mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
@mcp-use/cli@4.0.0-beta.7
144 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Enrico Toniato
|
392d36c079 |
Optimize the standalone Inspector package (#1968)
* fix inspector hosted proxy and oauth recovery * remove inspector compatibility report * refactor(inspector): mount project-local dev inspector * refactor(inspector): remove CDN application delivery * fix(inspector): finalize local mount and proxy health checks * refactor(typescript): optimize inspector packages * fix(typescript): build CLI for server examples * fix(typescript): keep CLI build deps development-only |
||
|
Andrew Khadder
|
6827ab20a1 |
Resolve Inspector beta assets to immutable CDN releases (#1952)
* Resolve Inspector CDN releases before loading assets * fix(ci): pin pnpm for server examples * fix(ci): relink server example CLI * fix(examples): support clean Next builds in CI * fix(examples): expose built workspace CLI * fix(inspector): address CDN loader review * fix(inspector): support legacy abort signals |
||
|
Enrico Toniato
|
f3fc8dab1b |
fix(client): surface manual OAuth failures (#1953)
* fix(client): surface manual OAuth failures * ci: publish TypeScript previews for beta PRs * ci: pin pnpm for server example checks * revert: keep server example CI out of OAuth fix |
||
|
Enrico
|
78266950f9 | feat(server): add Next.js drop-in adapter and example suite | ||
|
Enrico
|
856d90626e |
fix(ci): retry beta npm verify after publish
npm registry replication can lag behind trusted publishing; retry up to 2 minutes before failing the release job. |
||
|
Enrico
|
15798394a4 |
chore(typescript): raise Node floor to 22.22.2 and CI to 22.23.1
Excludes pre–March 2026 security patches and satisfies npm 12 for trusted beta publishing. |
||
|
Enrico
|
b47e268f61 |
chore(typescript): raise Node.js engine floor to 22.13
Unblocks beta releases on pnpm 11.13 and aligns CI, Docker, build targets, and scaffolds with Maintenance LTS Node 22. |
||
|
Enrico Toniato
|
50df3a1611 |
Create mcp use app version (#1924)
* refactor(create-mcp-use-app): replace --canary flag with --sdk-version for version pinning - Updated GitHub Actions workflows to use --sdk-version instead of --canary for creating apps. - Modified CLI options and internal logic to support --sdk-version for specifying npm dist-tags or semver. - Updated documentation and tests to reflect the change from --canary to --sdk-version. * chore(ci, workflows): downgrade Node.js version to 20.19.0 across all workflows - Updated GitHub Actions workflows to use Node.js version 20.19.0 instead of 24.15.0. - Adjusted package.json files to reflect the new Node.js engine requirements. - Updated pnpm-lock.yaml and TypeScript dependencies to ensure compatibility with the new Node.js version. |
||
|
Andrew Khadder
|
3bffd70dfe | fix beta preview packaging and docs (#1913) | ||
|
Andrew Khadder
|
5c09447160 | fix(ci): repair beta workflow checks (#1909) | ||
|
Andrew Khadder
|
5f25d3c8ad | fix conformance workflow for beta layout (#1908) | ||
|
Andrew Khadder
|
96c649db95 | fix(ci): retarget server typecheck workflow (#1907) | ||
|
Andrew Khadder
|
b7b5ec0dc6 | ci(typescript): align beta checks with Node 24 (#1895) | ||
|
Enrico
|
25b1e678fa | ci(typescript): publish beta tarballs with explicit tag | ||
|
Enrico
|
16cf9228e0 | ci(typescript): prepare Changesets base branch on beta | ||
|
Enrico
|
289cf2cbcc | Merge branch 'v2-server-scaffold' into beta | ||
|
Enrico
|
791f745cc4 | ci(typescript): publish beta exclusively with OIDC | ||
|
Enrico
|
0b8f68ba04 | ci(typescript): preserve non-beta npm tags | ||
|
Enrico
|
c51331530b | test(typescript): port Deno preview smoke test to v2 | ||
|
Enrico
|
ba1c2b051a | ci(typescript): gate beta publishing on package tests | ||
|
Enrico
|
4498176657 | ci(typescript): add guarded beta npm releases | ||
|
Enrico
|
f00b811205 | ci(typescript): run PR preview workflow for PRs targeting v2 | ||
|
Enrico
|
e395884302 | ci(typescript): run PR preview workflow for PRs targeting v2 | ||
|
Enrico
|
8843e2ef0d |
fix(ci): simplify version generation command in CI workflow
- Removed redundant version generation command for @mcp-use/client in the CI workflow. - Updated documentation links in code-mode.mdx and other files to reflect new paths. - Changed installation instructions from yarn to npm for consistency across documentation. - Enhanced error handling in client authentication and session management. - Added a utility function to compare semantic versions in telemetry. - Removed outdated unit tests for FileKVStore. |
||
|
Enrico
|
e6ce060a1b |
refactor(docs): update README and documentation for MCP SDK v2
- Improved formatting and consistency in README.md and various documentation files. - Updated import paths to reflect the new package structure for @mcp-use/client and @mcp-use/agent. - Enhanced examples and descriptions for MCPAgent and related components. - Cleaned up whitespace and formatting for better readability across multiple files. |
||
|
Enrico
|
e649639d5d |
fix(workflow): streamline pnpm and Node.js setup in CI configuration
- Adjusted the GitHub Actions workflow to conditionally set up pnpm only for pnpm repositories, preventing errors related to multiple version specifications. - Simplified the Node.js setup process by ensuring it is always configured, enhancing the reliability of the CI pipeline. |
||
|
Enrico
|
7a192d63aa |
fix(workflow): remove unnecessary flag from pnpm install command in CI configuration
- Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. |
||
|
Pietro Zullo
|
332a0a77a4 |
fix(ci): configure git identity before tagging in typescript release (#1675)
changesets creates annotated tags (git tag -m), which fail silently without user.name/user.email configured. On the main release path no prior step set the git identity, so stable releases were published to npm but never tagged - skipping GitHub releases and the Discord notification. Also fail the publish step loudly when no tags are created instead of exiting 0. |
||
|
Enrico Toniato
|
b182d98404 |
fix(ci): remove untrusted PR checkout from Claude workflow (#1664)
Resolves CodeQL alert #83 by dropping manual PR head checkout in the privileged issue_comment workflow and letting claude-code-action handle PR refs with its built-in base-branch config restore. |
||
|
Andrew Khadder
|
db69471a54 |
Revert "chore: have dependabot create against canary (#1630)" (#1654)
This reverts commit
|
||
|
Andrew Khadder
|
546dc1ad80 | chore: have dependabot create against canary (#1630) | ||
|
Andrew Khadder
|
83271e869f |
Canary (#1508)
* chore: remove unused mcp-use source files (#1476) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs(cli): clarify inspector skipped-in-production log + start section (#1505) * docs(cli): clarify inspector skipped-in-production log + start section The runtime log "[INSPECTOR] Skipped in production (use --with-inspector flag during build)" reads as if the flag can be passed to `mcp-use start`, which it can't (the flag is only registered under `build`). The new wording spells out the rebuild command, and `cli-reference.mdx` gains a short note under `start` pointing at the build flag for inspector-in-production. Closes #1495 * docs(cli): apply reviewer reword on inspector note * chore(typescript): version packages (canary) * chore(inspector): remove unused source files (#1510) Drops the 18 inspector files reported by `pnpm knip` from libraries/typescript and stops generating the unused client-side version.ts (the client reads the version from the window.__INSPECTOR_VERSION__ global injected by the server). Part of #1446. * chore(typescript): version packages (canary) * chore(typescript): prune 187 unused exports and 161 unused export types flagged by knip (#1511) * chore(typescript): prune 161 unused exported types flagged by knip Phase 2 of #1450: remove or de-export types that knip flags as unused. Skipped tuning knip.json (Phase 1) — focused only on the type cleanup. For each flagged type: - Used only within its source file → drop `export` - Re-exported through a barrel but never imported downstream → remove the re-export - Genuinely dead → delete No public-API removals: types exposed through the `mcp-use`, `@mcp-use/cli`, `@mcp-use/inspector`, or `create-mcp-use-app` package entry points remain exported. `client.ts` switches from inline `import("...")` to a top-level import so knip can see the `ToolSearchResponse` usage. Verified `pnpm knip` reports 0 unused types (down from 161) and `pnpm build` passes across all packages. * chore(typescript): prune 187 unused exports flagged by knip Closes #1450. * chore(typescript): fix prettier formatting * chore(typescript): delete orphaned PropsSelect.tsx Removing the unused barrel re-export in the prior commit left this file with no consumers. * chore(typescript): version packages (canary) * ci(knip): enforce knip and clear final baseline findings (#1512) * chore(knip): clear remaining baseline findings so knip passes clean - Mark `src/index.tsx` as an entry for create-mcp-use-app so its CLI dependencies (chalk, commander, ink, ora, tar, react, etc.) stop being flagged as unused. - Add `lsof`, `sleep`, and `dev` to ignoreBinaries for the mcp-use workspace — these appear in example scripts and are either system utilities or pnpm script names, not npm-resolvable binaries. - Turn off the `optionalPeerDependencies` rule. Optional peer deps (langchain/langfuse/e2b/etc.) are loaded conditionally by design; flagging them as referenced is noise. After this change `pnpm exec knip` exits 0 against canary. * ci(knip): enforce knip in CI The baseline is now clean (canary + previous PRs cleared all findings), so drop `--no-exit-code` and let the job fail when knip reports issues. Also generate `packages/mcp-use/src/version.ts` before knip runs so the gitignored `version.js` imports resolve. * chore(deps): bump better-auth in /libraries/typescript (#1515) Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.1 to 1.6.11. - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.6.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: tighten PR readiness and docs hygiene (#1509) * docs: tighten review readiness and doc links * docs: anchor api-reference redirect and fix missed node note Move the /typescript/server/api-reference target from a bare redirect to an anchored one (#mcpserver-api-reference) so existing "API Reference" links land on the renamed section directly. Drop the self-link in server/index.mdx and bring the commonjs example's Node note in line with the package engines range. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * feat(server/oauth): allow Supabase URL override for self-hosted/local instances (#1517) * feat(server/oauth): allow overriding Supabase URL for self-hosted/local instances `oauthSupabaseProvider` previously hardcoded `https://${projectId}.supabase.co`, preventing use against local Supabase (`http://localhost:54321`) or self-hosted deployments — even though those instances expose the same OAuth 2.1 server. Add an optional `supabaseUrl` config (and `MCP_USE_OAUTH_SUPABASE_URL` env var) that overrides the projectId-derived URL. `projectId` is now optional when `supabaseUrl` is set; hosted-project users are unaffected. Closes mcp-use/mcp-oauth-supabase-template#2 * test(server/oauth): trim supabase provider tests to factory contract Drop low-value string-concatenation and pre-existing-behavior tests; keep the two that cover the new behavior (supabaseUrl alone is accepted; empty config throws). Isolate process.env in the factory describe so the "throws when neither configured" assertion isn't defeated by local MCP_USE_OAUTH_SUPABASE_* env vars. * docs(server/oauth): document supabaseUrl override for local/self-hosted Supabase * chore(typescript): version packages (canary) * chore: use cross-platform clean commands (#1523) * chore: use cross-platform clean commands * chore: add empty changeset for cross-platform clean scripts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy (#1483) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy The DCR-direct metadata proxy was string-concatenating a path onto the issuer, which canonically ends with a trailing slash: `${issuer}/.well-known/oauth-authorization-server` // → "https://tenant.auth0.com//.well-known/oauth-authorization-server" Auth0 returns 404 for any path starting with "//", which broke OAuth discovery end-to-end against real Auth0 tenants in DCR-direct mode. new URL(path, base) normalizes the join regardless of trailing slash, so this works for any provider whose canonical issuer ends with "/". Fixes #1482. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(server/oauth): normalize issuer trailing slash instead of using URL constructor `new URL("/.well-known/...", issuer)` resolves the leading-slash path against the issuer's origin, stripping any path on the issuer. That breaks providers like Supabase whose issuer is `https://<project>.supabase.co/auth/v1`. Replace with a trailing-slash-stripping template literal, which handles both Auth0 (issuer ends with `/`) and Supabase (issuer has a path). * chore(changeset): trim oauth metadata fix entry * chore(changeset): drop issue reference --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * test(inspector): add OAuth e2e against emulated Google issuer (#1481) * test(inspector): add OAuth e2e test using emulated Google issuer Covers the inspector's OAuth redirect flow end-to-end against an `emulate`-backed Google issuer + MCP server in oauthProxy mode, run twice across the Direct and Via Proxy connection-type matrix. Both variants share one fixture in serial mode since the registered redirect URI pins the MCP server to a fixed port. * test(inspector): switch loop to factory to satisfy no-loop-func The for-loop variant captured the mutable `fixture` binding from beforeAll, which eslint's no-loop-func flags. Hoisting the body into a small factory keeps the shared fixture without the closure-over-loop pattern. * test(inspector): close emulator if MCPServer setup fails Wrap post-createEmulator work in try/catch so the emulator port doesn't stay bound when MCPServer construction or listen() throws. * chore(typescript): version packages (canary) * fix(inspector): surface MCP server auth failures with reconnect banner (#1485) * fix(inspector): surface MCP server auth failures with reconnect banner (MCP-2111) When the hosted inspector's chat backend returns 401 because the upstream MCP server rejected the user's OAuth token (e.g. Linear token expired), the inspector previously threw a generic `HTTP error! status: 401` and the cloud response misleadingly pointed users at the Manufact account login. The chat now recognises the cloud's `{ error: "mcp_auth_required", mcpServerUrl }` response and renders an inline banner above the input ("Reconnect to <server>") with a button that calls `connection.authenticate()`. Reconnect refreshes the OAuth token in localStorage; the banner clears on success and chat resumes. Pairs with a cloud-side change that drops the misleading `loginUrl` field from the 401 response. * fix(inspector): harden mcp_auth_required handling - Drop the no-op setMessages filter in the 401 branch; the optimistic assistant message is only added after the response check, so there's nothing to remove. - Guard `new URL(serverUrl)` in McpReconnectBanner so a malformed URL falls back to the raw string instead of crashing the chat tab. * refactor(inspector): rename mcpAuthRequired to mcpServerAuthRequired The hook's internal state was already named `mcpServerAuthRequired`, but the returned key and clear callback used the shorter `mcpAuthRequired`, forcing the ChatTab consumer to re-alias them. The shorter name was also ambiguous in a codebase that has two distinct auth flows: the Manufact account login (429 path) and the upstream MCP server OAuth (401 path). Align the public surface of `useChatMessages` with the internal state and the consumer's local name. The backend wire value `"mcp_auth_required"` is unchanged. * chore(inspector): remove mcpServerAuthRequired comment * chore(typescript): version packages (canary) * fix(inspector): keep tab count badges visible in collapsed mode (#1490) * fix(inspector): keep tab count badges visible in collapsed mode * Keep tab badges aligned in collapsed mode * extract TabCountBadge and fix badge visibility * chore(typescript): version packages (canary) * fix(inspector): drop unused TabCountBadge barrel re-export (#1533) The only consumer (LayoutHeader.tsx) imports TabCountBadge directly from ./shared/TabCountBadge, so the re-export in shared/index.ts is unused. Knip flagged it and started failing CI on canary after the TabCountBadge change landed. * chore(typescript): version packages (canary) * feat(inspector): add local LLM provider support for chat in Inspector (#1395) * feat(inspector): integrate ollama provider * feat(inspector): integrate lmstudio provider * fix(inspector): preserve no-icon behavior for openai-compatible provider * refactor(inspector): remove LM Studio provider and address PR feedback * fix(inspector): remove duplicate ollama union members Collapses the accidental `"ollama" | "ollama"` duplicates in ProviderName, MCPChatMessageEventData, and LLMConfig. * refactor(inspector): drop LLM proxy and call Ollama directly Ollama allows localhost origins by default, so the inspector talks to the daemon over CORS and skips the server-side proxy entirely. Surface an OLLAMA_ORIGINS hint when the browser fetch fails so tunneled or remote setups know what to configure. Theme the Ollama logo and tighten its size so the non-circular mark sits cleanly next to the other provider icons. * chore(inspector): revert gratuitous field reorders Restore original ordering of temperature/baseUrl and useCallback deps; remove stray blank line in vite.config.ts to keep the diff focused. * test(inspector): add unit tests for parseNDJSON * refactor(inspector): tighten Ollama provider integration - Guard Ollama streamChat against duplicate tool-call emissions when a chunk's tool_calls are repeated by proxies/forks - Key the models cache on (provider, baseUrl) for any base-url provider so openai-compatible no longer serves stale entries on URL changes; normalize Ollama variants (trailing slash, /api suffix) to one entry - Move OllamaCorsError into the Ollama provider module - Replace hand-written provider unions in telemetry events and server shared-utils with ProviderName - Single-source DEFAULT_OLLAMA_BASE_URL from ollama/utils.ts - Drop the unrelated tempApiKey/tempModel trim() drift in saveLLMConfig - Make OPENROUTER_ICON_URL module-private, clean up merge-artifact blank lines * chore: simplify changeset * style(inspector): apply prettier to shared-utils * fix(inspector): drop unused export on DEFAULT_BASE_URLS DEFAULT_BASE_URLS is only consumed by getDefaultBaseUrl in the same module. Knip flagged the export as unused and failed CI. * ci: retrigger after canary knip fix (#1533) --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): resolve CodeQL polynomial-regex alert in Ollama url normalizer (#1534) * fix(inspector): replace trailing-slash regex in Ollama url normalizer CodeQL flagged `/\/+$/` in `normalizeOllamaBaseUrl` as a polynomial regular expression on uncontrolled input. Swap the regex for an explicit linear scan and add unit tests covering the trimming behaviour plus a pathological-input case. * chore: drop unit test for trivial regex refactor * chore: drop accidentally committed .antigravitycli symlink * chore(typescript): version packages (canary) * chore: remove dead typescript-format-and-lint pre-commit hook (#1541) The hook entry pointed to `.git/hooks/typescript-pre-commit.sh`, a path that is never tracked and was never populated by any setup step, so the hook could not run for anyone. TypeScript formatting and linting are already handled by Husky (libraries/typescript/.husky/pre-commit), installed automatically via `pnpm install`'s `prepare` script. Closes #1536 * fix(inspector): stop ToolInputForm from mutating live tool inputSchema (#1545) * fix(inspector): stop ToolInputForm from mutating live tool inputSchema `ToolInputForm` was writing `required: boolean` onto each property of the live tool inputSchema during render. `required` is not valid as a per- property boolean — it belongs on the parent object as a `string[]`. Anthropic's draft 2020-12 validator rejected the resulting payload with `tools.0.custom.input_schema invalid`, breaking the Inspector chat after any tool had been opened in the Tools tab. Replace the mutation with a local `isRequired` const used only for the `*` indicator render. Fixes MCP-1970. * chore(inspector): trim comment on schema-mutation fix * chore: remove verbose comment * style(inspector): apply prettier to ToolInputForm * chore(typescript): version packages (canary) * Improve tab switch animation timing (#1544) * chore(ui): improve tab switch animation timing * chore(changeset): add changeset for tab animation improvement * chore(typescript): version packages (canary) * fix(inspector): propagate server alias updates through mcp server wrapper (#1539) * fix(inspector): propagate server alias updates through McpServerWrapper onUpdate * chore: add changeset for mcp-use server alias propagation fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * chore(typescript): add 3-day install cooldown via pnpm minimumReleaseAge (#1516) Blocks `pnpm install` from fetching npm versions published less than 3 days ago, mitigating supply-chain attacks where a malicious release is typically yanked within hours of discovery. The setting (introduced in pnpm 10.16) lives in pnpm-workspace.yaml — in modern pnpm only auth/registry config is read from .npmrc, so putting it there would be silently ignored. Workspace-published names (`mcp-use`, `@mcp-use/*`, `create-mcp-use-app`) are exempted so the cooldown never interferes with local development or fresh releases of our own packages. * fix(react): improve server management in McpClientProvider (#1561) Refactor server removal and update logic to use a ref for synchronous access to the latest server state. This change prevents React's warning about updating a component during rendering by ensuring that teardown side effects (`disconnect()` and `clearStorage()`) are executed outside of the state updater functions. The ref is updated in a useEffect hook to maintain the latest server state for event handlers. * chore(typescript): version packages (canary) * fix(inspector): forward MCP image tool results as image content (#1487) * fix(inspector): forward MCP image tool results as image content (MCP-1941) Previously, the inspector's chat loop and provider adapters serialized MCP tool results with JSON.stringify, which buried the base64 `data` field of `image` content blocks inside a text payload. Vision-capable models received a wall of base64 text instead of the image. Extract MCP `content` blocks into provider-neutral `ContentPart[]` and route image bytes through each provider's vision channel: - Anthropic: image blocks inside `tool_result.content` (base64 source). - OpenAI: tool role keeps text; image bytes forwarded as a follow-up user turn with `image_url` parts. - Google: `functionResponse.response` keeps text/metadata; image bytes forwarded as a follow-up user turn with `inlineData` parts. Text-only tool results keep the legacy `content: string` path on every provider. * style(inspector): apply prettier formatting * chore(inspector): drop unused export on collapseToString Only called internally by toolResultToContent — knip flagged it as an unused export. * fix(inspector): propagate MCP isError flag and fix image example tools - Add isToolResultError() helper and use it in toolLoop + replay so tool calls that return { isError: true } are flagged the same as thrown errors on both live and saved-conversation paths. - Pick a no-content fallback for OpenAI's tool role when there are no image parts to forward. - Replace via.placeholder.com URLs in the everything example with real base64-encoded bytes fetched from picsum.photos, since the image() helper expects MCP ImageContent base64 data, not URLs. * style(inspector): apply prettier formatting * chore(typescript): version packages (canary) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL (#1552) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL Browsers cannot resolve 0.0.0.0 as a destination, and the MCP SDK's OAuth resource validator does strict origin equality — so the inspector auto-connecting to http://0.0.0.0:PORT/mcp mismatches the resource metadata published as http://localhost:PORT (which goes through normalizeUrlHost in server-helpers.ts). Result: OAuth-protected mcp-use apps fail at the inspector's post-callback validation with "Protected resource X does not match expected Y". Mirror the existing normalization for the autoConnect URL and the banner log so both reflect the browser-reachable host. Closes #1551 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: add changeset for inspector autoConnect loopback normalization --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): align widget Vite base with /mcp-use/widgets (#1560) * fix(cli): align widget Vite base with /mcp-use/widgets/ when MCP_URL is set * chore: add changeset for cli widget base path fix * chore: format widget-paths.