The python-lint job installs ruff unpinned, so it always resolves to the
latest release. ruff 0.16.0 started formatting fenced code blocks inside
Markdown, which brought libraries/python/README.md into the scope of
`ruff format --check .` for the first time. Its quickstart examples were
never formatted that way, so the job now fails on every pull request that
touches libraries/python, regardless of what the change is.
Pin to 0.15.22, the newest release that passes both steps on current main.
This restores a reproducible check and leaves the Markdown question as a
deliberate choice rather than something a tool release decides.
Refs #1856
Fix MCPAgent not spawning MCPClient for explicit llm + mcpServers URL config, omit reasoning.effort unless opted in, and add CI e2e against remote analytics-demo.
* Resolve Inspector CDN releases before loading assets
* fix(ci): pin pnpm for server examples
* fix(ci): relink server example CLI
* fix(examples): support clean Next builds in CI
* fix(examples): expose built workspace CLI
* fix(inspector): address CDN loader review
* fix(inspector): support legacy abort signals
* fix(client): surface manual OAuth failures
* ci: publish TypeScript previews for beta PRs
* ci: pin pnpm for server example checks
* revert: keep server example CI out of OAuth fix
* refactor(create-mcp-use-app): replace --canary flag with --sdk-version for version pinning
- Updated GitHub Actions workflows to use --sdk-version instead of --canary for creating apps.
- Modified CLI options and internal logic to support --sdk-version for specifying npm dist-tags or semver.
- Updated documentation and tests to reflect the change from --canary to --sdk-version.
* chore(ci, workflows): downgrade Node.js version to 20.19.0 across all workflows
- Updated GitHub Actions workflows to use Node.js version 20.19.0 instead of 24.15.0.
- Adjusted package.json files to reflect the new Node.js engine requirements.
- Updated pnpm-lock.yaml and TypeScript dependencies to ensure compatibility with the new Node.js version.
- Removed redundant version generation command for @mcp-use/client in the CI workflow.
- Updated documentation links in code-mode.mdx and other files to reflect new paths.
- Changed installation instructions from yarn to npm for consistency across documentation.
- Enhanced error handling in client authentication and session management.
- Added a utility function to compare semantic versions in telemetry.
- Removed outdated unit tests for FileKVStore.
- Improved formatting and consistency in README.md and various documentation files.
- Updated import paths to reflect the new package structure for @mcp-use/client and @mcp-use/agent.
- Enhanced examples and descriptions for MCPAgent and related components.
- Cleaned up whitespace and formatting for better readability across multiple files.
- Adjusted the GitHub Actions workflow to conditionally set up pnpm only for pnpm repositories, preventing errors related to multiple version specifications.
- Simplified the Node.js setup process by ensuring it is always configured, enhancing the reliability of the CI pipeline.
- Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs.
changesets creates annotated tags (git tag -m), which fail silently
without user.name/user.email configured. On the main release path no
prior step set the git identity, so stable releases were published to
npm but never tagged - skipping GitHub releases and the Discord
notification. Also fail the publish step loudly when no tags are
created instead of exiting 0.
Resolves CodeQL alert #83 by dropping manual PR head checkout in the
privileged issue_comment workflow and letting claude-code-action handle
PR refs with its built-in base-branch config restore.
* chore: remove unused mcp-use source files (#1476)
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* docs(cli): clarify inspector skipped-in-production log + start section (#1505)
* docs(cli): clarify inspector skipped-in-production log + start section
The runtime log "[INSPECTOR] Skipped in production (use --with-inspector
flag during build)" reads as if the flag can be passed to `mcp-use
start`, which it can't (the flag is only registered under `build`). The
new wording spells out the rebuild command, and `cli-reference.mdx`
gains a short note under `start` pointing at the build flag for
inspector-in-production.
Closes#1495
* docs(cli): apply reviewer reword on inspector note
* chore(typescript): version packages (canary)
* chore(inspector): remove unused source files (#1510)
Drops the 18 inspector files reported by `pnpm knip` from
libraries/typescript and stops generating the unused client-side
version.ts (the client reads the version from the
window.__INSPECTOR_VERSION__ global injected by the server).
Part of #1446.
* chore(typescript): version packages (canary)
* chore(typescript): prune 187 unused exports and 161 unused export types flagged by knip (#1511)
* chore(typescript): prune 161 unused exported types flagged by knip
Phase 2 of #1450: remove or de-export types that knip flags as unused.
Skipped tuning knip.json (Phase 1) — focused only on the type cleanup.
For each flagged type:
- Used only within its source file → drop `export`
- Re-exported through a barrel but never imported downstream → remove the re-export
- Genuinely dead → delete
No public-API removals: types exposed through the `mcp-use`, `@mcp-use/cli`,
`@mcp-use/inspector`, or `create-mcp-use-app` package entry points remain
exported. `client.ts` switches from inline `import("...")` to a top-level
import so knip can see the `ToolSearchResponse` usage.
Verified `pnpm knip` reports 0 unused types (down from 161) and
`pnpm build` passes across all packages.
* chore(typescript): prune 187 unused exports flagged by knip
Closes#1450.
* chore(typescript): fix prettier formatting
* chore(typescript): delete orphaned PropsSelect.tsx
Removing the unused barrel re-export in the prior commit left this file
with no consumers.
* chore(typescript): version packages (canary)
* ci(knip): enforce knip and clear final baseline findings (#1512)
* chore(knip): clear remaining baseline findings so knip passes clean
- Mark `src/index.tsx` as an entry for create-mcp-use-app so its
CLI dependencies (chalk, commander, ink, ora, tar, react, etc.)
stop being flagged as unused.
- Add `lsof`, `sleep`, and `dev` to ignoreBinaries for the mcp-use
workspace — these appear in example scripts and are either system
utilities or pnpm script names, not npm-resolvable binaries.
- Turn off the `optionalPeerDependencies` rule. Optional peer deps
(langchain/langfuse/e2b/etc.) are loaded conditionally by design;
flagging them as referenced is noise.
After this change `pnpm exec knip` exits 0 against canary.
* ci(knip): enforce knip in CI
The baseline is now clean (canary + previous PRs cleared all findings),
so drop `--no-exit-code` and let the job fail when knip reports issues.
