read-only / write / destructive,
derived from MCP tool annotations) and an ARGS column (required/total).
When stdout is not a TTY (pipes, agents, CI), every list command emits
tab-separated values with no header, no decorative banners, and no ANSI —
matching how the GitHub CLI behaves so the output is parseable by AI
agents and shell pipelines.
* fix(cli): skip auto-opening browser for OAuth in non-TTY contexts
When `mcp-use client connect` (or a session restore) hits an OAuth flow,
the CLI used to launch a browser unconditionally. That's surprising when
an agent or CI script runs the command — the agent can't see the
browser, and the user gets an unexpected window.
`stdout.isTTY` now gates the browser launch: TTY opens it as before;
non-TTY prints the authorization URL to stderr and waits on the loopback
callback. The leading message also flips to "OAuth authentication
required." in non-TTY mode so the log doesn't claim a browser was opened.
* fix(auth): real forceRefresh + HTML-escape OAuth loopback failure page
- `OAuthSessionStore.forceRefresh()` calls the dedup'd refresh path
directly. `NodeOAuthClientProvider.forceRefresh()` now delegates to
it. The previous "blank access_token and re-read" trick never
triggered a refresh because `tokens()` gates that path on a truthy
access_token, so `mcp-use client auth refresh` was a no-op.
- Escape both `error` and `error_description` in the loopback failure
HTML. The previous version stripped `<>&` from the description but
interpolated `error` unsanitized, allowing reflected XSS on the
localhost callback page.
* feat(cli): accept key=value args for `client tools call` and `client prompts get`
Replace the single JSON-string argument with variadic `key=value` positionals.
Values are type-coerced from the tool's input schema (number/integer/boolean/
array/object/nullable). `key:=<json>` (httpie convention) forces JSON parsing
for nested objects/arrays. A leading `--` on a key is stripped so flag-style
habits work. The legacy single-JSON-object form is still accepted when the
sole positional starts with `{`. Same syntax applies to `client prompts get`.
Errors print usage examples and the target tool's schema so agents can self-
correct.
* fix(cli): surface tool call error details in `client tools call`
Label error content explicitly, color text content red, render
`structuredContent` for both success and failure, and print a fallback
when the server returned neither. Connection-level failures also print
any attached `data` payload.
* chore(cli): satisfy lint+prettier on format.ts ANSI regex
* chore(typescript): version packages (canary)
* feat(cli): add mcp-use screenshot command for visual feedback loop (#1432)
* feat(cli): add mcp-use screenshot command for visual feedback loop
Implements `mcp-use screenshot` — a CLI command that renders an MCP Apps
view headlessly via Playwright and saves a PNG. Designed for AI agent
visual feedback loops where the assistant calls a tool, screenshots the
result, and self-corrects without human round-trips (MCP-1566).
- New `packages/cli/src/commands/screenshot.ts` with --tool, --args,
--width, --height, --theme, --output, --header, and --server flags
- Auto-spawns a dev server if none is running; probes /inspector/health
first and tears the child process down on exit
- Default output path: `./<view>-<hash>.png` (6-char stable hash of
props + theme so re-runs at the same inputs overwrite the same file)
- New `/inspector/preview/:view` client-side route in the inspector SPA
- New `<ViewPreview>` component wrapping `<MCPAppsRenderer>` in
fullscreen+chromeless mode; sets `data-view-ready` on body once the
AppBridge handshake completes and fonts are ready
- `MCPAppsRenderer` gains `onReady` and `chromeless` optional props;
`chromeless` suppresses the fullscreen navbar and top padding
- Playwright added as optional peer dep on `@mcp-use/cli`; missing
Playwright prints an install hint and exits non-zero
- Unit tests covering arg parsing, hash stability, error paths
- Example PNGs from weather-display view as end-to-end verification
* style: apply prettier formatting to screenshot command files
* fix(cli): use timestamp instead of hash in default screenshot filename
Replaces the sha256-based hash suffix with a YYYYMMDDTHHmmss timestamp so
saved screenshots are sorted chronologically and self-descriptive.
* feat(cli, inspector): drop Playwright, use system Chrome via CDP
Replaces the optional `playwright` peer dep + `--install` flow on the
`mcp-use screenshot` command with a hand-rolled minimal Chrome DevTools
Protocol client that drives the user's existing system Chrome / Chromium
/ Edge / Brave install. No new dependencies — uses the `ws` package the
CLI already shipped. CLI dist is unchanged at 1.7 MB; users no longer
need to download a ~170 MB Chromium binary or run a separate install
step before screenshotting.
CLI changes:
- New `src/utils/chrome-path.ts`: detect Chrome-family binaries on
macOS / Linux / Windows. Honors `MCP_USE_CHROME_PATH`,
`PUPPETEER_EXECUTABLE_PATH`, and `CHROME_PATH` overrides.
- New `src/utils/cdp-screenshot.ts`: minimal CDP client (~200 LOC).
Spawns Chrome with `--headless=new --remote-debugging-port=0`, parses
the WS URL from stderr, opens a target via `Target.createTarget` +
`Target.attachToTarget {flatten:true}`, applies viewport + theme via
`Emulation.setDeviceMetricsOverride` / `setEmulatedMedia`, polls
`Runtime.evaluate` for the readiness selector, captures via
`Page.captureScreenshot`. Cleans up child + temp `--user-data-dir`.
- Drop `--install` flag, `loadPlaywright`, `runInstall`, and the
`playwright` peer + dev dependency from `package.json`.
- Split `--server` into `--inspector` (SPA host) and `--mcp` (RPC
target) so a remote MCP can be rendered inside a local inspector.
- Add `--delay <ms>` so chart libraries that animate past the readiness
signal can settle before capture, and emulate
`prefers-reduced-motion: reduce` to suppress animations where
possible.
- New `tests/chrome-path.test.ts` covers env-var precedence, platform
fallthrough, and the throwing wrapper.
Inspector changes:
- `ViewPreview.tsx` reads a `?headers=<base64 JSON>` query param and
forwards it as `headers` to `addServer`, so the preview's MCP
connection authenticates against a remote server. Temporary plumb
until the auth-aware MCP client lands in the CLI.
Verified end-to-end against `mcp.manufact.com/mcp`'s
`get_server_client_breakdown` view rendered through a local inspector.
* feat(cli, inspector): screenshot uses CLI session, inject bundle via CDP
`mcp-use screenshot` now reuses the saved OAuth session from `mcp-use
client connect` instead of requiring `--auth <token>` and `--mcp <url>`
on every invocation. The CLI calls the tool and reads the widget
resource itself, then injects the result into Chrome via CDP
`Page.addScriptToEvaluateOnNewDocument` as `globalThis.__mcpUsePreviewBundle`
before navigating to the inspector preview route. The OAuth token never
enters the browser and there's only one MCP connection per screenshot
instead of two.
- New `cli/src/utils/session.ts` extracts `getOrRestoreSession`,
`cleanupAndExit`, `activeSessions`, and `getCliClientInfo` from
`client.ts` so screenshot can reuse them.
- `screenshot.ts` drops `--auth` and `--header`; adds `--session <name>`
(defaults to active session). `--mcp <url>` remains as an
unauthenticated escape hatch.
- `cdp-screenshot.ts` accepts an optional `bundle` and injects it
before any document scripts run.
- `ViewPreview.tsx` splits into a bundle-mode branch (no
`useMcpClient`, no live MCP connection) and the existing live branch
for interactive debugging. The shared body-styling and readiness
effects are factored into `usePreviewViewport` and
`usePreviewReadinessSignal`.
* feat(cli): auto-capture widget screenshot in `client tools call`
When `mcp-use client tools call <name>` invokes a tool that declares a UI
resource (`_meta.ui.resourceUri` or `openai/outputTemplate`), the CLI now
captures a widget screenshot using the same pipeline as `mcp-use screenshot`.
The tool result is reused (no double tool-call) and the dev server is
auto-spawned if needed.
`--no-screenshot` opts out, `--screenshot-output <path>` overrides the
default `./<view>-<timestamp>.png` path. Screenshot failures warn to stderr
but don't fail the tool call. The success line is also on stderr so
`--json` stdout stays a clean CallToolResult.
* chore: remove SPEC.md from PR
* chore: remove example screenshots from PR
* refactor(cli): always spawn fresh inspector for screenshot, strict health probe
The screenshot path now always spawns @mcp-use/inspector standalone on a free
port instead of probing localhost:3000 / falling back to `mcp-use dev`. Two
fixes in one:
- A Vite/SPA dev server returns 200+HTML for any path, so the prior probe
(res.ok only) misidentified unrelated dev servers as a valid inspector.
probeServer now requires JSON `{ status: "ok" }` on /inspector/health.
- Spawning the inspector directly removes the need to be in a project with
an MCP server entry, so `screenshot` works from any cwd against any
remote MCP. `--inspector <url>` still works for pointing at an existing
instance.
Drops the cliBin plumbing now that screenshot no longer shells out to
`mcp-use dev`.
* chore: format
* fix(cli): use posix path joining in findOnPath for cross-platform tests
`findOnPath` is only called from the Linux branch of `findChrome`, but
relied on host-OS `path.join`. On Windows CI, tests that mock
`process.platform = "linux"` saw `path.join("/usr/bin", "google-chrome")`
return `\usr\bin\google-chrome`, breaking the PATH-walk assertion.
Use `path.posix.join` and a `:` separator unconditionally so the function
behaves the same regardless of the host OS.
* chore(typescript): version packages (canary)
* feat(cli): support remote CDP browsers via --cdp-url in screenshot (#1477)
Adds a `--cdp-url <ws|wss>` flag to `mcp-use screenshot` so the
screenshot pipeline can drive a hosted Chromium (e.g. Notte) instead of
spawning a local Chrome. Useful for running the pipeline in sandboxed
environments where a local browser install isn't available.
When the flag is set, `captureScreenshot` skips Chrome spawn / temp
user-data-dir / stderr parsing and connects the existing CDP client
directly to the supplied WebSocket. To pick up a flat-mode page session
it uses `Target.setAutoAttach` and listens for the resulting
`Target.attachedToTarget` event — providers like Notte forbid explicit
`Target.attachToTarget`. The local-Chrome path is unchanged when
`--cdp-url` is omitted.
The hosted preview already supported via `--inspector <url>` pairs
naturally: point the remote browser at a publicly reachable inspector
deployment and the bundle-mode preview renders without any local
infrastructure.
* Fix/duplicate exports 1449 (#1453)
* chore(typescript): resolve duplicate exports flagged by Knip (#1449)
- Removed redundant JsonRpcLoggerView default export\n- Removed Tel alias in favor of canonical Telemetry class\n- Unified re-exports in mcp-use to a single canonical path\n- Added changeset for breaking change in mcp-use
* chore: restore Tel alias with @alias directive and downgrade changeset to patch
# Conflicts:
# libraries/typescript/.changeset/resolve-duplicate-exports.md
# libraries/typescript/packages/mcp-use/src/telemetry/telemetry-browser.ts
# libraries/typescript/packages/mcp-use/src/telemetry/telemetry-node.ts
* feat(telemetry): re-export Tel alias from public entrypoints
* fix(telemetry): add missing Tel export to telemetry entry point
* feat(telemetry): explicitly export Tel from browser and react entrypoints
* feat(telemetry): use Tel alias consistently across the codebase
* chore(telemetry): correct changeset description and revert nit comment churn
- Rewrite changeset to match the PR (the re-exports from mcp-use/react
and mcp-use/browser are not removed; only Tel alias is suppressed via
@alias and the canonical source path is unified).
- Align telemetry-browser.ts class docstring example to use Tel for
consistency with telemetry-node.ts.
- Restore the more informative comments on browser.ts, react/index.ts,
and tel-fetch.ts.
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* feat(cli): add --header/-H to mcp-use screenshot for authenticated --mcp servers (#1491)
Lets `mcp-use screenshot --mcp <url>` reach an authenticated MCP server
without running `mcp-use client connect` first. Repeatable `-H "Key: Value"`
flags (curl-style) are parsed into the ad-hoc client's headers; only
honored with `--mcp <url>` so misuse alongside `--session` errors clearly.
* chore(typescript): version packages (canary)
* fix(inspector): implement dark-mode aware scrollbars (#1484)
* fix(inspector): implement dark-mode aware scrollbars #1479
* Improve dark mode scrollbar styling and hover visibility
* Add changeset for inspector scrollbar improvements
* chore: rerun ci
* chore(typescript): version packages (canary)
* feat(cli): drop "active session" model — every client command takes a name (#1494)
* fix(cli): stop printing tool results twice when servers return structuredContent
Per the MCP spec, a tool that returns `structuredContent` SHOULD also serialize
the same JSON into a `TextContent` block for backwards compatibility. The
client was rendering both, so every call to a structured-output tool printed
the JSON payload twice. Treat `structuredContent` as the canonical form: when
it's present, the content block is suppressed and only the structured JSON is
shown.
* feat(cli)!: drop the "active session" model — every client command takes a name
The CLI used to track an implicit active client and let you switch between
saved clients with `client sessions switch`. Per-command flags like
`--session` and `--name` were sprinkled around to override it. The active
state was hidden, easy to get wrong, and forced every subcommand to handle
"no session" as a real case.
It's gone. The client name is now a required positional, and every
per-client command lives under `mcp-use client <name> <scope> <action>`.
BREAKING CHANGES:
- `client connect <url> --name <name>` → `client connect <name> <url>`
- `--session <name>` removed from every per-client subcommand
- `client sessions list` → `client list`
- `client sessions switch` removed (no active client to switch to)
- `client disconnect --all` removed; disconnect each client by name
- `mcp-use screenshot` no longer falls back to the active session;
pass `--session <name>` or `--mcp <url>` explicitly
Existing `~/.mcp-use/cli-sessions.json` files keep working; the unused
`activeSession` field is silently ignored on load. Docs and integration
tests are updated for the new shape, and the CLI gives clearer feedback
for the shape mistakes the new syntax invites.
* fix(cli): tests no longer touch the developer's real ~/.mcp-use directory
Two leaks are closed:
- `session-storage.test.ts` computed its target path from `os.homedir()` and
`rmSync`'d it in `beforeEach`/`afterEach`, so running `pnpm test` during
local development deleted any saved clients on disk. The tests now mock
`node:os.homedir` to a per-process temp directory.
- `cli-integration.test.ts` spawned the real CLI as a subprocess and so read
the developer's real `cli-sessions.json` when running `client list`.
`runCLI` now sets HOME (and USERPROFILE) to an isolated temp dir for
every spawn.
* fix(cli): friendlier `client <name>` help and rename saved-client copy to "server"
Two related polish fixes for the CLI:
- `mcp-use client <name>` (no subcommand, or with `--help`) used to fall
through to commander's per-server help even when the name wasn't a
saved server, leaking subcommand surface instead of telling the user
how to make the name resolve. It now prints `Server '<name>' not
found.` plus a `client connect <name> <url>` hint and exits non-zero.
