mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
@mcp-use/client@2.0.0-beta.13
215 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Enrico
|
ac3d1eb3bb | fix(typescript): resolve CodeQL security alerts | ||
|
Andrew Khadder
|
c99141208b | Remove the skills command from the CLI (#1991) | ||
|
Andrew Khadder
|
0bdaed15fb |
feat(react): add shared view state (#1976)
* feat(react): add shared view state * docs(react): document shared view state |
||
|
Enrico Toniato
|
c8c4174145 | restore request-scoped notifications (#1974) | ||
|
Enrico Toniato
|
23bba3bbf2 |
refactor(server): update tool context to RequestContext and enhance client metadata handling (#1972)
- Renamed `ToolContext` to `RequestContext` in documentation and code. - Updated the context object to provide enhanced client metadata, including user information and capabilities. - Improved examples and descriptions for clarity on client capabilities and request-scoped metadata. - Adjusted tests to reflect changes in client metadata handling and ensure type safety. |
||
|
Andrew Khadder
|
8259292618 |
Enable public tunnels for production start (#1970)
* feat(cli): add tunnel support to v2 start * chore: add start tunnel changeset |
||
|
Enrico Toniato
|
192d193803 |
feat(server): restore Hono HTTP surface and strict tool refs (#1969)
Bring back typed Hono routes/middleware with server.fetch as the serving boundary, restore deprecated response helpers for upgrades, and require useCallTool names to resolve against mcp-env.d.ts ToolRefs (with useDynamicTool + mcp-use typecheck as the escape hatch). |
||
|
Enrico Toniato
|
392d36c079 |
Optimize the standalone Inspector package (#1968)
* fix inspector hosted proxy and oauth recovery * remove inspector compatibility report * refactor(inspector): mount project-local dev inspector * refactor(inspector): remove CDN application delivery * fix(inspector): finalize local mount and proxy health checks * refactor(typescript): optimize inspector packages * fix(typescript): build CLI for server examples * fix(typescript): keep CLI build deps development-only |
||
|
Enrico Toniato
|
eedeb4fc52 |
fix(inspector): recover OAuth and mount project-local dev Inspector (#1966)
* fix inspector hosted proxy and oauth recovery * remove inspector compatibility report * refactor(inspector): mount project-local dev inspector * refactor(inspector): remove CDN application delivery * fix(inspector): finalize local mount and proxy health checks |
||
|
Andrew Khadder
|
786dbf6f58 | Document inline view bundle support and source map build options (#1967) | ||
|
Enrico
|
b5354b5285 | fix(docs): update Inspector URL references to /mcp/inspector | ||
|
Enrico Toniato
|
3aca19c1ab |
feat: prefer Bun over Yarn and opt-in build source maps (#1950)
Replace create-mcp-use-app --yarn with --bun, align docs/install hints, and gate mcp-use build source maps behind --source-maps. Keep workspace root TypeScript on 5.9 so eslint stays compatible. |
||
|
Enrico
|
78266950f9 | feat(server): add Next.js drop-in adapter and example suite | ||
|
Enrico
|
d9c2023864 | manual commit | ||
|
Andrew Khadder
|
6aa0857b34 |
feat(server): make MCP middleware type-safe by method (#1932)
* feat(server): make MCP middleware type-safe by method * fix(server): omit schema dialect from tool descriptors (#1931) * fix(server): forward list middleware params * fix(server): export MCP middleware adapters |
||
|
Enrico
|
f25964142b |
Enhance MCP App Development Experience
- Updated documentation to clarify the use of `mcp-use dev --tunnel` and `mcp-use start --tunnel`, including automatic tunnel restart on registration drop. - Refined TypeScript API references for `allowedOrigins` and `cors` configurations to improve clarity on behavior. - Transitioned view-related files from `resources/` to `views/`, aligning with new authoring standards. - Introduced a new `mcp-env.d.ts` for type definitions and simplified favicon selection logic. - Enhanced the `create-mcp-use-app` template to support views, including a new fruit search example with improved UI components. - Added mock OpenAI file APIs for local development environments to facilitate testing. - Updated package.json descriptions and keywords for better clarity and alignment with project goals. |
||
|
Enrico
|
15798394a4 |
chore(typescript): raise Node floor to 22.22.2 and CI to 22.23.1
Excludes pre–March 2026 security patches and satisfies npm 12 for trusted beta publishing. |
||
|
Enrico
|
b47e268f61 |
chore(typescript): raise Node.js engine floor to 22.13
Unblocks beta releases on pnpm 11.13 and aligns CI, Docker, build targets, and scaffolds with Maintenance LTS Node 22. |
||
|
Andrew Khadder
|
adebe07133 |
feat(server): proxy multiple MCP servers (#1892)
* feat(server): proxy multiple MCP servers * fix(server): address proxy review feedback * fix(server): preserve proxy lifecycle ordering * test(server): refresh proxy bundle budget |
||
|
Andrew Khadder
|
fa574030eb |
feat(server): add v2 server branding (#1920)
* feat(server): add v2 server branding * fix(server): address branding review feedback |
||
|
Andrew Khadder
|
eabae55ea4 | feat(server): add Better Auth OAuth provider (#1921) | ||
|
Andrew Khadder
|
9c77ee214a |
feat(server): add v2 landing page (#1916)
* feat(server): add v2 landing page * docs(examples): expose auth landing pages * test(server): account for merged bundle growth * fix(server): harden landing install metadata |
||
|
Enrico Toniato
|
6737ecc45d |
feat(server): MCP middleware, observer events, CORS, and universal getHandler (#1918)
Add fetch-native operation middleware (server.use), read-only events (server.on), optional ServerConfig.cors, FrameworkHandler duck-typing for Hono, and getNodeHandler for custom Node http.Server composition. |
||
|
Andrew Khadder
|
14ae280e46 |
Add ChatGPT file upload support (#1897)
* Add ChatGPT file upload hook * Add file upload example |
||
|
Andrew Khadder
|
3bffd70dfe | fix beta preview packaging and docs (#1913) | ||
|
Enrico
|
4f11e03942 |
feat(server): external view assets, CDN env, and CSP configuration
Revamp production view builds to emit hashed assets served over HTTP, add --with-inspector for build manifests, split MCP_URL from MCP_ASSETS_URL, and support global CSP env overrides. |
||
|
Enrico
|
003447ce94 | fix(inspector): update CDN asset resolution and modify server start command | ||
|
Enrico
|
289cf2cbcc | Merge branch 'v2-server-scaffold' into beta | ||
|
Enrico
|
3d32445913 |
feat(assets): update SVG logos and favicon for improved design consistency
- Replaced existing SVG logos and favicon with new designs featuring updated dimensions and styles. - Enhanced the visual representation of the assets to align with the current branding guidelines. - Added a new `langchain.ts` file to the agent package for LangChain integration, including necessary exports and configurations. - Updated package.json and tsup.config.ts to reflect new entry points and dependencies. |
||
|
Enrico
|
1e548836d8 |
feat(docs): add migration page and enhance documentation clarity
- Added a new migration page to the TypeScript client documentation for better guidance on transitioning between versions. - Updated descriptions in various documentation files to improve clarity and consistency, including the MCPClient and Code Mode sections. - Revised links and examples to ensure they reflect the latest structure and best practices for using the MCP client. |
||
|
Enrico
|
8843e2ef0d |
fix(ci): simplify version generation command in CI workflow
- Removed redundant version generation command for @mcp-use/client in the CI workflow. - Updated documentation links in code-mode.mdx and other files to reflect new paths. - Changed installation instructions from yarn to npm for consistency across documentation. - Enhanced error handling in client authentication and session management. - Added a utility function to compare semantic versions in telemetry. - Removed outdated unit tests for FileKVStore. |
||
|
Enrico
|
e6ce060a1b |
refactor(docs): update README and documentation for MCP SDK v2
- Improved formatting and consistency in README.md and various documentation files. - Updated import paths to reflect the new package structure for @mcp-use/client and @mcp-use/agent. - Enhanced examples and descriptions for MCPAgent and related components. - Cleaned up whitespace and formatting for better readability across multiple files. |
||
|
Enrico Toniato
|
7cc7598c57 |
Release v1.34.1 — hosted OAuth discovery through the proxy (#1844)
* fix(auth): re-anchor proxy-origin .well-known discovery onto the MCP server (#1843) * fix(auth): re-anchor proxy-origin .well-known discovery onto the MCP server MCP traffic must always go through the gateway/inspector proxy (browser CORS on direct connections cannot be guaranteed — edge errors bypass the gateway's CORS middleware). But with the transport connected to the proxy URL, the SDK derives /.well-known/* discovery URLs from the proxy origin whenever no resource_metadata hint is available (SSE EventSource cannot read WWW-Authenticate; token refresh runs without a 401 at hand). Discovery then failed on the proxy origin and the server was misclassified as "does not support OAuth", hiding the Authenticate button on gateway-hosted servers. BrowserOAuthClientProvider.getProxyFetch() now rewrites connection-origin .well-known lookups onto the actual MCP server before routing them through the OAuth proxy — reproducing exactly what a direct connection would request, including the RFC 8414 §3.1 / RFC 9728 §3.1 path-insertion form. * style: prettier format * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs(changelog): add v1.34.1 (hosted OAuth discovery through the proxy) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
dcd97d69e2 |
fix(client): wire oauthProxyUrl option + stop misclassifying discover… (#1841)
* fix(client): wire oauthProxyUrl option + stop misclassifying discovered OAuth servers (#1840) Hosted OAuth servers (e.g. gateway-fronted, custom-domain) were dropping to `failed` with "Server does not support OAuth", hiding the Authenticate button. Routing MCP traffic through the inspector proxy anchored OAuth discovery on the proxy origin; a secondary discovery pass (token refresh / SSE fallback) then hit an HTML/500 and matched isOAuthDiscoveryFailure(). - Fully wire UseMcpOptions.oauthProxyUrl through createBrowserOAuthProvider so OAuth traffic can be proxied for CORS while MCP stays direct (transparent proxy preserves RFC 8414 issuer validation). preventAutoAuth manual flow now always uses the scoped OAuth proxy fetch instead of the MCP gateway proxy. - useMcp: when a prepared authorization URL already exists (OAuth discovery succeeded on an earlier pass) and preventAutoAuth is set, surface `pending_auth` on a later failure instead of "server does not support OAuth". * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs: update changelogs for v12.0.0 and v1.34.0 releases - Added details for v12.0.0, highlighting improvements in hosted OAuth reliability and updates from `mcp-use` v1.34.0. - Included fixes for OAuth server failures and updates to peer dependencies in the inspector changelog. - Documented new features and fixes in the TypeScript changelog, emphasizing the introduction of `oauthProxyUrl` for enhanced OAuth proxying and reliability improvements. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Andrew Khadder