Also generate `packages/mcp-use/src/version.ts` before knip runs so the
gitignored `version.js` imports resolve.
* chore(deps): bump better-auth in /libraries/typescript (#1515)
Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.1 to 1.6.11.
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth)
---
updated-dependencies:
- dependency-name: better-auth
dependency-version: 1.6.11
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* docs: tighten PR readiness and docs hygiene (#1509)
* docs: tighten review readiness and doc links
* docs: anchor api-reference redirect and fix missed node note
Move the /typescript/server/api-reference target from a bare redirect
to an anchored one (#mcpserver-api-reference) so existing "API Reference"
links land on the renamed section directly. Drop the self-link in
server/index.mdx and bring the commonjs example's Node note in line with
the package engines range.
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* feat(server/oauth): allow Supabase URL override for self-hosted/local instances (#1517)
* feat(server/oauth): allow overriding Supabase URL for self-hosted/local instances
`oauthSupabaseProvider` previously hardcoded `https://${projectId}.supabase.co`,
preventing use against local Supabase (`http://localhost:54321`) or self-hosted
deployments — even though those instances expose the same OAuth 2.1 server.
Add an optional `supabaseUrl` config (and `MCP_USE_OAUTH_SUPABASE_URL` env var)
that overrides the projectId-derived URL. `projectId` is now optional when
`supabaseUrl` is set; hosted-project users are unaffected.
Closes mcp-use/mcp-oauth-supabase-template#2
* test(server/oauth): trim supabase provider tests to factory contract
Drop low-value string-concatenation and pre-existing-behavior tests; keep
the two that cover the new behavior (supabaseUrl alone is accepted; empty
config throws). Isolate process.env in the factory describe so the
"throws when neither configured" assertion isn't defeated by local
MCP_USE_OAUTH_SUPABASE_* env vars.
* docs(server/oauth): document supabaseUrl override for local/self-hosted Supabase
* chore(typescript): version packages (canary)
* chore: use cross-platform clean commands (#1523)
* chore: use cross-platform clean commands
* chore: add empty changeset for cross-platform clean scripts
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* fix(server/oauth): use URL constructor to avoid double slash in metadata proxy (#1483)
* fix(server/oauth): use URL constructor to avoid double slash in metadata proxy
The DCR-direct metadata proxy was string-concatenating a path onto the
issuer, which canonically ends with a trailing slash:
`${issuer}/.well-known/oauth-authorization-server`
// → "https://tenant.auth0.com//.well-known/oauth-authorization-server"
Auth0 returns 404 for any path starting with "//", which broke OAuth
discovery end-to-end against real Auth0 tenants in DCR-direct mode.
new URL(path, base) normalizes the join regardless of trailing slash, so
this works for any provider whose canonical issuer ends with "/".
Fixes#1482.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(server/oauth): normalize issuer trailing slash instead of using URL constructor
`new URL("/.well-known/...", issuer)` resolves the leading-slash path against
the issuer's origin, stripping any path on the issuer. That breaks providers
like Supabase whose issuer is `https://<project>.supabase.co/auth/v1`. Replace
with a trailing-slash-stripping template literal, which handles both Auth0
(issuer ends with `/`) and Supabase (issuer has a path).
* chore(changeset): trim oauth metadata fix entry
* chore(changeset): drop issue reference
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* test(inspector): add OAuth e2e against emulated Google issuer (#1481)
* test(inspector): add OAuth e2e test using emulated Google issuer
Covers the inspector's OAuth redirect flow end-to-end against an
`emulate`-backed Google issuer + MCP server in oauthProxy mode, run
twice across the Direct and Via Proxy connection-type matrix. Both
variants share one fixture in serial mode since the registered redirect
URI pins the MCP server to a fixed port.
* test(inspector): switch loop to factory to satisfy no-loop-func
The for-loop variant captured the mutable `fixture` binding from beforeAll,
which eslint's no-loop-func flags. Hoisting the body into a small factory
keeps the shared fixture without the closure-over-loop pattern.
* test(inspector): close emulator if MCPServer setup fails
Wrap post-createEmulator work in try/catch so the emulator port
doesn't stay bound when MCPServer construction or listen() throws.
* chore(typescript): version packages (canary)
* fix(inspector): surface MCP server auth failures with reconnect banner (#1485)
* fix(inspector): surface MCP server auth failures with reconnect banner (MCP-2111)
When the hosted inspector's chat backend returns 401 because the upstream
MCP server rejected the user's OAuth token (e.g. Linear token expired),
the inspector previously threw a generic `HTTP error! status: 401` and
the cloud response misleadingly pointed users at the Manufact account
login.
The chat now recognises the cloud's `{ error: "mcp_auth_required",
mcpServerUrl }` response and renders an inline banner above the input
("Reconnect to <server>") with a button that calls
`connection.authenticate()`. Reconnect refreshes the OAuth token in
localStorage; the banner clears on success and chat resumes.
Pairs with a cloud-side change that drops the misleading `loginUrl`
field from the 401 response.
* fix(inspector): harden mcp_auth_required handling
- Drop the no-op setMessages filter in the 401 branch; the optimistic
assistant message is only added after the response check, so there's
nothing to remove.
- Guard `new URL(serverUrl)` in McpReconnectBanner so a malformed URL
falls back to the raw string instead of crashing the chat tab.
* refactor(inspector): rename mcpAuthRequired to mcpServerAuthRequired
The hook's internal state was already named `mcpServerAuthRequired`, but
the returned key and clear callback used the shorter `mcpAuthRequired`,
forcing the ChatTab consumer to re-alias them. The shorter name was
also ambiguous in a codebase that has two distinct auth flows: the
Manufact account login (429 path) and the upstream MCP server OAuth
(401 path).
Align the public surface of `useChatMessages` with the internal state
and the consumer's local name. The backend wire value
`"mcp_auth_required"` is unchanged.
