- Renamed `ToolContext` to `RequestContext` in documentation and code.
- Updated the context object to provide enhanced client metadata, including user information and capabilities.
- Improved examples and descriptions for clarity on client capabilities and request-scoped metadata.
- Adjusted tests to reflect changes in client metadata handling and ensure type safety.
Bring back typed Hono routes/middleware with server.fetch as the serving
boundary, restore deprecated response helpers for upgrades, and require
useCallTool names to resolve against mcp-env.d.ts ToolRefs (with
useDynamicTool + mcp-use typecheck as the escape hatch).
* fix inspector hosted proxy and oauth recovery
* remove inspector compatibility report
* refactor(inspector): mount project-local dev inspector
* refactor(inspector): remove CDN application delivery
* fix(inspector): finalize local mount and proxy health checks
* docs(inspector): add self-hosting guide
The inspector README and feature table reference self-hosting with Docker,
but the docs site had no page for it (mcp-use.com/docs/inspector/self-hosting
404s). Add the guide based on the README's self-hosting section: Docker Hub
image, docker run / compose deployment, environment variables, and how
self-hosting compares to the hosted and CLI options.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(inspector): bind examples to loopback, add exposure warning and air-gapped transfer steps
Addresses review feedback on #1861:
- trim wordy intro sentence
- quick start and deployment examples now bind 127.0.0.1 to avoid
exposing the Inspector proxy on all interfaces; added Warning with
reverse-proxy/firewall guidance for remote access
- add docker save/load transfer steps for air-gapped hosts
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: ayaanmacmini3 <ayaanmacmini3@ayaanmacmini3s-Mac-mini.local>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
- Updated documentation to clarify the use of `mcp-use dev --tunnel` and `mcp-use start --tunnel`, including automatic tunnel restart on registration drop.
- Refined TypeScript API references for `allowedOrigins` and `cors` configurations to improve clarity on behavior.
- Transitioned view-related files from `resources/` to `views/`, aligning with new authoring standards.
- Introduced a new `mcp-env.d.ts` for type definitions and simplified favicon selection logic.
- Enhanced the `create-mcp-use-app` template to support views, including a new fruit search example with improved UI components.
- Added mock OpenAI file APIs for local development environments to facilitate testing.
- Updated package.json descriptions and keywords for better clarity and alignment with project goals.
The current mint CLI throws 'URIError: URI malformed' generating the anchor
slug for '### 100% Client Conformance (20/20)' (bare % followed by non-hex),
failing the 'Generate and validate API documentation' job on every PR.
Reworded to 'Full Client Conformance (20/20)'; mint broken-links now passes
across the whole docs tree.
Closes#1911
Co-authored-by: ayaanmacmini3 <ayaanmacmini3@ayaanmacmini3s-Mac-mini.local>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Revamp production view builds to emit hashed assets served over HTTP,
add --with-inspector for build manifests, split MCP_URL from
MCP_ASSETS_URL, and support global CSP env overrides.
- Replaced existing SVG logos and favicon with new designs featuring updated dimensions and styles.
- Enhanced the visual representation of the assets to align with the current branding guidelines.
- Added a new `langchain.ts` file to the agent package for LangChain integration, including necessary exports and configurations.
- Updated package.json and tsup.config.ts to reflect new entry points and dependencies.
- Added a new migration page to the TypeScript client documentation for better guidance on transitioning between versions.
- Updated descriptions in various documentation files to improve clarity and consistency, including the MCPClient and Code Mode sections.
- Revised links and examples to ensure they reflect the latest structure and best practices for using the MCP client.
- Removed redundant version generation command for @mcp-use/client in the CI workflow.
- Updated documentation links in code-mode.mdx and other files to reflect new paths.
- Changed installation instructions from yarn to npm for consistency across documentation.
- Enhanced error handling in client authentication and session management.
- Added a utility function to compare semantic versions in telemetry.