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(cli): headless screenshot with auto-sizing and external MCP server support (#1579) * feat(cli): headless screenshot command with auto-sizing and external MCP server support - Make width/height optional; when omitted, clips to the widget's natural rendered size by reading body[data-view-*] rect attrs set by the preview page - Add useBundleReadinessSignal in ViewPreview that uses ResizeObserver to wait for the iframe to stabilize before setting data-view-ready, serializing the iframe's bounding rect so the CLI can clip tightly instead of capturing the full viewport - Switch ViewPreviewBundle to displayMode="inline" so widgets auto-size to content height - Add inlineWidthOverride prop to MCPAppsRenderer to bypass the 768px inline cap when screenshotting at an explicit width - Fix extractViewName to handle external MCP server URIs (ui://<server>/<name>.html) by flattening to <server>-<name>; previously only ui://widget/ was handled, causing React Router to fail to match the preview route for third-party servers like Excalidraw * chore: add changeset for screenshot auto-sizing and external MCP fix * fix(cli): unexport CaptureScreenshotResult to satisfy knip * chore(typescript): version packages (canary) * feat(auth): enhance OAuth callback handling with improved state management and user feedback (#1580) * feat(auth): enhance OAuth callback handling with improved state management and user feedback - Introduced a module-level cache for in-flight authorization promises to prevent duplicate network requests during the same page load. - Added utility functions to determine if the current window is a popup and to render user-friendly messages for closing the window after authentication. - Improved handling of redirect flows and popup scenarios to ensure a seamless user experience, including error handling and messaging for lost opener situations. * fix(auth): BroadcastChannel fallback when popup opener is severed Popup callback now broadcasts success/failure over a same-origin BroadcastChannel("mcp_auth_callback") in the lost-opener branch, and useMcp subscribes to that channel alongside the existing window.message listener. Without this, popups whose window.opener was severed by COOP or cross-origin intermediate redirects would save tokens but leave the parent stuck in `authenticating`. Matches the dual-transport pattern used by oidc-client-ts and MSAL.js for the same COOP scenario. * chore(auth): unexport MCP_AUTH_BROADCAST_CHANNEL to satisfy knip It's only used inside callback.ts; the parent side hard-codes the same string in useMcp.ts. Removing the export drops knip's "unused export" finding while keeping a single source-of-truth comment that links the two files. * fix(mcp-use): split langchain agents out of mcp-use/browser entry Move MCPAgent, RemoteAgent, adapters, and observability to mcp-use/browser/agent so Next.js clients importing MCPClient only no longer pull @langchain/* into the browser bundle. * chore: format browser bundle test file * chore(typescript): version packages (canary) * fix(inspector): add copy button to user messages (#1556) * fix(inspector): add copy button to user messages Extract CopyButton into a shared component and add it to UserMessage, matching the existing assistant message UX. Resolves #1555 * chore: add inspector copy button changeset --------- Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(server): add publicLandingPage option for OAuth-protected servers (#1550) * feat(server): add publicLandingPage option for OAuth-protected servers * fix(server): keep public landing auth gate in oauth setup * docs(server): add public landing page example * chore(server): format mcp endpoint * chore(server): simplify accept header lookup * chore(server): restore mcp mount diff * fix(server): align oauth exports with canary * chore(server): format oauth exports * fix(server): remove unused oauth barrel exports --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * Move mcp-apps template pnpm settings to workspace config (#1602) * fix(inspector): widget fullscreen above embedded host chrome (MCP-2181) (#1605) * fix(inspector): portal widget fullscreen above host chrome MCP-2181: cloud chat headers at z-50 covered the fullscreen exit control because the overlay used z-40 inside a nested stacking context. Portals the fullscreen shell to document.body at z-[100], sets data-mcp-widget-fullscreen for hosts, and shows the Apps SDK exit navbar in CSS fullscreen fallback. * fix(inspector): native fullscreen first, no portal remount (MCP-2181) Revert conditional createPortal that remounted widgets on fullscreen toggle. Use requestFullscreen() as the primary path; apply CSS z-[100] overlay only when the API fails. Keep exit navbar and data-mcp-widget-fullscreen for both. * refactor(inspector): consolidate widget fullscreen into shared hook Extract useWidgetFullscreenControls for native-first fullscreen + CSS fallback. Removes duplicated handlers, unused helpers, and OpenAI edge-case branches from MCPAppsRenderer and OpenAIComponentRenderer. * fix(inspector): preserve widget state when entering fullscreen (MCP-2181) Route ui/request-display-mode through native fullscreen handling, target requestFullscreen on the iframe wrapper, and avoid resetting load state on display-mode-only changes. Stabilize OpenAI iframe listeners so chat re-renders do not flash the skeleton. * style(inspector): format OpenAIComponentRenderer for Prettier * fix(inspector): fullscreen shell includes navbar and fills viewport Promote the outer widget shell via requestFullscreen so FullscreenNavbar stays visible and bg-background fills the screen instead of browser black letterboxing around a nested iframe wrapper. * fix(inspector): PiP portal and sandbox remount bridge reconnect (MCP-2181) Port PiP to document.body with z-[100]. Re-run AppBridge when the sandbox iframe remounts; keep the host spinner until initCount recovers. Unify display-mode document attributes for optional host chrome hiding. * fix(inspector): resend widget data after PiP remount * chore(typescript): version packages (canary) * Hash Claude resource domains from authored ui.domain (#1599) * Apply Claude resource domain hashing for UI metadata * chore: format Claude domain helper * fix(inspector): drop unused widget-fullscreen exports to satisfy knip (#1607) widget-fullscreen.ts (added in #1605) exported several symbols that nothing outside the file consumes, plus pre-emptive @deprecated aliases for an API that never shipped. Only useWidgetDisplayModeControls is used (by MCPAppsRenderer and OpenAIComponentRenderer). - Unexport internal-only constants, the WidgetDisplayMode type, and the useWidgetDisplayModeDocumentChrome helper - Remove the dead useWidgetFullscreenControls / useWidgetFullscreenDocumentChrome aliases * test(agent): drop live Langfuse API integration tests (#1608) The observability integration tests queried the live Langfuse REST API (via getRecentTraces) to verify traces landed. cloud.langfuse.com has been returning 403 Forbidden for both ingestion and queries, failing the 'should send traces to Langfuse when observability is enabled' test and reddening canary CI. Remove the two tests that depend on the live API (the failing test and the already-skipped manual-trace test) plus the now-unused getRecentTraces helper. Keep the two tests that verify observability enable/disable behavior locally with no network dependency. * chore(typescript): version packages (canary) * fix(oauth): redact token verification errors (#1573) * fix(oauth): redact token verification errors * chore: add oauth error redaction changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): skip emulate oauth tests in builtin e2e (#1609) * chore: add codex to gitignore (#1612) * fix(docs): update server API reference links (#1611) * fix(mcp-use): pin published dependency versions (#1610) * docs(changelog): document v1.29.0 / inspector v7.0.0 release TypeScript changelog gains a v1.29.0 entry (public landing pages, Supabase URL override, Claude UI-resource domain hashing, OAuth callback + React-provider hardening). Inspector changelog gains a major v7.0.0 entry (local Ollama provider, image tool results, MCP-server reconnect banner, widget fullscreen/PiP rework). * Fix builtin inspector auto-connect to use HTTP (#1613) * Switch builtin inspector auto-connect to HTTP * Use plain URL autoConnect in builtin e2e helper * Fix built-in inspector auto-connect to use HTTP * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: asim48-ctrl <asim48@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Truffle <truffleagent@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SSharma1103 <shivamsharma11032009@gmail.com> Co-authored-by: Polæ <steven@polae.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Udaykumar Dhokia <udaykumardhokia@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Jefsky Wong <hwj3344@hotmail.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Ritwij Aryan Parmar <88580521+RitwijParmar@users.noreply.github.com> |
||
|
Enrico
|
d6e9f2cc98 | ci: drop pnpm cache from bump reusable workflow (fixes post-step failure) | ||
|
Enrico
|
c24c38b2a6 | ci: allow lockfile refresh when bumping mcp-use in CI | ||
|
Enrico
|
7c025fcc73 |
ci: add reusable workflow to bump mcp-use in template repos
Weekly callers in template repos can invoke this to pin ^<npm stable>, refresh lockfiles, build, and push only when files change. |
||
|
Andrew Khadder
|
78cfc8a74d |
Canary (#1434)
* feat(mcp-use): add Clerk OAuth provider for TypeScript (#1429) * feat(mcp-use): add Clerk OAuth provider * docs: add Clerk OAuth provider documentation page * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(cli): propagate --env/--env-file to server on deploy redeploys (#1433) The deploy command only forwarded `--env`/`--env-file` values when creating a brand-new server (where they ride on the createServer body). On redeploys to an existing linked server, env vars were parsed and shown in the preview, then silently dropped before createDeployment. Now upserts each entry against /api/v1/servers/{id}/env-variables (PATCH for existing keys, POST for new ones) before triggering the deployment. Closes MCP-1995 * chore(typescript): version packages (canary) * chore(typescript): adopt Knip to find and remove unused code (#1359) * chore(typescript): adopt knip at workspace root Add Knip as a dev dependency at the TypeScript workspace root with a root-level knip.json covering all packages. Consolidates the existing per-package Knip setup in @mcp-use/inspector into the shared config and delegates its check-deps script to the root install. Adds `pnpm knip`, `pnpm knip:deps`, and `pnpm knip:production` scripts and documents them in the TypeScript README. Baseline configuration suppresses known false positives (build-generated version.js, Tailwind/ Scarf deps, nested example and template workspaces, test helpers and servers). Actual dead-code removal is deferred to follow-up PRs. Refs MCP-1707 * ci: add warning-only Knip step Runs `pnpm knip --no-exit-code --no-progress` on TypeScript-affecting PRs/pushes and writes the report to the GitHub Actions step summary. Stays non-blocking by design — tighten to a failing check once the baseline cleanup PRs land. * chore(inspector): drop redundant check-deps script Root-level pnpm knip:deps already covers all workspaces, so the inspector-only wrapper just duplicated the same delegation. Devs needing scoped output can use pnpm knip --workspace packages/inspector. * chore(typescript): drop changeset for dev-only knip adoption * feat(inspector): support custom base URL for OpenAI-compatible providers (#1437) * feat(inspector): support custom base URL for OpenAI-compatible providers * feat(inspector): add support for OpenAI-compatible providers with configurable base URL Co-authored-by: Copilot <copilot@github.com> * refactor(inspector): simplify openai-compatible plumbing - Widen ProviderName union to include "openai-compatible" and