Existing servers still get the full help.
- User-facing copy throughout the `client` subcommand tree (help text,
table headers, errors, REPL prompts, docs) referred to saved entries
as "clients" — but the CLI itself is the client, and the things it
connects to are servers. Renamed to "server" / "saved server"
consistently. The `mcp-use client` command name is unchanged, so no
scripts break.
* fix(cli): tighten client routing and trim review nits from prior commits
- index.ts: pin per-client routing to argv[2] instead of indexOf("client", 2),
which would otherwise match the literal "client" appearing later in argv
as someone's argument value and mis-route to a tailored error.
- index.ts: route the two routing-layer error prints through formatError for
style parity with the rest of the codebase.
- client-auth.ts: destructure { name, url } from `target` after the guard so
the `target!` non-null assertions disappear.
- session-storage.ts: drop the existsSync guard around mkdir (recursive mkdir
is already a no-op when the dir exists) and memoize the call.
- cli-integration.test.ts: prettier reflow that was missed in a prior commit.
* feat(cli): add `mcp-use client remove <name>` to drop a saved server
Saved servers could be added (`client connect`) and listed (`client list`),
but the only way to delete one was to hand-edit
`~/.mcp-use/cli-sessions.json`. `client remove <name>` now does this: it
errors if no server by that name exists, closes any in-process connection,
deletes the entry, and — for OAuth-authenticated servers — also revokes
the stored tokens for that URL. If another saved server still points at
the same URL the tokens are kept (they're URL-keyed, so wiping them would
break the sibling); the CLI prints which sibling is keeping them alive.
* fix(cli): stop auto-opening the browser during OAuth flows
When `mcp-use client` commands hit a 401 they would launch the user's
browser via the `open` package on TTYs, and only print the URL when stdout
wasn't a TTY. That was surprising in two directions: scripts that did
happen to inherit a TTY got pop-up windows, and the heuristic missed
plenty of agentic/CI environments that *do* keep a TTY attached. The CLI
now always prints the authorization URL and waits on the loopback
callback — the user opens the link themselves whenever it's convenient.
Other CLI surfaces that intentionally open a browser (`deploy --open`,
the `auth login` flow) are unchanged.
* fix(cli): address review feedback for client-name refactor
- formatToolCall: when structuredContent is present, suppress only the
duplicate TextContent blocks. Image/resource markers are kept since they
carry information the structured payload doesn't (and the terminal can
only render them as placeholders anyway).
- index.ts: attach a .catch() to the per-server routing IIFE so a rejection
from parseAsync surfaces a clean error message + exit 1 instead of an
UnhandledPromiseRejection trace.
- connectCommand: reject saved-server names that collide with per-server
scope tokens (tools, resources, prompts, auth, disconnect, interactive),
which would otherwise be silently unreachable through the new routing.
- session.ts: rename a stray "Failed to restore client" log to "server" to
match the rest of the renamed copy.
* chore(typescript): version packages (canary)
* feat(cli): move screenshot under client and require explicit session name (#1497)
* feat(cli): move screenshot under client and require explicit session name
The standalone `mcp-use screenshot` command is folded into `mcp-use client`:
- Saved-server form: `mcp-use client <name> screenshot --tool <tool>` reuses
the saved server's auth from `mcp-use client connect`. The `--session` flag
is removed — the server name is the positional, matching every other
per-client command.
- Ad-hoc form: `mcp-use client screenshot --mcp <url> --tool <tool>` keeps
`-H/--header` for one-off authenticated captures (programmatic / CI use
that doesn't want to save a server first).
`screenshot` becomes a reserved subcommand name under `client`.
* refactor(cli): lift session name out of ScreenshotOptions into a context arg
Replace the internal `session?` field on `ScreenshotOptions` (set via spread
into Commander's options bag) with a separate `ScreenshotContext` parameter
carrying `sessionName` and `usagePrefix`. Drop the default-value parameter
on `screenshotCommand` and strip redundant WHAT-comments in client.ts.
* chore(typescript): version packages (canary)
* feat(cli): add --device-scale-factor flag for high-DPI screenshots (#1498)
Exposes the previously-hardcoded CDP deviceScaleFactor on both the
dedicated `mcp-use screenshot` command (`--device-scale-factor <n>`)
and the auto-screenshot in `mcp-use client <name> tools call`
(`--screenshot-device-scale-factor <n>`). Defaults to 1, accepts
fractional values, bounded to (0, 4]. Closes MCP-2167.
* chore(typescript): version packages (canary)
* fix(cli): error when client screenshot omits required tool args (#1499)
* fix(cli): error when client screenshot omits required tool args
`mcp-use client screenshot --tool <tool>` silently produced a blank
PNG and exited 0 when the tool declared required arguments but none
were passed — the empty-args call reached the server, the iframe
rendered nothing, the readiness selector still flipped, and capture
proceeded. Mirror the `client tools call` validation: error with
"This tool requires arguments." plus the tool schema, exit 1,
skip the inspector/browser spawn.
* fix(cli): use context.usagePrefix in screenshot args error path
Typo introduced in
|
||
|
Andrew Khadder
|
6bf61fdcb8 |
docs(skills): add Clerk OAuth ref and link standalone provider templates (#1463)
Adds a Clerk authentication reference to the mcp-apps-builder skill (and
its mcp-builder / chatgpt-app-builder mirrors), and links the standalone
mcp-oauth-{provider}-template starter repos from each provider guide.
Closes MCP-2065
|
||
|
Andrew Khadder
|
1bdec92bae |
Canary (#1387)
* fix(cli): add auto-port discovery to mcp-use start command (#1377) * fix(cli): add auto-port discovery to mcp-use start command When port 3000 (or the configured port) is already in use, the start command now automatically finds and uses the next available port instead of failing silently — matching the behavior already present in dev. * chore: add changeset for auto-port discovery fix in cli * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(cli): add ORG column to deployments list (#1378) * feat(cli): add ORG column to deployments list output Closes #1673 * chore: add changeset for deployments list ORG column * chore(typescript): version packages (canary) * feat(cli): add --org flag to login for non-interactive org selection (#1379) * feat(cli): add --org flag to login for non-interactive org selection (MCP-1670) Agents invoking `mcp-use login` could authenticate in the browser but then got stuck on the post-login org picker because they have no way to write to the running process's stdin. `--org <slug|id|name>` now picks the organization up-front and skips the prompt, matching the resolver already used by `mcp-use deploy --org`. When login runs without a TTY and no `--org` is supplied, the command now fails fast with a message pointing at the flag instead of hanging. The org resolver is extracted into a pure `resolveOrgFromOption()` helper in `src/commands/auth.ts`, covered by real unit tests in `tests/auth.test.ts`. * refactor(cli): dedupe org-resolution logic via resolveOrgFromOption Reuse the helper added for `login --org` from `deploy --org` and `applyOrgOption` (used by `servers`/`logs`/`env`) so the slug/id/name matching lives in one place. Also tighten a JSDoc and fix a misleading test name. * style(cli): apply prettier formatting to resolveOrgFromOption * test(cli): use generic 'Personal' org name in auth test fixtures * fix(cli): surface org-selection errors from login instead of swallowing them The try/catch around testAuth also wrapped the new org-selection branches, silently eating the "--org not found" and "no TTY for interactive selection" throws and leaving the user logged in without an org. * chore(typescript): version packages (canary) * feat(cli): drop-in MCP server inside Next.js apps via --mcp-dir (#1332) * feat(typescript): Add scopes customization to oauth providers * refactor: move scopesSupported to BaseOAuthConfig and remove test file * feat(typescript): add scopesSupported to better auth provider * fix: return scopesSupported properly for Better Auth provider factory * docs(oauth): add scopesSupported to provider docs * chore: format * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): add missing fields to CustomProviderConfig to match docs (#1136) The Custom Provider docs show config fields (userInfoEndpoint, jwksUri, clientId, clientSecret, mode, scopes, audience) that don't exist in the code. This adds all documented fields to CustomProviderConfig and CustomOAuthConfig, implements the corresponding getters on CustomOAuthProvider, and resolves alias pairs (jwksUrl/jwksUri, scopes/scopesSupported). * style: fix prettier formatting in custom oauth provider * fix: add OAuthProvider interface methods and fix unsafe type casts - Add getClientId(), getUserInfoEndpoint(), getAudience() as optional methods on OAuthProvider interface so new CustomOAuthProvider getters are callable without type casting - Make CustomOAuthConfig.jwksUrl optional (users provide their own verifyToken, JWKS URL isn't always needed) - Fix jwksUrl fallback from empty string to undefined in factory to avoid silent runtime failures - Replace unsafe (provider as any).config?.clientId with type-safe provider.getClientId?.() in routes.ts - Add getClientId() to WorkOSOAuthProvider for the pre-registered client detection in direct mode metadata * fix(typescript): remove scopes alias from CustomProviderConfig in favor of scopesSupported * fix(typescript): remove jwksUri alias from CustomProviderConfig in favor of jwksUrl * chore: update changeset to reflect jwksUrl and scopesSupported field names * fix: inline jwksUrl and scopesSupported in CustomOAuthProvider constructor * fix: simplify oauthCustomProvider by spreading config into constructor * fix: remove redundant comments from CustomProviderConfig * chore(typescript): version packages (canary) * fix(inspector): hide thinking indicator when assistant message has parts (#1315) * fix(inspector): hide thinking indicator when assistant message has parts When streaming via the server-side path, content is delivered through the parts array while the message's content field stays empty until the stream reader fully closes. The isThinking check only looked at content, causing a window where the thinking indicator reappeared after the done event but before setIsLoading(false) ran in the finally block. Now we check parts first — if any parts exist, the model has produced output and we should not show the thinking indicator. * chore: add changeset for thinking indicator fix * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in Google provider (#1317) * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in JSON Schema output z.record() in @langchain/core's serializer emits a `propertyNames` keyword for constrained or enum key types. Google's Generative AI API rejects schemas containing `propertyNames`, breaking tool calls when using the Google provider. Switching to z.object({}).catchall() produces identical runtime behavior but serializes to clean `additionalProperties` without `propertyNames`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: add changeset for Google provider propertyNames fix --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(typescript): version packages (canary) * Major/cli/device flow (#1294) * fix(inspector): sync URL tab param on tab change to preserve state on refresh When switching tabs via header clicks, keyboard shortcuts, or command palette, only React state was updated but the URL was not. This meant refreshing the page would lose the active tab. Now all tab changes also update the ?tab= query parameter using navigate() with replace:true. Closes #1157 * fix: update import paths for Windows compatibility and modify postins… (#1255) * fix: update import paths for Windows compatibility and modify postinstall script in package.json templates - Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms. - Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation. * fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility - Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems. * changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: add changeset * chore(typescript): version packages (canary) * feat(auth): enhance login command with API key option and implement device code flow - Updated the login command to allow non-interactive login using an API key. - Introduced device code flow for authentication, including functions to request device codes and poll for access tokens. - Refactored API key creation to use access tokens and updated related utility functions for better authentication handling. * refactor(cli): improve code formatting and readability in authentication commands - Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks. - Removed unused import in `auth.ts` to clean up the codebase. - Enhanced error messages for clarity in authentication processes. * refactor(logging): change logger level from info to debug for various messages - Updated multiple logging statements across the codebase to use `logger.debug` instead of `logger.info` for routine messages, enhancing log clarity and reducing noise in production logs. - This change applies to session management, agent initialization, and connection handling, ensuring that only significant events are logged at the info level. * fix(oauth): correct Auth0 issuer handling and improve token validation - Updated the Auth0 issuer to include a trailing slash to comply with token validation requirements. - Separated baseUrl from issuer to prevent double-slash URLs in JWKS, auth, and token endpoints. - Added direct mode for the Auth0 provider to enable MCP clients to communicate directly for OAuth flows. - Enhanced protected resource metadata to include scopes_supported, ensuring clients request appropriate scopes during authorization. * update * lint --------- Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * refactor(cli): update authentication and organization handling (#1326) - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * fix(inspector): use correct OAuth callback URL when mounted at /inspector (#1323) * fix(inspector): use correct OAuth callback URL when mounted at /inspector The BrowserOAuthClientProvider defaulted redirect_uri to /oauth/callback but the React Router (basename="/inspector") only mounts OAuthCallback at /inspector/oauth/callback, causing a blank screen after auth. Root fix: add defaultCallbackUrl prop to McpClientProvider so the inspector declares the correct path once at the provider level. All addServer calls inherit it automatically — no per-connection wiring needed. Removes the "Redirect URL" field from the auth dialog: it was never actually passed to the connection and couldn't be set to a value the inspector would handle. * chore: bump mcp-use changeset to minor (new public API prop) * docs: document defaultCallbackUrl in McpClientProvider; remove redirectUrl from inspector connection-settings * chore(typescript): version packages (canary) * Device flow 2 (#1329) * refactor(cli): update authentication and organization handling - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * refactor(cli): streamline organization ID resolution in deploy command - Replaced the previous method of resolving the organization ID with a direct call to api.resolveOrganizationId() for improved clarity and efficiency. - Removed unnecessary comments and code related to organization ID handling, enhancing overall code readability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Fix/cli/git create (#1331) * refactor(cli): enhance deployment command and GitHub integration - Added new GitHub API methods for creating repositories and retrieving installation IDs. - Introduced git utility functions for initializing repositories, adding remotes, and committing changes. - Improved environment variable parsing and error handling in the deployment command. - Cleaned up code for better readability and maintainability. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deployment command options and improve code readability - Added a new option for specifying the deployment region in the CLI. - Rearranged and cleaned up command options for better organization. - Improved error handling and logging in the deployment process. - Refactored code for better readability and maintainability across several files. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(cli, mcp-use): drop-in MCP server inside Next.js apps Adds a --mcp-dir flag to `mcp-use dev/build/start` and matching mcp-use.config.json `mcpDir` option so a developer can drop a single `src/mcp/` folder into an existing Next.js repo and get a working MCP server + widgets — no sibling package, no restructure, no second codebase. CLI (@mcp-use/cli) - New `--mcp-dir <dir>` flag on dev/build/start. When set, defaults the server entry to `<dir>/index.ts` and the widgets dir to `<dir>/resources`. `mcp-use.config.json` supports the same value via a new `mcpDir` field. - Widget Vite builds now register `vite-tsconfig-paths` against the project's tsconfig when present, so widgets can `import '@/components/...'` and resolve through the app's own paths. Tailwind `@source` also scans the project's `src/` so classes on shared components come through. - Auto-shim Next.js server-runtime modules when `next` is detected in the project's package.json: `server-only`, `client-only`, `next/cache`, `next/headers`, `next/navigation`, `next/server`. Ships both an ESM loader (for `import`) and a CJS `Module._resolveFilename` patch (for the `require()` calls tsx emits when compiling TS in a non-`type: module` package). Covers both the HMR in-process path and the tsx-watch subprocess path via `NODE_OPTIONS`. - Loads Next.js's env cascade (`.env` / `.env.development` / `.env.local` / `.env.development.local`) so tools transitively imported from the app find the vars they expect without the user mirroring them by hand. - Replaces tsImport-with-namespace (which causes tsx's resolver to bail on transitive `@/*` imports) with a namespace-less tsx/esm + tsx/cjs register pair, then native dynamic `import()` with `?t=` cache-busting on reload. This is what finally makes `@/lib/...` imports resolve in HMR mode. mcp-use (runtime) - `mountWidgets` at both call sites in MCPServer now reads `process.env.MCP_USE_WIDGETS_DIR` (set by the CLI when --mcp-dir is used) as the default. Nothing in user code changes. - `mount-widgets-dev.ts` loads `vite-tsconfig-paths` from the user's project when a root tsconfig.json exists and installs it in front of the dev Vite server's plugin chain. The hardcoded `"@": resources` alias now only fires as a fallback. Tailwind `@source` auto-extends to scan `<projectRoot>/src` under the same conditions. Validated end-to-end against a real Next.js 16 + React 19 app: node .../cli/dist/index.cjs dev --mcp-dir src/mcp → tsx resolves @/lib/assistant/tools through project tsconfig → server-only / next/cache / next/headers shims pass → .env.local loads (FLAGS, Supabase keys) → tools/list returns both tools with correct Apps SDK widget metadata → tools/call returns structured props + text output → /mcp-use/widgets/contact_card/ serves the widget HTML with @/components resolved via the project's own tsconfig paths * fix(inspector): detect Hono via duck-typing, not instanceof `mountInspector(app)` chooses between a fast Hono-direct path and a slow Express-compat bridge based on `app instanceof Hono`. When the host (`mcp-use`) and `@mcp-use/inspector` resolve different copies of `hono` from `node_modules` — common in apps with deps that pin their own hono version (`@hono/node-server`, `@browserbasehq/stagehand`, etc.) — `instanceof` returns false even for a real Hono app. The Express bridge then runs against a Hono `Context` and crashes on every request trying to read `req.headers.host`. Switch to a duck-type check: Hono exposes `.fetch(Request) => Response`, Express does not. The check is unambiguous in practice and works regardless of which physical hono module produced the app. Surfaces in the new Next.js drop-in flow (--mcp-dir) because Next.js apps invariably have other deps that bundle hono. * fix(widgets): pin React across HMR reloads to keep hooks dispatcher alive When a widget lives in an existing app (the --mcp-dir drop-in flow), Vite's walk-up react resolution from `.mcp-use/<widget>/` could land on a different physical `node_modules/react` than the one item-brain's shared components see. After an HMR re-optimize, the new React module instance replaced the running one and React's hooks dispatcher snapped to null, producing "Cannot read properties of null (reading 'useState')" on the next render. First load was fine; only post-edit renders crashed. Pin react / react-dom / react/jsx-runtime / react/jsx-dev-runtime to the absolute paths of the user-project's installed copies via a tiny `resolveId` plugin scoped to client (browser) resolution only. SSR mode deliberately falls through to default resolution because the metadata- extraction pass uses `ssrLoadModule` and ESM-evaluating CJS `react/index.js` crashes with `module is not defined`. The plugin honors `options.ssr` and returns `null` in that case; SSR also gets react/react-dom marked as external for belt-and-braces. Validated on a real Next.js 16 + React 19 app: edit the widget tsx mid-flight → no React errors, widget HTML still serves 200, tools/call returns updated structuredContent. * fix(widgets): rely on Vite dedupe instead of pinning React paths The previous fix pinned `react` and `react-dom` to the user-project's absolute file paths via a custom `resolveId` plugin. That made Vite serve the raw CJS files via `@fs/`, skipping the optimizeDeps pre-bundling that converts them to ESM with named exports. Result: the browser failed with "does not provide an export named 'jsxDEV'" (the first React subpath it tried to load) and would have failed on `react/index.js` next ("module is not defined") because the raw CJS has no ESM default export. Drop the plugin and broaden Vite's `dedupe` list to cover every React entrypoint the widget code might import: react react-dom react/jsx-runtime react/jsx-dev-runtime react-dom/client `dedupe` ensures Vite resolves a single instance of each module regardless of importer location, which is what protects the hooks dispatcher across HMR cycles. The original concern (duplicate React post-edit producing "Cannot read properties of null (reading 'useState')") is the dedupe contract — `dedupe` is the supported way to enforce it, and it doesn't bypass optimizeDeps. Also drop the now-unused SSR external for React (added defensively when the alias was breaking SSR; no longer relevant). Verified end-to-end: react/react-dom/jsx-dev-runtime all serve from .vite/deps/*.js?v=<hash> (pre-bundled ESM), HMR cycle clean, no useState/jsxDEV errors after editing the widget mid-flight. * chore: address PR review + fix prettier/CI Prettier: - `prettier --write` on the three files flagged by format:check (cli/src/index.ts, cli/src/utils/project-config.ts, mcp-use/src/server/widgets/mount-widgets-dev.ts). No logic changes. project-config.ts: - `loadProjectConfig`: distinguish ENOENT from JSON parse errors. Malformed mcp-use.config.json now throws `Invalid JSON in <path>: <reason>` instead of being silently ignored. - `resolvePort`: validate each source (CLI flag, PORT env, config.port) against `Number.isInteger(…) && 0 ≤ n ≤ 65535`. Invalid values at one level fall through to the next, so `--port abc` or `PORT=abc` no longer advertise NaN. - Tests: add `tests/project-config.test.ts` — 23 unit tests covering `loadProjectConfig` (missing / valid / malformed), `resolveMcpDir`, `resolveWidgetsDir`, `resolveEntryFile` (every precedence level + mcpDir-specific errors + legacy fallback), and `resolvePort` (NaN handling + out-of-range + per-source fallthrough). mcp-server.ts: - `mountWidgets` call: match the comment's intent by only forwarding `resourcesDir` when `MCP_USE_WIDGETS_DIR` is set. When unset, `mountWidgets` applies its own default, so the spread pattern keeps the runtime behavior identical while letting future default-logic changes take effect. mount-widgets-dev.ts: - `vite-tsconfig-paths` resolution now falls back to `@mcp-use/cli`'s bundled copy when the user's project doesn't have it installed directly. pnpm/strict hoisting configurations couldn't resolve it through `userProjectRequire` alone, which silently dropped `@/*`-alias support for Next.js drop-in projects. - Extract the Tailwind `@source "<projectSrc>"` line computation into a module-level `computeProjectSrcSourceLine` helper. Both CSS generation sites (initial mount + on-the-fly HMR) now call the same function, which also fixes the indentation mismatch Copilot flagged in the second block. * fix(cli): drop shadowed require("node:url") in HMR onImport callback The outer destructure at the top of the HMR block already pulls in `fileURLToPath` from `node:url`. The inline `require("node:url")` inside the `onImport` callback re-declares it (making the outer binding unused) and uses CJS `require()` in an ESM file — tripping two eslint rules: - @typescript-eslint/no-unused-vars on the outer `fileURLToPath` - @typescript-eslint/no-require-imports on the inner require Use the outer binding directly. Functionally identical; eslint clean. * fix(cli): make `build` and `start` work for --mcp-dir projects Two shared failures for drop-in Next.js projects: 1. `generateToolRegistryTypesForServer` still used tsx's `tsImport`, which wraps tsx in a generated namespace. tsx's resolver then bails with `return nextResolve(...)` for any specifier whose parent URL doesn't carry that namespace — so transitive `@/lib/...` imports from the user entry never hit tsx's tsconfig-paths resolver and fail with `Cannot find package '@/lib'`. Mirror the dev-path fix: detect Next.js, install the server-runtime shims in-process, namespace-less `tsx/esm/api.register()` + `tsx/cjs/api.register()`, then native dynamic `import()`. 2. `transpileWithEsbuild(projectPath)` tried to walk every `.ts`/`.tsx` file in the project's `tsconfig.include` patterns. For a Next.js app that's `src/app/**/*`, `tailwind.config.ts`, RSC-only files, etc. — none of which are meant to be runtime-compiled by an MCP build. esbuild chokes on the first `require()` it sees in `tailwind.config.ts` and prints `Cannot find tsconfig file "tsconfig.json"`. Fix: in `--mcp-dir` mode, skip the full-project transpile and skip the `tsc --noEmit` type-check (the host Next.js app owns both). Record the `.ts` source as the entry point in the manifest. `mcp-use start` then runs it through tsx at boot — same setup as `mcp-use dev`, minus HMR — so the `@/*` aliases and the Next.js server-runtime shims are active in production too. Start's entry resolution now also includes `<mcpDir>/index.ts` / `.tsx` as fallback candidates, and spawns `node <tsx-bin> <file>` (with `withNextShimsEnv`) when the resolved entry is a TS file. Also: stop swallowing `findServerFile` errors silently. A misconfigured `--mcp-dir` previously cascaded into a manifest without an `entryPoint` and a confusing "No built server file found" at start time. Now it logs the underlying error immediately. * feat(inspector): improve navbar UX with smart tab collapsing, deploy button, settings menu, and expanded telemetry UI changes: - Move Chat tab to first position with always-expanded label and separator - Active tab label stays visible when navbar is collapsed - Add Deploy button linking to manufact.com/signup with inspector referrer - Move Tunnel button between Add to Client and Deploy, restyle with violet theme - Show Tunnel button in mobile layout - Consolidate theme toggle, command palette, and GitHub into a settings dropdown - Add "Report a Bug" menu item pre-filling GitHub issue with inspector label New telemetry events: - mcp_tunnel_action: track tunnel start/stop with success status - mcp_deploy_click: track Deploy button clicks with referrer - mcp_chat_configured: track chat API key setup (provider + model, no API key) - mcp_tab_navigation: track tab switches with previous/current tab - mcp_add_to_client: track which client users connect to (cursor, vscode, claude, etc.) - mcp_session_duration: fire on page unload with duration, tabs visited, tools executed Wired up existing unused events: - mcp_server_connection: fires when server transitions to ready (deduplicated) - mcp_server_removed: fires when user removes a server Engagement/retention metrics computable in PostHog from existing user_id (localStorage). * feat(inspector): add inspector environment to telemetry * chore: fix lint * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(react): restore window.fetch interceptor when useMcp unmounts (Via Proxy → Direct) (#1337) * fix(react): restore window.fetch interceptor when useMcp unmounts When a proxy-mode connection is torn down (e.g. switching from "Via Proxy" to "Direct" in the inspector), the BrowserOAuthClientProvider's window.fetch interceptor was never removed. The new direct connection would then route its OAuth discovery requests through the old proxy, which rewrites the `resource` field to the proxy URL, causing the "Protected resource does not match" error. Fix: call restoreFetch() in the useMcp useEffect cleanup so the interceptor is always torn down when the hook unmounts. Closes #1334 * chore: add changeset for proxy fetch interceptor teardown fix * fix(tests): count all console channels in useMcp logLevel isolation test The per-instance isolation test compared cumulative console.log counts before and after rendering a logLevel: "debug" instance. Debug-level output routes to console.debug, not console.log, so the counter never moved and `0 > 0` failed once .tsx tests started running. Snapshot log/info/debug/warn counts after the silent render (asserting all four are 0 — silent really is silent), then take the delta on log/info/debug after the debug render and assert > 0. * chore(typescript): version packages (canary) * refactor(cli): enhance deploy command with GitHub authorization handling (#1343) - Introduced GitHubAuthRequiredError to manage authorization requirements for personal accounts. - Updated deployCommand to handle repository creation errors and prompt for authorization when necessary. - Improved organization ID resolution and uncommitted changes checks during deployment. - Cleaned up code for better readability and maintainability. * chore(typescript): version packages (canary) * chore(cli): drop mcp-use.config.json, add shim tests + docs Remove the project-config.ts utility and mcp-use.config.json support — the --mcp-dir, --entry, and --widgets-dir CLI flags are sufficient, and the config file layer added maintenance surface without a clear user request. - Inline resolveEntryFile / resolveWidgetsDir into src/index.ts - Add unit tests for the Next.js shim noop exports (cache, headers, navigation, server) covering the contract those stubs promise to user code - Add unit tests for detectNextJsProject() and the loadNextJsEnvFiles() cascade ordering - Document --mcp-dir / --entry / --widgets-dir on dev/build/start in the CLI reference * chore(cli, mcp-use): centralize shim registry + guard widgets against server-only imports - Extract the Next.js server-runtime module list into `next-shims-registry.json`, loaded by both `next-shims-loader.mjs` (ESM) and `next-shims-cjs.cjs` (CJS). Adds a startup sanity check in the loader that throws if the registry and the per-module stub bodies drift out of sync. - Add a Vite plugin to both the CLI widget build (`buildWidgets`) and the `mount-widgets-dev` dev server that fails the build with an actionable error when a widget (or a module it transitively imports) pulls in a Next.js server-only specifier. The error names the offending specifier, the importing file, and points the user at moving the call into an MCP tool. * refactor(cli, mcp-use): replace vite-tsconfig-paths with Vite's native resolve.tsconfigPaths Vite 8 supports tsconfig paths resolution natively via `resolve.tsconfigPaths`, which makes the plugin redundant (and triggers a deprecation warning on every widget build/dev start). Drop the dependency and swap the plugin wiring for the native option at all three call sites: the metadata SSR server, the production widget build, and the dev mount in mcp-use. Also deletes the user-project-require / cli-fallback resolution dance in mount-widgets-dev.ts, which only existed to locate a copy of the plugin under pnpm strict-hoisting. Net -111 lines. * chore: remove changesets from PR * chore: restore next-js-drop-in changeset * fix(cli): fail `mcp-use build` when any widget fails Previously a widget whose Vite build threw (e.g. via the server-only guard) was caught, logged in red, and silently dropped from the result — the outer `build` command still printed `✓ Build complete!