* chore(inspector): remove mcpServerAuthRequired comment
* chore(typescript): version packages (canary)
* fix(inspector): keep tab count badges visible in collapsed mode (#1490)
* fix(inspector): keep tab count badges visible in collapsed mode
* Keep tab badges aligned in collapsed mode
* extract TabCountBadge and fix badge visibility
* chore(typescript): version packages (canary)
* fix(inspector): drop unused TabCountBadge barrel re-export (#1533)
The only consumer (LayoutHeader.tsx) imports TabCountBadge directly
from ./shared/TabCountBadge, so the re-export in shared/index.ts is
unused. Knip flagged it and started failing CI on canary after the
TabCountBadge change landed.
* chore(typescript): version packages (canary)
* feat(inspector): add local LLM provider support for chat in Inspector (#1395)
* feat(inspector): integrate ollama provider
* feat(inspector): integrate lmstudio provider
* fix(inspector): preserve no-icon behavior for openai-compatible provider
* refactor(inspector): remove LM Studio provider and address PR feedback
* fix(inspector): remove duplicate ollama union members
Collapses the accidental `"ollama" | "ollama"` duplicates in
ProviderName, MCPChatMessageEventData, and LLMConfig.
* refactor(inspector): drop LLM proxy and call Ollama directly
Ollama allows localhost origins by default, so the inspector talks to
the daemon over CORS and skips the server-side proxy entirely. Surface
an OLLAMA_ORIGINS hint when the browser fetch fails so tunneled or
remote setups know what to configure. Theme the Ollama logo and tighten
its size so the non-circular mark sits cleanly next to the other
provider icons.
* chore(inspector): revert gratuitous field reorders
Restore original ordering of temperature/baseUrl and useCallback deps;
remove stray blank line in vite.config.ts to keep the diff focused.
* test(inspector): add unit tests for parseNDJSON
* refactor(inspector): tighten Ollama provider integration
- Guard Ollama streamChat against duplicate tool-call emissions when a
chunk's tool_calls are repeated by proxies/forks
- Key the models cache on (provider, baseUrl) for any base-url provider
so openai-compatible no longer serves stale entries on URL changes;
normalize Ollama variants (trailing slash, /api suffix) to one entry
- Move OllamaCorsError into the Ollama provider module
- Replace hand-written provider unions in telemetry events and
server shared-utils with ProviderName
- Single-source DEFAULT_OLLAMA_BASE_URL from ollama/utils.ts
- Drop the unrelated tempApiKey/tempModel trim() drift in saveLLMConfig
- Make OPENROUTER_ICON_URL module-private, clean up merge-artifact
blank lines
* chore: simplify changeset
* style(inspector): apply prettier to shared-utils
* fix(inspector): drop unused export on DEFAULT_BASE_URLS
DEFAULT_BASE_URLS is only consumed by getDefaultBaseUrl in the same
module. Knip flagged the export as unused and failed CI.
* ci: retrigger after canary knip fix (#1533)
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* fix(inspector): resolve CodeQL polynomial-regex alert in Ollama url normalizer (#1534)
* fix(inspector): replace trailing-slash regex in Ollama url normalizer
CodeQL flagged `/\/+$/` in `normalizeOllamaBaseUrl` as a polynomial
regular expression on uncontrolled input. Swap the regex for an
explicit linear scan and add unit tests covering the trimming
behaviour plus a pathological-input case.
* chore: drop unit test for trivial regex refactor
* chore: drop accidentally committed .antigravitycli symlink
* chore(typescript): version packages (canary)
* chore: remove dead typescript-format-and-lint pre-commit hook (#1541)
The hook entry pointed to `.git/hooks/typescript-pre-commit.sh`, a path
that is never tracked and was never populated by any setup step, so the
hook could not run for anyone. TypeScript formatting and linting are
already handled by Husky (libraries/typescript/.husky/pre-commit),
installed automatically via `pnpm install`'s `prepare` script.
Closes#1536
* fix(inspector): stop ToolInputForm from mutating live tool inputSchema (#1545)
* fix(inspector): stop ToolInputForm from mutating live tool inputSchema
`ToolInputForm` was writing `required: boolean` onto each property of the
live tool inputSchema during render. `required` is not valid as a per-
property boolean — it belongs on the parent object as a `string[]`.
Anthropic's draft 2020-12 validator rejected the resulting payload with
`tools.0.custom.input_schema invalid`, breaking the Inspector chat after
any tool had been opened in the Tools tab.
Replace the mutation with a local `isRequired` const used only for the
`*` indicator render.
Fixes MCP-1970.
* chore(inspector): trim comment on schema-mutation fix
* chore: remove verbose comment
* style(inspector): apply prettier to ToolInputForm
* chore(typescript): version packages (canary)
* Improve tab switch animation timing (#1544)
* chore(ui): improve tab switch animation timing
* chore(changeset): add changeset for tab animation improvement
* chore(typescript): version packages (canary)
* fix(inspector): propagate server alias updates through mcp server wrapper (#1539)
* fix(inspector): propagate server alias updates through McpServerWrapper onUpdate
* chore: add changeset for mcp-use server alias propagation fix
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* chore(typescript): add 3-day install cooldown via pnpm minimumReleaseAge (#1516)
Blocks `pnpm install` from fetching npm versions published less than 3
days ago, mitigating supply-chain attacks where a malicious release is
typically yanked within hours of discovery.
The setting (introduced in pnpm 10.16) lives in pnpm-workspace.yaml — in
modern pnpm only auth/registry config is read from .npmrc, so putting it
there would be silently ignored.
Workspace-published names (`mcp-use`, `@mcp-use/*`, `create-mcp-use-app`)
are exempted so the cooldown never interferes with local development or
fresh releases of our own packages.
* fix(react): improve server management in McpClientProvider (#1561)
Refactor server removal and update logic to use a ref for synchronous access to the latest server state. This change prevents React's warning about updating a component during rendering by ensuring that teardown side effects (`disconnect()` and `clearStorage()`) are executed outside of the state updater functions. The ref is updated in a useEffect hook to maintain the latest server state for event handlers.
* chore(typescript): version packages (canary)
* fix(inspector): forward MCP image tool results as image content (#1487)
* fix(inspector): forward MCP image tool results as image content (MCP-1941)
Previously, the inspector's chat loop and provider adapters serialized MCP
tool results with JSON.stringify, which buried the base64 `data` field of
`image` content blocks inside a text payload. Vision-capable models
received a wall of base64 text instead of the image.