- Removed outdated unit tests for FileKVStore.
- Improved formatting and consistency in README.md and various documentation files.
- Updated import paths to reflect the new package structure for @mcp-use/client and @mcp-use/agent.
- Enhanced examples and descriptions for MCPAgent and related components.
- Cleaned up whitespace and formatting for better readability across multiple files.
* fix(auth): re-anchor proxy-origin .well-known discovery onto the MCP server (#1843)
* fix(auth): re-anchor proxy-origin .well-known discovery onto the MCP server
MCP traffic must always go through the gateway/inspector proxy (browser CORS
on direct connections cannot be guaranteed — edge errors bypass the gateway's
CORS middleware). But with the transport connected to the proxy URL, the SDK
derives /.well-known/* discovery URLs from the proxy origin whenever no
resource_metadata hint is available (SSE EventSource cannot read
WWW-Authenticate; token refresh runs without a 401 at hand). Discovery then
failed on the proxy origin and the server was misclassified as "does not
support OAuth", hiding the Authenticate button on gateway-hosted servers.
BrowserOAuthClientProvider.getProxyFetch() now rewrites connection-origin
.well-known lookups onto the actual MCP server before routing them through
the OAuth proxy — reproducing exactly what a direct connection would request,
including the RFC 8414 §3.1 / RFC 9728 §3.1 path-insertion form.
* style: prettier format
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* docs(changelog): add v1.34.1 (hosted OAuth discovery through the proxy)
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(client): wire oauthProxyUrl option + stop misclassifying discovered OAuth servers (#1840)
Hosted OAuth servers (e.g. gateway-fronted, custom-domain) were dropping to
`failed` with "Server does not support OAuth", hiding the Authenticate button.
Routing MCP traffic through the inspector proxy anchored OAuth discovery on the
proxy origin; a secondary discovery pass (token refresh / SSE fallback) then hit
an HTML/500 and matched isOAuthDiscoveryFailure().
- Fully wire UseMcpOptions.oauthProxyUrl through createBrowserOAuthProvider so
OAuth traffic can be proxied for CORS while MCP stays direct (transparent
proxy preserves RFC 8414 issuer validation). preventAutoAuth manual flow now
always uses the scoped OAuth proxy fetch instead of the MCP gateway proxy.
- useMcp: when a prepared authorization URL already exists (OAuth discovery
succeeded on an earlier pass) and preventAutoAuth is set, surface
`pending_auth` on a later failure instead of "server does not support OAuth".
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* docs: update changelogs for v12.0.0 and v1.34.0 releases
- Added details for v12.0.0, highlighting improvements in hosted OAuth reliability and updates from `mcp-use` v1.34.0.
- Included fixes for OAuth server failures and updates to peer dependencies in the inspector changelog.
- Documented new features and fixes in the TypeScript changelog, emphasizing the introduction of `oauthProxyUrl` for enhanced OAuth proxying and reliability improvements.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Greenfield v2 server SDK built on @modelcontextprotocol/server@2.0.0-beta.1
(stateless 2026-07-28 protocol) and Hono. SPEC.md in the package is the
working contract: constructor-only config, raw SDK result shapes (no response
helpers), compile-time structuredContent enforcement, Standard Schema inputs
(zod v4 / ArkType / Valibot), secure-by-default listen(). Ships with
type-level contract tests, an end-to-end smoke test, and Vercel/Railway
example deployments. Private during development — no releases.
Workspace changes: pnpm workspace + root tsconfig registration, scoped
TSDoc/jsdoc lint gates in eslint.config.js, and removal of the old
repo-level CLAUDE.md files in favor of per-package docs.
Claude-Session: https://claude.ai/code/session_01B59sx2QJ6bBBwMevCCqkr4
* docs: remove stale feedback block and orphaned anchor from docs.json
* chore(docs): make Typescript more prominent
* chore(docs): Update `welcome.mdx`
* docs: rewrite TypeScript quickstart and welcome pages
Refocus the quickstart on create-mcp-use-app (scaffold, run, and deploy a
first MCP server) and drop the agent/client/server primer table and
diagram. Convert the welcome page's server + widget example from Tabs to
CodeGroup and tighten the intro wording.