|
f7d3d10605 |
feat(typescript): scaffold @mcp-use/server v2 package (MCP-2601)
Greenfield v2 server SDK built on @modelcontextprotocol/server@2.0.0-beta.1 (stateless 2026-07-28 protocol) and Hono. SPEC.md in the package is the working contract: constructor-only config, raw SDK result shapes (no response helpers), compile-time structuredContent enforcement, Standard Schema inputs (zod v4 / ArkType / Valibot), secure-by-default listen(). Ships with type-level contract tests, an end-to-end smoke test, and Vercel/Railway example deployments. Private during development — no releases. Workspace changes: pnpm workspace + root tsconfig registration, scoped TSDoc/jsdoc lint gates in eslint.config.js, and removal of the old repo-level CLAUDE.md files in favor of per-package docs. Claude-Session: https://claude.ai/code/session_01B59sx2QJ6bBBwMevCCqkr4 |
||
|
Andrew Khadder
|
68afda5885 |
docs(typescript): review and rewrite TypeScript docs (MCP-2466) (#1780)
* docs: remove stale feedback block and orphaned anchor from docs.json * chore(docs): make Typescript more prominent * chore(docs): Update `welcome.mdx` * docs: rewrite TypeScript quickstart and welcome pages Refocus the quickstart on create-mcp-use-app (scaffold, run, and deploy a first MCP server) and drop the agent/client/server primer table and diagram. Convert the welcome page's server + widget example from Tabs to CodeGroup and tighten the intro wording. * docs: remove stale server templates page and fix its references Delete the typescript/server/templates page and repoint the home templates tip to the quickstart, which now covers create-mcp-use-app. * docs(typescript): fix dead example links to real example paths The 'see a full example' links pointed at GitHub folders that 404 or contain only a README. Corrected to the real runnable examples under libraries/typescript/packages/mcp-use/examples/, verified against origin/main (incl. matching cd commands): - installation: examples/server -> packages/.../examples/server - client-configuration: a .py link -> real TS multi-server example - code-mode: examples/client/* -> examples/agent/code-mode/* - elicitation, sampling, notifications: server/X -> server/features/X - supabase: server/supabase -> server/deployment/supabase - clerk: restore missing packages/mcp-use/ path segment Quickstart links were already fixed by the quickstart rewrite (e6903716). Part of the docs audit (MCP-2466). * docs(typescript): rewrite Agent and Client introduction pages Rewrite the Agent and Client intro pages to be task-oriented and scannable: concise feature lists with cross-links, runnable quick-start examples, and added API reference sections. Drop stale CodeSandbox embeds and outdated model names. * docs(typescript): fix MCPServer class name casing in server reference The API Reference heading, prose, and class signature used McpServer; the real SDK export is MCPServer. Corrected all three occurrences in server/index.mdx. * docs: add redirect for bare /typescript/server path Routes the bare /typescript/server path to its index page now that the server section has been restructured. Claude-Session: https://claude.ai/code/session_015uioJjKTAZXGQpbXHUHZWp * docs(typescript): fix broken code examples across MCP Server & Apps section Fix all 102 confirmed code defects found in the MCP Server & MCP Apps documentation audit (47 pages, 401 code blocks), verified against the mcp-use@1.32 SDK source. The recurring patterns that made copy-pasted examples fail to compile or run are now corrected everywhere they appeared: - server.start() -> await server.listen() (no start() method exists) - bare-object tool returns wrapped in object()/text() response helpers; catch blocks renamed so they no longer shadow the error() helper - prompt messages use role:"user" with typed { type:"text" } content instead of the invalid role:"system" + bare-string shape - auth reads ctx.auth.user.userId (not ctx.auth.userId); user fields live under ctx.auth.user, scopes/permissions stay top-level - security: remove verifyJwt: process.env.NODE_ENV === 'production' from all six OAuth provider pages (off-prod it skips signature verification and accepts forged tokens); rely on the secure default, with a warning never to disable it - correct import subpaths: Logger/MCPClient from mcp-use, response helpers and server symbols from mcp-use/server, MCPClient as BrowserMCPClient from mcp-use/browser; drop the unexported getMcpAppsBridge - useWidget generics use the real <TProps, TState, TOutput, ...> order; remove the non-existent notifyIntrinsicHeight (auto-size via McpUseProvider) - fix the deployment URL to <id>.run.mcp-use.com/mcp, add missing z/helper imports, add the --branch/--dockerfile CLI options, and clean up em dashes and bare/malformed code fences Each page was fixed and then independently re-verified against the SDK source, with a repo-wide pattern sweep confirming no instances remain. Structural IA changes (moving widget-components to /react/, orphan redirects) are intentionally deferred to the docs rewrite. * docs(typescript): restructure MCP Server & MCP Apps IA Promote MCP Apps to its own top-level section in the TypeScript SDK Docs tab and move the 9 React widget-component pages out of /server/widget-components/ into /typescript/react/. - Move 9 React component pages to typescript/react/ (git renames) with 9 redirects - Promote MCP Apps to a top-level group (Overview pages + React subgroup) - Remove the duplicate MCP Apps group from the Home product nav; rehome guides/chatgpt-apps-flow under MCP Apps so it no longer orphans - Move cli-reference out of MCP Server into a new Tooling group - Relocate response-helpers -> Core Components, openapi -> Advanced Features, nextjs-drop-in -> Deployment - Repoint all widget-components links to /typescript/react/ - Fix 3 broken anchor links (inspector CLI env var, mcp-apps metadata, auth providers) Structure-only change; no page content rewrites. Refs MCP-2466. * docs: refresh TypeScript server app docs * docs: add TypeScript API reference * docs: streamline TypeScript server navigation * docs: rewrite core TypeScript server guides * docs: rewrite advanced TypeScript server guides * docs: rewrite TypeScript server OAuth guides * docs: rewrite TypeScript server session storage guides * docs: rewrite MCP Apps section * docs: add TypeScript MCP client API reference * docs: add TypeScript MCP agent API reference * docs: reorder TypeScript API reference nav * docs: reorganize TypeScript tooling nav * docs: rewrite inspector guides * docs: rewrite MCP server tunneling guide * docs: rewrite CLI client and reference docs * docs: finalize TypeScript documentation rewrite * docs: move inspector updates under get started * Fix Mintlify validation errors * Fix Mintlify broken links * docs: update Manufact Cloud deployment guide * chore: retrigger Mintlify docs preview * Fix MDX comment syntax on home page * docs: rework TypeScript server examples * docs: fix server docs links * docs: restore SDK links in home sidebar * docs: move SDK links to end of home sidebar |
||
|
pietrozullo
|
ad42b4bb3e |
docs: noindex auto-generated Python API reference instead of searchable flag
The searchable: false approach on the API Reference tab was inert on visible tabs. Switch to per-page noindex: true frontmatter, which keeps pages in the sidebar but excludes them from search indexing (search engines, internal docs search, and AI context) so generic queries like "CLI" surface curated guides instead of the generated reference. Applied to all 73 existing reference pages and emitted by the generator on every regeneration. Closes MCP-2398 |
||
|
pietrozullo
|
648ac110b3 |
docs: exclude auto-generated Python API reference from docs search
Set searchable: false on the Python SDK API Reference tab so generic queries (e.g. "CLI") surface curated guides instead of the generated reference, while keeping the reference visible in the sidebar. The generator now emits this flag on every regeneration. Closes MCP-2398 |
||
|
Andrew Khadder
|
430178c9a3 |
Canary (#1757)
* chore(deps): bump hono in /libraries/typescript/packages/mcp-use (#1755) Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.23...v4.12.25) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.25 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore: add hono changeset * chore(typescript): version packages (canary) * Fix Codex skills install path (#1756) * chore(typescript): version packages (canary) * chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript (#1742) * chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.8 to 8.0.16. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.0.16 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * Handle inspector CLI version and unknown options (#1722) * Handle inspector CLI version and unknown options * Keep inspector version in sync with package metadata --------- Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * Make MCP Apps primary widget runtime & Apply Host Context Styles (#1739) * Make MCP Apps primary widget runtime * Format MCP Apps runtime changes * Remove unused OpenAI globals event types * Apply MCP Apps host style variables * fix host style variable application * fix(react): avoid light fallback for missing host theme * Preserve model context when widget state updates * Remove obsolete MCP Apps runtime theme tests * Format MCP Apps runtime tests * chore(typescript): version packages (canary) * fix(cli): surface GitHub App install URL up front on deploy (#1761) * fix(cli): surface GitHub App install URL up front on deploy When `mcp-use deploy` detects the GitHub App is not connected or lacks access to the target repo, it now prints the install URL before any prompt. In a non-interactive context (an agent or CI, without `--yes`) it prints the URL and next steps and exits cleanly instead of hanging on an unanswerable prompt. Interactive and `--yes` flows are unchanged. * test(cli): simplify GitHub install-flow tests; tidy deploy no_access branch - Collapse redundant gitHubInstallUrl cases into one - Mock `open` and assert the non-interactive path never launches a browser - Extract a `noAccess` local in promptGitHubInstallation for readability * fix(cli): unexport internal-only GitHubInstallation type to satisfy knip GitHubInstallation is only referenced within api.ts (via GitHubConnectionStatus), so the export was dead and failed the knip check. * fix(cli): unexport internal-only InstallFlowMode type to satisfy knip InstallFlowMode is only used within deploy.ts as resolveInstallFlowMode's return type; the test imports the function, not the type. Verified with the full `knip --no-progress` run (exit 0), which CI uses. * chore(typescript): version packages (canary) * fix(cli): preserve deployment list sort order (#1752) * fix(cli): preserve deployment list sort order * chore(cli): add changeset for deployment list sort order fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): stop prompting signed-in users to log in (MCP-2142) (#1767) The hosted inspector showed the "free tier — Sign in to increase your limits" CTA to every managed-LLM visitor, even when already authenticated. ChatTab now resolves the shared Manufact session via a new useHostedSession hook (also adopted by HostedUserMenu) and hides the free-tier sign-in/upgrade chrome for authenticated users. The visibility rule is extracted into a pure shouldShowFreeTierUpgrade helper with unit tests. * chore(typescript): version packages (canary) * fix(typescript): pass the cwd field (#1785) * fix: pass the cwd field Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * fix: add changeset Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * doc: add documentation of cwd field Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> --------- Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> * chore(typescript): version packages (canary) * fix(inspector): replace stale auto-connect transports (#1792) * chore(typescript): version packages (canary) * fix(templates): score 100% on publishing checklist (MCP-2260) (#1772) * fix(templates): score 100% on publishing checklist (MCP-2260) Auto-derive openai/widgetDescription from the widget description in the Apps SDK adapter so hosts always see a widget description, and fill the small metadata gaps the templates were missing: - starter: fetch-weather declares a title + outputSchema (returns matching structuredContent). - mcp-apps: search-tools and get-fruit-details declare a title; the product-search-result widget declares a domain (widgetDescription is now auto-derived from its description). Adds a unit test for the widgetDescription default. * feat(server): enforce outputSchema at the tool return position (MCP-2260) Type-check a tool's outputSchema through the existing object()/widget() calls with no new API: - Content helpers (text, markdown, image, ...) now return a content-only ToolContentResult (structuredContent?: never), so they're always allowed. - widget() is generic over its props, which become the result's structuredContent — so widget({ props }) is checked against outputSchema. - The tool callback return type is TypedCallToolResult<TOutput> | ToolContentResult, making object({ wrong })/widget({ props: wrong }) a compile-time error. Adds a type-level test (npm run test:types) and removes an internal template comment. Edge cases that now error against a tool with outputSchema: mix() carrying structured content, or a raw literal with a mismatched structuredContent. * fix(templates): remove hardcoded widget domain Keep the generated MCP Apps template client-neutral so deployers can set their own production widget origin. * chore(typescript): update knip.json to include additional ignore patterns and entry points - Added "test_app" to the ignoreWorkspaces list. - Included "tests/types/**/*.ts" in the entry patterns for type checking. - Removed redundant "scripts/**/*.{js,mjs,ts}" from the entry list in the create-mcp-use-app package. * chore(typescript): version packages (canary) * feat(cli): expose monorepo auto-deploy trigger config (#1793) Add --watch-paths/--wait-for-ci to `mcp-use deploy` and --watch-paths/--deploy-branches/--wait-for-ci/--root-dir to `mcp-use servers update`, and surface the effective trigger config in `servers get`/`update`. Closes the gap where the Cloud API accepted these fields but the CLI could not set them, so monorepo apps can be scoped to only redeploy on relevant changes (#1547). Updates the deployment + CLI reference docs accordingly. * chore(typescript): version packages (canary) * fix(mcp-use): restore Apps SDK compatibility in useWidget as a fallback (#1794) Keep the MCP Apps bridge as the primary widget runtime, but use window.openai (Apps SDK) as a compatibility fallback when the bridge does not connect, instead of dropping it entirely. #1739 made the MCP Apps bridge the sole iframe runtime, which left any Apps SDK-only host (e.g. a ChatGPT widget without MCP Apps support) stuck on the loading spinner forever. A connected MCP Apps bridge still always wins, so ChatGPT keeps using MCP Apps as the source of truth. Also fixes two pre-existing issues in the scroll-to-bottom chat e2e test (strict-mode locator + measuring the animated scroll synchronously). * chore(typescript): version packages (canary) * feat(inspector, typescript): release v11.0.0 and v1.33.0 with MCP Apps as primary widget runtime - Introduced MCP Apps as the primary widget runtime, enhancing style variable application. - Fixed issues with auto-connect entries, user prompts for free-tier, and CLI version handling. - Updated dependencies including `vite` and `mcp-use`. - Added monorepo auto-deploy controls and improved CLI documentation for new flags. See changelogs for detailed updates and fixes. * fix(inspector): scope OAuth proxy fetch per server configuration (#1770) * fix(inspector): scope OAuth proxy fetch per server configuration The browser OAuth provider installed a global window.fetch interceptor to route OAuth requests through the inspector proxy. With multiple servers, connecting one server "Via Proxy" mutated fetch for the entire page, so other servers (including "Direct" ones) and unrelated requests were affected, and switching a server from "Via Proxy" back to "Direct" could leave a stale interceptor behind. BrowserOAuthClientProvider now exposes a scoped getProxyFetch() that returns a fetch confined to a single provider. It is passed only to that server's SDK transport and auth() calls (via the SDK's fetch / fetchFn options), so OAuth-proxy behavior is scoped to the selected server's connection and the global fetch is never mutated. Closes #1766 Co-authored-by: Cursor <cursoragent@cursor.com> * chore: remove redundant OAuth cleanup comment --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * Adopt auto connection mode in inspector docs and UI (#1795) * Adopt auto connection mode in inspector docs and UI * Fix embedded inspector auto proxy fallback * chore(typescript): version packages (canary) * docs: update TypeScript release changelogs --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Ghost Monkey <haugun79@gmail.com> Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com> Co-authored-by: 落尘 <cuidong111@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Dr. Carsten Leue <55989662+Carsten-Leue@users.noreply.github.com> Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com> Co-authored-by: Hemant Krishnakumar <51333870+hemant1026@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
efa7fe78b2 |
Canary (#1719)
* fix(cli): update EnvVariable type to allow null values for sensitive rows (#1717) - Modified the `value` property in the `EnvVariable` interface to accept `null`, indicating write-only sensitive rows where the stored value is withheld by the API. - Adjusted the `printEnvVar` function to handle cases where `value` is `null`, ensuring proper display of sensitive information. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(server): add outgoing notification logging (#1674) * chore(typescript): version packages (canary) * fix(server): mount RFC 8414 canonical well-known paths for path-suffix issuers (#1684) * fix(server): mount RFC 8414 canonical well-known paths for path-suffix issuers Construct upstream OAuth/OIDC metadata URLs per RFC 8414 and OIDC Discovery, and mount canonical path-suffixed routes on the MCP server when the upstream issuer includes a path component. Fixes #1576 Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> * fix(server): mount OIDC discovery at root only; stop leaking error detail Remove the unreachable, malformed OIDC path-suffix local mount (OIDC Discovery appends the well-known segment to the issuer, so there is no canonical form under the openid-configuration prefix, and no client flow reaches a path-suffixed local route). Keep the RFC 8414 OAuth path-suffix mount. Return a generic error_description to clients and log the raw exception server-side instead of echoing it. * style: apply prettier formatting --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(server/oauth): broker upstream OAuth callback through /oauth/callback (#1728) In proxy mode the server was forwarding each MCP client's redirect_uri straight to the upstream provider, which forced every client's callback (Claude, ChatGPT, the inspector, ...) to be pre-registered on the provider. Instead, /authorize now sends the upstream the server's own /oauth/callback and packs the client's redirect_uri + state into the upstream `state` (base64url JSON, stateless). A new GET /oauth/callback restores them and forwards the code (or upstream error) to the client's original callback. /token rewrites redirect_uri to the brokered callback so it matches the authorize request (RFC 6749 §4.1.3). PKCE passes through untouched. Also: jwksVerifier now rejects opaque (non-JWT) access tokens with an actionable message pointing at the missing `audience`, instead of jose's cryptic "Invalid Compact JWS". Only `<server-domain>/oauth/callback` needs registering upstream now. Closes MCP-2170 * fix(inspector): route localhost MCP servers through client-side chat (MCP-2419) (#1736) * fix(inspector): route localhost MCP servers through client-side chat (MCP-2419) In hosted mode the Chat tab streams through the managed cloud backend (chatApiUrl), which connects to the MCP server server-side and cannot reach a user's localhost server. The request 502s and, lacking CORS headers, surfaces in the browser as an opaque "Failed to fetch" / CORS error. Loopback server URLs now