Extract MCP `content` blocks into provider-neutral `ContentPart[]` and
route image bytes through each provider's vision channel:
- Anthropic: image blocks inside `tool_result.content` (base64 source).
- OpenAI: tool role keeps text; image bytes forwarded as a follow-up
user turn with `image_url` parts.
- Google: `functionResponse.response` keeps text/metadata; image bytes
forwarded as a follow-up user turn with `inlineData` parts.
Text-only tool results keep the legacy `content: string` path on every
provider.
* style(inspector): apply prettier formatting
* chore(inspector): drop unused export on collapseToString
Only called internally by toolResultToContent — knip flagged it as an
unused export.
* fix(inspector): propagate MCP isError flag and fix image example tools
- Add isToolResultError() helper and use it in toolLoop + replay so
tool calls that return { isError: true } are flagged the same as
thrown errors on both live and saved-conversation paths.
- Pick a no-content fallback for OpenAI's tool role when there are
no image parts to forward.
- Replace via.placeholder.com URLs in the everything example with
real base64-encoded bytes fetched from picsum.photos, since the
image() helper expects MCP ImageContent base64 data, not URLs.
* style(inspector): apply prettier formatting
* chore(typescript): version packages (canary)
* fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL (#1552)
* fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL
Browsers cannot resolve 0.0.0.0 as a destination, and the MCP SDK's
OAuth resource validator does strict origin equality — so the inspector
auto-connecting to http://0.0.0.0:PORT/mcp mismatches the resource
metadata published as http://localhost:PORT (which goes through
normalizeUrlHost in server-helpers.ts). Result: OAuth-protected mcp-use
apps fail at the inspector's post-callback validation with "Protected
resource X does not match expected Y".
Mirror the existing normalization for the autoConnect URL and the
banner log so both reflect the browser-reachable host.
Closes#1551
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: add changeset for inspector autoConnect loopback normalization
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* fix(cli): align widget Vite base with /mcp-use/widgets (#1560)
* fix(cli): align widget Vite base with /mcp-use/widgets/ when MCP_URL is set
* chore: add changeset for cli widget base path fix
* chore: format widget-paths.ts
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* feat(cli): headless screenshot with auto-sizing and external MCP server support (#1579)
* feat(cli): headless screenshot command with auto-sizing and external MCP server support
- Make width/height optional; when omitted, clips to the widget's natural rendered size
by reading body[data-view-*] rect attrs set by the preview page
- Add useBundleReadinessSignal in ViewPreview that uses ResizeObserver to wait for the
iframe to stabilize before setting data-view-ready, serializing the iframe's bounding
rect so the CLI can clip tightly instead of capturing the full viewport
- Switch ViewPreviewBundle to displayMode="inline" so widgets auto-size to content height
- Add inlineWidthOverride prop to MCPAppsRenderer to bypass the 768px inline cap when
screenshotting at an explicit width
- Fix extractViewName to handle external MCP server URIs (ui://<server>/<name>.html)
by flattening to <server>-<name>; previously only ui://widget/ was handled, causing
React Router to fail to match the preview route for third-party servers like Excalidraw
* chore: add changeset for screenshot auto-sizing and external MCP fix
* fix(cli): unexport CaptureScreenshotResult to satisfy knip
* chore(typescript): version packages (canary)
* feat(auth): enhance OAuth callback handling with improved state management and user feedback (#1580)
* feat(auth): enhance OAuth callback handling with improved state management and user feedback
- Introduced a module-level cache for in-flight authorization promises to prevent duplicate network requests during the same page load.
- Added utility functions to determine if the current window is a popup and to render user-friendly messages for closing the window after authentication.
- Improved handling of redirect flows and popup scenarios to ensure a seamless user experience, including error handling and messaging for lost opener situations.
* fix(auth): BroadcastChannel fallback when popup opener is severed
Popup callback now broadcasts success/failure over a same-origin
BroadcastChannel("mcp_auth_callback") in the lost-opener branch, and
useMcp subscribes to that channel alongside the existing window.message
listener. Without this, popups whose window.opener was severed by COOP
or cross-origin intermediate redirects would save tokens but leave the
parent stuck in `authenticating`.
Matches the dual-transport pattern used by oidc-client-ts and MSAL.js
for the same COOP scenario.
* chore(auth): unexport MCP_AUTH_BROADCAST_CHANNEL to satisfy knip
It's only used inside callback.ts; the parent side hard-codes the same
string in useMcp.ts. Removing the export drops knip's "unused export"
finding while keeping a single source-of-truth comment that links the
two files.
* fix(mcp-use): split langchain agents out of mcp-use/browser entry
Move MCPAgent, RemoteAgent, adapters, and observability to
mcp-use/browser/agent so Next.js clients importing MCPClient only
no longer pull @langchain/* into the browser bundle.
* chore: format browser bundle test file
* chore(typescript): version packages (canary)
* fix(inspector): add copy button to user messages (#1556)
* fix(inspector): add copy button to user messages
Extract CopyButton into a shared component and add it to UserMessage,
matching the existing assistant message UX.
Resolves#1555
* chore: add inspector copy button changeset
---------
Co-authored-by: Jefsky <jefsky@users.noreply.github.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* feat(server): add publicLandingPage option for OAuth-protected servers (#1550)
* feat(server): add publicLandingPage option for OAuth-protected servers
* fix(server): keep public landing auth gate in oauth setup
* docs(server): add public landing page example
* chore(server): format mcp endpoint
* chore(server): simplify accept header lookup
* chore(server): restore mcp mount diff
* fix(server): align oauth exports with canary
* chore(server): format oauth exports
* fix(server): remove unused oauth barrel exports
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* Move mcp-apps template pnpm settings to workspace config (#1602)
* fix(inspector): widget fullscreen above embedded host chrome (MCP-2181) (#1605)
* fix(inspector): portal widget fullscreen above host chrome
MCP-2181: cloud chat headers at z-50 covered the fullscreen exit control
because the overlay used z-40 inside a nested stacking context. Portals
the fullscreen shell to document.body at z-[100], sets
data-mcp-widget-fullscreen for hosts, and shows the Apps SDK exit navbar
in CSS fullscreen fallback.