* docs: remove stale server templates page and fix its references
Delete the typescript/server/templates page and repoint the home
templates tip to the quickstart, which now covers create-mcp-use-app.
* docs(typescript): fix dead example links to real example paths
The 'see a full example' links pointed at GitHub folders that 404 or
contain only a README. Corrected to the real runnable examples under
libraries/typescript/packages/mcp-use/examples/, verified against
origin/main (incl. matching cd commands):
- installation: examples/server -> packages/.../examples/server
- client-configuration: a .py link -> real TS multi-server example
- code-mode: examples/client/* -> examples/agent/code-mode/*
- elicitation, sampling, notifications: server/X -> server/features/X
- supabase: server/supabase -> server/deployment/supabase
- clerk: restore missing packages/mcp-use/ path segment
Quickstart links were already fixed by the quickstart rewrite (e6903716).
Part of the docs audit (MCP-2466).
* docs(typescript): rewrite Agent and Client introduction pages
Rewrite the Agent and Client intro pages to be task-oriented and
scannable: concise feature lists with cross-links, runnable quick-start
examples, and added API reference sections. Drop stale CodeSandbox
embeds and outdated model names.
* docs(typescript): fix MCPServer class name casing in server reference
The API Reference heading, prose, and class signature used McpServer;
the real SDK export is MCPServer. Corrected all three occurrences in
server/index.mdx.
* docs: add redirect for bare /typescript/server path
Routes the bare /typescript/server path to its index page now that the
server section has been restructured.
Claude-Session: https://claude.ai/code/session_015uioJjKTAZXGQpbXHUHZWp
* docs(typescript): fix broken code examples across MCP Server & Apps section
Fix all 102 confirmed code defects found in the MCP Server & MCP Apps
documentation audit (47 pages, 401 code blocks), verified against the
mcp-use@1.32 SDK source. The recurring patterns that made copy-pasted
examples fail to compile or run are now corrected everywhere they appeared:
- server.start() -> await server.listen() (no start() method exists)
- bare-object tool returns wrapped in object()/text() response helpers;
catch blocks renamed so they no longer shadow the error() helper
- prompt messages use role:"user" with typed { type:"text" } content
instead of the invalid role:"system" + bare-string shape
- auth reads ctx.auth.user.userId (not ctx.auth.userId); user fields live
under ctx.auth.user, scopes/permissions stay top-level
- security: remove verifyJwt: process.env.NODE_ENV === 'production' from all
six OAuth provider pages (off-prod it skips signature verification and
accepts forged tokens); rely on the secure default, with a warning never
to disable it
- correct import subpaths: Logger/MCPClient from mcp-use, response helpers
and server symbols from mcp-use/server, MCPClient as BrowserMCPClient from
mcp-use/browser; drop the unexported getMcpAppsBridge
- useWidget generics use the real <TProps, TState, TOutput, ...> order;
remove the non-existent notifyIntrinsicHeight (auto-size via McpUseProvider)
- fix the deployment URL to <id>.run.mcp-use.com/mcp, add missing z/helper
imports, add the --branch/--dockerfile CLI options, and clean up em dashes
and bare/malformed code fences
Each page was fixed and then independently re-verified against the SDK
source, with a repo-wide pattern sweep confirming no instances remain.
Structural IA changes (moving widget-components to /react/, orphan
redirects) are intentionally deferred to the docs rewrite.
* docs(typescript): restructure MCP Server & MCP Apps IA
Promote MCP Apps to its own top-level section in the TypeScript SDK Docs tab and move the 9 React widget-component pages out of /server/widget-components/ into /typescript/react/.