` and exited 0, emitting a manifest with zero widgets. CI couldn't tell a broken build from a widget-less project. Now `buildWidgets` tracks per-widget status and throws an aggregate error when any entry fails. The `build` command's outer try/catch turns that into `process.exit(1)` with a clear summary line ("N widget(s) failed to build: name1, name2"). Dev mode is unaffected — widget errors there surface in Vite's browser overlay as before. Regression test in tests/build-failure.test.ts spawns the real CLI against a fixture with a widget that imports a nonexistent module and asserts non-zero exit + no "Build complete" line. * chore: scope PR to next-js drop-in only Remove unrelated bleed that came in via the canary merge: - Revert CHANGELOG.md, package.json, and canary-side inspector/ mcp-use source changes to their origin/canary state. These are unrelated inspector UI work, proxy-fetch cleanup, and version bumps that belong to other PRs. - Delete changesets from other PRs (fix-proxy-fetch-interceptor-teardown, inspector-ui-improvements, late-lies-tan) and the stale pre.json — canary is no longer in pre-release mode. Net result: the PR diff against canary is now 16 files, all next-js drop-in scope (CLI, shims, tests, mcp-server widget env-var plumbing, dev-side widget guard, and docs). * fix(cli): surface git failures during deploy and normalize main (#1354) * refactor(cli): enhance deploy command with improved error handling and Git command execution - Introduced GitCommandError class for better error management during Git operations. - Updated deployCommand to handle Git initialization, adding remotes, and pushing changes with actionable error messages. - Refactored git utility functions to throw errors on failure, ensuring users receive clear feedback on issues encountered during deployment. * fix(cli): streamline error logging in deploy command for Git failures - Consolidated error logging for GitCommandError to improve readability. - Enhanced conditional checks for specific Git errors, ensuring clearer output for users during deployment failures. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Potential fix for pull request finding 'CodeQL / Uncontrolled command line' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deploy command with improved API session handling (#1356) - Introduced ApiUnauthorizedError for better error management during API authentication failures. - Added functions to prompt for reauthentication on 401 errors and ensure valid API sessions during deployment. - Updated GitHub connection status retrieval to handle reauthentication seamlessly. - Refactored deployCommand to improve organization ID resolution and error handling, enhancing overall user experience during deployment. * chore(typescript): version packages (canary) * feat: add copy/export chat button to MCPUse inspector (#1324) * feat: add copy/export chat button to MCPUse inspector * chore: copy/export chat button changeset * fix(inspector): improve copy/export chat UI and reliability * fix(inspector): fix blank assistant messages and polish chat export/copy format * fix(inspector): remove error role type * fix(inspector): skip any message copy that has no text content * fix(inspector): clean up chat export/copy implementation - Move changeset to correct location (out of copy/ subdirectory) - Use existing copyToClipboard and downloadJSON utilities - Remove includeToolCalls option; tools always included in markdown output - Render parts in order so tools appear inline with surrounding text - Replace ...m spread in JSON export with clean field projection - Remove <details> wrapper, fragile startsWith heuristic, and noise comments - Fix revokeObjectURL race condition with setTimeout in markdown export * test(inspector): add E2E tests for chat copy and export functionality Add data-testid attributes to copy/export buttons in ChatHeader and add three Playwright E2E tests covering copy to clipboard, export as JSON, and export as Markdown. * style(inspector): fix prettier formatting in ChatHeader --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(react): add colorScheme prop to McpUseProvider and ThemeProvider (#1365) - Introduced a new `colorScheme` prop in `McpUseProvider` to control the document's color scheme based on the active theme. - Updated `ThemeProvider` to apply the color scheme only when the `colorScheme` prop is enabled, preventing issues with iframe backgrounds when themes differ. - Enhanced documentation for both components to clarify the behavior and default values of the new prop. * chore(typescript): version packages (canary) * remove changeset * chore(release): release version 2.2.0 for @mcp-use/inspector and mcp-use - Enhanced chat functionality with "Copy Chat" and "Export Chat" buttons. - Removed hard dependencies on `@langchain/*` packages, allowing direct API calls. - Configured hosted chat URL to be set at runtime via `MANUFACT_CHAT_URL`. - Fixed issues with environment variable handling in server entrypoints. - Updated dependencies to latest versions, ensuring compatibility and stability. * feat: add Next.js drop-in feature to TypeScript server - Updated `docs.json` to include the new "nextjs-drop-in" feature in the TypeScript server documentation. - Enhanced `pnpm-lock.yaml` with dependencies for the Next.js drop-in feature, including `@tailwindcss/vite`, `@vitejs/plugin-react`, and `next`. - Added a new test application configuration in `pnpm-lock.yaml` to support the Next.js drop-in functionality. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: Andrew Khadder <andrew.khadder@gmail.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: pederzh <luigipederzani@gmail.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Pallavi Kumari <pallavilpmt1995@gmail.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): respect --org flag when a linked deployment exists in a different org (#1380) * fix(cli): respect --org flag when a linked deployment exists in a different org When `--org` is specified and a linked server exists in `.mcp-use/project.json`, check the server's organizationId before redeploying. If it belongs to a different org, skip the link and create a new server in the specified org instead of silently deploying to the wrong one. Closes MCP-1672 * fix(cli): name target org in linked-server mismatch warning Capture resolvedOrgName/resolvedOrgSlug in Step 2 and interpolate them into the Step 6 warning so users see which org the new server will be created in, not just "the specified org". * chore(cli): add changeset for --org linked-server override fix * chore(typescript): version packages (canary) * fix(cli): validate token on login and unify 401 handling (#1383) * fix(cli): validate token on login and handle 401s uniformly (MCP-1671) `mcp-use login` short-circuited on file presence alone, so a revoked or expired API key still produced "You are already logged in" and subsequent commands blew up with a raw 401 dump. Login now calls `testAuth()` after the `isLoggedIn()` check — on `ApiUnauthorizedError` it clears the stale config and falls through to the device-auth flow; network/other errors preserve the old message so offline users aren't forced through re-auth. Extracts a shared `handleCommandError(error, context)` helper in `utils/errors.ts` that converts `ApiUnauthorizedError` into a friendly "session expired — run `npx mcp-use login`" hint. Wired through `whoami`, `org`, `servers`, `deployments`, and `env` (which previously had no try/catch at all, so errors leaked as stack traces). `deploy`'s richer `promptReauthenticateOn401` flow is untouched. * refactor(cli): simplify login re-auth flow and chalk test mock Flatten the loginCommand re-auth branch in auth.ts to use an explicit needsReauth boolean instead of a try/catch with implicit fall-through and duplicated "already logged in" branches. Trim WHAT comments; keep the WHY on the catch (network/disk errors get the benefit of the doubt). Replace the Proxy-based chalk mock in errors.test.ts with a plain object covering the exact chains handleCommandError uses. Tighten the JSDoc on handleCommandError to drop the redundant "print a friendly error and exit" half. * fix(cli): send 401 re-auth hint to stderr The hint was going to stdout while the error header went to stderr, so `2>/dev/null` would swallow the header and leave a stray-looking success line, and scripts piping stdout would see noise after a failed command. Route both to stderr so they stay together. * chore(typescript): version packages (canary) * fix(inspector): add Open Graph and Twitter Card meta tags to hosted inspector (#1376) * fix(inspector): add Open Graph and Twitter Card meta tags to hosted inspector The hosted inspector at inspector.mcp-use.com was served with no og:*, twitter:*, or meta description tags, so links shared on Slack, X, LinkedIn, Discord, etc. had no preview card. Adds a description plus full OG and Twitter Card blocks to both the Vite-built index.html (what prod serves today) and the CDN shell path in shared-static.ts, along with a branded inspector-cover.png used as the social image. Closes MCP-1710 * refactor(inspector): ship OG cover image in inspector package Moves inspector-cover.png from docs/images/ to the inspector's public/ folder so it ships with @mcp-use/inspector via dist/web/. Adds a Hono route for /inspector/inspector-cover.png (registered ahead of SPA/CDN shell fallbacks and active in both modes) so the file is served with image/png instead of getting swallowed by the SPA fallback. Updates the og:image and twitter:image URLs in both the Vite build and the CDN shell path to the self-hosted https://inspector.mcp-use.com/inspector/ inspector-cover.png. * refactor(inspector): serve OG image from CDN instead of bundled file Point og:image and twitter:image meta tags to https://inspector-cdn.mcp-use.com/inspector-cover.png and remove the bundled public/inspector-cover.png and its local file-serving route. * chore(typescript): version packages (canary) * fix(inspector): preserve URL path in OAuth authorize redirect (#1360) * fix(inspector): preserve URL path in OAuth authorize redirect When an OAuth provider uses a basePath (e.g. /api/auth), the authenticate() function strips the URL to just the origin, causing the authorization redirect to go to the wrong URL. Preserve the pathname component when constructing baseUrl for the auth() call. Closes #1333 * chore: add changeset for oauth basepath fix * style: run prettier on useMcp.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(inspector): inline elicitation requests in chat thread (#1336) * feat(inspector): add InlineElicitationCard component for chat-inline elicitation * feat(inspector): render inline elicitation cards in MessageList * feat(inspector): pass elicitation handlers from ChatTab to MessageList * feat(inspector): suppress elicitation toast when chat tab is active * chore: format InlineElicitationCard and add changeset * refactor(inspector): extract shared elicitation form primitives Deduplicate form-rendering logic between ElicitationRequestDisplay (panel) and InlineElicitationCard (chat) by extracting a shared module: - schemaHelpers: enum/one-of/any-of choice parsing - useElicitationForm: form state, schema-default init, required-field validation - ElicitationFormFields: parameterized field renderer (boolean, number, select, enum, multi-select, textarea, input) Both callers now consume these pieces while keeping their distinct chrome (panel header/footer/toast vs. compact card + collapsed-after-response). Test IDs preserved so e2e coverage is unaffected. * chore: apply prettier formatting to shared elicitation primitives * chore(typescript): version packages (canary) * feat(skills): consolidate deprecated mcp-builder and chatgpt-app-builder skills (#1375) * feat(skills): consolidate mcp-builder and chatgpt-app-builder into mcp-apps-builder content Replace deprecated redirect stubs with the full mcp-apps-builder skill content so both skills work standalone without requiring users to install a separate skill. * feat(create-mcp-use-app): only copy mcp-apps-builder skill during project setup Skip deprecated mcp-builder and chatgpt-app-builder skills when installing skills into new projects. * feat(skills): replace deprecated reference files with mcp-apps-builder references Old flat references/ folders in mcp-builder and chatgpt-app-builder are stale and incompatible with the updated SKILL.md. Replace them with the full mcp-apps-builder reference structure so all links resolve correctly. * chore(changeset): patch create-mcp-use-app for deprecated skill skip * chore(typescript): version packages (canary) * refactor(mcp-use): Typescript OAuth Providers (#1321) * refactor(mcp-use): remove proxy mode from built-in OAuth providers All built-in providers are now DCR-direct only. The MCP server proxies metadata discovery to the upstream and verifies bearer tokens; clients register and authenticate directly with the upstream authorization server. Removed from the public interface: - `OAuthMode` type and `OAuthProvider.getMode/getClientId/getRegistrationEndpoint` - `CustomProviderConfig`: `mode`, `clientId`, `clientSecret` - `WorkOSProviderConfig`: `clientId`, `apiKey` - `BetterAuthProviderConfig`: `clientId` - Env vars: `MCP_USE_OAUTH_WORKOS_CLIENT_ID`, `MCP_USE_OAUTH_WORKOS_API_KEY`, `MCP_USE_OAUTH_BETTER_AUTH_CLIENT_ID` are no longer read by providers Routes: deleted proxy-mode branching; extracted `createAuthorizeHandler` and `createTokenHandler` as exported factories (dormant under DCR-direct, retained for the forthcoming `oauthProxyProvider`). Metadata passthrough now always returns the upstream body including `registration_endpoint`. Docs and examples updated to reflect the single DCR flow. WorkOS example renames the API-call key to the user-owned `WORKOS_API_KEY`. Auth0 README replaces the proxy architecture diagram and flow description with DCR-direct. A dedicated `oauthProxyProvider` will follow in a future release for users who need an MCP-server-mediated OAuth flow. BREAKING CHANGE: proxy mode config fields and env vars removed; see above. * feat(mcp-use): add OAuth proxy support Adds OAuthProxyProvider enabling servers to delegate OAuth flows to an external proxy, and refactors OAuth routes/middleware/setup to support the new provider type alongside the existing built-in providers. * feat(mcp-use): add Auth0 OAuth proxy example Demonstrates using OAuthProxyProvider with Auth0 as the upstream identity provider, showing how to configure and run the proxy server. * feat(mcp-use): add jwksVerifier helper and make verifyToken explicit Replaces the implicit `jwksUrl` config field on `oauthProxy` with an explicit `verifyToken` function. Ships a built-in `jwksVerifier()` helper that covers the standard JWT+JWKS case (Auth0, Okta, Google, etc.) while leaving the door open for non-JWT providers (e.g. GitHub opaque tokens). * docs: add custom OAuth provider to sidebar navigation * docs: rewrite OAuth provider authentication docs * chore: add changeset for OAuth provider refactor * chore: format * fix(oauth): normalize Supabase provider to use verifyJwt instead of skipVerification Aligns Supabase with Auth0, WorkOS, Keycloak, and Better Auth which all use the verifyJwt boolean convention. * fix(oauth): remove clientId from Keycloak provider, add audience field Keycloak DCR-based flows never expose the client_id to the MCP server — it is issued to the OAuth client during registration. The MCP server validates tokens against issuer + JWKS only; audience should be the MCP server URL (set via Keycloak audience mapper on client scopes), not clientId. - Replace `clientId` with `audience` in KeycloakOAuthConfig and KeycloakProviderConfig - Use `audience` (not clientId) for JWT `aud` claim verification - Remove client-specific role extraction via resource_access[clientId] - Add MCP_USE_OAUTH_KEYCLOAK_AUDIENCE env var (replaces MCP_USE_OAUTH_KEYCLOAK_CLIENT_ID) * docs(oauth): rename oauthProxyProvider to oauthProxy in changeset and docstring * chore: format * fix(oauth): accept JSON and parse form-encoded token responses in proxy GitHub's /login/oauth/access_token returns application/x-www-form-urlencoded by default, which made the proxy's token handler throw "Unexpected token 'a', 'access_tok'... is not valid JSON". Send `Accept: application/json` upstream and parse the response based on its Content-Type so both JSON and form-encoded providers work. * fix(oauth): override client_id at /authorize in proxy mode The authorize handler was forwarding the incoming client_id to the upstream as-is, while /token already overrode it with proxy.clientId. Stale DCR cache on the MCP client (e.g. a synthetic UUID from a prior issuer) would reach the upstream and produce a generic 404. In proxy mode only the configured client_id is valid upstream, so enforce it here the same way /token does. * chore: drop stale inspector