fall back to client-side (in-browser) chat streaming, which already holds a direct session to the localhost server. The configure-key empty state shows an explanatory notice telling the user the managed key can't reach their machine and that a personal API key is needed — only in hosted mode; the local inspector is unchanged. The localhost check is extracted into a shared serverUrl util (with IPv6 [::1] bracket handling) plus unit tests, and e2e tests cover the hosted+localhost fallback, the no-cloud-call guarantee, and the notice's presence/absence. * fix(inspector): address PR review on MCP-2419 localhost chat fix - serverUrl: detect the full 127.0.0.0/8 loopback range (not just 127.0.0.1), anchored so "127.example.com" is not a false positive - serverUrl tests: cover 127.0.0.0/8 and near-loopback negatives - e2e: stub the hosted `/api/auth/get-session` endpoint in enableHostedChatMode so HostedUserMenu never hits the real cloud backend (avoids CI flakiness/slowness) - changeset: fix grammar * style(inspector): prettier formatting for e2e test helpers * chore(typescript): version packages (canary) * fix(cli): use authoritative GitHub repo-access check for deploy (MCP-2467) (#1737) The `mcp-use deploy` pre-flight repo-access check listed an installation's repos and matched the target locally. That only inspected the first page, so repos on later pages were wrongly reported inaccessible (MCP-2467); fully paginating it (the prior behavior) hung on very large orgs. Replace it with a single authoritative question per installation via the new backend `GET /github/installations/:installationId/repos/:owner/:repo/access` endpoint (a `repos.get` probe). The installation whose account matches the repo owner is checked first, falling back to the others, preserving the across-installations fix from MCP-2358 without paginating. * chore(typescript): version packages (canary) * chore(deps): bump esbuild from 0.27.1 to 0.28.1 in /libraries/typescript (#1734) * chore(deps): bump esbuild from 0.27.1 to 0.28.1 in /libraries/typescript Bumps [esbuild](https://github.com/evanw/esbuild) from 0.27.1 to 0.28.1. - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](https://github.com/evanw/esbuild/compare/v0.27.1...v0.28.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(typescript): silence dev widget logs when project has no widgets (#1730) * chore(typescript): version packages (canary) * feat : inspector add scroll-to-bottom button (#1538) * inspector: add scroll-to-bottom button * fix(inspector): center chat scroll button --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): cleanly unsubscribe on Ctrl+C (SIGINT) (#1687) * fix(cli): add SIGINT handler to cleanly unsubscribe from resource Addresses #1686 * chore: add cli changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): update emulate oauth callback (#1743) * refactor: centralize screenshot handling and add REPL screenshot support (#1592) * refactor: centralize screenshot handling and add REPL screenshot support * chore: fix knip checks * chore: drop knip version ignore --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(api): update base URL for remote API calls to manufact.com (#1745) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * fix(api): update base URL for remote API calls to manufact.com - Changed the default base URL from 'https://cloud.mcp-use.com' to 'https://cloud.manufact.com' across multiple files, including MCPAgent and RemoteAgent initializations, ensuring consistency in API endpoint references. * chore(typescript): version packages (canary) * feat(cli): add support for custom Dockerfile path in deployment options (#1746) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * feat(cli): add support for custom Dockerfile path in deployment options - Introduced a new CLI option `--dockerfile` to specify a non-default Dockerfile path relative to the project root. - Updated the `DeployOptions` interface to include the `dockerfile` property. - Enhanced deployment command output to display the specified Dockerfile path, improving user feedback during deployment processes. * refactor(cli): improve console log formatting for Dockerfile output - Reformatted the console log statement for the Dockerfile option in the deploy command to enhance readability by breaking it into multiple lines. This change aims to maintain consistent code style and improve maintainability. * chore(typescript): version packages (canary) * Remove obsolete OAuth proxy callback changeset * chore(typescript): version packages (canary) * docs: update canary changelogs * fix(cli): allow empty env var updates (#1750) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * fix(cli): allow empty env var updates * Add changeset for empty env value updates --------- Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(deps): bump tar from 7.5.11 to 7.5.16 in /libraries/typescript (#1744) * chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml - Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions. * fix(workflow): remove unnecessary flag from pnpm install command in CI configuration - Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs. * chore(deps): bump tar from 7.5.11 to 7.5.16 in /libraries/typescript Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](https://github.com/isaacs/node-tar/compare/v7.5.11...v7.5.16) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.16 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Dhruv Tiwari <144548881+dhruvtiwari6@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kalpchaniyara <kalpchaniyara.2006@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: 落尘 <cuidong111@gmail.com> |
||
|
Enrico Toniato
|
5b4afc845c |
Add client auth info retrieval to useMcp (#1715)
* feat(auth): add getTokenEndpoint method for OAuth token discovery (#1714) * feat(auth): add getTokenEndpoint method for OAuth token discovery - Implemented `getTokenEndpoint` in `BrowserOAuthClientProvider` and `OAuthSessionStore` to resolve and cache the OAuth token endpoint via server metadata discovery. - Updated `UseMcpResult` type to include `token_endpoint` for consumers to persist the endpoint alongside tokens. - Enhanced `useMcp` to utilize the new method for proactive token refresh. - Added unit tests to verify the functionality of the `getTokenEndpoint` method, including caching behavior and error handling. * refactor(auth): improve code formatting in OAuthSessionStore and related tests - Reformatted code in `OAuthSessionStore` for better readability by breaking long lines into multiple lines. - Updated unit tests for `OAuthSessionStore` to enhance clarity by applying similar formatting improvements. - These changes aim to enhance maintainability and readability of the codebase. * feat(auth): add getClientCredentials method for OAuth client information retrieval - Implemented `getClientCredentials` in `BrowserOAuthClientProvider` and `OAuthSessionStore` to allow consumers to retrieve stored OAuth client credentials, facilitating server-side token refresh. - Updated `UseMcpResult` type to include `client_id` and `client_secret` for better token management. - Enhanced `useMcp` to utilize the new method for proactive token refresh, ensuring smoother authentication flows. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v9.0.2 and v1.32.0 releases - Added details for patch release v9.0.2 in the inspector changelog, noting the update to `mcp-use` v1.32.0 with no inspector-specific runtime changes. - Documented minor release v1.32.0 in the TypeScript changelog, highlighting the introduction of OAuth token endpoint discovery and new methods for retrieving client credentials, along with an update to `@mcp-use/inspector`. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
0fb18685d3 |
feat(cli): servers update + branch-scoped env/deploy management (#1711) (#1712)
* feat(cli): servers update + branch-scoped env/deploy management (#1711) * feat(cli): add servers update + branch-scoped env/deploy management Adds `mcp-use servers update` to mutate server config in place (productionBranch, name, description, build/start commands) without delete/recreate, mapping flags to the backend UpdateServerBody (--branch -> productionBranch; build/start commands nested under config). Also completes MCP-1794 branch scoping: - deploy --branch (defaults to current git branch) scopes env sync to the branch's preview env - servers env list/add/update/rm --branch; update/rm accept a KEY resolved within the branch scope, not just a UUID - deployments restart --branch (defaults to the deployment's branch) Supersedes #1706 with the correct field mapping. Adds unit tests, README docs (flags + env naming mapping), and a changeset. * docs(skills): document servers update + branch-scoped env CLI commands Update the mcp-apps-builder and openapi-to-mcp skills for the new CLI surface: add the deploy `--branch` flag, document `servers update` and `servers env` for post-deploy config, and fix the stale `mcp-use deployments env set` reference (the real command is `mcp-use servers env add`). * feat(cli): map empty build/start flags to null for config unset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v9.0.1 and v1.31.1 releases - Added details for patch release v9.0.1 in the inspector changelog, noting the update to `mcp-use` v1.31.1 with no inspector-specific runtime changes. - Documented patch release v1.31.1 in the TypeScript changelog, highlighting workspace dependency alignment and new features in `@mcp-use/cli`, including server updates and branch-scoped environment management. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
4d00a1ffc4 |
Canary (#1704)