drop the resolveProvider helper; the providers dispatcher fall-throughs from "openai-compatible" to the openai impl, so callers can pass the UI provider name straight through. - openai.ts: extract buildEndpoint/buildHeaders, strip trailing slashes on baseUrl, and skip Authorization header when apiKey is empty. - ConfigurationDialog: defensive parsing of /models response, surface CORS hint on fetch failure, mention CORS requirement in helper text, move "OpenAI Compatible" to end of dropdown. - useConfig: persist openai-compatible base URL per-provider in localStorage (mirrors api keys), restore on switch + cross-tab sync. - Drop openai-compatible logo references in ChatHeader / ChatLandingForm / ConfigurationDialog dropdown. * style(inspector): apply prettier formatting * chore(changeset): bump @mcp-use/inspector to minor for openai-compatible provider --------- Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat: integrate OpenRouter as a first-class LLM provider (fixes #1402) (#1403) * feat(inspector): integrate OpenRouter as a first-class LLM provider Adds OpenRouter to the inspector chat configuration. Selecting OpenRouter routes through the existing OpenAI provider with an override base URL and the required HTTP-Referer / X-Title headers, so users get multi-model access (OpenAI, Anthropic, Google, etc.) from a single API key without duplicating provider plumbing. Co-authored-by: Andrew Khadder <andrew@mcp-use.com> Closes #1402 * fix(inspector): use inspector.mcp-use.com as OpenRouter HTTP-Referer * feat(inspector): swap OpenRouter favicon.ico for inline gray SVG Drops the runtime fetch to openrouter.ai/favicon.ico in favor of an inline data-URL'd SVG with a neutral #94A3B8 fill. Follow-up will lift this onto the provider CDN alongside the other provider marks. * fix(inspector): stop OpenRouter SVG curves from being implicitly filled The two arrow-body paths are open curves; with the parent svg's fill set, the browser implicitly closed them and filled the resulting region, producing visual artifacts at small sizes. Mark those two paths fill="none" so only their strokes render. * fix(inspector): use OpenRouter SVG in ChatLandingForm chip The landing-form provider chip was hardcoded to the CDN png URL, which 404s for the openrouter provider and rendered a broken-image blob clipped by rounded-full styling. Match the ChatHeader behavior and fall back to OPENROUTER_ICON_URL. * fix(inspector): set OpenRouter X-Title to mcp-use Inspector * refactor(inspector): drop OpenRouter baseUrl path special-case Set OpenRouter's baseUrl to the API root (/api/v1) and let buildEndpoint append /chat/completions like the rest of the OpenAI-compatible flow, removing the includes("/chat/completions") short-circuit that only existed to defuse the path baked into the override. * style(inspector): apply prettier formatting * chore(inspector): drop redundant baseUrl jsdoc comment --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(auth): pre-registered OAuth client credentials and scopes in Inspector (#1400) * feat(auth): pre-registered OAuth client credentials and scopes Wires clientId, clientSecret, and scope end-to-end from the Inspector's Authentication dialog through useMcp into BrowserOAuthClientProvider's staticClientInfo. When clientId is set the SDK skips Dynamic Client Registration (required for proxy-mode servers like Slack/WorkOS that strip registration_endpoint). When clientSecret is also set, the SDK auto-switches token-endpoint auth from "none" to client_secret_basic / client_secret_post, supporting providers that don't support PKCE. * refactor(inspector): extract OAuthStaticConfig type and builder helper Replaces six inline copies of `{ clientId?; clientSecret?; scope? }` and two copy-pasted trim+spread builders with a shared `OAuthStaticConfig` type and `buildOAuthStaticConfig()` helper in connectionUpdates.ts. Also widens ServerConnectionModal's connection/onConnect types so the `as { oauth?: ... }` structural cast can go away (the modal was passing oauth in the spread without declaring it on the callback type). * docs: document pre-registered OAuth client credentials Updates client authentication, useMcp, and inspector connection-settings docs to cover the new oauth.{clientId, clientSecret, scope} option and the proxy-mode/confidential-client cases it unlocks. Replaces the inaccurate snake_case OAuth params table with the actual camelCase API shape. * chore(typescript): version packages (canary) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry (#1443) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry The env var previously disabled Node-side telemetry and the inspector's server-side proxy, but the in-browser posthog-js init triggered by useMcp still fired POSTs to https://eu.i.posthog.com that ad/tracker blockers flag. The inspector server now mirrors the env var into a runtime flag (window.__MCP_USE_ANONYMIZED_TELEMETRY__) and localStorage before the client bundle runs; both mcp-use's browser telemetry and the inspector's own client telemetry honor that flag, so a single env var disables every telemetry path. * fix(inspector): drop sticky localStorage write; honor opt-out in Vite dev The previous revision mirrored MCP_USE_ANONYMIZED_TELEMETRY=false into localStorage, which persisted across sessions even after the env var was unset. Switch to a per-page window flag only — unsetting the env var fully restores defaults on the next page load. Also extend the opt-out to pure-Vite dev mode via a transformIndexHtml plugin, so the env var works whether the inspector is served by the backend or by Vite directly. * chore(typescript): version packages (canary) * fix(inspector): drop trailing-slash regex flagged by CodeQL The /\/+$/ regex on user-supplied base URLs triggered js/polynomial-redos. Most servers normalize a double slash in `${baseUrl}/path` fine, so just drop the stripping rather than working around the alert. * docs(changelog): add v1.27.0 / inspector v5.0.0 release notes --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Siddhant Rai <47355538+siiddhantt@users.noreply.github.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> |
||
|
Enrico Toniato
|
b76df332f6 |
Canary (#1218)
* ci: enhance CI workflow with tunnel testing for dev and start commands - Added new jobs to test the development and start commands with the `--tunnel` flag in the CI workflow. - Implemented logic to start the dev server and poll for the tunnel URL, ensuring it is generated successfully. - Included cleanup steps to terminate the server processes after testing. - Enhanced error handling to report if the tunnel URL is not found in the output logs. * docs: fix changelog order (newest first) * chore: move tunnel testing from create-mcp-use-app CI to inspector E2E - Remove tunnel steps from create-mcp-use-app-tests (dev --tunnel, start --tunnel) - Add run-tunnel-test.mjs (test_tunnel) in inspector E2E scripts - Add test:e2e:tunnel script and inspector-e2e-tunnel job * chore: enter canary prerelease mode * fix: prettier format run-tunnel-test.mjs * feat: add reconnection options to conformance client (#1212) * feat: add reconnection options to conformance client - Introduced `reconnectionOptions` with a `maxRetries` setting to enhance the conformance client’s ability to handle connection issues. * fix(tests): update prompt server path in test configuration - Modified the test configuration to use the correct path for the prompt server, ensuring that the tests can locate and execute the server script properly. * chore(typescript): version packages (canary) * chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 (#1209) * chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 - Bumped Vite version from ^7.3.0 to ^8.0.0 across multiple package.json files. - Updated @vitejs/plugin-react from ^5.1.4 to ^6.0.0 in various templates and packages. - Adjusted pnpm-lock.yaml to reflect these changes. - Modified build configurations to use 'rolldownOptions' instead of 'rollupOptions' for consistency. * fix: ensure consistent handling of TypeScript file paths across platforms - Updated path handling in TypeScript-related functions to ensure compatibility with Windows and other operating systems. - Refactored code to utilize `path.join` for constructing file paths, addressing issues with path separators. - Enhanced error handling in CLI tests to prevent failures due to missing build artifacts. * fix: prettier format run-tunnel-test.mjs * chore: update dependency versions in pnpm-lock.yaml and package.json - Changed the version specifier for `ai` from `^6.0.116` to `>=5.0.52`. - Updated `express-rate-limit` from `^7.5.1` to `>=8.2.2` in both `pnpm-lock.yaml` and `package.json`. - Adjusted the corresponding version in the lock file to reflect the new version of `express-rate-limit`. * test: enhance telemetry test stability with increased wait times - Updated `beforeEach` to include a delay for settling lingering telemetry. - Increased wait times from 100ms to 500ms in multiple test cases to ensure telemetry events are captured reliably. * chore(typescript): version packages (canary) * Feat/use-files (#1213) * feat(react): add useFiles hook with isSupported detection Adds useFiles() hook for file upload and download in widgets. File operations are only supported in the ChatGPT Apps SDK environment. The MCP Apps spec (SEP-1865) has deferred file handling, meaning MCP Apps clients (Claude, Goose, VS Code) do not support file operations. The hook exposes an isSupported flag computed from the presence of window.openai.uploadFile and window.openai.getFileDownloadUrl, letting widgets render graceful fallback UI in non-ChatGPT environments rather than throwing runtime errors. - isSupported: true only in ChatGPT Apps SDK hosts - upload(file): delegates to window.openai.uploadFile, returns FileMetadata - getDownloadUrl(file): delegates to window.openai.getFileDownloadUrl - Both throw a descriptive error when called with isSupported === false Also adds: - FileMetadata type ({ fileId: string }) in widget-types.ts - Optional uploadFile/getFileDownloadUrl on the API interface - examples/server/ui/files/ — file manager widget with upload, progress state, download URL retrieval, and isSupported-based fallback notice - docs/typescript/server/widget-components/usefiles.mdx — API reference with isSupported usage, FileMetadata type, and error handling guidance * feat(react): add modelVisible option to useFiles and unit tests Adds model visibility control to useFiles().upload() and 19 unit tests verifying the full hook behaviour. ### modelVisible option By default, uploaded files are tracked in widget state under `imageIds` so ChatGPT includes them in the model's conversation context (matching the post-fix behaviour of Skybridge PR #539 which fixed privateContent not being preserved during setWidgetState). Pass `{ modelVisible: false }` to upload privately — the file is still uploaded via window.openai.uploadFile but the fileId is not added to imageIds, so the model won't see it. ```ts // Model sees this (default) const { fileId } = await upload(file); // Model does not see this const { fileId } = await upload(file, { modelVisible: false }); ``` Existing imageIds and other widgetState fields are preserved when tracking a new fileId, so uploads never wipe non-file state. ### Tests (19) - isSupported: false when window/openai undefined or partial - upload() error when not supported (message includes isSupported) - upload() delegates to window.openai.uploadFile - upload() returns FileMetadata - upload() calls setWidgetState with updated imageIds - upload() appends to existing imageIds - upload() preserves other widgetState fields - upload({ modelVisible: false }) skips setWidgetState entirely - upload({ modelVisible: false }) still returns FileMetadata - getDownloadUrl() error when not supported - getDownloadUrl() delegates to window.openai.getFileDownloadUrl - getDownloadUrl() passes through fileId * docs(skill): add files reference to mcp-apps-builder skill Adds references/widgets/files.md covering: - useFiles() hook (isSupported, upload, getDownloadUrl) - isSupported guard pattern — always required, renders fallback in MCP Apps - Model visibility: modelVisible option (true = tracked in imageIds, false = private) - Storing fileId in widget state vs caching download URLs - Error handling patterns Also adds a navigation entry and decision tree node to SKILL.md. * chore(typescript): version packages (canary) * feat(mcp-use): add MCP operation-level middleware support (#1137) - Introduced a new middleware system for handling MCP operations, allowing for cross-cutting concerns like logging and authentication. - Updated `MCPServerClass` to register and manage middleware entries dynamically. - Enhanced documentation to include examples of using `server.use('mcp:...', handler)` for middleware registration. - Added new types and utility functions to support middleware composition and context management. This commit enhances the flexibility and functionality of the MCP framework by enabling developers to define custom middleware for various MCP operations. * chore(typescript): version packages (canary) * Feat/model-context (#1214) * feat(react): add ModelContext component and modelContext imperative API Adds two complementary APIs for annotating widget UI with contextual descriptions the AI model can see, without requiring explicit tool calls or storing data in developer-managed state. - <ModelContext content="..."