reference from oauth-refactor changeset * docs(oauth): flesh out Supabase example with consent page and anon sign-in Adds an auth-routes module that hosts the consent screen Supabase redirects to after /authorize, including an anonymous sign-in flow for zero-config demos. Fixes the example's package name, validates SUPABASE_PROJECT_ID at startup, and documents the dashboard setup in .env.example. * chore: changeset to minor * docs(oauth): add Keycloak example using DCR-direct provider Mirrors the Auth0 example layout (server.ts, package.json, tsconfig, README, .env.example) and wires the new oauthKeycloakProvider against a locally-hosted Keycloak realm. The example runs without additional plumbing once the companion keycloak-auth-server docker setup is up, exposing get-user-info and get-keycloak-userinfo tools over an MCP-over-HTTP server with JWT verification via the realm's JWKS. * docs(oauth): drop private-repo references from Keycloak example README The README pointed at a companion keycloak-auth-server repo that isn't being published alongside this example. Rewrite the prerequisites as a BYO-Keycloak checklist (DCR, Trusted Hosts, web-origins policies), and drop the testuser/testpassword references that only made sense inside that other repo's seeded realm. * chore: fix readme * docs(oauth): modernize Supabase example to use supabase-js SDK Replaces raw fetch with @supabase/supabase-js methods (signInAnonymously, auth.oauth.getAuthorizationDetails, approveAuthorization, denyAuthorization). Renames the anon key env var to MCP_USE_OAUTH_SUPABASE_PUBLISHABLE_KEY and drops the legacy MCP_USE_OAUTH_SUPABASE_JWT_SECRET from the example — the provider continues to accept a jwtSecret for legacy HS256 projects, but new projects use ES256+JWKS automatically. * docs(oauth): refresh TypeScript OAuth provider guides Update provider docs to reflect the refactored TypeScript OAuth providers, and trim the Keycloak guide to assume an existing instance rather than walking through Docker setup. * docs(skills): align authentication references with new OAuth provider guidelines Rewrite the authentication reference set shared across mcp-apps-builder, mcp-builder, and chatgpt-app-builder to match the refactored TypeScript OAuth providers: remote-auth vs oauthProxy split, oauthProxy + jwksVerifier recipes, Supabase publishable keys + SDK pattern, verifyJwt rename, and first-class Auth0 and Keycloak guides. * docs(oauth): add dedicated OAuth Proxy provider page Splits the OAuth Proxy content out of custom.mdx and the authentication overview into its own provider page covering Google, Okta, Azure AD, Auth0 (non-DCR), and GitHub. custom.mdx now focuses on DCR-capable providers and links to the new page; the overview links to it too. * chore(typescript): version packages (canary) * docs(changelog): document v1.25.0 / inspector v3.0.0 release wave Add Mintlify changelog entries for the canary release wave: mcp-use v1.25.0 (OAuth DCR-direct refactor, Next.js drop-in), @mcp-use/cli v3.1.0, @mcp-use/inspector v3.0.0 (inline elicitation, OG meta tags), and create-mcp-use-app v0.14.9. * chore(typescript): add experimental option for peer dependency updates Updated the TypeScript changeset configuration to include an experimental option for controlling peer dependency updates, allowing only updates when out of range. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: pederzh <luigipederzani@gmail.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Pallavi Kumari <pallavilpmt1995@gmail.com> Co-authored-by: Kagura <kagura.chen28@gmail.com> |
||
|
Enrico Toniato
|
bc5add402f |
fix: replace broken doc hosts with canonical mcp-use.com/docs URLs (#1366)
- docs.mcp-use.io/python/changelog/changelog timed out in link checker - mcp-use.dev caused HTTP/2 protocol errors Both replaced with equivalent paths on mcp-use.com/docs, already the canonical host used across the rest of the monorepo. Made-with: Cursor |
||
|
Enrico Toniato
|
4070f26294 |
Canary (#1320)
* feat(typescript): Add scopes customization to oauth providers * refactor: move scopesSupported to BaseOAuthConfig and remove test file * feat(typescript): add scopesSupported to better auth provider * fix: return scopesSupported properly for Better Auth provider factory * docs(oauth): add scopesSupported to provider docs * chore: format * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): add missing fields to CustomProviderConfig to match docs (#1136) The Custom Provider docs show config fields (userInfoEndpoint, jwksUri, clientId, clientSecret, mode, scopes, audience) that don't exist in the code. This adds all documented fields to CustomProviderConfig and CustomOAuthConfig, implements the corresponding getters on CustomOAuthProvider, and resolves alias pairs (jwksUrl/jwksUri, scopes/scopesSupported). * style: fix prettier formatting in custom oauth provider * fix: add OAuthProvider interface methods and fix unsafe type casts - Add getClientId(), getUserInfoEndpoint(), getAudience() as optional methods on OAuthProvider interface so new CustomOAuthProvider getters are callable without type casting - Make CustomOAuthConfig.jwksUrl optional (users provide their own verifyToken, JWKS URL isn't always needed) - Fix jwksUrl fallback from empty string to undefined in factory to avoid silent runtime failures - Replace unsafe (provider as any).config?.clientId with type-safe provider.getClientId?.() in routes.ts - Add getClientId() to WorkOSOAuthProvider for the pre-registered client detection in direct mode metadata * fix(typescript): remove scopes alias from CustomProviderConfig in favor of scopesSupported * fix(typescript): remove jwksUri alias from CustomProviderConfig in favor of jwksUrl * chore: update changeset to reflect jwksUrl and scopesSupported field names * fix: inline jwksUrl and scopesSupported in CustomOAuthProvider constructor * fix: simplify oauthCustomProvider by spreading config into constructor * fix: remove redundant comments from CustomProviderConfig * chore(typescript): version packages (canary) * fix(inspector): hide thinking indicator when assistant message has parts (#1315) * fix(inspector): hide thinking indicator when assistant message has parts When streaming via the server-side path, content is delivered through the parts array while the message's content field stays empty until the stream reader fully closes. The isThinking check only looked at content, causing a window where the thinking indicator reappeared after the done event but before setIsLoading(false) ran in the finally block. Now we check parts first — if any parts exist, the model has produced output and we should not show the thinking indicator. * chore: add changeset for thinking indicator fix * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in Google provider (#1317) * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in JSON Schema output z.record() in @langchain/core's serializer emits a `propertyNames` keyword for constrained or enum key types. Google's Generative AI API rejects schemas containing `propertyNames`, breaking tool calls when using the Google provider. Switching to z.object({}).catchall() produces identical runtime behavior but serializes to clean `additionalProperties` without `propertyNames`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: add changeset for Google provider propertyNames fix --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(typescript): version packages (canary) * Major/cli/device flow (#1294) * fix(inspector): sync URL tab param on tab change to preserve state on refresh When switching tabs via header clicks, keyboard shortcuts, or command palette, only React state was updated but the URL was not. This meant refreshing the page would lose the active tab. Now all tab changes also update the ?tab= query parameter using navigate() with replace:true. Closes #1157 * fix: update import paths for Windows compatibility and modify postins… (#1255) * fix: update import paths for Windows compatibility and modify postinstall script in package.json templates - Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms. - Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation. * fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility - Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems. * changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: add changeset * chore(typescript): version packages (canary) * feat(auth): enhance login command with API key option and implement device code flow - Updated the login command to allow non-interactive login using an API key. - Introduced device code flow for authentication, including functions to request device codes and poll for access tokens. - Refactored API key creation to use access tokens and updated related utility functions for better authentication handling. * refactor(cli): improve code formatting and readability in authentication commands - Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks. - Removed unused import in `auth.ts` to clean up the codebase. - Enhanced error messages for clarity in authentication processes. * refactor(logging): change logger level from info to debug for various messages - Updated multiple logging statements across the codebase to use `logger.debug` instead of `logger.info` for routine messages, enhancing log clarity and reducing noise in production logs. - This change applies to session management, agent initialization, and connection handling, ensuring that only significant events are logged at the info level. * fix(oauth): correct Auth0 issuer handling and improve token validation - Updated the Auth0 issuer to include a trailing slash to comply with token validation requirements. - Separated baseUrl from issuer to prevent double-slash URLs in JWKS, auth, and token endpoints. - Added direct mode for the Auth0 provider to enable MCP clients to communicate directly for OAuth flows. - Enhanced protected resource metadata to include scopes_supported, ensuring clients request appropriate scopes during authorization. * update * lint --------- Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * refactor(cli): update authentication and organization handling (#1326) - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * fix(inspector): use correct OAuth callback URL when mounted at /inspector (#1323) * fix(inspector): use correct OAuth callback URL when mounted at /inspector The BrowserOAuthClientProvider defaulted redirect_uri to /oauth/callback but the React Router (basename="/inspector") only mounts OAuthCallback at /inspector/oauth/callback, causing a blank screen after auth. Root fix: add defaultCallbackUrl prop to McpClientProvider so the inspector declares the correct path once at the provider level. All addServer calls inherit it automatically — no per-connection wiring needed. Removes the "Redirect URL" field from the auth dialog: it was never actually passed to the connection and couldn't be set to a value the inspector would handle. * chore: bump mcp-use changeset to minor (new public API prop) * docs: document defaultCallbackUrl in McpClientProvider; remove redirectUrl from inspector connection-settings * chore(typescript): version packages (canary) * Device flow 2 (#1329) * refactor(cli): update authentication and organization handling - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * refactor(cli): streamline organization ID resolution in deploy command - Replaced the previous method of resolving the organization ID with a direct call to api.resolveOrganizationId() for improved clarity and efficiency. - Removed unnecessary comments and code related to organization ID handling, enhancing overall code readability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Fix/cli/git create (#1331) * refactor(cli): enhance deployment command and GitHub integration - Added new GitHub API methods for creating repositories and retrieving installation IDs. - Introduced git utility functions for initializing repositories, adding remotes, and committing changes. - Improved environment variable parsing and error handling in the deployment command. - Cleaned up code for better readability and maintainability. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deployment command options and improve code readability - Added a new option for specifying the deployment region in the CLI. - Rearranged and cleaned up command options for better organization. - Improved error handling and logging in the deployment process. - Refactored code for better readability and maintainability across several files. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(inspector, typescript): update changelogs for v2.0.0 and v1.24.0 releases - Added details for the major release v2.0.0 of the inspector, highlighting improvements in OAuth handling, chat UI, and tab persistence. - Documented the minor release v1.24.0 of mcp-use, featuring OAuth scope customization, telemetry support, and device-flow authentication enhancements. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: Andrew Khadder <andrew.khadder@gmail.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Enrico Toniato
|
6d7c4df9ef |
Canary (#1290)
* fix(inspector): sync URL tab param on tab change to preserve state on refresh
When switching tabs via header clicks, keyboard shortcuts, or command palette,
only React state was updated but the URL was not. This meant refreshing the
page would lose the active tab. Now all tab changes also update the ?tab=
query parameter using navigate() with replace:true.
Closes #1157
* feat(inspector): add editable MCP server aliases in connection settings
* fix(inspector): avoid reconnecting on alias-only edits
* chore: add changeset for server alias and updateServerMetadata
* docs: document updateServerMetadata in useMcpClient API reference
* fix: update import paths for Windows compatibility and modify postins… (#1255)
* fix: update import paths for Windows compatibility and modify postinstall script in package.json templates
- Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms.
- Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation.
* fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility
- Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems.
* changeset
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore: add changeset
* chore(typescript): version packages (canary)
* chore(deps): bump hono from 4.12.8 to 4.12.12 in /libraries/typescript (#1284)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* chore(deps): bump hono from 4.12.8 to 4.12.12 in /libraries/typescript
Bumps [hono](https://github.com/honojs/hono) from 4.12.8 to 4.12.12.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.8...v4.12.12)
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.12
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* chore(deps): bump vite from 8.0.0 to 8.0.5 in /libraries/typescript (#1280)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* chore(deps): bump vite from 8.0.0 to 8.0.5 in /libraries/typescript
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.0 to 8.0.5.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite)
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* Update architecture.md
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* Update server routing and middleware references
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* feat(chat): add disabledTools prop to ChatTab and useChatMessages for enhanced tool management (#1291)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* feat(chat): add disabledTools prop to ChatTab and useChatMessages for enhanced tool management
- Introduced a new `disabledTools` prop in both `ChatTab` and `useChatMessages` to allow users to specify tools that should be excluded from the chat session.
- Updated the handling of chat messages to accommodate the new `disabledTools` feature, ensuring proper communication with the server.
* chore(typescript): version packages (canary)
* feat(auth): enhance login command with API key option and implement device code flow (#1292)
* feat(auth): enhance login command with API key option and implement device code flow
- Updated the login command to allow non-interactive login using an API key.
- Introduced device code flow for authentication, including functions to request device codes and poll for access tokens.
- Refactored API key creation to use access tokens and updated related utility functions for better authentication handling.
* refactor(cli): improve code formatting and readability in authentication commands
- Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks.
- Removed unused import in `auth.ts` to clean up the codebase.
- Enhanced error messages for clarity in authentication processes.