* fix(mcp-use): move chalk to regular dependencies (#1702) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(cli): enhance deployment and server management feedback (#1703) * feat(cli): enhance deployment and server management feedback - Added server ID retrieval during deployment to provide clearer context. - Improved user messaging for deployments without a GitHub remote, clarifying the source location. - Updated server information display to indicate when a repository is platform-managed. - Enhanced the `removeServer` function to optionally clear OAuth credentials, allowing for explicit logout actions. This update aims to improve user experience by providing more informative feedback during deployment and server management operations. * refactor(cli, mcp-use): improve code formatting and readability - Simplified console log formatting in `getServerCommand` for better clarity. - Enhanced type definition formatting in `pushSourceToServer` for improved readability. - Streamlined conditional checks in `runAuthPopup` and `useMcp` to follow consistent formatting. - Updated test utility for dispatching messages to enhance clarity. These changes aim to improve code maintainability and readability across the CLI and MCP use libraries. * delete(tests): remove obsolete diag test file - Eliminated the `diag.test.ts` file as it is no longer needed. This cleanup helps maintain a more relevant and streamlined test suite. * chore(typescript): version packages (canary) * feat(auth): enhance popup authentication flow with grace period and return URL - Added a `returnUrl` parameter to the `renderCloseWindowMessage` function to provide users a way back to the app when popups cannot be closed. - Implemented a grace period in `runAuthPopup` to handle scenarios where the popup reports closed before tokens are received, improving reliability during cross-origin navigation. - Updated tests to validate the new grace period behavior and ensure successful resolution of authentication when tokens arrive during this window. These changes aim to enhance user experience and reliability in the authentication process. * chore(changelog): update changelogs for v9.0.0 and v1.31.0 releases - Added details for major release v9.0.0 in the inspector changelog, highlighting OAuth credential lifecycle improvements and updates to peer dependencies. - Included patch release v1.31.0 in the TypeScript changelog, focusing on OAuth popup reliability and credential lifecycle enhancements, along with updates to dependencies. - Updated mcp-use version references in both changelogs to reflect the latest changes. * chore(changelog): update TypeScript changelog for v1.30.2 release - Removed outdated entries for v1.30.2, including the chalk CJS compatibility fix and updates to @mcp-use/inspector and @mcp-use/cli. - Added a fix for downgrading chalk to v4 to resolve compatibility issues with CJS server bundles on Node ≥ 22. This update ensures the changelog accurately reflects the latest changes and fixes. --------- Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
c866bdaa7c |
Canary (#1695)
* feat(cli): managed (no-GitHub) deploy + device-code login (#1691) * feat(cli): add managed (no-GitHub) deploy and device-code login - `mcp-use deploy --managed` packs the local project into a tarball and uploads it to the platform-managed GitHub org, so users can deploy without connecting their own GitHub. Redeploys reuse the linked server. - `mcp-use login --device-code <code>` authenticates non-interactively with a pre-approved OAuth device code (used by the web onboarding flow), skipping the browser step. * feat(cli): auto-detect managed server on redeploy A project linked to a managed server now redeploys via the managed upload path without needing --managed again (detected from the server's connectedRepository.isManaged flag). * docs(skill): document managed deploy + device-code login Update the mcp-apps-builder deployment guide for `mcp-use deploy --managed` (no GitHub required) and non-interactive `mcp-use login --device-code`. * refactor(cli): rename managed deploy option to no-github Updated the CLI command from `--managed` to `--no-github` for deploying local sources without connecting to GitHub. This change clarifies the functionality and aligns with the new documentation. The deployment process remains unchanged, allowing users to upload their project source directly to the platform-managed organization. Additionally, updated related documentation to reflect this change. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): stop inspector widget status label blocking iframe i… (#1694) * feat(greeting-card): migrate greeting-card resource to React widget tool (#1659) * feat(greeting-card): migrate greeting-card resource to React widget tool (#1658) * chore(changeset): add changeset for greeting-card widget migration * fix(widget): disable prefersBorder for greeting-card to prevent double border and remove old changeset * fix(typescript): stop inspector widget status label blocking iframe interactions * chore(inspector): add changeset and pointer-events-none on Apps SDK label Add a patch changeset for @mcp-use/inspector and apply pointer-events-none to the OpenAIComponentRenderer status label for parity with MCPAppsRenderer. --------- Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: iframe collapse when widget renders null (#1693) Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> * chore(typescript): version packages (canary) * chore: update changelogs for v8.0.1 and v1.30.1 releases - Added details for v8.0.1, addressing the widget status label pointer-events issue in the inspector. - Documented v1.30.1 enhancements, including no-GitHub deployment and device-code login features, along with fixes for iframe interactions and zero-height collapse in the McpUseProvider. * feat(mcp): enhance error handling for MCP client readiness (#1528) * feat(mcp): enhance error handling for MCP client readiness - Introduced `formatMcpNotReadyReason` function to provide clearer error messages when MCP operations are attempted before the client is ready. - Updated error messages in `useMcp` to utilize the new formatting function, improving clarity on client state and connection status. * fix(mcp): refine disconnect logic to prevent race conditions - Updated `disconnect()` to only nullify `clientRef` when it points to the closing client and the connect epoch remains unchanged. This adjustment addresses scenarios where `connect()` reuses the same `BrowserMCPClient` instance for a new URL, enhancing error handling for MCP operations. - Introduced a `connectEpochRef` to track connection attempts and ensure proper client state management during disconnects. * fix(react,client): enhance disconnect logic to prevent session wipe on reconnect - Updated `disconnect()` to only nullify `clientRef` when it points to the closing client and the connect epoch remains unchanged, addressing race conditions during reconnections. - Modified `BaseMCPClient.closeSession()` to conditionally delete sessions, ensuring that a new session created during a disconnect does not get wiped, which improves error handling for MCP operations. * fix(react,client): guard disconnect state reset; test closeSession slot guard Address review follow-ups on the disconnect/reconnect race fix: - disconnect() now skips the state reset (setState("discovering") + list clearing) when superseded by a newer connect(), so a manual disconnect() racing a reconnect can no longer clobber the live connection's state. - Add a direct unit test for BaseMCPClient.closeSession's slot-equality guard (parallel createSession survives, normal delete still happens, delete still runs when disconnect() throws). * chore(typescript): version packages (canary) * chore: update changelog for v1.30.1 and enhance MCP client error handling - Documented patch release v1.30.1, including fixes for `McpUseProvider` zero-height collapse, `useMcp` disconnect/reconnect race conditions, and clearer error messages for client readiness. - Improved `useMcp` disconnect logic to prevent stale state issues during reconnections. - Minor formatting adjustment in `MCPAppsRenderer` for cleaner code. --------- Signed-off-by: Parship Chowdhury <parshipchowdhury@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: sonikagutha <gsonikachowdary@gmail.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Parship Chowdhury <parshipchowdhury@gmail.com> |
||
|
Andrew Khadder
|
25ae46eb6a |
Canary (#1657)
* Add MCP server instructions to TypeScript docs and templates (#1601) * Add MCP server instructions to TypeScript docs and templates * Address MCP instructions review feedback * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Potential fix for code scanning alert no. 78: Incomplete string escaping or encoding (#1661) * Potential fix for code scanning alert no. 78: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * fix(inspector): enhance user experience with copy button for messages Added a copy button to user messages in the inspector, improving usability by allowing users to easily copy message content. This change addresses user feedback for better interaction within the chat interface. Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(mcp-use): bump hono to 4.12.23 for CVE-2026-47674 (#1663) Address Dependabot alert #222 by upgrading the direct hono dependency and raising the pnpm override floor to the patched release. * chore(typescript): version packages (canary) * Handle paginated cloud lists (#1619) * chore(typescript): version packages (canary) * Add OpenAPI-based server generation to the TypeScript SDK (#1583) * Add OpenAPI constructor to MCPServer * Add OpenAPI server example * Simplify OpenAPI example run instructions * Format OpenAPI server generation files * Use live weather.gov OpenAPI spec in example * Clarify weather.gov example path selection * Document OpenAPI server generation * Fix OpenAPI docs example and sidebar placement * Add OpenAPI server tool generation * chore(typescript): version packages (canary) * Fix idle cleanup of session refs (#1624) Co-authored-by: Deepak kudi <deepakkudi23@adsl-172-10-9-116.dsl.sndg02.sbcglobal.net> * chore(typescript): version packages (canary) * fix(cli): check repo access across all GitHub installations (#1629) * fix(cli): check repo access across all GitHub installations getGitHubRepos() only fetched repos from the first installation linked to the organization, so deploys of repos owned by any other installation failed the access check with "GitHub App doesn't have access" even when the app had all-repositories access. Aggregate repos across every installation instead, tolerating per-installation fetch errors. Fixes MCP-2358 * chore(changeset): add changeset for cli repo access fix * chore(typescript): version packages (canary) * docs: add v1.30.0 and inspector v8.0.0 changelog entries Document the canary release wave covering OpenAPI server generation, MCP instructions, session cleanup, and CLI fixes. Co-authored-by: Cursor <cursoragent@cursor.com> * test(agent): skip MCPAgent Quick Start when OPENAI_API_KEY is unset Conditionally skip the docs example test in fork PR CI where secrets are unavailable, with Prettier-correct indentation for describe.skipIf. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(openapi): prevent ReDoS in slugifyToolName regex Split the ambiguous leading/trailing underscore trim pattern and cap input length before regex processing to satisfy CodeQL js/polynomial-redos. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(openapi): remove polynomial regex in slugifyToolName Replace the end-anchored `_+$` trim (and `^_+`) with single-character `_$`/`^_` trims. Because underscore runs are already collapsed to a single `_` by the preceding replace, the edge trims never need a quantifier, eliminating the O(n^2) backtracking that CodeQL flagged as js/polynomial-redos. Drop the now-unnecessary length cap. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(openapi): remove explanatory comment in slugifyToolName Co-authored-by: Cursor <cursoragent@cursor.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Rohith Matam <81304757+Rohithmatham12@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Puneet Dixit <puneetdixit4321@gmail.com> Co-authored-by: Deepak kudi <deepakkudi23@adsl-172-10-9-116.dsl.sndg02.sbcglobal.net> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