* fix(inspector): native fullscreen first, no portal remount (MCP-2181)
Revert conditional createPortal that remounted widgets on fullscreen toggle.
Use requestFullscreen() as the primary path; apply CSS z-[100] overlay only
when the API fails. Keep exit navbar and data-mcp-widget-fullscreen for both.
* refactor(inspector): consolidate widget fullscreen into shared hook
Extract useWidgetFullscreenControls for native-first fullscreen + CSS
fallback. Removes duplicated handlers, unused helpers, and OpenAI edge-case
branches from MCPAppsRenderer and OpenAIComponentRenderer.
* fix(inspector): preserve widget state when entering fullscreen (MCP-2181)
Route ui/request-display-mode through native fullscreen handling, target
requestFullscreen on the iframe wrapper, and avoid resetting load state on
display-mode-only changes. Stabilize OpenAI iframe listeners so chat
re-renders do not flash the skeleton.
* style(inspector): format OpenAIComponentRenderer for Prettier
* fix(inspector): fullscreen shell includes navbar and fills viewport
Promote the outer widget shell via requestFullscreen so FullscreenNavbar
stays visible and bg-background fills the screen instead of browser black
letterboxing around a nested iframe wrapper.
* fix(inspector): PiP portal and sandbox remount bridge reconnect (MCP-2181)
Port PiP to document.body with z-[100]. Re-run AppBridge when the sandbox
iframe remounts; keep the host spinner until initCount recovers. Unify
display-mode document attributes for optional host chrome hiding.
* fix(inspector): resend widget data after PiP remount
* chore(typescript): version packages (canary)
* Hash Claude resource domains from authored ui.domain (#1599)
* Apply Claude resource domain hashing for UI metadata
* chore: format Claude domain helper
* fix(inspector): drop unused widget-fullscreen exports to satisfy knip (#1607)
widget-fullscreen.ts (added in #1605) exported several symbols that
nothing outside the file consumes, plus pre-emptive @deprecated aliases
for an API that never shipped. Only useWidgetDisplayModeControls is used
(by MCPAppsRenderer and OpenAIComponentRenderer).
- Unexport internal-only constants, the WidgetDisplayMode type, and the
useWidgetDisplayModeDocumentChrome helper
- Remove the dead useWidgetFullscreenControls / useWidgetFullscreenDocumentChrome aliases
* test(agent): drop live Langfuse API integration tests (#1608)
The observability integration tests queried the live Langfuse REST API
(via getRecentTraces) to verify traces landed. cloud.langfuse.com has
been returning 403 Forbidden for both ingestion and queries, failing the
'should send traces to Langfuse when observability is enabled' test and
reddening canary CI.
Remove the two tests that depend on the live API (the failing test and
the already-skipped manual-trace test) plus the now-unused getRecentTraces
helper. Keep the two tests that verify observability enable/disable
behavior locally with no network dependency.
* chore(typescript): version packages (canary)
* fix(oauth): redact token verification errors (#1573)
* fix(oauth): redact token verification errors
* chore: add oauth error redaction changeset
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* fix(inspector): skip emulate oauth tests in builtin e2e (#1609)
* chore: add codex to gitignore (#1612)
* fix(docs): update server API reference links (#1611)
* fix(mcp-use): pin published dependency versions (#1610)
* docs(changelog): document v1.29.0 / inspector v7.0.0 release
TypeScript changelog gains a v1.29.0 entry (public landing pages, Supabase URL override, Claude UI-resource domain hashing, OAuth callback + React-provider hardening). Inspector changelog gains a major v7.0.0 entry (local Ollama provider, image tool results, MCP-server reconnect banner, widget fullscreen/PiP rework).
* Fix builtin inspector auto-connect to use HTTP (#1613)
* Switch builtin inspector auto-connect to HTTP
* Use plain URL autoConnect in builtin e2e helper
* Fix built-in inspector auto-connect to use HTTP
* chore(typescript): version packages (canary)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: asim48-ctrl <asim48@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Truffle <truffleagent@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: SSharma1103 <shivamsharma11032009@gmail.com>
Co-authored-by: Polæ <steven@polae.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com>
Co-authored-by: Udaykumar Dhokia <udaykumardhokia@gmail.com>
Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: Jefsky Wong <hwj3344@hotmail.com>
Co-authored-by: Jefsky <jefsky@users.noreply.github.com>
Co-authored-by: Ritwij Aryan Parmar <88580521+RitwijParmar@users.noreply.github.com>
* feat(mcp-use): add Clerk OAuth provider for TypeScript (#1429)
* feat(mcp-use): add Clerk OAuth provider
* docs: add Clerk OAuth provider documentation page
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* fix(cli): propagate --env/--env-file to server on deploy redeploys (#1433)
The deploy command only forwarded `--env`/`--env-file` values when creating
a brand-new server (where they ride on the createServer body). On redeploys
to an existing linked server, env vars were parsed and shown in the preview,
then silently dropped before createDeployment. Now upserts each entry against
/api/v1/servers/{id}/env-variables (PATCH for existing keys, POST for new
ones) before triggering the deployment.
Closes MCP-1995
* chore(typescript): version packages (canary)
* chore(typescript): adopt Knip to find and remove unused code (#1359)
* chore(typescript): adopt knip at workspace root
Add Knip as a dev dependency at the TypeScript workspace root with a
root-level knip.json covering all packages. Consolidates the existing
per-package Knip setup in @mcp-use/inspector into the shared config and
delegates its check-deps script to the root install.
Adds `pnpm knip`, `pnpm knip:deps`, and `pnpm knip:production` scripts
and documents them in the TypeScript README. Baseline configuration
suppresses known false positives (build-generated version.js, Tailwind/
Scarf deps, nested example and template workspaces, test helpers and
servers). Actual dead-code removal is deferred to follow-up PRs.
Refs MCP-1707
* ci: add warning-only Knip step
Runs `pnpm knip --no-exit-code --no-progress` on TypeScript-affecting
PRs/pushes and writes the report to the GitHub Actions step summary.
Stays non-blocking by design — tighten to a failing check once the
baseline cleanup PRs land.
* chore(inspector): drop redundant check-deps script
Root-level pnpm knip:deps already covers all workspaces, so the
inspector-only wrapper just duplicated the same delegation. Devs
needing scoped output can use pnpm knip --workspace packages/inspector.