- Move 9 React component pages to typescript/react/ (git renames) with 9 redirects
- Promote MCP Apps to a top-level group (Overview pages + React subgroup)
- Remove the duplicate MCP Apps group from the Home product nav; rehome guides/chatgpt-apps-flow under MCP Apps so it no longer orphans
- Move cli-reference out of MCP Server into a new Tooling group
- Relocate response-helpers -> Core Components, openapi -> Advanced Features, nextjs-drop-in -> Deployment
- Repoint all widget-components links to /typescript/react/
- Fix 3 broken anchor links (inspector CLI env var, mcp-apps metadata, auth providers)
Structure-only change; no page content rewrites. Refs MCP-2466.
* docs: refresh TypeScript server app docs
* docs: add TypeScript API reference
* docs: streamline TypeScript server navigation
* docs: rewrite core TypeScript server guides
* docs: rewrite advanced TypeScript server guides
* docs: rewrite TypeScript server OAuth guides
* docs: rewrite TypeScript server session storage guides
* docs: rewrite MCP Apps section
* docs: add TypeScript MCP client API reference
* docs: add TypeScript MCP agent API reference
* docs: reorder TypeScript API reference nav
* docs: reorganize TypeScript tooling nav
* docs: rewrite inspector guides
* docs: rewrite MCP server tunneling guide
* docs: rewrite CLI client and reference docs
* docs: finalize TypeScript documentation rewrite
* docs: move inspector updates under get started
* Fix Mintlify validation errors
* Fix Mintlify broken links
* docs: update Manufact Cloud deployment guide
* chore: retrigger Mintlify docs preview
* Fix MDX comment syntax on home page
* docs: rework TypeScript server examples
* docs: fix server docs links
* docs: restore SDK links in home sidebar
* docs: move SDK links to end of home sidebar
The searchable: false approach on the API Reference tab was inert on
visible tabs. Switch to per-page noindex: true frontmatter, which keeps
pages in the sidebar but excludes them from search indexing (search
engines, internal docs search, and AI context) so generic queries like
"CLI" surface curated guides instead of the generated reference.
Applied to all 73 existing reference pages and emitted by the generator
on every regeneration.
Closes MCP-2398
Set searchable: false on the Python SDK API Reference tab so generic
queries (e.g. "CLI") surface curated guides instead of the generated
reference, while keeping the reference visible in the sidebar. The
generator now emits this flag on every regeneration.
Closes MCP-2398
* chore(deps): bump hono in /libraries/typescript/packages/mcp-use (#1755)
Bumps [hono](https://github.com/honojs/hono) from 4.12.23 to 4.12.25.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.23...v4.12.25)
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.25
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore: enter canary prerelease mode
* chore: add hono changeset
* chore(typescript): version packages (canary)
* Fix Codex skills install path (#1756)
* chore(typescript): version packages (canary)
* chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript (#1742)
* chore(deps): bump vite from 8.0.8 to 8.0.16 in /libraries/typescript
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.8 to 8.0.16.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite)
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.16
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* Handle inspector CLI version and unknown options (#1722)
* Handle inspector CLI version and unknown options
* Keep inspector version in sync with package metadata
---------
Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* Make MCP Apps primary widget runtime & Apply Host Context Styles (#1739)
* Make MCP Apps primary widget runtime
* Format MCP Apps runtime changes
* Remove unused OpenAI globals event types
* Apply MCP Apps host style variables
* fix host style variable application
* fix(react): avoid light fallback for missing host theme
* Preserve model context when widget state updates
* Remove obsolete MCP Apps runtime theme tests
* Format MCP Apps runtime tests
* chore(typescript): version packages (canary)
* fix(cli): surface GitHub App install URL up front on deploy (#1761)
* fix(cli): surface GitHub App install URL up front on deploy
When `mcp-use deploy` detects the GitHub App is not connected or lacks
access to the target repo, it now prints the install URL before any
prompt. In a non-interactive context (an agent or CI, without `--yes`)
it prints the URL and next steps and exits cleanly instead of hanging on
an unanswerable prompt. Interactive and `--yes` flows are unchanged.