> — lifecycle-tied React component that participates in a parent-child tree via React context (useId + ParentIdContext). Supports empty children (leaf nodes) and nesting. - modelContext.set(key, content) / .remove(key) / .clear() — module-level imperative API that works anywhere: event handlers, plain functions, outside React. Entries are always root-level nodes. Both APIs feed into a shared global registry that serializes the node tree into an indented markdown-like string on every change (batched via queueMicrotask). The string is pushed to the host via: - MCP Apps: ui/update-model-context (structuredContent.__model_context) - ChatGPT Apps SDK: setWidgetState (__model_context merged into state) useWidget wires up a registerModelContextFlush handler on mount so annotations always reach the correct protocol channel. __model_context is filtered from the developer-facing state value returned by useWidget. setState preserves existing __model_context to prevent annotations from being wiped on state updates. Also adds: - examples/server/ui/model-context/ — interactive product browser example demonstrating nesting (<ModelContext>) and imperative (modelContext.set) usage with a visual context debug panel - docs/typescript/server/widget-components/modelcontext.mdx — API reference for both APIs, nesting behavior, serialization format, and comparison with setState * test(react): add model-context unit tests; expose test helpers Adds 25 unit tests covering the full ModelContext system: - Tree serialization: empty, single, multiple root entries, nesting, whitespace trimming, blank content skipped, upsert, remove, clear - modelContext imperative API: set/remove/clear, no-op on missing key - registerModelContextFlush: immediate notification on registration, deregistration stops calls, deregistering stale handler is safe - Batched flush: multiple synchronous mutations → single handler call - Context state passed to model: full integration of set + flush handler, update, remove, clear sequences Also exposes two @internal helpers required for testing module singletons: - _resetModelContextForTesting() — resets nodes/handler/flushScheduled - _getDescriptionForTesting() — returns the current serialized string without triggering a flush * docs(skill): add model-context reference to mcp-apps-builder skill Adds references/widgets/model-context.md covering: - When to use ModelContext vs setState - <ModelContext> component: nesting, siblings, leaf nodes, lifecycle - modelContext imperative API: set/remove/clear, cleanup rules - How the tree is serialized and sent to the model - Common patterns: tab-switching, selected item, multi-level dashboard Also adds a navigation entry and decision tree node to SKILL.md. * Update title in modelcontext.mdx Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: add changeset for useFiles and ModelContext minor features --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: prefix resource and prompt tool names to avoid collisions (#937) * fix: prefix resource and prompt tool names to avoid collisions (#910) When a resource and a prompt share the same name, the LangChain tools array sent to the API contains duplicate tool names, causing a 400 error. Prefix resource tools with `resource_` and prompt tools with `prompt_` to ensure unique names. * dynamic implementation to avoid prompt resource names collisions * fix: make reserveName collision-safe and sanitize prompt names - reserveName now checks the prefixed name for conflicts too, falling back to a numeric suffix when both base and prefixed names are taken. Previously a tool named resource_foo alongside a resource named foo would silently produce a duplicate tool name. - Prompt names are now sanitized through sanitizeToolName() for consistency with resource names. * chore: add changeset for tool name collision fix --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: map elicit result content to data for Zod validation (#1215) (#1216) * fix: map elicit result content to data for Zod validation The MCP SDK returns form data in result.content per the elicitation spec, but createElicitMethod was checking result.data which is always undefined. This caused Zod validation to never run, leaving result.data as undefined for tool callbacks that use ctx.elicit() with a Zod schema. Now checks result.content (SDK spec) with fallback to result.data for backward compatibility with custom handlers. Fixes #1215 * fix: also fix inspector and tests for elicit content/data mapping - Inspector: send `content` instead of `data` per MCP spec - Server: also map `content` to `data` for non-Zod-schema elicit calls (verbose API overload), so conformance server tools work correctly - Tests: update all integration test mocks to use spec-correct `content` field instead of non-standard `data`, and adjust validation error assertions to match SDK-level schema validation - Add changeset Follows up on the initial fix in b90ea51e. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): implement tunnel management functionality (#1222) - Added API endpoints for starting, stopping, and checking the status of a tunnel. - Integrated tunnel management into the Layout and LayoutHeader components, allowing users to start and stop tunnels directly from the UI. - Updated context to manage tunnel state, including a loading state for starting the tunnel. - Enhanced the user experience with visual feedback during tunnel operations and added instructions for using the tunnel URL in ChatGPT. This feature improves the overall functionality of the inspector by enabling real-time tunnel management. * chore(typescript): version packages (canary) * chore(changelog): update changelog for v0.25.0 and v1.22.0 releases - Added details for v0.25.0: introduced tunnel management for `mcp-use dev`, Vite 8 build stack, and aligned elicit payload with MCP spec. - Updated v1.22.0: included enhancements for MCP middleware, new React hooks, and fixes for elicit and adapter functionalities. - Updated dependencies for both releases. * fix(tests): update server-telemetry test to mock startServer return value - Modified the mock implementation of startServer to return an object containing close and forceClose functions, ensuring proper handling in tests. - This change prevents actual server startup during tests while maintaining the expected interface. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gab <86735558+gabrielekarra@users.noreply.github.com> Co-authored-by: guoyangzhen <upgyz@qq.com> |
||
|
pietrozullo
|
f9613ac8fa | ci(typescript): add Discord notification for stable releases | ||
|
pietrozullo
|
2692703929 | ci(python): fix discussion action version and discord notification | ||
|
pietrozullo
|
853b8fe517 | ci: use real titles for release notification test | ||
|
pietrozullo
|
84511efb05 | ci: add checkout step to discord notification job | ||
|
pietrozullo
|
ead5913a70 | ci: add test workflow for release notifications | ||
|
Enrico Toniato
|
ed0fadbb01 |
Canary (#1200)
* Fix/move-zod-to-peer (#1198) * chore: update pnpm-lock.yaml and package.json to include zod dependency in mcp-use package and test_app configuration * feat(cli): implement TypeScript file collection and transpilation with esbuild - Added `collectTsFiles` function to gather TypeScript files based on tsconfig patterns using Node.js built-ins. - Introduced `transpileWithEsbuild` function to handle TypeScript transpilation, improving performance and memory usage. - Updated build command to utilize esbuild for transpilation and added an option to skip TypeScript type checking with `--no-typecheck`. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: update package dependencies in TypeScript libraries (#1199) * chore: update package dependencies in TypeScript libraries - Bump `qs` version from `>=6.14.1` to `>=6.14.2`. - Add new dependencies: `flatted`, `tar`, `hono`, `@hono/node-server`, `express-rate-limit`, `dompurify`, `minimatch`, `rollup`, `@modelcontextprotocol/sdk`, `ai`, `ajv`, `axios`, `body-parser`, `brace-expansion`, `@isaacs/brace-expansion`, `form-data`, `lodash`, and `@eslint/plugin-kit`. - Update `tar` version from `^7.5.9` to `^7.5.11` in multiple packages. - Update `hono` version from `^4.11.10` to `^4.12.7` in relevant packages. - Update `@modelcontextprotocol/sdk` version from `^1.26.0` to `^1.27.1` in relevant packages. - Update `express-rate-limit` version from `^7.4.1` to `>=8.2.2` in the example server feature. * chore: remove ajv dependency from TypeScript libraries - Removed `ajv` dependency from `package.json` and `pnpm-lock.yaml`. - Updated peer dependencies for `ajv-formats` to use `^8.0.0` instead of `>=8.18.0`. - Added new dependencies: `fast-json-stable-stringify`, `json-schema-traverse`, and `uri-js` with their respective versions. * fix: ensure widget parameter is non-null in setupWidgetRoutes - Updated the widget parameter retrieval in setupWidgetRoutes to use a non-null assertion, ensuring that the widget variable is always defined when serving static assets and widget index.html files. * chore(typescript): version packages (canary) * fix(typescript): use file:// URL in tsImport to fix Windows crash (#1193) * fix(typescript): use file:// URL in tsImport to fix Windows crash The tsImport call was passing serverFilePath (raw OS path) instead of serverFileUrl (file:// URL), causing ERR_UNSUPPORTED_ESM_URL_SCHEME on Windows. Fixes #1171 * fix(typescript): also fix file:// URL in generate-types and add Windows CI The original fix addressed tsImport in the dev command but missed the same bug in generateToolRegistryTypesForServer (used by generate-types and postinstall). Also adds Windows to the CLI test matrix so platform-specific path issues are caught in CI. * fix(typescript): fix Windows path separator issues in CLI tests - display-package-versions: use path.join instead of hardcoded forward-slash path - tsx-resolution: use path.join in assertions to handle backslash separators - cli-integration: skip when dist/index.cjs build artifact is missing --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(workflows): enhance environment variable usage in GitHub Actions - Updated multiple workflow files to use environment variables for better readability and maintainability. - Replaced direct references to GitHub context variables with environment variables in `claude.yml`, `conformance.yml`, `create-app-e2e-canary.yml`, `railway-deploy.yml`, and `typescript-pr-preview.yml`. - Improved conditional checks in scripts to utilize these environment variables, streamlining the workflow logic. * refactor(tests): format playwrightArgs for better readability - Reformatted the addition of `--grep-invert` arguments in the run-test-matrix script to improve code clarity and maintainability. * refactor(cli, mcp-use): update type generation functions to return success status (#1201) - Modified `generateToolRegistryTypesForServer` and `generateToolRegistryTypes` to return a boolean indicating success or failure instead of void. - Updated CLI commands to handle and log success or error messages based on the type generation outcome. - Enhanced error handling in type generation to prevent server crashes while providing feedback on failures. * chore(typescript): version packages (canary) * chore(docs): update changelog for v0.24.5 and v1.21.5 releases - Added entries for v0.24.5, detailing dependency updates and fixes for security alerts. - Included v1.21.5 changes, highlighting Zod peer dependency adjustments, esbuild transpilation improvements, and Windows path handling fixes. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: guoyangzhen <upgyz@qq.com> |