* Revert "feat(auth): enhance login command with API key option and implement d…" (#1293)
This reverts commit
|
||
|
Enrico Toniato
|
a4a84d9a66 |
fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API. - Removed outdated link to middleware documentation in the resources section. |
||
|
Enrico Toniato
|
7d2112e89c |
Canary (#1228)
* feat(telemetry): integrate telFetch for improved data fetching (#1224) - Added `telFetch` to the telemetry utilities, enhancing data fetching capabilities. - Updated `registerInspectorRoutes` to utilize `telFetch` for PostHog and Scarf requests, ensuring consistent telemetry handling. - Removed error logging in telemetry catch blocks to maintain silent operation during failures. * chore: enter canary prerelease mode * chore: update flatted dependency version to 3.4.2 in package.json and pnpm-lock.yaml * feat(mcp-use): enhance middleware and type definitions (#1227) - Added new types for middleware context and parameters, including `ToolsCallParams`, `ResourcesReadParams`, and `PromptsGetParams`. - Introduced `McpMiddlewarePatternMap` and `McpMiddlewareFnFor` to improve type inference for middleware functions. - Updated `ResourceTemplateDefinition` and related types to support optional Zod schemas for parameter validation. - Enhanced `MCPServerClass` to utilize the new type definitions, ensuring better type safety and flexibility in middleware handling. * chore(typescript): version packages (canary) * Fix/ctx auth optional typing (#1229) * fix: make ctx.auth accessible when OAuth is not configured Change McpContextBase.auth from `never` to `AuthInfo | undefined` so that `ctx.auth` can be null-checked in tool callbacks even when OAuth is conditionally enabled via environment variables. * fix: singleton AsyncLocalStorage, safe Hono context extraction, auth propagation - context-storage: use globalThis to guarantee a single AsyncLocalStorage instance even when bundlers split the module into multiple chunks - tool-execution-helpers: replace Object.create(honoContext) with explicit property extraction to avoid Hono private field access errors (#req, #var) - mcp-server: forward mwCtx.auth and mwCtx.state to the enhanced tool context so HTTP middleware data reaches tool handlers * chore(typescript): version packages (canary) * feat: ErrorBoundary fallback/onError props, inspector fix, connector improvement (#1230) - ErrorBoundary: add `fallback` (ReactNode | (error) => ReactNode) and `onError` callback props for custom error UI and reporting - Update ErrorBoundary docs (errorboundary.mdx, api-reference.mdx) - Inspector: MCPAppsRenderer fix - Connectors: base.ts improvements * chore(typescript): version packages (canary) * feat(chat): enhance message conversion to support tool results and multimodal content (#1231) - Added functions to extract text content and serialize tool results. - Updated `convertMessagesToLangChain` to handle tool invocations and return structured messages, including `ToolMessage` for tool results. - Improved handling of user and assistant messages, ensuring proper context preservation across conversation turns. * chore(typescript): version packages (canary) * feat(org): add organization management commands and enhance deployment options (#1232) - Introduced new commands for managing organizations: `org list`, `org switch`, and `org current`. - Enhanced the `deploy` command to accept an `--org` option for specifying the target organization. - Implemented organization selection during login and updated user info display to include organization details. - Added utility functions for prompting organization selection and retrieving stored profile information. * chore(typescript): version packages (canary) * feat(cli): add --yes option to skip confirmation prompts during deployment (#1233) - Introduced a new `--yes` option to the deploy command, allowing users to bypass interactive confirmation prompts. - Updated the deployment process to handle non-interactive scenarios, improving usability in CI environments. - Enhanced related functions to respect the `yes` flag for GitHub setup and deployment confirmations. * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v0.25.1 and v1.22.1 releases - Added details for v0.25.1, highlighting improvements in chat history tool results and ErrorBoundary customization. - Included v1.22.1 changes, featuring CLI organization management, non-interactive deployments, and enhanced middleware context propagation. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
b76df332f6 |
Canary (#1218)
* ci: enhance CI workflow with tunnel testing for dev and start commands - Added new jobs to test the development and start commands with the `--tunnel` flag in the CI workflow. - Implemented logic to start the dev server and poll for the tunnel URL, ensuring it is generated successfully. - Included cleanup steps to terminate the server processes after testing. - Enhanced error handling to report if the tunnel URL is not found in the output logs. * docs: fix changelog order (newest first) * chore: move tunnel testing from create-mcp-use-app CI to inspector E2E - Remove tunnel steps from create-mcp-use-app-tests (dev --tunnel, start --tunnel) - Add run-tunnel-test.mjs (test_tunnel) in inspector E2E scripts - Add test:e2e:tunnel script and inspector-e2e-tunnel job * chore: enter canary prerelease mode * fix: prettier format run-tunnel-test.mjs * feat: add reconnection options to conformance client (#1212) * feat: add reconnection options to conformance client - Introduced `reconnectionOptions` with a `maxRetries` setting to enhance the conformance client’s ability to handle connection issues. * fix(tests): update prompt server path in test configuration - Modified the test configuration to use the correct path for the prompt server, ensuring that the tests can locate and execute the server script properly. * chore(typescript): version packages (canary) * chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 (#1209) * chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 - Bumped Vite version from ^7.3.0 to ^8.0.0 across multiple package.json files. - Updated @vitejs/plugin-react from ^5.1.4 to ^6.0.0 in various templates and packages. - Adjusted pnpm-lock.yaml to reflect these changes. - Modified build configurations to use 'rolldownOptions' instead of 'rollupOptions' for consistency. * fix: ensure consistent handling of TypeScript file paths across platforms - Updated path handling in TypeScript-related functions to ensure compatibility with Windows and other operating systems. - Refactored code to utilize `path.join` for constructing file paths, addressing issues with path separators. - Enhanced error handling in CLI tests to prevent failures due to missing build artifacts. * fix: prettier format run-tunnel-test.mjs * chore: update dependency versions in pnpm-lock.yaml and package.json - Changed the version specifier for `ai` from `^6.0.116` to `>=5.0.52`. - Updated `express-rate-limit` from `^7.5.1` to `>=8.2.2` in both `pnpm-lock.yaml` and `package.json`. - Adjusted the corresponding version in the lock file to reflect the new version of `express-rate-limit`. * test: enhance telemetry test stability with increased wait times - Updated `beforeEach` to include a delay for settling lingering telemetry. - Increased wait times from 100ms to 500ms in multiple test cases to ensure telemetry events are captured reliably. * chore(typescript): version packages (canary) * Feat/use-files (#1213) * feat(react): add useFiles hook with isSupported detection Adds useFiles() hook for file upload and download in widgets. File operations are only supported in the ChatGPT Apps SDK environment. The MCP Apps spec (SEP-1865) has deferred file handling, meaning MCP Apps clients (Claude, Goose, VS Code) do not support file operations. The hook exposes an isSupported flag computed from the presence of window.openai.uploadFile and window.openai.getFileDownloadUrl, letting widgets render graceful fallback UI in non-ChatGPT environments rather than throwing runtime errors. - isSupported: true only in ChatGPT Apps SDK hosts - upload(file): delegates to window.openai.uploadFile, returns FileMetadata - getDownloadUrl(file): delegates to window.openai.getFileDownloadUrl - Both throw a descriptive error when called with isSupported === false Also adds: - FileMetadata type ({ fileId: string }) in widget-types.ts - Optional uploadFile/getFileDownloadUrl on the API interface - examples/server/ui/files/ — file manager widget with upload, progress state, download URL retrieval, and isSupported-based fallback notice - docs/typescript/server/widget-components/usefiles.mdx — API reference with isSupported usage, FileMetadata type, and error handling guidance * feat(react): add modelVisible option to useFiles and unit tests Adds model visibility control to useFiles().upload() and 19 unit tests verifying the full hook behaviour. ### modelVisible option By default, uploaded files are tracked in widget state under `imageIds` so ChatGPT includes them in the model's conversation context (matching the post-fix behaviour of Skybridge PR #539 which fixed privateContent not being preserved during setWidgetState). Pass `{ modelVisible: false }` to upload privately — the file is still uploaded via window.openai.uploadFile but the fileId is not added to imageIds, so the model won't see it. ```ts // Model sees this (default) const { fileId } = await upload(file); // Model does not see this const { fileId } = await upload(file, { modelVisible: false }); ``` Existing imageIds and other widgetState fields are preserved when tracking a new fileId, so uploads never wipe non-file state. ### Tests (19) - isSupported: false when window/openai undefined or partial - upload() error when not supported (message includes isSupported) - upload() delegates to window.openai.uploadFile - upload() returns FileMetadata - upload() calls setWidgetState with updated imageIds - upload() appends to existing imageIds - upload() preserves other widgetState fields - upload({ modelVisible: false }) skips setWidgetState entirely - upload({ modelVisible: false }) still returns FileMetadata - getDownloadUrl() error when not supported - getDownloadUrl() delegates to window.openai.getFileDownloadUrl - getDownloadUrl() passes through fileId * docs(skill): add files reference to mcp-apps-builder skill Adds references/widgets/files.md covering: - useFiles() hook (isSupported, upload, getDownloadUrl) - isSupported guard pattern — always required, renders fallback in MCP Apps - Model visibility: modelVisible option (true = tracked in imageIds, false = private) - Storing fileId in widget state vs caching download URLs - Error handling patterns Also adds a navigation entry and decision tree node to SKILL.md. * chore(typescript): version packages (canary) * feat(mcp-use): add MCP operation-level middleware support (#1137) - Introduced a new middleware system for handling MCP operations, allowing for cross-cutting concerns like logging and authentication. - Updated `MCPServerClass` to register and manage middleware entries dynamically. - Enhanced documentation to include examples of using `server.use('mcp:...', handler)` for middleware registration. - Added new types and utility functions to support middleware composition and context management. This commit enhances the flexibility and functionality of the MCP framework by enabling developers to define custom middleware for various MCP operations. * chore(typescript): version packages (canary) * Feat/model-context (#1214) * feat(react): add ModelContext component and modelContext imperative API Adds two complementary APIs for annotating widget UI with contextual descriptions the AI model can see, without requiring explicit tool calls or storing data in developer-managed state. - <ModelContext content="..."> — lifecycle-tied React component that participates in a parent-child tree via React context (useId + ParentIdContext). Supports empty children (leaf nodes) and nesting. - modelContext.set(key, content) / .remove(key) / .clear() — module-level imperative API that works anywhere: event handlers, plain functions, outside React. Entries are always root-level nodes. Both APIs feed into a shared global registry that serializes the node tree into an indented markdown-like string on every change (batched via queueMicrotask). The string is pushed to the host via: - MCP Apps: ui/update-model-context (structuredContent.__model_context) - ChatGPT Apps SDK: setWidgetState (__model_context merged into state) useWidget wires up a registerModelContextFlush handler on mount so annotations always reach the correct protocol channel. __model_context is filtered from the developer-facing state value returned by useWidget. setState preserves existing __model_context to prevent annotations from being wiped on state updates. Also adds: - examples/server/ui/model-context/ — interactive product browser example demonstrating nesting (<ModelContext>) and imperative (modelContext.set) usage with a visual context debug panel - docs/typescript/server/widget-components/modelcontext.mdx — API reference for both APIs, nesting behavior, serialization format, and comparison with setState * test(react): add model-context unit tests; expose test helpers Adds 25 unit tests covering the full ModelContext system: - Tree serialization: empty, single, multiple root entries, nesting, whitespace trimming, blank content skipped, upsert, remove, clear - modelContext imperative API: set/remove/clear, no-op on missing key - registerModelContextFlush: immediate notification on registration, deregistration stops calls, deregistering stale handler is safe - Batched flush: multiple synchronous mutations → single handler call - Context state passed to model: full integration of set + flush handler, update, remove, clear sequences Also exposes two @internal helpers required for testing module singletons: - _resetModelContextForTesting() — resets nodes/handler/flushScheduled - _getDescriptionForTesting() — returns the current serialized string without triggering a flush * docs(skill): add model-context reference to mcp-apps-builder skill Adds references/widgets/model-context.md covering: - When to use ModelContext vs setState - <ModelContext> component: nesting, siblings, leaf nodes, lifecycle - modelContext imperative API: set/remove/clear, cleanup rules - How the tree is serialized and sent to the model - Common patterns: tab-switching, selected item, multi-level dashboard Also adds a navigation entry and decision tree node to SKILL.md. * Update title in modelcontext.mdx Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: add changeset for useFiles and ModelContext minor features --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: prefix resource and prompt tool names to avoid collisions (#937) * fix: prefix resource and prompt tool names to avoid collisions (#910) When a resource and a prompt share the same name, the LangChain tools array sent to the API contains duplicate tool names, causing a 400 error. Prefix resource tools with `resource_` and prompt tools with `prompt_` to ensure unique names. * dynamic implementation to avoid prompt resource names collisions * fix: make reserveName collision-safe and sanitize prompt names - reserveName now checks the prefixed name for conflicts too, falling back to a numeric suffix when both base and prefixed names are taken. Previously a tool named resource_foo alongside a resource named foo would silently produce a duplicate tool name. - Prompt names are now sanitized through sanitizeToolName() for consistency with resource names. * chore: add changeset for tool name collision fix --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: map elicit result content to data for Zod validation (#1215) (#1216) * fix: map elicit result content to data for Zod validation The MCP SDK returns form data in result.content per the elicitation spec, but createElicitMethod was checking result.data which is always undefined. This caused Zod validation to never run, leaving result.data as undefined for tool callbacks that use ctx.elicit() with a Zod schema. Now checks result.content (SDK spec) with fallback to result.data for backward compatibility with custom handlers. Fixes #1215 * fix: also fix inspector and tests for elicit content/data mapping - Inspector: send `content` instead of `data` per MCP spec - Server: also map `content` to `data` for non-Zod-schema elicit calls (verbose API overload), so conformance server tools work correctly - Tests: update all integration test mocks to use spec-correct `content` field instead of non-standard `data`, and adjust validation error assertions to match SDK-level schema validation - Add changeset Follows up on the initial fix in b90ea51e. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): implement tunnel management functionality (#1222) - Added API endpoints for starting, stopping, and checking the status of a tunnel. - Integrated tunnel management into the Layout and LayoutHeader components, allowing users to start and stop tunnels directly from the UI. - Updated context to manage tunnel state, including a loading state for starting the tunnel. - Enhanced the user experience with visual feedback during tunnel operations and added instructions for using the tunnel URL in ChatGPT. This feature improves the overall functionality of the inspector by enabling real-time tunnel management. * chore(typescript): version packages (canary) * chore(changelog): update changelog for v0.25.0 and v1.22.0 releases - Added details for v0.25.0: introduced tunnel management for `mcp-use dev`, Vite 8 build stack, and aligned elicit payload with MCP spec. - Updated v1.22.0: included enhancements for MCP middleware, new React hooks, and fixes for elicit and adapter functionalities. - Updated dependencies for both releases. * fix(tests): update server-telemetry test to mock startServer return value - Modified the mock implementation of startServer to return an object containing close and forceClose functions, ensuring proper handling in tests. - This change prevents actual server startup during tests while maintaining the expected interface. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gab <86735558+gabrielekarra@users.noreply.github.com> Co-authored-by: guoyangzhen <upgyz@qq.com> |
||
|
Enrico Toniato
|
405fac7a0b |
Canary (#1116)