* chore(typescript): drop changeset for dev-only knip adoption
* feat(inspector): support custom base URL for OpenAI-compatible providers (#1437)
* feat(inspector): support custom base URL for OpenAI-compatible providers
* feat(inspector): add support for OpenAI-compatible providers with configurable base URL
Co-authored-by: Copilot <copilot@github.com>
* refactor(inspector): simplify openai-compatible plumbing
- Widen ProviderName union to include "openai-compatible" and drop the
resolveProvider helper; the providers dispatcher fall-throughs from
"openai-compatible" to the openai impl, so callers can pass the UI
provider name straight through.
- openai.ts: extract buildEndpoint/buildHeaders, strip trailing slashes
on baseUrl, and skip Authorization header when apiKey is empty.
- ConfigurationDialog: defensive parsing of /models response, surface
CORS hint on fetch failure, mention CORS requirement in helper text,
move "OpenAI Compatible" to end of dropdown.
- useConfig: persist openai-compatible base URL per-provider in
localStorage (mirrors api keys), restore on switch + cross-tab sync.
- Drop openai-compatible logo references in ChatHeader / ChatLandingForm
/ ConfigurationDialog dropdown.
* style(inspector): apply prettier formatting
* chore(changeset): bump @mcp-use/inspector to minor for openai-compatible provider
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* feat: integrate OpenRouter as a first-class LLM provider (fixes#1402) (#1403)
* feat(inspector): integrate OpenRouter as a first-class LLM provider
Adds OpenRouter to the inspector chat configuration. Selecting OpenRouter
routes through the existing OpenAI provider with an override base URL and
the required HTTP-Referer / X-Title headers, so users get multi-model
access (OpenAI, Anthropic, Google, etc.) from a single API key without
duplicating provider plumbing.
Co-authored-by: Andrew Khadder <andrew@mcp-use.com>
Closes#1402
* fix(inspector): use inspector.mcp-use.com as OpenRouter HTTP-Referer
* feat(inspector): swap OpenRouter favicon.ico for inline gray SVG
Drops the runtime fetch to openrouter.ai/favicon.ico in favor of an inline
data-URL'd SVG with a neutral #94A3B8 fill. Follow-up will lift this onto
the provider CDN alongside the other provider marks.
* fix(inspector): stop OpenRouter SVG curves from being implicitly filled
The two arrow-body paths are open curves; with the parent svg's fill set,
the browser implicitly closed them and filled the resulting region,
producing visual artifacts at small sizes. Mark those two paths
fill="none" so only their strokes render.
* fix(inspector): use OpenRouter SVG in ChatLandingForm chip
The landing-form provider chip was hardcoded to the CDN png URL, which
404s for the openrouter provider and rendered a broken-image blob clipped
by rounded-full styling. Match the ChatHeader behavior and fall back to
OPENROUTER_ICON_URL.
* fix(inspector): set OpenRouter X-Title to mcp-use Inspector
* refactor(inspector): drop OpenRouter baseUrl path special-case
Set OpenRouter's baseUrl to the API root (/api/v1) and let buildEndpoint
append /chat/completions like the rest of the OpenAI-compatible flow,
removing the includes("/chat/completions") short-circuit that only
existed to defuse the path baked into the override.
* style(inspector): apply prettier formatting
* chore(inspector): drop redundant baseUrl jsdoc comment
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* feat(auth): pre-registered OAuth client credentials and scopes in Inspector (#1400)
* feat(auth): pre-registered OAuth client credentials and scopes
Wires clientId, clientSecret, and scope end-to-end from the Inspector's
Authentication dialog through useMcp into BrowserOAuthClientProvider's
staticClientInfo. When clientId is set the SDK skips Dynamic Client
Registration (required for proxy-mode servers like Slack/WorkOS that
strip registration_endpoint). When clientSecret is also set, the SDK
auto-switches token-endpoint auth from "none" to client_secret_basic /
client_secret_post, supporting providers that don't support PKCE.
* refactor(inspector): extract OAuthStaticConfig type and builder helper
Replaces six inline copies of `{ clientId?; clientSecret?; scope? }` and
two copy-pasted trim+spread builders with a shared `OAuthStaticConfig`
type and `buildOAuthStaticConfig()` helper in connectionUpdates.ts.
Also widens ServerConnectionModal's connection/onConnect types so the
`as { oauth?: ... }` structural cast can go away (the modal was passing
oauth in the spread without declaring it on the callback type).
* docs: document pre-registered OAuth client credentials
Updates client authentication, useMcp, and inspector connection-settings
docs to cover the new oauth.{clientId, clientSecret, scope} option and the
proxy-mode/confidential-client cases it unlocks. Replaces the inaccurate
snake_case OAuth params table with the actual camelCase API shape.
* chore(typescript): version packages (canary)
* fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry (#1443)
* fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry
The env var previously disabled Node-side telemetry and the inspector's
server-side proxy, but the in-browser posthog-js init triggered by
useMcp still fired POSTs to https://eu.i.posthog.com that ad/tracker
blockers flag. The inspector server now mirrors the env var into a
runtime flag (window.__MCP_USE_ANONYMIZED_TELEMETRY__) and localStorage
before the client bundle runs; both mcp-use's browser telemetry and the
inspector's own client telemetry honor that flag, so a single env var
disables every telemetry path.
* fix(inspector): drop sticky localStorage write; honor opt-out in Vite dev
The previous revision mirrored MCP_USE_ANONYMIZED_TELEMETRY=false into
localStorage, which persisted across sessions even after the env var
was unset. Switch to a per-page window flag only — unsetting the env
var fully restores defaults on the next page load.
Also extend the opt-out to pure-Vite dev mode via a transformIndexHtml
plugin, so the env var works whether the inspector is served by the
backend or by Vite directly.
* chore(typescript): version packages (canary)
* fix(inspector): drop trailing-slash regex flagged by CodeQL
The /\/+$/ regex on user-supplied base URLs triggered js/polynomial-redos.
Most servers normalize a double slash in `${baseUrl}/path` fine, so just
drop the stripping rather than working around the alert.