* test(cli): simplify GitHub install-flow tests; tidy deploy no_access branch
- Collapse redundant gitHubInstallUrl cases into one
- Mock `open` and assert the non-interactive path never launches a browser
- Extract a `noAccess` local in promptGitHubInstallation for readability
* fix(cli): unexport internal-only GitHubInstallation type to satisfy knip
GitHubInstallation is only referenced within api.ts (via GitHubConnectionStatus), so the export was dead and failed the knip check.
* fix(cli): unexport internal-only InstallFlowMode type to satisfy knip
InstallFlowMode is only used within deploy.ts as resolveInstallFlowMode's return type; the test imports the function, not the type. Verified with the full `knip --no-progress` run (exit 0), which CI uses.
* chore(typescript): version packages (canary)
* fix(cli): preserve deployment list sort order (#1752)
* fix(cli): preserve deployment list sort order
* chore(cli): add changeset for deployment list sort order fix
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* fix(inspector): stop prompting signed-in users to log in (MCP-2142) (#1767)
The hosted inspector showed the "free tier — Sign in to increase your
limits" CTA to every managed-LLM visitor, even when already authenticated.
ChatTab now resolves the shared Manufact session via a new useHostedSession
hook (also adopted by HostedUserMenu) and hides the free-tier sign-in/upgrade
chrome for authenticated users. The visibility rule is extracted into a pure
shouldShowFreeTierUpgrade helper with unit tests.
* chore(typescript): version packages (canary)
* fix(typescript): pass the cwd field (#1785)
* fix: pass the cwd field
Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com>
* fix: add changeset
Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com>
* doc: add documentation of cwd field
Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com>
---------
Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com>
Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com>
* chore(typescript): version packages (canary)
* fix(inspector): replace stale auto-connect transports (#1792)
* chore(typescript): version packages (canary)
* fix(templates): score 100% on publishing checklist (MCP-2260) (#1772)
* fix(templates): score 100% on publishing checklist (MCP-2260)
Auto-derive openai/widgetDescription from the widget description in the Apps
SDK adapter so hosts always see a widget description, and fill the small
metadata gaps the templates were missing:
- starter: fetch-weather declares a title + outputSchema (returns matching
structuredContent).
- mcp-apps: search-tools and get-fruit-details declare a title; the
product-search-result widget declares a domain (widgetDescription is now
auto-derived from its description).
Adds a unit test for the widgetDescription default.
* feat(server): enforce outputSchema at the tool return position (MCP-2260)
Type-check a tool's outputSchema through the existing object()/widget() calls
with no new API:
- Content helpers (text, markdown, image, ...) now return a content-only
ToolContentResult (structuredContent?: never), so they're always allowed.
- widget() is generic over its props, which become the result's
structuredContent — so widget({ props }) is checked against outputSchema.
- The tool callback return type is TypedCallToolResult<TOutput> | ToolContentResult,
making object({ wrong })/widget({ props: wrong }) a compile-time error.
Adds a type-level test (npm run test:types) and removes an internal template
comment. Edge cases that now error against a tool with outputSchema: mix()
carrying structured content, or a raw literal with a mismatched structuredContent.
* fix(templates): remove hardcoded widget domain
Keep the generated MCP Apps template client-neutral so deployers can set their own production widget origin.
* chore(typescript): update knip.json to include additional ignore patterns and entry points
- Added "test_app" to the ignoreWorkspaces list.
- Included "tests/types/**/*.ts" in the entry patterns for type checking.
- Removed redundant "scripts/**/*.{js,mjs,ts}" from the entry list in the create-mcp-use-app package.