* Dev inspector no-open (#1100) * fix(inspector): respect --no-open flag in dev mode standalone The inspector standalone server.ts (used in dev mode) was ignoring the --no-open flag and always opening the browser. This fix: 1. Adds hasNoOpenFlag() helper function to utils.ts to check for --no-open flag 2. Updates server.ts to check for --no-open before auto-opening browser in dev mode 3. Also adds --no-open support to cli.ts for consistency Fixes MCP-1406 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: add changeset for inspector --no-open fix Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Hono express middleware types (#1101) * fix: Add proper TypeScript types for Express middleware in Hono server - Added ExpressMiddleware and ExpressErrorMiddleware type definitions - Created ExtendedHonoUse type that accepts both Hono and Express middleware - Updated createHonoProxy return type to HonoWithExpressMiddleware - Removed (app as any) type assertions and used proper types - Fixes type errors when passing Express middleware to server.use() Resolves MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * test: Add Express middleware example and type tests - Created example demonstrating Express and Hono middleware compatibility - Example includes: Express middleware, Hono middleware, MCP tool, GET route, POST route - Added unit tests for Express middleware type compatibility - Example successfully runs and demonstrates all features - Added README with usage instructions Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * refactor: Use real npm middleware packages and remove type annotations - Replaced mock Express middleware with real packages: morgan and express-rate-limit - Removed all TypeScript type annotations from example code - Updated tests to use real npm packages - Updated README with correct usage examples - Server successfully runs with morgan logger and rate limiting Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * docs: Update documentation for Express middleware support - Updated architecture.md to show Express middleware is now supported - Updated tools.md note about Express middleware compatibility - Added Express middleware examples to api-reference.mdx - Enhanced middleware section in configuration.mdx with Express examples - Clarified that Express middleware is auto-detected and adapted Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: Add changeset and improve Express middleware detection robustness - Added changeset for Express middleware type fix - Improved middleware detection with pattern matching for both Express and Hono patterns - Added verification for 3-4 param functions to check Express patterns - Added Hono pattern detection for 2-param functions - Updated documentation to reflect more robust detection mechanism - Ran pnpm lint and pnpm format (all passed) Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * Tar package deprecation (#1102) * fix: remove deprecated @types/tar and update tar to latest version - Remove @types/tar from packages/cli (tar now includes its own types) - Remove @types/tar from packages/create-mcp-use-app - Update tar in create-mcp-use-app from ^7.4.3 to ^7.5.9 Resolves MCP-1428 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: add changeset for tar deprecation fix Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(typescript): add client-side completion support (#1056) * feat(typescript): add client-side completion support Add complete() method to BaseConnector, MCPSession, and useMcp hook to enable requesting autocomplete suggestions for prompt arguments and resource template URIs. Key changes: - Add complete() method to BaseConnector wrapping SDK client.complete() - Add complete() method to MCPSession with delegation to connector - Add complete() method to useMcp React hook with proper state management - Fix resourceTemplates state population (was exposed but never populated) - Add refreshResourceTemplates() method to useMcp hook - Update refreshAll() to include resource templates - Add comprehensive unit and integration tests - Add detailed documentation in docs/typescript/client/completion.mdx - Update docs/typescript/client/usemcp.mdx with new methods This enables users to request autocomplete suggestions from servers that provide completion callbacks via completable() in prompt schemas and resource templates. Closes #969 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(auth): resolve OAuth flow for WorkOS across client, server, and inspector (#1058) * add proactive token refresh and credential invalidation to BrowserOAuthClientProvider * fix OAuth token refresh by removing static Authorization header from transport config * add changeset * update refresh to use official mcp sdk methods * update workos to always use proxy method since its an external provider * update autoConnect to always include proxyAddress even without bearer tokens * run format * update changeset * chore: update pnpm-lock.yaml after rebase onto main --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * improvement(auth): accept full AuthKit domain in WorkOS subdomain config (#1057) * change subdomain to include authkit.app * add changeset * chore(typescript): version packages (canary) * Fix/inspector/first render (#1060) * fix(tsconfig): include .mcp-use directory in TypeScript configuration for starter and blank templates * fix(package.json): update postinstall script to remove fallback for generate-types in mcp-apps template * fix(MessageList): enhance tool metadata retrieval by normalizing tool names for consistency with API responses * feat(inspector): enhance MCPApps components with required props handling and improved UI feedback - Added `requiredProps` to `MCPAppsDebugControls` to auto-open a popover when required props are missing, providing users with a clear indication of necessary inputs. - Updated `MCPAppsRenderer` and `MessageList` to support cancellation state, allowing for better user experience during tool execution. - Enhanced `PropsConfigDialog` to detect and display required props from widget schemas, improving the configuration process. - Introduced utility functions in `usePropsLLM` for better JSON extraction from LLM responses, ensuring accurate prop generation. * feat(inspector): enhance IframeConsole with expandable log entries and improved log formatting - Added expandable functionality to log entries, allowing users to view detailed logs on click. - Introduced a copy button for logs, enabling easy copying of log content to the clipboard. - Improved log formatting and display, including inline previews and better handling of log levels. - Updated UI elements with new icons and styles for a more intuitive user experience. * feat(inspector): add clientOptions to InspectorDashboard for enhanced capabilities - Introduced `clientOptions` with `capabilities` to support new extensions in the InspectorDashboard component. - This enhancement allows for better integration with the MCP application protocol, improving overall functionality. * feat(inspector): refine Layout component by updating validTabs and adding clientOptions - Updated the `validTabs` array in the Layout component to remove the "playground" tab. - Added `clientOptions` with specific capabilities to enhance integration with MCP application protocol, improving functionality. * feat(types): enhance type definitions with detailed documentation and examples - Updated `MCPServerClass` tool and prompt definitions to include more specific type constraints for better type safety. - Enhanced `ServerConfig`, `InputDefinition`, and various resource and tool interfaces with comprehensive JSDoc comments, including examples for clarity. - Improved overall type definitions for widgets and tools, ensuring better integration and usability within the MCP framework. - Added missing descriptions and examples to several interfaces, improving developer experience and documentation quality. * feat(mcp-apps): update server and widget integration for enhanced functionality - Refactored the MCP server setup to improve integration with MCP Apps, including updated descriptions and documentation links. - Introduced a new search tool for fruits, allowing users to filter results and display them in a visual widget. - Enhanced the product search result widget with improved loading states and detail views for selected fruits. - Removed unused dependencies and components to streamline the project structure. - Updated README files to reflect changes and provide clearer guidance for users. * feat(inspector): enhance MCPAppsRenderer and ui-resource-registration for improved widget re-initialization and metadata handling - Added logic in MCPAppsRenderer to re-read `prefersBorder` from the server upon widget re-initialization, improving responsiveness to metadata changes. - Implemented detection of widget re-initialization to ensure tool input is correctly sent to new widget instances after events like HMR page reloads. - Refactored resource registration in ui-resource-registration to dynamically resolve the latest enriched definitions, ensuring accurate metadata is used during HMR updates. - Updated read callbacks to handle dynamic URIs and maintain consistency in resource handling, enhancing overall widget functionality. * feat(widget): enhance useWidget hook and documentation for improved functionality - Updated the `useWidget` hook to support additional generic parameters for better type safety and flexibility. - Introduced new props for real-time streaming and external link handling, enhancing widget capabilities. - Improved documentation in SKILL.md and ui-widgets.mdx to clarify usage of new features, including partial argument streaming and external navigation. - Removed deprecated dependencies from package.json files across templates to streamline project setup. - Enhanced various components to utilize new props and improve user experience during tool interactions. * feat(tsconfig): enhance TypeScript configuration and widget functionality - Updated TypeScript configurations across multiple templates to include incremental builds and build info file paths, improving build performance and efficiency. - Modified the `useWidget` hook to streamline state management and enhance type safety by refining generic parameters. - Simplified the `ProductSearchResult` component by reducing unnecessary generic parameters, improving code clarity and maintainability. - Adjusted helper functions to ensure consistent type handling across the widget framework. * feat(update-check): implement update notification for mcp-use CLI - Added a new utility to check for updates of the mcp-use package and notify users if a newer version is available. - Integrated the update check into the CLI's pre-action hook, ensuring users are informed before executing commands. - Created a caching mechanism to minimize unnecessary network requests and improve performance. * feat(inspector): add file utilities for client file management - Introduced a new `file-utils.ts` module containing functions to determine content types based on file extensions, check for the existence of client files, and retrieve the client distribution path. - Updated the middleware to utilize these new utilities for improved handling of client files, including warnings when files are not found. * feat(inspector): update TypeScript and MCPApps components for improved functionality - Added TypeScript version 5.9.3 to the pnpm-lock.yaml for enhanced type safety and features. - Enhanced MCPAppsDebugControls to prevent auto-application of localStorage presets in tool context. - Refactored MCPAppsRenderer to optimize state management and prevent unnecessary re-renders, including the use of refs for tool input and output. - Improved OpenAIComponentRenderer with better state handling and batching of updates to prevent double renders. - Updated ToolsTab to streamline resource pre-fetching and reduce unnecessary renders during tool execution. - Enhanced ToolResultRenderer and ToolResultDisplay for better memoization and performance. - Introduced a new RelativeTimeDisplay component to manage time updates without affecting parent re-renders. * chore: update pnpm-lock.yaml after rebase onto main Co-authored-by: Cursor <cursoragent@cursor.com> * fix: update postinstall script in package.json templates to prevent failure on type generation * Potential fix for code scanning alert no. 81: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * feat(inspector): add HTML escaping function for safe user input handling - Introduced a new `escapeHtml` function to sanitize user input in responses, preventing potential XSS vulnerabilities. - Updated the CDN server response to utilize the `escapeHtml` function when returning 404 error messages. * chore: update TypeScript version to 5.9.3 across multiple packages and enhance component functionality - Added TypeScript version 5.9.3 to pnpm-lock.yaml and various package.json files for improved type safety. - Enhanced OpenAIComponentRenderer to optimize state updates and prevent redundant dispatches. - Updated ResourceResultDisplay to include a data-testid for better testing capabilities. - Improved debugging tools to scope props dialog interactions to the correct resource widget preview. * format * refactor(tests): update widget integration and data flow tests to align with SEP-1865 specifications - Adjusted tests to verify that widget metadata is now located on tool definitions rather than in tool call results, as per SEP-1865. - Updated assertions to check for structured content in results instead of relying on metadata properties. - Enhanced test coverage for tool invocation and output structure to ensure compliance with new standards. * package * test(widget-helper): enhance integration tests for tool metadata validation - Updated assertions to ensure manual and auto tools are defined before checking metadata properties. - Improved handling of auto tool metadata to account for potential absence of _meta. - Enhanced regex checks for output templates to ensure proper formatting and compliance with widget standards. * changeset --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): enhance MCPApps components and improve widget handling (#1063) * feat(inspector): enhance MCPApps components and improve widget handling - Added a new test_app configuration in pnpm-lock.yaml with updated dependencies for better development support. - Updated InspectorDashboard to set a default MCP_URL when not provided. - Refined ProductSearchResult and CarouselItem components to use a consistent text-danger class for better styling. - Improved error handling in InspectorDashboard for connection retries. - Streamlined MCPAppsRenderer to enhance widget re-initialization and metadata handling. - Removed deprecated dev widget endpoints and related logic to simplify the codebase. - Enhanced FormattedContentDisplay to allow toggling between formatted and plain text for better user experience. - Updated PropsConfigDialog and ResourceResultDisplay to utilize standardized metadata paths for improved prop detection. This commit focuses on enhancing the overall functionality and user experience of the MCPApps components and related widgets. * feat(inspector): enhance ToolsTab and ToolExecutionPanel for improved field handling - Introduced state management for tracking fields that should be sent as empty, allowing for explicit control over empty values in tool arguments. - Updated ToolsTab to initialize and manage sets of fields, enhancing the handling of tool input schemas. - Enhanced ToolExecutionPanel to accept and utilize the new payload structure, ensuring accurate representation of data sent during tool execution. - Added toggle functionality in ToolInputForm for explicitly sending empty objects and arrays, improving user experience and flexibility in input handling. This commit focuses on refining the input handling process within the inspector, providing users with better control over the data they send. * feat(widget): enhance useWidget hook to unwrap CallToolResult envelope - Updated the useWidget hook to unwrap the CallToolResult envelope when the OpenAI provider is used, allowing for direct access to structured content. - Improved handling of toolOutput to ensure compatibility with hosts that pass the full tool-result parameters. - Enhanced documentation comments to clarify the changes and improve understanding of the new logic. This commit focuses on refining the output handling within the useWidget hook, improving type safety and usability for developers. * feat(inspector): enhance CSP handling and widget re-execution logic - Updated the Inspector components to improve handling of Content Security Policy (CSP) settings, ensuring that widget metadata is correctly enriched with CSP directives. - Introduced logic to re-execute widgets when CSP mode changes, allowing for dynamic updates to the widget's execution context. - Enhanced the MCPAppsDebugControls and MCPAppsRenderer to better manage CSP violations and provide clearer user feedback on required props. - Refactored the PropsConfigDialog to utilize standardized metadata paths for improved prop detection and configuration. This commit focuses on refining the CSP management and widget lifecycle within the inspector, enhancing overall functionality and user experience. * refactor(tests): update weather-display widget tests for props handling - Modified tests in `aaa-ui-widgets.test.ts` to check for visibility of props wall text instead of iframe visibility, ensuring that the widget's required props are correctly validated. - Removed unnecessary iframe visibility checks in `debugger-tools.test.ts` to streamline the test flow and focus on props configuration. - Updated `navigateToResourcesAndSelectWeather` helper function to wait for props wall text, enhancing clarity on widget requirements during testing. This commit enhances the accuracy of widget tests by focusing on required props visibility, improving overall test reliability. * chore(typescript): version packages (canary) * docs: add completion page to nav and McpClientProvider example * feat(examples): add completion server and client example - Add completion server with static list, dynamic callback, and resource template - Add Node client example demonstrating prompt and resource completions - Add example:server:completion, example:client:completion, example:completion scripts - Update completion docs with run instructions --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Sidharth Shambu <sshambu@MacBookPro.lan> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(mcp-use): enhance host information and capabilities handling (#1082) * feat(mcp-use): enhance host information and capabilities handling - Added `hostInfo` and `hostCapabilities` properties to `McpAppsBridge` for storing host details during initialization. - Implemented `getHostInfo` and `getHostCapabilities` methods to retrieve host information. - Updated `useWidget` to manage and expose host information and capabilities state. - Enhanced `UseWidgetResult` type to include `hostInfo` and `hostCapabilities` for better integration with widgets. - Introduced `ClientCapabilityChecker` interface to provide structured access to client capabilities and information in the context. * feat(mcp-use): enhance client information handling and context management - Introduced `ctx.client.info()` and `ctx.client.supportsApps()` methods for improved client identification and MCP Apps support checks. - Updated `useWidget` to include `hostInfo` and `hostCapabilities` properties, enhancing widget integration with MCP Apps. - Enhanced context management in `mcp-server.ts` to provide a structured client capability checker, ensuring consistent access to client capabilities across different handlers. - Improved documentation to reflect new client and host information features, providing clearer guidance for developers. * feat(mcp-use): enhance user context handling and capabilities integration - Introduced `UserContext` to extract and normalize end-user metadata from request-level parameters, improving personalization and context awareness in tools. - Updated `createEnhancedContext` to include user context, allowing tools to access user-specific information such as locale and location. - Enhanced `toolRegistration` and `createEnhancedContext` methods to handle user metadata, ensuring consistent access across different handlers. - Improved documentation to reflect new user context features and their usage in tools and resources. * chore(typescript): version packages (canary) * feat(inspector): enhance logger middleware to filter noisy API endpoints (#1104) - Updated logger middleware to filter out noisy endpoints (telemetry, RPC stream/log) to reduce log