* docs(changelog): add v1.27.0 / inspector v5.0.0 release notes
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Siddhant Rai <47355538+siiddhantt@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com>
* ci: enhance CI workflow with tunnel testing for dev and start commands
- Added new jobs to test the development and start commands with the `--tunnel` flag in the CI workflow.
- Implemented logic to start the dev server and poll for the tunnel URL, ensuring it is generated successfully.
- Included cleanup steps to terminate the server processes after testing.
- Enhanced error handling to report if the tunnel URL is not found in the output logs.
* docs: fix changelog order (newest first)
* chore: move tunnel testing from create-mcp-use-app CI to inspector E2E
- Remove tunnel steps from create-mcp-use-app-tests (dev --tunnel, start --tunnel)
- Add run-tunnel-test.mjs (test_tunnel) in inspector E2E scripts
- Add test:e2e:tunnel script and inspector-e2e-tunnel job
* chore: enter canary prerelease mode
* fix: prettier format run-tunnel-test.mjs
* feat: add reconnection options to conformance client (#1212)
* feat: add reconnection options to conformance client
- Introduced `reconnectionOptions` with a `maxRetries` setting to enhance the conformance client’s ability to handle connection issues.
* fix(tests): update prompt server path in test configuration
- Modified the test configuration to use the correct path for the prompt server, ensuring that the tests can locate and execute the server script properly.
* chore(typescript): version packages (canary)
* chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 (#1209)
* chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0
- Bumped Vite version from ^7.3.0 to ^8.0.0 across multiple package.json files.
- Updated @vitejs/plugin-react from ^5.1.4 to ^6.0.0 in various templates and packages.
- Adjusted pnpm-lock.yaml to reflect these changes.
- Modified build configurations to use 'rolldownOptions' instead of 'rollupOptions' for consistency.
* fix: ensure consistent handling of TypeScript file paths across platforms
- Updated path handling in TypeScript-related functions to ensure compatibility with Windows and other operating systems.
- Refactored code to utilize `path.join` for constructing file paths, addressing issues with path separators.
- Enhanced error handling in CLI tests to prevent failures due to missing build artifacts.
* fix: prettier format run-tunnel-test.mjs
* chore: update dependency versions in pnpm-lock.yaml and package.json
- Changed the version specifier for `ai` from `^6.0.116` to `>=5.0.52`.
- Updated `express-rate-limit` from `^7.5.1` to `>=8.2.2` in both `pnpm-lock.yaml` and `package.json`.
- Adjusted the corresponding version in the lock file to reflect the new version of `express-rate-limit`.
* test: enhance telemetry test stability with increased wait times
- Updated `beforeEach` to include a delay for settling lingering telemetry.
- Increased wait times from 100ms to 500ms in multiple test cases to ensure telemetry events are captured reliably.
* chore(typescript): version packages (canary)
* Feat/use-files (#1213)
* feat(react): add useFiles hook with isSupported detection
Adds useFiles() hook for file upload and download in widgets.
File operations are only supported in the ChatGPT Apps SDK environment.
The MCP Apps spec (SEP-1865) has deferred file handling, meaning MCP Apps
clients (Claude, Goose, VS Code) do not support file operations.
The hook exposes an isSupported flag computed from the presence of
window.openai.uploadFile and window.openai.getFileDownloadUrl, letting
widgets render graceful fallback UI in non-ChatGPT environments rather
than throwing runtime errors.
- isSupported: true only in ChatGPT Apps SDK hosts
- upload(file): delegates to window.openai.uploadFile, returns FileMetadata
- getDownloadUrl(file): delegates to window.openai.getFileDownloadUrl
- Both throw a descriptive error when called with isSupported === false
Also adds:
- FileMetadata type ({ fileId: string }) in widget-types.ts
- Optional uploadFile/getFileDownloadUrl on the API interface
- examples/server/ui/files/ — file manager widget with upload, progress
state, download URL retrieval, and isSupported-based fallback notice
- docs/typescript/server/widget-components/usefiles.mdx — API reference
with isSupported usage, FileMetadata type, and error handling guidance
* feat(react): add modelVisible option to useFiles and unit tests
Adds model visibility control to useFiles().upload() and 19 unit tests
verifying the full hook behaviour.
### modelVisible option
By default, uploaded files are tracked in widget state under `imageIds`
so ChatGPT includes them in the model's conversation context (matching
the post-fix behaviour of Skybridge PR #539 which fixed privateContent
not being preserved during setWidgetState).
Pass `{ modelVisible: false }` to upload privately — the file is still
uploaded via window.openai.uploadFile but the fileId is not added to
imageIds, so the model won't see it.
```ts
// Model sees this (default)
const { fileId } = await upload(file);
// Model does not see this
const { fileId } = await upload(file, { modelVisible: false });
```
Existing imageIds and other widgetState fields are preserved when
tracking a new fileId, so uploads never wipe non-file state.
### Tests (19)
- isSupported: false when window/openai undefined or partial
- upload() error when not supported (message includes isSupported)
- upload() delegates to window.openai.uploadFile
- upload() returns FileMetadata
- upload() calls setWidgetState with updated imageIds
- upload() appends to existing imageIds
- upload() preserves other widgetState fields
- upload({ modelVisible: false }) skips setWidgetState entirely
- upload({ modelVisible: false }) still returns FileMetadata
- getDownloadUrl() error when not supported
- getDownloadUrl() delegates to window.openai.getFileDownloadUrl
- getDownloadUrl() passes through fileId
* docs(skill): add files reference to mcp-apps-builder skill
Adds references/widgets/files.md covering:
- useFiles() hook (isSupported, upload, getDownloadUrl)
- isSupported guard pattern — always required, renders fallback in MCP Apps
- Model visibility: modelVisible option (true = tracked in imageIds, false = private)
- Storing fileId in widget state vs caching download URLs
- Error handling patterns
Also adds a navigation entry and decision tree node to SKILL.md.
* chore(typescript): version packages (canary)
* feat(mcp-use): add MCP operation-level middleware support (#1137)
- Introduced a new middleware system for handling MCP operations, allowing for cross-cutting concerns like logging and authentication.
- Updated `MCPServerClass` to register and manage middleware entries dynamically.