d7f44dd31a | chore: update context7 claim (#1666) | ||
|
Andrew Khadder
|
feb8f09b6e |
Canary (#1616)
* chore(deps): bump hono from 4.12.12 to 4.12.18 in /libraries/typescript/packages/mcp-use (#1615) * chore(deps): bump hono in /libraries/typescript/packages/mcp-use Bumps [hono](https://github.com/honojs/hono) from 4.12.12 to 4.12.18. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.12.12...v4.12.18) --- updated-dependencies: - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix: require bearer auth on /sse MCP transport (#1628) The MCP JSON-RPC handler is mounted on both /mcp and /sse, but the OAuth bearer-auth middleware was only applied to /mcp/*, leaving /sse reachable without a token on OAuth-protected servers. Apply the middleware to /sse and /sse/* as well, and advertise RFC 9728 path-scoped protected-resource metadata for /sse. Adds a regression test exercising setupOAuthForServer. * chore: update dependencies in TypeScript libraries (#1626) - Bump versions of `react-router`, `react-router-dom`, and `qs` in package.json and pnpm-lock.yaml. - Update `hono`, `dompurify`, and `axios` to their latest versions. - Add new dependencies: `protobufjs`, `@protobufjs/utf8`, `vitest`, `ws`, `uuid`, `fast-uri`, `ip-address`, `postcss`, `langsmith`, `follow-redirects`, and `better-auth` to package.json. - Update `@vitest/coverage-v8` to version ~4.1.0 in mcp-use package.json. * chore(typescript): version packages (canary) * chore(deps-dev): bump oauth2-mock-server in /libraries/typescript (#1650) Bumps [oauth2-mock-server](https://github.com/axa-group/oauth2-mock-server) from 8.2.1 to 8.2.2. - [Release notes](https://github.com/axa-group/oauth2-mock-server/releases) - [Changelog](https://github.com/axa-group/oauth2-mock-server/blob/master/CHANGELOG.md) - [Commits](https://github.com/axa-group/oauth2-mock-server/compare/v8.2.1...v8.2.2) --- updated-dependencies: - dependency-name: oauth2-mock-server dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump eslint-import-resolver-typescript (#1643) Bumps [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript) from 4.4.4 to 4.4.5. - [Release notes](https://github.com/import-js/eslint-import-resolver-typescript/releases) - [Changelog](https://github.com/import-js/eslint-import-resolver-typescript/blob/master/CHANGELOG.md) - [Commits](https://github.com/import-js/eslint-import-resolver-typescript/compare/v4.4.4...v4.4.5) --- updated-dependencies: - dependency-name: eslint-import-resolver-typescript dependency-version: 4.4.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump vitest from 4.0.18 to 4.1.0 in /libraries/typescript (#1600) * chore(deps-dev): bump vitest in /libraries/typescript Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.0.18 to 4.1.0. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * docs: add v1.29.1 and v7.0.1 changelog entries Document the OAuth /sse bearer-auth fix and workspace security dependency bumps on the docs site ahead of the canary release wave. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: update changelog --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
83271e869f |
Canary (#1508)
* chore: remove unused mcp-use source files (#1476) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs(cli): clarify inspector skipped-in-production log + start section (#1505) * docs(cli): clarify inspector skipped-in-production log + start section The runtime log "[INSPECTOR] Skipped in production (use --with-inspector flag during build)" reads as if the flag can be passed to `mcp-use start`, which it can't (the flag is only registered under `build`). The new wording spells out the rebuild command, and `cli-reference.mdx` gains a short note under `start` pointing at the build flag for inspector-in-production. Closes #1495 * docs(cli): apply reviewer reword on inspector note * chore(typescript): version packages (canary) * chore(inspector): remove unused source files (#1510) Drops the 18 inspector files reported by `pnpm knip` from libraries/typescript and stops generating the unused client-side version.ts (the client reads the version from the window.__INSPECTOR_VERSION__ global injected by the server). Part of #1446. * chore(typescript): version packages (canary) * chore(typescript): prune 187 unused exports and 161 unused export types flagged by knip (#1511) * chore(typescript): prune 161 unused exported types flagged by knip Phase 2 of #1450: remove or de-export types that knip flags as unused. Skipped tuning knip.json (Phase 1) — focused only on the type cleanup. For each flagged type: - Used only within its source file → drop `export` - Re-exported through a barrel but never imported downstream → remove the re-export - Genuinely dead → delete No public-API removals: types exposed through the `mcp-use`, `@mcp-use/cli`, `@mcp-use/inspector`, or `create-mcp-use-app` package entry points remain exported. `client.ts` switches from inline `import("...")` to a top-level import so knip can see the `ToolSearchResponse` usage. Verified `pnpm knip` reports 0 unused types (down from 161) and `pnpm build` passes across all packages. * chore(typescript): prune 187 unused exports flagged by knip Closes #1450. * chore(typescript): fix prettier formatting * chore(typescript): delete orphaned PropsSelect.tsx Removing the unused barrel re-export in the prior commit left this file with no consumers. * chore(typescript): version packages (canary) * ci(knip): enforce knip and clear final baseline findings (#1512) * chore(knip): clear remaining baseline findings so knip passes clean - Mark `src/index.tsx` as an entry for create-mcp-use-app so its CLI dependencies (chalk, commander, ink, ora, tar, react, etc.) stop being flagged as unused. - Add `lsof`, `sleep`, and `dev` to ignoreBinaries for the mcp-use workspace — these appear in example scripts and are either system utilities or pnpm script names, not npm-resolvable binaries. - Turn off the `optionalPeerDependencies` rule. Optional peer deps (langchain/langfuse/e2b/etc.) are loaded conditionally by design; flagging them as referenced is noise. After this change `pnpm exec knip` exits 0 against canary. * ci(knip): enforce knip in CI The baseline is now clean (canary + previous PRs cleared all findings), so drop `--no-exit-code` and let the job fail when knip reports issues. Also generate `packages/mcp-use/src/version.ts` before knip runs so the gitignored `version.js` imports resolve. * chore(deps): bump better-auth in /libraries/typescript (#1515) Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.1 to 1.6.11. - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.6.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: tighten PR readiness and docs hygiene (#1509) * docs: tighten review readiness and doc links * docs: anchor api-reference redirect and fix missed node note Move the /typescript/server/api-reference target from a bare redirect to an anchored one (#mcpserver-api-reference) so existing "API Reference" links land on the renamed section directly. Drop the self-link in server/index.mdx and bring the commonjs example's Node note in line with the package engines range. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * feat(server/oauth): allow Supabase URL override for self-hosted/local instances (#1517) * feat(server/oauth): allow overriding Supabase URL for self-hosted/local instances `oauthSupabaseProvider` previously hardcoded `https://${projectId}.supabase.co`, preventing use against local Supabase (`http://localhost:54321`) or self-hosted deployments — even though those instances expose the same OAuth 2.1 server. Add an optional `supabaseUrl` config (and `MCP_USE_OAUTH_SUPABASE_URL` env var) that overrides the projectId-derived URL. `projectId` is now optional when `supabaseUrl` is set; hosted-project users are unaffected. Closes mcp-use/mcp-oauth-supabase-template#2 * test(server/oauth): trim supabase provider tests to factory contract Drop low-value string-concatenation and pre-existing-behavior tests; keep the two that cover the new behavior (supabaseUrl alone is accepted; empty config throws). Isolate process.env in the factory describe so the "throws when neither configured" assertion isn't defeated by local MCP_USE_OAUTH_SUPABASE_* env vars. * docs(server/oauth): document supabaseUrl override for local/self-hosted Supabase * chore(typescript): version packages (canary) * chore: use cross-platform clean commands (#1523) * chore: use cross-platform clean commands * chore: add empty changeset for cross-platform clean scripts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy (#1483) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy The DCR-direct metadata proxy was string-concatenating a path onto the issuer, which canonically ends with a trailing slash: `${issuer}/.well-known/oauth-authorization-server` // → "https://tenant.auth0.com//.well-known/oauth-authorization-server" Auth0 returns 404 for any path starting with "//", which broke OAuth discovery end-to-end against real Auth0 tenants in DCR-direct mode. new URL(path, base) normalizes the join regardless of trailing slash, so this works for any provider whose canonical issuer ends with "/". Fixes #1482. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(server/oauth): normalize issuer trailing slash instead of using URL constructor `new URL("/.well-known/...", issuer)` resolves the leading-slash path against the issuer's origin, stripping any path on the issuer. That breaks providers like Supabase whose issuer is `https://<project>.supabase.co/auth/v1`. Replace with a trailing-slash-stripping template literal, which handles both Auth0 (issuer ends with `/`) and Supabase (issuer has a path). * chore(changeset): trim oauth metadata fix entry * chore(changeset): drop issue reference --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * test(inspector): add OAuth e2e against emulated Google issuer (#1481) * test(inspector): add OAuth e2e test using emulated Google issuer Covers the inspector's OAuth redirect flow end-to-end against an `emulate`-backed Google issuer + MCP server in oauthProxy mode, run twice across the Direct and Via Proxy connection-type matrix. Both variants share one fixture in serial mode since the registered redirect URI pins the MCP server to a fixed port. * test(inspector): switch loop to factory to satisfy no-loop-func The for-loop variant captured the mutable `fixture` binding from beforeAll, which eslint's no-loop-func flags. Hoisting the body into a small factory keeps the shared fixture without the closure-over-loop pattern. * test(inspector): close emulator if MCPServer setup fails Wrap post-createEmulator work in try/catch so the emulator port doesn't stay bound when MCPServer construction or listen() throws. * chore(typescript): version packages (canary) * fix(inspector): surface MCP server auth failures with reconnect banner (#1485) * fix(inspector): surface MCP server auth failures with reconnect banner (MCP-2111) When the hosted inspector's chat backend returns 401 because the upstream MCP server rejected the user's OAuth token (e.g. Linear token expired), the inspector previously threw a generic `HTTP error! status: 401` and the cloud response misleadingly pointed users at the Manufact account login. The chat now recognises the cloud's `{ error: "mcp_auth_required", mcpServerUrl }` response and renders an inline banner above the input ("Reconnect to <server>") with a button that calls `connection.authenticate()`. Reconnect refreshes the OAuth token in localStorage; the banner clears on success and chat resumes. Pairs with a cloud-side change that drops the misleading `loginUrl` field from the 401 response. * fix(inspector): harden mcp_auth_required handling - Drop the no-op setMessages filter in the 401 branch; the optimistic assistant message is only added after the response check, so there's nothing to remove. - Guard `new URL(serverUrl)` in McpReconnectBanner so a malformed URL falls back to the raw string instead of crashing the chat tab. * refactor(inspector): rename mcpAuthRequired to mcpServerAuthRequired The hook's internal state was already named `mcpServerAuthRequired`, but the returned key and clear callback used the shorter `mcpAuthRequired`, forcing the ChatTab consumer to re-alias them. The shorter name was also ambiguous in a codebase that has two distinct auth flows: the Manufact account login (429 path) and the upstream MCP server OAuth (401 path). Align the public surface of `useChatMessages` with the internal state and the consumer's local name. The backend wire value `"mcp_auth_required"` is unchanged. * chore(inspector): remove mcpServerAuthRequired comment * chore(typescript): version packages (canary) * fix(inspector): keep tab count badges visible in collapsed mode (#1490) * fix(inspector): keep tab count badges visible in collapsed mode * Keep tab badges aligned in collapsed mode * extract TabCountBadge and fix badge visibility * chore(typescript): version packages (canary) * fix(inspector): drop unused TabCountBadge barrel re-export (#1533) The only consumer (LayoutHeader.tsx) imports TabCountBadge directly from ./shared/TabCountBadge, so the re-export in shared/index.ts is unused. Knip flagged it and started failing CI on canary after the TabCountBadge change landed. * chore(typescript): version packages (canary) * feat(inspector): add local LLM provider support for chat in Inspector (#1395) * feat(inspector): integrate ollama provider * feat(inspector): integrate lmstudio provider * fix(inspector): preserve no-icon behavior for openai-compatible provider * refactor(inspector): remove LM Studio provider and address PR feedback * fix(inspector): remove duplicate ollama union members Collapses the accidental `"ollama" | "ollama"` duplicates in ProviderName, MCPChatMessageEventData, and LLMConfig. * refactor(inspector): drop LLM proxy and call Ollama directly Ollama allows localhost origins by default, so the inspector talks to the daemon over CORS and skips the server-side proxy entirely. Surface an OLLAMA_ORIGINS hint when the browser fetch fails so tunneled or remote setups know what to configure. Theme the Ollama logo and tighten its size so the non-circular mark sits cleanly next to the other provider icons. * chore(inspector): revert gratuitous field reorders Restore original ordering of temperature/baseUrl and useCallback deps; remove stray blank line in vite.config.ts to keep the diff focused. * test(inspector): add unit tests for parseNDJSON * refactor(inspector): tighten Ollama provider integration - Guard Ollama streamChat against duplicate tool-call emissions when a chunk's tool_calls are repeated by proxies/forks - Key the models cache on (provider, baseUrl) for any base-url provider so openai-compatible no longer serves stale entries on URL changes; normalize Ollama variants (trailing slash, /api suffix) to one entry - Move OllamaCorsError into the Ollama provider module - Replace hand-written provider unions in telemetry events and server shared-utils with ProviderName - Single-source DEFAULT_OLLAMA_BASE_URL from ollama/utils.ts - Drop the unrelated tempApiKey/tempModel trim() drift in saveLLMConfig - Make OPENROUTER_ICON_URL module-private, clean up merge-artifact blank lines * chore: simplify changeset * style(inspector): apply prettier to shared-utils * fix(inspector): drop unused export on DEFAULT_BASE_URLS DEFAULT_BASE_URLS is only consumed by getDefaultBaseUrl in the same module. Knip flagged the export as unused and failed CI. * ci: retrigger after canary knip fix (#1533) --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): resolve CodeQL polynomial-regex alert in Ollama url normalizer (#1534) * fix(inspector): replace trailing-slash regex in Ollama url normalizer CodeQL flagged `/\/+$/` in `normalizeOllamaBaseUrl` as a polynomial regular expression on uncontrolled input. Swap the regex for an explicit linear scan and add unit tests covering the trimming behaviour plus a pathological-input case. * chore: drop unit test for trivial regex refactor * chore: drop accidentally committed .antigravitycli symlink * chore(typescript): version packages (canary) * chore: remove dead typescript-format-and-lint pre-commit hook (#1541) The hook entry pointed to `.git/hooks/typescript-pre-commit.sh`, a path that is never tracked and was never populated by any setup step, so the hook could not run for anyone. TypeScript formatting and linting are already handled by Husky (libraries/typescript/.husky/pre-commit), installed automatically via `pnpm install`'s `prepare` script. Closes #1536 * fix(inspector): stop ToolInputForm from mutating live tool inputSchema (#1545) * fix(inspector): stop ToolInputForm from mutating live tool inputSchema `ToolInputForm` was writing `required: boolean` onto each property of the live tool inputSchema during render. `required` is not valid as a per- property boolean — it belongs on the parent object as a `string[]`. Anthropic's draft 2020-12 validator rejected the resulting payload with `tools.0.custom.input_schema invalid`, breaking the Inspector chat after any tool had been opened in the Tools tab. Replace the mutation with a local `isRequired` const used only for the `*` indicator render. Fixes MCP-1970. * chore(inspector): trim comment on schema-mutation fix * chore: remove verbose comment * style(inspector): apply prettier to ToolInputForm * chore(typescript): version packages (canary) * Improve tab switch animation timing (#1544) * chore(ui): improve tab switch animation timing * chore(changeset): add changeset for tab animation improvement * chore(typescript): version packages (canary) * fix(inspector): propagate server alias updates through mcp server wrapper (#1539) * fix(inspector): propagate server alias updates through McpServerWrapper onUpdate * chore: add changeset for mcp-use server alias propagation fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * chore(typescript): add 3-day install cooldown via pnpm minimumReleaseAge (#1516) Blocks `pnpm install` from fetching npm versions published less than 3 days ago, mitigating supply-chain attacks where a malicious release is typically yanked within hours of discovery. The setting (introduced in pnpm 10.16) lives in pnpm-workspace.yaml — in modern pnpm only auth/registry config is read from .npmrc, so putting it there would be silently ignored. Workspace-published names (`mcp-use`, `@mcp-use/*`, `create-mcp-use-app`) are exempted so the cooldown never interferes with local development or fresh releases of our own packages. * fix(react): improve server management in McpClientProvider (#1561) Refactor server removal and update logic to use a ref for synchronous access to the latest server state. This change prevents React's warning about updating a component during rendering by ensuring that teardown side effects (`disconnect()` and `clearStorage()`) are executed outside of the state updater functions. The ref is updated in a useEffect hook to maintain the latest server state for event handlers. * chore(typescript): version packages (canary) * fix(inspector): forward MCP image tool results as image content (#1487) * fix(inspector): forward MCP image tool results as image content (MCP-1941) Previously, the inspector's chat loop and provider adapters serialized MCP tool results with JSON.stringify, which buried the base64 `data` field of `image` content blocks inside a text payload. Vision-capable models received a wall of base64 text instead of the image. Extract MCP `content` blocks into provider-neutral `ContentPart[]` and route image bytes through each provider's vision channel: - Anthropic: image blocks inside `tool_result.content` (base64 source). - OpenAI: tool role keeps text; image bytes forwarded as a follow-up user turn with `image_url` parts. - Google: `functionResponse.response` keeps text/metadata; image bytes forwarded as a follow-up user turn with `inlineData` parts. Text-only tool results keep the legacy `content: string` path on every provider. * style(inspector): apply prettier formatting * chore(inspector): drop unused export on collapseToString Only called internally by toolResultToContent — knip flagged it as an unused export. * fix(inspector): propagate MCP isError flag and fix image example tools - Add isToolResultError() helper and use it in toolLoop + replay so tool calls that return { isError: true } are flagged the same as thrown errors on both live and saved-conversation paths. - Pick a no-content fallback for OpenAI's tool role when there are no image parts to forward. - Replace via.placeholder.com URLs in the everything example with real base64-encoded bytes fetched from picsum.photos, since the image() helper expects MCP ImageContent base64 data, not URLs. * style(inspector): apply prettier formatting * chore(typescript): version packages (canary) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL (#1552) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL Browsers cannot resolve 0.0.0.0 as a destination, and the MCP SDK's OAuth resource validator does strict origin equality — so the inspector auto-connecting to http://0.0.0.0:PORT/mcp mismatches the resource metadata published as http://localhost:PORT (which goes through normalizeUrlHost in server-helpers.ts). Result: OAuth-protected mcp-use apps fail at the inspector's post-callback validation with "Protected resource X does not match expected Y". Mirror the existing normalization for the autoConnect URL and the banner log so both reflect the browser-reachable host. Closes #1551 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: add changeset for inspector autoConnect loopback normalization --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): align widget Vite base with /mcp-use/widgets (#1560) * fix(cli): align widget Vite base with /mcp-use/widgets/ when MCP_URL is set * chore: add changeset for cli widget base path fix * chore: format widget-paths.