spam. - Introduced a list of noisy paths and modified the logger function to skip logging for these paths, improving log clarity and relevance. * chore(typescript): version packages (canary) * feat(docs): add per-server elicitation and sampling callbacks examples - Introduced documentation for per-server elicitation and sampling callbacks, allowing different MCP servers to define their own callback functions. - Added TypeScript examples demonstrating how to configure `onElicitation` and `onSampling` for individual servers, enhancing flexibility in handling user interactions. - Updated precedence order tables for both elicitation and sampling to clarify callback resolution hierarchy. * fix(react): make health check and reconnection intervals configurable (fix #985) (#994) * feat(mcp-use): enhance reconnection and health check options - Updated `autoReconnect` configuration to support detailed options for reconnection and health checks, including initial delay, health check interval, and timeout settings. - Introduced `reconnectionOptions` for controlling the retry behavior of the underlying transport, allowing for more granular control over reconnection strategies. - Enhanced documentation to clarify the new configuration options and their usage, improving developer experience and flexibility in managing connections. * changeset --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(widget): enhance sendFollowUpMessage to support content block arrays (#1085) - Updated the `sendFollowUpMessage` method to accept both string shorthand and an array of `MessageContentBlock` objects, allowing for richer message content per the SEP-1865 `ui/message` specification. - Modified documentation and examples across various files to reflect the new functionality, including usage of text, image, and resource blocks. - Ensured compatibility with the ChatGPT Apps SDK, clarifying that only text blocks are utilized in that context. * chore(typescript): version packages (canary) * feat(mcp-use): add proxy server functionality and documentation (#1113) - Introduced a new `proxy` method in the `MCPServerClass` to allow mounting multiple MCP clients onto a single server, enhancing server capabilities. - Updated documentation to include a new "Proxy Servers" section, detailing usage examples and configuration options for the proxy feature. - Added relevant entries in the pnpm-lock.yaml to support the new proxy functionality, ensuring all dependencies are correctly managed. - Enhanced the `index.mdx` file to reflect the addition of the proxy server feature, improving clarity for developers on available functionalities. * chore(typescript): version packages (canary) * Feat/dashboard/embedded (#1115) * feat(inspector): enhance inspector components and improve type handling - Updated `tsup.client.ts` to include new external dependencies for better integration. - Enhanced `index.ts` by adding `InspectorProvider` and related types for improved context management. - Modified `PromptResultDisplay.tsx` to ensure error messages are returned as strings for consistency. - Changed `ListItem.tsx` to allow `description` prop to accept `ReactNode` for more flexible content. - Improved `MarkdownRenderer.tsx` to adjust list styling for better visual presentation. - Updated `RpcPanel.tsx` to include an effect for collapsing the panel on mount and refined resizing logic for better user experience. This commit focuses on enhancing the functionality and usability of the inspector components. * fix(chat): remove background styling from ChatHeader component - Updated the ChatHeader component to remove the background styling for improved visual consistency. - This change enhances the overall appearance of the chat interface by simplifying the design. * feat(inspector): fix build to allow inspector embedding - Added a changeset for the minor version update of the "@mcp-use/inspector" package. - Improved the build process to support embedding of the inspector, enhancing its integration capabilities. * chore(typescript): version packages (canary) * feat(deploy): update dashboard URL construction to use dynamic web URL (#1117) * chore(typescript): version packages (canary) * chore(changelog): update changelogs for inspector and typescript packages - Added new entries for version v0.24.0 in the inspector changelog, highlighting embedding support, logger improvements, and updates to mcp-use. - Updated typescript changelog for version v1.21.0, detailing new proxy server functionality, client-side completion support, and various enhancements and fixes. * fix(tests): update inspector and debugger tools tests for improved reliability (#1120) - Commented out modal closing logic in connection tests due to focus issues requiring multiple ESC presses. - Enhanced debugger tools tests by refining navigation and visibility checks for resource widgets and props popovers, ensuring more stable interactions. - Adjusted helper functions to prevent unnecessary button clicks when popovers are already visible, improving test performance. * chore(typescript): version packages (canary) * chore(docs): update links in README and changelogs for improved navigation - Updated documentation links in README.md and various changelogs to point to the correct URLs, enhancing accessibility to resources. - Ensured consistency across documentation by replacing relative links with absolute URLs for better clarity and user experience. * fix(widgets): update metadata handling for widget registration (#1121) - Adjusted the logic for setting widget metadata to ensure it only includes enriched CSP metadata when available, preventing undefined values. - Enhanced the registration process by refining how metadata is merged, improving overall reliability and consistency in widget definitions. * chore(typescript): version packages (canary) * feat(server): enhance landing page generation with favicon and icon support (#1122) - Added favicon and icon configuration options to the MCPServer setup, improving visual branding. - Updated landing page generation to include tools, prompts, and resources, enhancing the user experience with more detailed information. - Introduced HTML escaping function to prevent XSS vulnerabilities in user-provided content. * chore(typescript): version packages (canary) * feat(auth): enhance OAuth flow and CORS handling (#1128) * feat(auth): enhance OAuth flow and CORS handling - Introduced PKCE verifier management to prevent drift during overlapping auth attempts. - Updated CORS middleware to explicitly allow Authorization headers, ensuring compatibility with browser security policies. - Refined OAuth proxy URL inference logic to handle gateway connections more effectively. - Improved error handling for missing code verifiers during authentication state restoration. * fix(auth): improve OAuth metadata handling and logging - Updated the OAuth flow to enhance metadata resource handling, ensuring the correct resource is used for SDK validation. - Introduced logging for connection URLs and metadata responses to aid in debugging and monitoring. - Adjusted the handling of connection URLs to prevent issues with local proxy URLs during callback flows. - Enhanced error handling for metadata fetching and improved fallback mechanisms for OAuth proxy URLs. * chore(typescript): version packages (canary) * fix: use Node.js telemetry in server-side code instead of browser stub (#1086) * fix: use Node.js telemetry in server-side code instead of browser stub Server-side code was importing Telemetry from the barrel file (telemetry/index.js) which re-exports the browser implementation. The browser Telemetry class detects Node.js as "unknown" runtime and silently disables all telemetry, meaning no server events were being sent to PostHog or Scarf. Changed 6 server-side files to import from telemetry-node.js directly. Also updated the unit test mock path to match the new import. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: split tsup build to prevent telemetry-node from leaking into browser bundle mcp_agent.ts and connectors/base.ts are exported from src/browser.ts but now import from telemetry-node.ts (which contains require("node:fs/os/path/crypto")). Without a split build, these require() calls would be inlined into dist/src/browser.js, causing webpack/Vite to emit errors or polyfill Node.js built-ins in browser targets. Split tsup.config.ts into two configs: - Node/server entries: no substitution, telemetry-node.ts imports unchanged - Browser entries (src/browser.ts, src/react/index.ts): esbuild plugin transparently rewrites any telemetry-node import to telemetry-browser at build time Also removed duplicate "@modelcontextprotocol/sdk" entry in external list. * fix: preserve src/ prefix in browser build output paths tsup infers output paths from the common root of all entry points. When browser entries were split into a separate config containing only src/browser.ts and src/react/index.ts, the common root became src/, causing output to land at dist/browser.js and dist/react/index.js instead of dist/src/browser.js and dist/src/react/index.js. package.json exports expect the src/-prefixed paths, so the inspector build (and any consumer importing mcp-use/react or mcp-use/browser) would fail with ENOENT. Fix: use tsup object entry syntax with explicit output keys to force the correct dist/src/ output paths regardless of common-root inference. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(mcp-use): resolve autoReconnect issues and enhance server management (#1130) * fix(mcp-use): resolve autoReconnect issues and enhance server management - Disabled unwanted GET polling when autoReconnect is false by setting maxRetries to 0. - Improved getServer() logic to correctly handle server configurations in React StrictMode, preventing duplicate server warnings. - Added a new example for dynamically adding an MCP server post-authentication, demonstrating the use of getServer guard. - Updated logging levels for server addition to reduce noise in debug output. * refactor(mcp-use): simplify server addition logic and update documentation - Removed the getServer guard from the ProtectedRoute example, as addServer is now idempotent and handles duplicate calls silently. - Updated the McpClientContextType interface to clarify that addServer can be called multiple times with the same id without issues. - Streamlined the addServer implementation to enhance readability and maintainability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Sidharth Shambu <49567934+shambu2k@users.noreply.github.com> Co-authored-by: Sidharth Shambu <sshambu@MacBookPro.lan> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Ashutosh Kumar Singh <161562995+Ashutosh0x@users.noreply.github.com> Co-authored-by: Luigi Pederzani <luigipederzani@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Joaquin Coromina
|
b18172f09d | add sendFollowUpMessage docs and replace callTool with useCallTool across mcp-apps-builder skill (#1091) | ||
|
Joaquin Coromina
|
a437afd0db |
improvement(skills): add scaffolding pre-flight check, template guidance, and deployment reference to mcp-apps-builder skill (#1088)
* add scaffolding pre-flight check, template guidance, and deployment reference to mcp-apps-builder skill * remove untested features and confusing guidance |
||
|
Enrico Toniato
|
455c18f349 |
Fix/hack/3 (#1075) (#1077)
* Fix/hack/3 (#1075) * fix(inspector): update MCPAppsRenderer and OpenAIComponentRenderer for improved border handling and status display - Changed default state for `prefersBorder` in MCPAppsRenderer to false, aligning with updated UI specifications. - Updated OpenAIComponentRenderer to conditionally display status labels above the widget in inline mode, enhancing user feedback. - Adjusted CSS classes for better layout management based on display modes, improving overall user experience. - Increased z-index for sticky elements in ToolResultDisplay to ensure proper layering in the UI. * feat(mcp-use): enhance health monitoring with dynamic authentication headers - Added `getAuthHeaders` parameter to `startConnectionHealthMonitoring` for customizable authentication headers during health checks. - Implemented logic to fetch and include authorization headers in the health check request, improving security and flexibility. - Updated `useMcp` to provide a default implementation for `getAuthHeaders`, ensuring seamless integration with authentication providers. - Modified middleware to allow HEAD requests without authentication, facilitating health checks and keep-alive functionality. * fix(inspector): update useAutoConnect to retain tile visibility on connection failure - Modified the connection failure handling in useAutoConnect to keep the tile visible in a failed state instead of navigating away or removing the connection. - Updated comments for clarity on the new behavior during connection failures, ensuring better user experience and feedback. * fix(mcp-apps-builder): update interactivity documentation to reflect useCallTool changes - Replaced instances of `callTool()` with `useCallTool()` in documentation to align with the new hook-based approach. - Enhanced explanations of `useCallTool()` functionality, including state management and error handling. - Updated examples to demonstrate the new usage patterns for creating, updating, and deleting items within widgets. * feat(inspector): introduce tool management options in MCPAgent and UI components - Added `exposeResourcesAsTools` and `exposePromptsAsTools` options to `MCPAgentOptions`, defaulting to `true` for backward compatibility. - Updated the inspector chat tab to set these options to `false`, ensuring only actual MCP tools are exposed to the LLM. - Implemented a `ToolSelector` component for managing tool visibility, allowing users to enable or disable tools dynamically. - Modified relevant components (`ChatInput`, `ChatInputArea`, `ChatLandingForm`) to integrate the new tool management features, enhancing user interaction and control. - Adjusted the `useChatMessagesClientSide` hook to recreate the agent based on disabled tools, improving responsiveness to user settings. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Joaquin Coromina
|
a3fd6a55dd | update all docs to fix guidance on workos subdomain (#1076) | ||
|
Enrico Toniato
|
4546a8c5b4 |
Canary (#1073)
* fix(create-mcp-use-app): unify logo usage across all entry paths (#1070) * fix: unify logo display across all CLI entry paths * add changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Fix/hack/2 (#1071) * feat(inspector): enhance MCPAppsDebugControls and sandbox-proxy for improved CSP handling - Updated MCPAppsDebugControls to dynamically adjust violation indicators based on CSP mode, providing clearer user feedback. - Introduced a function in sandbox-proxy.html to strip existing CSP meta tags, ensuring that the injected permissive CSP is not overridden by restrictive policies. - Enhanced comments for clarity on CSP handling logic, improving maintainability and understanding of the code. * feat(widget): introduce invoking and invoked status texts for improved user feedback - Added `invoking` and `invoked` properties to widget metadata, allowing for customizable status messages during tool execution. - Updated relevant components to display these status texts, enhancing user experience by providing real-time feedback on tool operations. - Adjusted default values for `invoking` and `invoked` to improve clarity and consistency across widgets. - Refactored documentation to reflect changes in widget metadata and usage patterns, ensuring developers have clear guidance on implementing these features. * fix(docs): remove BrowserRouter from McpUseProvider documentation and update related descriptions - Updated the `<McpUseProvider />` documentation to reflect the removal of `BrowserRouter` from its setup. - Adjusted descriptions and examples to clarify the new usage without `BrowserRouter`, ensuring accurate guidance for users. * fix(tests): update widget-helper integration tests for explicit auto-widget naming - Changed references from "auto-widget" to "explicit-auto-widget" in the integration tests to align with updated tool definitions. - Adjusted assertions to verify the correct metadata and URI format for the explicit auto-widget, ensuring compliance with the latest specifications. * chore(typescript): version packages (canary) --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Joaquin Coromina
|
7b50461152 | add guidance for redirect uri errors (#1072) | ||
|
Joaquin Coromina
|
22927ede9f | add authentication guidance to smcp-apps-builder (#1061) | ||
|
Joaquin Coromina
|
ab71aa7a0a |
feat(skills): create a consolidated and improved skill to help agent write mcp-use typescript sdk code (#1026)
* create consolidated skill for building typescript mcp servers * fix missing imports, missing resource response helper, and lazy useState initialization with props bug * fix resources example destructure and add additional guidance in SKILL.md * remove old skills * change skill name to mcp-apps-builder * add explicit types to ctx method args * add completion for prompts and resource templates to skill * update SKILL.md high level reading guidance and add architecture guidance for lower level server integrations * improve guidance on widget props typing and when to open widget reference files * add prerequisites on top of debounced search for reading interactivity.md * add back the previous skills with a deprecation notice in the description * updated all express examples to hono |
||
|
Enrico Toniato
|
3e36cd6bcf |
refactor(SKILL.md, components-api.md, response-helpers.md): enhance documentation clarity and structure (#981)
- Updated SKILL.md for both ChatGPT App Builder and MCP Builder to improve descriptions and organization, emphasizing key concepts and setup instructions. - Refined the components-api.md to clarify the useWidget hook's return values and added examples for new functionalities like sendFollowUpMessage and openExternal. - Expanded response-helpers.md to include new error and embedded resource response types, along with usage examples for better developer guidance. |
||
|
pederzh
|
ea631e9146 |
Refactor SKILL.md for ChatGPT App Builder
- Streamlined instructions for building ChatGPT apps with mcp-use, emphasizing zero-config widget development. - Updated project structure details and clarified setup commands. - Enhanced explanations of MCP Apps vs ChatGPT Apps SDK, highlighting compatibility and benefits. - Improved widget metadata section for clarity on required fields and CSP configuration. |
||
|
pederzh
|
bbc6f0472a |
Add MCP Builder Skill with License and Documentation
- Created SKILL.md detailing the MCP Server Builder, including setup instructions and best practices. - Added resource-templates.md for parameterized resource templates reference. - Included response-helpers.md for comprehensive response helper functions documentation. - Updated existing SKILL.md to streamline instructions and enhance clarity. |
||
|
pederzh
|
a0ce24134b |
Implement ChatGPT App Builder Skill with License and Documentation
- Introduced SKILL.md detailing the ChatGPT App Builder, including setup instructions and features. - Created components-api.md for reference on React components provided by mcp-use. - Added csp-and-metadata.md for guidance on Content Security Policy and metadata configuration. - Developed widget-patterns.md showcasing advanced widget patterns and examples for ChatGPT apps. |
||
|
pederzh
|
7712d26ce4 | add skills and claude marketplace plugin |