- Enhanced documentation to include examples of using `server.use('mcp:...', handler)` for middleware registration.
- Added new types and utility functions to support middleware composition and context management.
This commit enhances the flexibility and functionality of the MCP framework by enabling developers to define custom middleware for various MCP operations.
* chore(typescript): version packages (canary)
* Feat/model-context (#1214)
* feat(react): add ModelContext component and modelContext imperative API
Adds two complementary APIs for annotating widget UI with contextual
descriptions the AI model can see, without requiring explicit tool calls
or storing data in developer-managed state.
- <ModelContext content="..."> — lifecycle-tied React component that
participates in a parent-child tree via React context (useId +
ParentIdContext). Supports empty children (leaf nodes) and nesting.
- modelContext.set(key, content) / .remove(key) / .clear() — module-level
imperative API that works anywhere: event handlers, plain functions,
outside React. Entries are always root-level nodes.
Both APIs feed into a shared global registry that serializes the node tree
into an indented markdown-like string on every change (batched via
queueMicrotask). The string is pushed to the host via:
- MCP Apps: ui/update-model-context (structuredContent.__model_context)
- ChatGPT Apps SDK: setWidgetState (__model_context merged into state)
useWidget wires up a registerModelContextFlush handler on mount so
annotations always reach the correct protocol channel. __model_context
is filtered from the developer-facing state value returned by useWidget.
setState preserves existing __model_context to prevent annotations from
being wiped on state updates.
Also adds:
- examples/server/ui/model-context/ — interactive product browser example
demonstrating nesting (<ModelContext>) and imperative (modelContext.set)
usage with a visual context debug panel
- docs/typescript/server/widget-components/modelcontext.mdx — API reference
for both APIs, nesting behavior, serialization format, and comparison
with setState
* test(react): add model-context unit tests; expose test helpers
Adds 25 unit tests covering the full ModelContext system:
- Tree serialization: empty, single, multiple root entries, nesting,
whitespace trimming, blank content skipped, upsert, remove, clear
- modelContext imperative API: set/remove/clear, no-op on missing key
- registerModelContextFlush: immediate notification on registration,
deregistration stops calls, deregistering stale handler is safe
- Batched flush: multiple synchronous mutations → single handler call
- Context state passed to model: full integration of set + flush handler,
update, remove, clear sequences
Also exposes two @internal helpers required for testing module singletons:
- _resetModelContextForTesting() — resets nodes/handler/flushScheduled
- _getDescriptionForTesting() — returns the current serialized string
without triggering a flush
* docs(skill): add model-context reference to mcp-apps-builder skill
Adds references/widgets/model-context.md covering:
- When to use ModelContext vs setState
- <ModelContext> component: nesting, siblings, leaf nodes, lifecycle
- modelContext imperative API: set/remove/clear, cleanup rules
- How the tree is serialized and sent to the model
- Common patterns: tab-switching, selected item, multi-level dashboard
Also adds a navigation entry and decision tree node to SKILL.md.
* Update title in modelcontext.mdx
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* chore: add changeset for useFiles and ModelContext minor features
---------
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* chore(typescript): version packages (canary)
* fix: prefix resource and prompt tool names to avoid collisions (#937)
* fix: prefix resource and prompt tool names to avoid collisions (#910)
When a resource and a prompt share the same name, the LangChain tools
array sent to the API contains duplicate tool names, causing a 400 error.
Prefix resource tools with `resource_` and prompt tools with `prompt_`
to ensure unique names.
* dynamic implementation to avoid prompt resource names collisions
* fix: make reserveName collision-safe and sanitize prompt names
- reserveName now checks the prefixed name for conflicts too, falling
back to a numeric suffix when both base and prefixed names are taken.
Previously a tool named resource_foo alongside a resource named foo
would silently produce a duplicate tool name.
- Prompt names are now sanitized through sanitizeToolName() for
consistency with resource names.
* chore: add changeset for tool name collision fix
---------
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* chore(typescript): version packages (canary)
* fix: map elicit result content to data for Zod validation (#1215) (#1216)
* fix: map elicit result content to data for Zod validation
The MCP SDK returns form data in result.content per the elicitation spec,
but createElicitMethod was checking result.data which is always undefined.
This caused Zod validation to never run, leaving result.data as undefined
for tool callbacks that use ctx.elicit() with a Zod schema.
Now checks result.content (SDK spec) with fallback to result.data for
backward compatibility with custom handlers.
Fixes#1215
* fix: also fix inspector and tests for elicit content/data mapping
- Inspector: send `content` instead of `data` per MCP spec
- Server: also map `content` to `data` for non-Zod-schema elicit calls
(verbose API overload), so conformance server tools work correctly
- Tests: update all integration test mocks to use spec-correct `content`
field instead of non-standard `data`, and adjust validation error
assertions to match SDK-level schema validation
- Add changeset
Follows up on the initial fix in b90ea51e.
---------
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* chore(typescript): version packages (canary)
* feat(inspector): implement tunnel management functionality (#1222)
- Added API endpoints for starting, stopping, and checking the status of a tunnel.
- Integrated tunnel management into the Layout and LayoutHeader components, allowing users to start and stop tunnels directly from the UI.
- Updated context to manage tunnel state, including a loading state for starting the tunnel.
- Enhanced the user experience with visual feedback during tunnel operations and added instructions for using the tunnel URL in ChatGPT.
This feature improves the overall functionality of the inspector by enabling real-time tunnel management.
* chore(typescript): version packages (canary)
* chore(changelog): update changelog for v0.25.0 and v1.22.0 releases
- Added details for v0.25.0: introduced tunnel management for `mcp-use dev`, Vite 8 build stack, and aligned elicit payload with MCP spec.
- Updated v1.22.0: included enhancements for MCP middleware, new React hooks, and fixes for elicit and adapter functionalities.
- Updated dependencies for both releases.
* fix(tests): update server-telemetry test to mock startServer return value
- Modified the mock implementation of startServer to return an object containing close and forceClose functions, ensuring proper handling in tests.
- This change prevents actual server startup during tests while maintaining the expected interface.
---------
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Gab <86735558+gabrielekarra@users.noreply.github.com>
Co-authored-by: guoyangzhen <upgyz@qq.com>
Enrico