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(cli): headless screenshot with auto-sizing and external MCP server support (#1579) * feat(cli): headless screenshot command with auto-sizing and external MCP server support - Make width/height optional; when omitted, clips to the widget's natural rendered size by reading body[data-view-*] rect attrs set by the preview page - Add useBundleReadinessSignal in ViewPreview that uses ResizeObserver to wait for the iframe to stabilize before setting data-view-ready, serializing the iframe's bounding rect so the CLI can clip tightly instead of capturing the full viewport - Switch ViewPreviewBundle to displayMode="inline" so widgets auto-size to content height - Add inlineWidthOverride prop to MCPAppsRenderer to bypass the 768px inline cap when screenshotting at an explicit width - Fix extractViewName to handle external MCP server URIs (ui://<server>/<name>.html) by flattening to <server>-<name>; previously only ui://widget/ was handled, causing React Router to fail to match the preview route for third-party servers like Excalidraw * chore: add changeset for screenshot auto-sizing and external MCP fix * fix(cli): unexport CaptureScreenshotResult to satisfy knip * chore(typescript): version packages (canary) * feat(auth): enhance OAuth callback handling with improved state management and user feedback (#1580) * feat(auth): enhance OAuth callback handling with improved state management and user feedback - Introduced a module-level cache for in-flight authorization promises to prevent duplicate network requests during the same page load. - Added utility functions to determine if the current window is a popup and to render user-friendly messages for closing the window after authentication. - Improved handling of redirect flows and popup scenarios to ensure a seamless user experience, including error handling and messaging for lost opener situations. * fix(auth): BroadcastChannel fallback when popup opener is severed Popup callback now broadcasts success/failure over a same-origin BroadcastChannel("mcp_auth_callback") in the lost-opener branch, and useMcp subscribes to that channel alongside the existing window.message listener. Without this, popups whose window.opener was severed by COOP or cross-origin intermediate redirects would save tokens but leave the parent stuck in `authenticating`. Matches the dual-transport pattern used by oidc-client-ts and MSAL.js for the same COOP scenario. * chore(auth): unexport MCP_AUTH_BROADCAST_CHANNEL to satisfy knip It's only used inside callback.ts; the parent side hard-codes the same string in useMcp.ts. Removing the export drops knip's "unused export" finding while keeping a single source-of-truth comment that links the two files. * fix(mcp-use): split langchain agents out of mcp-use/browser entry Move MCPAgent, RemoteAgent, adapters, and observability to mcp-use/browser/agent so Next.js clients importing MCPClient only no longer pull @langchain/* into the browser bundle. * chore: format browser bundle test file * chore(typescript): version packages (canary) * fix(inspector): add copy button to user messages (#1556) * fix(inspector): add copy button to user messages Extract CopyButton into a shared component and add it to UserMessage, matching the existing assistant message UX. Resolves #1555 * chore: add inspector copy button changeset --------- Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(server): add publicLandingPage option for OAuth-protected servers (#1550) * feat(server): add publicLandingPage option for OAuth-protected servers * fix(server): keep public landing auth gate in oauth setup * docs(server): add public landing page example * chore(server): format mcp endpoint * chore(server): simplify accept header lookup * chore(server): restore mcp mount diff * fix(server): align oauth exports with canary * chore(server): format oauth exports * fix(server): remove unused oauth barrel exports --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * Move mcp-apps template pnpm settings to workspace config (#1602) * fix(inspector): widget fullscreen above embedded host chrome (MCP-2181) (#1605) * fix(inspector): portal widget fullscreen above host chrome MCP-2181: cloud chat headers at z-50 covered the fullscreen exit control because the overlay used z-40 inside a nested stacking context. Portals the fullscreen shell to document.body at z-[100], sets data-mcp-widget-fullscreen for hosts, and shows the Apps SDK exit navbar in CSS fullscreen fallback. * fix(inspector): native fullscreen first, no portal remount (MCP-2181) Revert conditional createPortal that remounted widgets on fullscreen toggle. Use requestFullscreen() as the primary path; apply CSS z-[100] overlay only when the API fails. Keep exit navbar and data-mcp-widget-fullscreen for both. * refactor(inspector): consolidate widget fullscreen into shared hook Extract useWidgetFullscreenControls for native-first fullscreen + CSS fallback. Removes duplicated handlers, unused helpers, and OpenAI edge-case branches from MCPAppsRenderer and OpenAIComponentRenderer. * fix(inspector): preserve widget state when entering fullscreen (MCP-2181) Route ui/request-display-mode through native fullscreen handling, target requestFullscreen on the iframe wrapper, and avoid resetting load state on display-mode-only changes. Stabilize OpenAI iframe listeners so chat re-renders do not flash the skeleton. * style(inspector): format OpenAIComponentRenderer for Prettier * fix(inspector): fullscreen shell includes navbar and fills viewport Promote the outer widget shell via requestFullscreen so FullscreenNavbar stays visible and bg-background fills the screen instead of browser black letterboxing around a nested iframe wrapper. * fix(inspector): PiP portal and sandbox remount bridge reconnect (MCP-2181) Port PiP to document.body with z-[100]. Re-run AppBridge when the sandbox iframe remounts; keep the host spinner until initCount recovers. Unify display-mode document attributes for optional host chrome hiding. * fix(inspector): resend widget data after PiP remount * chore(typescript): version packages (canary) * Hash Claude resource domains from authored ui.domain (#1599) * Apply Claude resource domain hashing for UI metadata * chore: format Claude domain helper * fix(inspector): drop unused widget-fullscreen exports to satisfy knip (#1607) widget-fullscreen.ts (added in #1605) exported several symbols that nothing outside the file consumes, plus pre-emptive @deprecated aliases for an API that never shipped. Only useWidgetDisplayModeControls is used (by MCPAppsRenderer and OpenAIComponentRenderer). - Unexport internal-only constants, the WidgetDisplayMode type, and the useWidgetDisplayModeDocumentChrome helper - Remove the dead useWidgetFullscreenControls / useWidgetFullscreenDocumentChrome aliases * test(agent): drop live Langfuse API integration tests (#1608) The observability integration tests queried the live Langfuse REST API (via getRecentTraces) to verify traces landed. cloud.langfuse.com has been returning 403 Forbidden for both ingestion and queries, failing the 'should send traces to Langfuse when observability is enabled' test and reddening canary CI. Remove the two tests that depend on the live API (the failing test and the already-skipped manual-trace test) plus the now-unused getRecentTraces helper. Keep the two tests that verify observability enable/disable behavior locally with no network dependency. * chore(typescript): version packages (canary) * fix(oauth): redact token verification errors (#1573) * fix(oauth): redact token verification errors * chore: add oauth error redaction changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): skip emulate oauth tests in builtin e2e (#1609) * chore: add codex to gitignore (#1612) * fix(docs): update server API reference links (#1611) * fix(mcp-use): pin published dependency versions (#1610) * docs(changelog): document v1.29.0 / inspector v7.0.0 release TypeScript changelog gains a v1.29.0 entry (public landing pages, Supabase URL override, Claude UI-resource domain hashing, OAuth callback + React-provider hardening). Inspector changelog gains a major v7.0.0 entry (local Ollama provider, image tool results, MCP-server reconnect banner, widget fullscreen/PiP rework). * Fix builtin inspector auto-connect to use HTTP (#1613) * Switch builtin inspector auto-connect to HTTP * Use plain URL autoConnect in builtin e2e helper * Fix built-in inspector auto-connect to use HTTP * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: asim48-ctrl <asim48@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Truffle <truffleagent@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SSharma1103 <shivamsharma11032009@gmail.com> Co-authored-by: Polæ <steven@polae.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Udaykumar Dhokia <udaykumardhokia@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Jefsky Wong <hwj3344@hotmail.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Ritwij Aryan Parmar <88580521+RitwijParmar@users.noreply.github.com> |
||
|
pietrozullo
|
1092e1e5e9 | Remove launch week banner from docs | ||
|
Andrew Khadder
|
0a5c118bc3 | Add Context7 config for TypeScript docs (#1507) |