||
|
pietrozullo
|
fbf65152c1 | chore: python release workflow discussion publish | ||
|
Enrico Toniato
|
4618c6eced |
ci: add OPENAI_API_KEY environment variable to CI workflows
* Added OPENAI_API_KEY to the environment variables for both Python and TypeScript CI jobs. * Conditional execution of agent tests based on the presence of OPENAI_API_KEY. This change ensures that the necessary API key is available during the CI process for relevant tests. |
||
|
Pietro Zullo
|
30b23271d5 |
fix(python): respect configured inspector path (#1176)
* fix(python): respect configured inspector path * fix(python): treat inspector path as a base prefix * fix(python): format inspector fixes for ruff * fix(ci): run conformance with node 22 * fix(ci): fail conformance runs with empty results * chore(ci): drop inline conformance result validation * docs(python): clarify inspector path behavior |
||
|
Enrico Toniato
|
8d55603972 |
Canary (#1166)
* feat(python): add E2E testing for Python server in CI workflow - Introduced a new job in the GitHub Actions workflow to run end-to-end tests against the Python MCP server. - Updated the inspector.py to allow overriding the CDN base URL via an environment variable. - Added a new script command for running Python E2E tests in the package.json. - Enhanced documentation to include instructions for running Python server E2E tests. * fix(inspector): skip proxy when inspector is served from the MCP server itself When the inspector is embedded in a Python (or other) MCP server, the window.location.origin matches the MCP server's origin, so /inspector/api/proxy doesn't exist there. Routing auto-connect through that missing proxy caused silent connection failures. Now proxyAddress is only set when the inspector origin differs from the target URL's origin (i.e. the inspector has its own server running). Also add echo tool to server_example.py so python.test.ts can pass. * fix(inspector): detect proxy availability via runtime config injection Inject window.__MCP_PROXY_URL__ from the inspector server when it serves the HTML. When served from a Python/custom MCP server (same origin), the flag is absent and autoProxyFallback is disabled so no proxy is used. - Add proxyUrl to RuntimeConfig in shared-static.ts - Default to /inspector/api/proxy when inspector server serves - Read __MCP_PROXY_URL__ in App.tsx and configure defaultAutoProxyFallback - Disable autoProxyFallback when no proxy is available (no hosted fallback) * ci: trigger inspector E2E workflow on PRs to canary/main * ci: temporarily disable mix/prod/builtin E2E jobs for Python testing * ci: re-enable all E2E jobs, workflow_dispatch only * ci: re-enable E2E jobs for Python testing in CI workflow * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): resolve auto-connect issues for embedded servers This patch release addresses the auto-connect functionality of the inspector when served from an MCP server. Key changes include skipping the proxy when the inspector's origin matches the MCP server's origin and detecting proxy availability through runtime configuration. Additionally, the mcp-use package has been updated to version 1.21.2. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Pietro Zullo
|
3a8113041d |
ci: skip unused language in conformance tests based on changed files (#1149)
* ci: skip unused language in conformance tests based on changed files Add a detect-changes job using dorny/paths-filter (same pattern as ci.yml) to determine which languages have changes. Python-only PRs now skip TypeScript setup/build/tests and vice versa, saving several minutes of CI time. - Push/PR: auto-detect via path filters - workflow_dispatch: existing python_only/typescript_only inputs still work - Changes to conformance.yml itself runs both (safety net) * ci: guard conformance-test job when no language detected |
||
|
Enrico Toniato
|
179e8003b7 |
Canary (#1045)
* feat(typescript): add everything-server example for compile-time type coverage of mcp-use APIs (#1040) * add everything-server example for compile-time type coverage of mcp-use APIs * add UseWidgetResult<Props> type annotation to validate useWidget() return type * add changeset * run format * move everything-typecheck to an independent workflow * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(inspector): enhance ToolsTab with bulk paste functionality and auto-fill dialog (#1043) * feat(inspector): enhance ToolsTab with bulk paste functionality and auto-fill dialog - Implemented bulk paste feature allowing users to paste JSON or JavaScript objects directly into input fields. - Added auto-fill dialog for confirming updates when pasted data would overwrite existing values, improving user experience. - Introduced utility functions for parsing pasted text and converting JavaScript object syntax to valid JSON. - Updated ToolInputForm and ToolExecutionPanel components to support new functionality and provide visual feedback for auto-filled fields. * feat(inspector): update ToolExecutionPanel to copy full tool definition fix(server): correctly convert nested inpout schema args for tools * chore(typescript): version packages (canary) * Fix/various (#1041) * refactor(inspector): improve MCPAppsRenderer loading logic and enhance useWidget for iframe handling (#1037) - Updated MCPAppsRenderer to replace `isReady` with `initCount` for better iframe loading state management, ensuring the spinner is hidden appropriately. - Enhanced loading logic to account for iframe initialization, improving user experience during rapid remounts. - Modified useWidget to handle transitional states in iframes without URL parameters, preventing premature rendering with empty props. * chore(typescript): version packages (canary) * feat(cli): add generate-types command for TypeScript type definitions - Introduced a new CLI command `generate-types` to generate TypeScript type definitions for tools, writing to `.mcp-use/tool-registry.d.ts`. - Added options for specifying the project directory and server entry file. - Implemented error handling for missing server files and type generation failures. - Updated `package.json` to include a post-install script that runs the `generate-types` command. - Modified `tsconfig.json` to include the generated type definitions in the TypeScript compilation process. * chore: remove outdated changeset files for inspector and mcp-use - Deleted changeset markdown files and pre.json related to previous enhancements in the inspector and mcp-use libraries to streamline the repository and eliminate deprecated entries. * chore: remove outdated changeset reference from pre.json - Deleted the "petite-rules-talk" changeset entry from pre.json to clean up the changeset list and maintain accuracy in the repository. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v0.21.0 and v0.20.1 releases - Added details for v0.21.0 including bulk paste functionality and tool definition enhancements. - Included v0.20.1 updates focusing on MCPApps and widget improvements. - Updated package versions for dependencies in both changelogs. --------- Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
f4e2a70bd6 |
Canary (#1024)
* feat(typescript): add conformance client for client-side conformance testing (#1009) * feat(dns-rebinding): implement DNS rebinding protection and examples (#1001) - Added `allowedOrigins` configuration to the `MCPServer` for DNS rebinding protection, enabling host validation for specified origins. - Updated documentation to clarify the behavior of `allowedOrigins` in development and production environments. - Introduced a new example demonstrating DNS rebinding protection, including curl commands for testing. - Enhanced server methods and middleware to support the new host validation feature. - Refactored related documentation to improve clarity on middleware and configuration options. * chore: enter canary prerelease mode * feat(mcp): defer server callbacks to avoid render-phase updates (#1002) - Introduced a mechanism to collect callbacks for server state changes and defer their execution using `queueMicrotask`, preventing potential render-phase updates during state updates. - Updated the `McpClientProvider` to push `onServerAdded` and `onServerStateChange` callbacks into an array for deferred execution, enhancing performance and stability. * feat(inspector): enhance elicitation support with SEP-1330 enum schema variants (#1010) - Added detailed documentation for the Elicitation tab, outlining its features and supported schema patterns. - Implemented handling for various SEP-1330 enum schema variants in the client and server, including single-select and multi-select options. - Introduced new tests to validate the elicitation flow for all enum schema variants, ensuring correct rendering and submission behavior. - Updated examples and README files to reflect the new elicitation capabilities and SEP-1330 patterns. * feat(inspector): implement partial tool input handling for streaming arguments - Added support for partial tool input in the MCPAppsRenderer, allowing for real-time updates during LLM argument generation. - Enhanced MessageList and ToolResultRenderer components to accommodate new streaming states and partial arguments. - Updated useChatMessagesClientSide to handle streaming tool call arguments, improving user experience during interactions. - Introduced new types and state management in useWidget for tracking partial tool input and streaming status. * chore(typescript): version packages (canary) * feat(inspector): enhance tool argument handling with type coercion and schema resolution (#1013) - Introduced utility functions for coercing input values based on their expected types, improving the handling of boolean, array, and object parameters. - Updated ToolsTab and ToolInputForm components to utilize new schema utilities for resolving property types and extracting enum values. - Added a new server tool for validating argument typing, ensuring correct submission of typed values. - Enhanced end-to-end tests to verify the correct behavior of typed arguments in tool execution. * feat(docs): enhance documentation for streaming tool arguments and live previews - Updated guides and examples to include details on streaming tool arguments in widgets, enabling real-time updates during LLM interactions. - Added new sections in `useWidget` documentation to explain `partialToolInput` and `isStreaming` properties. - Included a new example demonstrating live previews while streaming tool arguments in the MCP Inspector and MCP Apps clients. * feat(typescript): add conformance client for client-side conformance testing Adds conformance-client.ts alongside the existing conformance server (no new packages — reuses the server's deps). - conformance-client.ts: handles initialize, tools_call, elicitation defaults, and sse-retry scenarios using MCPClient - run-conformance-client.sh: wrapper for the conformance runner - Updated CI workflow to run TS client conformance alongside Python client * fix(client): fix client oauth handling (#1015) * fix(docs): update links and references in documentation - Updated Discord link in SKILL.md to the new invite URL. - Corrected path for Apps SDK in examples/README.md to reflect the new directory structure. - Revised deployment instructions in cli/README.md for clarity on environment variable configuration. - Enhanced WorkOS OAuth example documentation with a link to the relevant settings screenshot. * refactor: update conformance workflow and documentation for TypeScript client - Adjusted paths in the conformance workflow to reflect the new directory structure for client features. - Enhanced documentation to clarify the configuration structure and options for the MCPClient, including root-level callbacks and examples. - Removed deprecated references and improved clarity in the elicitation and sampling sections. - Updated examples to demonstrate the new configuration options and usage patterns for the TypeScript client. * feat(client): enhance OAuth handling in conformance clients - Integrated automatic OAuth flow in TypeScript conformance clients (browser, node, and react). - Updated `headless-oauth-provider` to support token request preparation for authorization code exchange. - Modified `useMcp` to allow automatic triggering of OAuth authentication based on configuration. - Improved handling of authentication scenarios in the conformance test client. This update streamlines the authentication process, ensuring a smoother user experience during conformance testing. * feat(auth): add probeAuthParams for enhanced OAuth parameter handling - Introduced `probeAuthParams` to extract WWW-Authenticate parameters (scope, resource_metadata) from 401 responses. - Updated conformance clients (browser and node) to utilize `probeAuthParams` for improved OAuth flow. - Enhanced `useMcp` hook to support automatic probing of authentication parameters during the OAuth process. This update streamlines the authentication experience by ensuring necessary parameters are captured and utilized effectively. * feat(conformance): integrate pre-registration context in OAuth provider - Added `parseConformanceContext` function to extract pre-registration parameters from environment variables. - Updated conformance clients (browser, node, and react) to utilize the new context when creating the headless OAuth provider. - Enhanced `createHeadlessConformanceOAuthProvider` to accept an optional pre-registration context for improved OAuth handling. This update improves the flexibility and configurability of the OAuth flow in conformance testing scenarios. * feat(conformance): enhance OAuth flow for scope-step-up scenarios - Introduced `isScopeStepUpScenario` function to identify scenarios requiring special handling for OAuth authentication. - Updated conformance clients (browser, node, and react) to implement OAuth retry fetch for scope-step-up scenarios, ensuring the first token has limited scope. - Modified authentication logic to prevent pre-authentication in scope-step-up cases, allowing for proper token escalation. This update improves the OAuth handling in conformance testing, ensuring correct behavior during scope escalation scenarios. * feat(oauth): improve OAuth retry fetch and custom fetch support - Enhanced `createOAuthRetryFetch` to strip the `WWW-Authenticate` header, preventing unwanted auth flows during retries. - Added optional `fetch` property in `UseMcpOptions` to allow custom fetch functions for MCP HTTP requests, enabling better control over authentication logic. - Updated `useMcp` to pass the custom fetch function when provided, facilitating OAuth retry handling. This update enhances the flexibility and robustness of the OAuth flow in conformance testing scenarios. * chore: remove outdated changeset files for inspector and mcp-use - Deleted changeset files related to previous enhancements in the inspector and mcp-use libraries, including updates on argument handling and server callback deferral. - Cleared pre.json file and other changeset markdowns to streamline the repository and remove deprecated entries. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(create-mcp-use-app): add optional skills and package dependency installation steps (#998) * add install steps for skills and dependencies * fix tests to point at starter instead of ui and skip user interactive prompting * update docs for create-mcp-use-app * run format and lint * add changeset * fix user message * switch from vercel skills package to manual download and copy of skills folder * remove unnecessary early return if presets are empty * update pnpm-lock.yaml to add tar and @types/tar dependencies, and include minipass version 4.2.8 * change skills installation prompt to (Y/n) instead of selecting agents. add telemetry event to vercel for every download. update tests and docs * move InstallTelemetryData interface above where its used * remove helper text --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: correct mcp_apps MIME type & disable telemetry in tests (#1023) * fix: use correct MIME type for mcp_apps resource counting and disable telemetry in tests Replace hardcoded "text/html+mcp" with RESOURCE_MIME_TYPE from @modelcontextprotocol/ext-apps so mcp_apps_resources_number reports correctly. Add MCP_USE_ANONYMIZED_TELEMETRY=false to vitest configs to prevent telemetry during local test runs. * fix: disable telemetry in inspector e2e tests Set MCP_USE_ANONYMIZED_TELEMETRY=false in playwright.config.ts so the inspector's web server and test processes don't fire telemetry events. * chore: add changeset for MIME type fix and telemetry disable * chore(typescript): version packages (canary) * improvement(typescript): fix prompt method to use generic type inference for callback parameters (#1029) * test: trigger conformance badge update with new token Co-authored-by: Cursor <cursoragent@cursor.com> * test: trigger badge update with delay fix Co-authored-by: Cursor <cursoragent@cursor.com> * test: trigger badge update with delay fix Co-authored-by: Cursor <cursoragent@cursor.com> * improve type inference for prompt args in the callback fn * Remove test badge update fix comment Signed-off-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> * Remove comment from conformance.yml Remove comment about test badge update delay fix Signed-off-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> --------- Signed-off-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * fix(typescript): lint error when object() response helper added to mix() (#1025) * test: trigger conformance badge update with new token Co-authored-by: Cursor <cursoragent@cursor.com> * fix type issue when object() response helper is added in mix() --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * chore(typescript): version packages (canary) * feat(inspector): enhance ChatTab and related components with quick questions and followups (#997) * feat(inspector): enhance client package with new components and configuration options (#973) * feat(inspector): enhance client package with new components and configuration options - Added a new test_app configuration in pnpm-lock.yaml with updated dependencies for improved development. - Refactored build scripts in package.json to streamline client exports and ensure compatibility. - Introduced tsup.client.ts for better bundling configuration of client components. - Expanded the index.ts file to include new chat components and utility functions, enhancing the inspector's functionality. - Updated ChatTab and related components to support new props for better customization and control. - Added serverBaseUrl prop to various components to facilitate external API calls without relying on context. - Implemented new hooks and types for improved chat message handling and configuration management. - Introduced stubs for Node.js modules to ensure compatibility in browser environments. - Added rpc-log-bus for logging RPC events, enhancing debugging capabilities in server interactions. * feat(inspector): add new props for ChatTab, ChatHeader, and ChatLandingForm components - Introduced `clearButtonLabel`, `hideTitle`, and `hideModelBadge` props to enhance customization options for the ChatTab and ChatHeader components. - Updated the ChatLandingForm to conditionally render the model badge based on the new `hideModelBadge` prop. - Improved the display logic for the clear/new-chat button to utilize the `clearButtonLabel` prop, allowing for dynamic labeling. * feat(inspector): add hideServerUrl prop to ChatTab and ChatLandingForm components - Introduced `hideServerUrl` prop to both ChatTab and ChatLandingForm components, allowing for conditional rendering of the MCP server URL. - Updated documentation comments to reflect the new prop's functionality, enhancing customization options for users. * feat(hmr): enhance TypeScript support and registration synchronization - Updated the `tsImport` function to accept additional options for improved TypeScript handling, including cache busting and import callbacks. - Enhanced the `importServerModule` function to provide better warnings for module re-imports and instance management. - Refined the `syncRegistrationsFrom` method in `MCPServerClass` to return detailed change statistics for tools, prompts, and resources, improving change detection and logging. - Added debug logging for unchanged registrations to aid in troubleshooting during hot module reloading (HMR). - Wrapped handler functions with session context to maintain access to context features after HMR updates, ensuring consistent behavior. * feat(inspector): enhance tool change detection and metadata handling - Updated the `ToolsTab` component to include additional checks for changes in tool metadata, ensuring more accurate detection of updates. - Refined the handling of tool metadata during hot module reloading (HMR) to fully replace existing metadata instead of merging, improving consistency. - Added comprehensive E2E tests to validate tool handler logic changes after HMR, ensuring expected behavior for both text and widget outputs. - Adjusted the `McpClientProvider` to correctly pass metadata to tools, enhancing the overall functionality and user experience. * feat(inspector): enhance ChatTab and Layout components with new props and visibility controls - Added new props to `ChatTab` and `ChatHeader` for customizing the clear/new-chat button, including `clearButtonHideIcon`, `clearButtonHideShortcut`, and `clearButtonVariant`. - Updated `Layout` and `LayoutHeader` components to support single-tab mode and visibility of tabs based on the `embeddedConfig`, improving user experience in embedded scenarios. - Refactored tab rendering logic in `LayoutContent` to conditionally display tabs based on the `visibleTabs` configuration, enhancing flexibility for users. * feat(mcp): propagate widget resources to existing sessions - Added `propagateWidgetResourcesToSessions` method to `MCPServerClass` to ensure newly registered widget resources are available to existing sessions without requiring a reconnect. - Updated `uiResourceRegistration` to call the new method, allowing resource propagation regardless of tool registration status. - Enhanced logging for resource propagation to improve visibility during session updates. * fix(cli): increase chunk size warning limit for bundles * feat(inspector): add HMR regression test for widget resource propagation - Implemented a new E2E test to verify that dynamically added widget resources are correctly registered and propagated to existing sessions during hot module reloading (HMR). - Enhanced file utility functions to support writing and removing widget resource files, ensuring proper cleanup after tests. - Updated the MCPServerClass to track session references for resources, improving synchronization during HMR updates. * feat(logging): add conditional debug logging for widget operations - Introduced a `debugWidget` flag to control logging for widget-related operations in `shared-routes.ts`, `shared-utils.ts`, and `mount-mcp.ts`. - Enhanced logging statements to only execute when the `DEBUG` environment variable is set, improving performance and reducing noise in production logs. - Updated the `requestLogger` to skip logging for noisy GET requests, further optimizing log management. * chore(pnpm): remove test_app configuration and its dependencies from pnpm-lock.yaml * fix(inspector): update build configurations and improve type handling - Modified `package.json` to ensure proper declaration file generation during client exports. - Adjusted `tsconfig.client.json` to change the root directory and output directory for better organization. - Enhanced type handling in `McpUIRenderer.tsx` by using a more specific type for resource properties. - Updated `WidgetDebugContext.tsx` to define a `DeviceType` type for improved type safety. - Removed unused `rpc-log-bus` definitions to clean up the codebase. * feat(mcp): improve resource registration logic in MCPServerClass - Enhanced the resource registration process to skip adding resources that are already propagated to sessions, preventing duplicate registrations. - Updated logging to provide clearer feedback on resource addition and registration failures. - Refactored the handling of widget resource templates to ensure they are only registered if not already present in the session, improving efficiency and reducing potential errors. * feat(mcp): implement dynamic HMR port allocation for development servers - Added a function to find an available port for Hot Module Replacement (HMR), allowing multiple development servers to run concurrently without port conflicts. - Updated the Vite server configuration to use the dynamically allocated HMR port instead of a hardcoded value, enhancing flexibility in development environments. - Improved logging to reflect the dynamically chosen HMR port, ensuring better visibility during server setup. * fix(inspector): improve same-origin detection for widget iframes - Updated the logic for determining if the widget iframe is same-origin with the inspector page, enhancing console interception and debug controls. - Refactored the setting of `isSameOrigin` to use the new computed value, ensuring accurate cross-origin handling for both development and production environments. * fix(inspector): correct inspector API base URL handling - Updated the logic for determining the inspector API base URL to use relative URLs, ensuring that API calls target the correct origin of the inspector UI instead of the MCP server. - Removed the previous logic that derived the base from the MCP server URL, which caused issues when the server ran on a different port, improving cross-origin handling. * refactor(mcp-server): update syncRegistrationsFrom method to return detailed change summary - Modified the syncRegistrationsFrom method to return an object containing total changes and detailed counts for added, removed, and updated tools, prompts, and resources. - This enhancement improves the method's utility by providing comprehensive feedback on registration changes during synchronization. * fix(tests): enhance waitForHMR function to support no-change scenarios - Updated the waitForHMR function to accept an options parameter, allowing it to handle cases where no changes are detected during Hot Module Replacement (HMR). - Modified the integration test to utilize the new functionality, ensuring it can correctly resolve when no changes occur, improving test reliability. * feat(hmr-sync): add debug logging for HMR changes and improve resource key handling - Introduced a new function to check if debug logging is enabled, enhancing the visibility of changes during Hot Module Replacement (HMR). - Updated debug logging to conditionally display changes in configuration and handler, including previews of old and new handlers. - Refactored resource key handling in MCPServerClass to improve clarity and maintainability. * feat(hmr): implement widget re-addition test and enhance resource cleanup - Added a new test to verify that deleting and re-adding a widget resource correctly re-registers it for the same session during Hot Module Replacement (HMR). - Enhanced the MCPServerClass to ensure proper cleanup of resources from both session and root native server states, preventing registration conflicts when re-adding widgets. * feat(inspector): enhance ChatTab and related components with quick questions and followups - Added support for `chatQuickQuestions` and `chatFollowups` props in `ChatTab`, `ChatLandingForm`, and `ChatInputArea` components to improve user interaction. - Implemented functionality to handle quick question and followup selection, enhancing the chat experience. - Updated `InspectorContext` to include new configuration options for quick questions and followups. - Enhanced message handling and event posting for better integration with the chat system. * feat(inspector): enhance error handling and logging for MCP Apps and OpenAI components - Implemented error logging functionality in MCPAppsRenderer and OpenAIComponentRenderer to capture and post error messages and stack traces to the parent window. - Added global error and unhandled promise rejection listeners in shared-utils to emit runtime errors with detailed context. - Enhanced console error handling in mcp-apps route to serialize and send console errors to the parent window, improving debugging capabilities. * refactor(inspector): replace isReady state with initCount in MCPAppsRenderer - Updated the MCPAppsRenderer component to replace the `isReady` state with `initCount` for better tracking of initialization events. - Adjusted related useEffect hooks to utilize `initCount` for conditional logic, improving clarity and functionality in widget initialization and message handling. * feat(mcp): implement direct stdio connector handling in Node.js client - Added support for handling the stdio connector directly within the Node.js MCPClient, allowing for command and argument configuration. - Updated the loadConfigFile function to dynamically import the fs module, preventing unnecessary inclusion in browser bundles. - Enhanced error handling to ensure that the stdio connector is only utilized in the appropriate environment, improving compatibility and clarity. * feat(inspector): add log copying functionality to IframeConsole and enhance theme handling in OpenAIComponentRenderer - Implemented a new feature in IframeConsole to copy all logs to the clipboard, providing users with an easy way to access console logs. - Enhanced OpenAIComponentRenderer to manage widget readiness state and apply theme changes dynamically, improving user experience and visual consistency. - Updated ThemeProvider to synchronize theme application with Tailwind dark mode and OpenAI Apps SDK design tokens, ensuring a seamless theme transition. - Added a message signaling to the parent window when the widget is ready, enhancing communication between components. * test: trigger badge update with delay fix Co-authored-by: Cursor <cursoragent@cursor.com> * feat(inspector): enhance ToolsList component with metadata display and add MCP/OpenAI icons - Updated ListItem component to conditionally render metadata. - Enhanced ToolsList to include tool metadata with icons for MCP and OpenAI, utilizing tool detection logic. - Introduced McpIcon and OpenAIIcon components for better visual representation of tool types. * feat(inspector): improve loading state and UI feedback in OpenAIComponentRenderer - Replaced shimmer animation with a Spinner component for a more consistent loading experience. - Introduced a skeleton loading state that only displays on the initial load of the widget. - Updated ToolResultDisplay to adjust the order of view checks for better clarity. - Enhanced ToolsList to conditionally display parameter counts based on tool input schemas. * fix(vitest): add support for additional file extensions in Vitest configuration (#1031) * Fix README formatting for test badge update Fix formatting of the test badge update section in README. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * fix(ChatLandingForm): update button text color for better visibility in light and dark modes * fix(changesets): clean up and complete changeset documentation - Removed 3 changesets from PR #973 that were already in canary (lazy-animals-feel, slow-otters-lick, sour-hoops-arrive) - Updated six-groups-fry.md to include full description of OpenAI renderer improvements - Added chatty-owls-glow.md for quick questions/followups feature - Added brave-lions-sleep.md for error handling and logging enhancements - Added tough-dragons-wave.md for IframeConsole log copying and theme handling - Added tiny-trains-smile.md for ToolsList metadata and icons - Added happy-sharks-dance.md for stdio connector support All code changes in this branch are now properly documented with changesets. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(mcp): normalize client info in stdio connector handling - Updated the MCPClient to use normalizeClientInfo for clientInfo when configuring the StdioConnector. - Removed dynamic require for StdioConnector, improving code clarity and maintainability. - Enhanced type definitions for stdioConfig to ensure better type safety and clarity in the configuration process. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * refactor(inspector): update frame-ancestors policy for improved security handling (#1032) - Simplified the logic for setting the frame-ancestors policy in the getWidgetSecurityHeaders function. - Enhanced the handling of the FRAME_ANCESTORS environment variable to allow for backward compatibility while defaulting to allow all origins when unset. - Updated comments for clarity on the behavior of frame-ancestors in different scenarios. * chore(typescript): version packages (canary) * feat(readme): add client conformance badges for Python and TypeScript - Introduced new conformance badges for Python and TypeScript client packages in the README to enhance visibility of project status and compliance. * feat: add logLevel option and silent mode to suppress console logging (fix #986) (#995) * feat: add logLevel option and silent mode to suppress console logging (fix #986) Changes: - Add 'silent' log level to LogLevel type; shouldLog() returns false for all levels when silent - Add logLevel option to UseMcpOptions; takes precedence over the debug boolean - Route addLog() through per-instance Logger instead of raw console[level]() calls - Fix global clobber: each useMcp instance creates its own named logger via Logger.get() so multiple instances don't overwrite each other's log levels - Migrate all console.* calls to logger.* in: - react/useMcp.ts - client/browser.ts - connectors/base.ts - connectors/http.ts - Export LogLevel type from browser entry point The mcp.log state array is still always populated for programmatic access. * feat: migrate McpClientProvider console.* to logger and deprecate debug attr * fix(react): complete logLevel migration and add comprehensive tests Completes the migration to respect logLevel configuration across all React client components by routing remaining console.* calls through the Logger class. Changes: - Route rpc-logger console calls through Logger.get('RpcLogger') - Route ErrorBoundary console.error through Logger.get('ErrorBoundary') - Remove debug console.log in ThemeProvider - Fix inconsistent logging in useMcp (use addLog instead of direct instanceLogger) Tests: - Add comprehensive Logger configuration tests (13 tests) - Silent mode suppression - Log level filtering - Per-instance loggers - Format styles (minimal, detailed, emoji) - Logger.setDebug() behavior - Add useMcp hook logLevel tests (6 tests) - logLevel option behavior - Silent mode with log state preservation - logLevel vs debug prop precedence - Per-instance logger isolation All tests passing, build succeeds. Related: PR #995, Issue #986 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(logging): enhance logging consistency and add tests for logLevel behavior - Improved logging consistency across React components by ensuring all console calls are routed through the Logger class. - Added comprehensive tests for Logger configuration, including log level filtering and silent mode behavior. - Updated useMcp hook tests to validate logLevel options and their interactions. All tests passing, build succeeds. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> * chore(typescript): version packages (canary) * fix error() return type to be compatible with tool callbacks that use outputSchema (#1033) * chore(typescript): version packages (canary) * feat(inspector): enhance MCPAppsRenderer and OpenAIComponentRenderer with loading states and spinner (#1034) - Updated MCPAppsRenderer to include a loading spinner during widget initialization, improving user feedback. - Introduced a new `isReady` state to manage the loading state effectively. - Enhanced OpenAIComponentRenderer to adjust display properties based on the new configuration for better responsiveness. - Added a maximum width for the Picture-in-Picture mode in MCP_APPS_CONFIG for improved layout control. - Refactored iframe loading handling to ensure proper state management and user experience during loading phases. * chore(typescript): version packages (canary) * feat(inspector): release v0.20.0 with chat enhancements and improved UX - Introduced support for `chatQuickQuestions` and `chatFollowups` in ChatTab components. - Enhanced loading states in MCPAppsRenderer with a new spinner and skeleton loading for widgets. - Added global error listeners and improved error logging in widget components. - New feature to copy all logs to clipboard and enhanced theme handling in OpenAIComponentRenderer. - Updated dependencies, including mcp-use to v1.19.0. - Various fixes for CSP frame ancestors and MIME type handling. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Signed-off-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Luigi Pederzani <luigipederzani@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Ashutosh Kumar Singh <161562995+Ashutosh0x@users.noreply.github.com> |