* chore(typescript): version packages (canary)
* feat(cli): expose monorepo auto-deploy trigger config (#1793)
Add --watch-paths/--wait-for-ci to `mcp-use deploy` and
--watch-paths/--deploy-branches/--wait-for-ci/--root-dir to
`mcp-use servers update`, and surface the effective trigger config in
`servers get`/`update`. Closes the gap where the Cloud API accepted
these fields but the CLI could not set them, so monorepo apps can be
scoped to only redeploy on relevant changes (#1547). Updates the
deployment + CLI reference docs accordingly.
* chore(typescript): version packages (canary)
* fix(mcp-use): restore Apps SDK compatibility in useWidget as a fallback (#1794)
Keep the MCP Apps bridge as the primary widget runtime, but use
window.openai (Apps SDK) as a compatibility fallback when the bridge
does not connect, instead of dropping it entirely.
#1739 made the MCP Apps bridge the sole iframe runtime, which left any
Apps SDK-only host (e.g. a ChatGPT widget without MCP Apps support)
stuck on the loading spinner forever. A connected MCP Apps bridge still
always wins, so ChatGPT keeps using MCP Apps as the source of truth.
Also fixes two pre-existing issues in the scroll-to-bottom chat e2e test
(strict-mode locator + measuring the animated scroll synchronously).
* chore(typescript): version packages (canary)
* feat(inspector, typescript): release v11.0.0 and v1.33.0 with MCP Apps as primary widget runtime
- Introduced MCP Apps as the primary widget runtime, enhancing style variable application.
- Fixed issues with auto-connect entries, user prompts for free-tier, and CLI version handling.
- Updated dependencies including `vite` and `mcp-use`.
- Added monorepo auto-deploy controls and improved CLI documentation for new flags.
See changelogs for detailed updates and fixes.
* fix(inspector): scope OAuth proxy fetch per server configuration (#1770)
* fix(inspector): scope OAuth proxy fetch per server configuration
The browser OAuth provider installed a global window.fetch interceptor to
route OAuth requests through the inspector proxy. With multiple servers,
connecting one server "Via Proxy" mutated fetch for the entire page, so other
servers (including "Direct" ones) and unrelated requests were affected, and
switching a server from "Via Proxy" back to "Direct" could leave a stale
interceptor behind.
BrowserOAuthClientProvider now exposes a scoped getProxyFetch() that returns a
fetch confined to a single provider. It is passed only to that server's SDK
transport and auth() calls (via the SDK's fetch / fetchFn options), so
OAuth-proxy behavior is scoped to the selected server's connection and the
global fetch is never mutated.
Closes#1766
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: remove redundant OAuth cleanup comment
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* Adopt auto connection mode in inspector docs and UI (#1795)
* Adopt auto connection mode in inspector docs and UI
* Fix embedded inspector auto proxy fallback
* chore(typescript): version packages (canary)
* docs: update TypeScript release changelogs
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Dr. Carsten Leue <carsten.leue@de.ibm.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Ghost Monkey <haugun79@gmail.com>
Co-authored-by: GhostAOI <232006627+GhostAOI@users.noreply.github.com>
Co-authored-by: 落尘 <cuidong111@gmail.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: Dr. Carsten Leue <55989662+Carsten-Leue@users.noreply.github.com>
Co-authored-by: Dr. Carsten Leue <carsten.leue@de.ibm.com>
Co-authored-by: Hemant Krishnakumar <51333870+hemant1026@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cli): update EnvVariable type to allow null values for sensitive rows (#1717)
- Modified the `value` property in the `EnvVariable` interface to accept `null`, indicating write-only sensitive rows where the stored value is withheld by the API.
- Adjusted the `printEnvVar` function to handle cases where `value` is `null`, ensuring proper display of sensitive information.
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* feat(server): add outgoing notification logging (#1674)
* chore(typescript): version packages (canary)
* fix(server): mount RFC 8414 canonical well-known paths for path-suffix issuers (#1684)
* fix(server): mount RFC 8414 canonical well-known paths for path-suffix issuers
Construct upstream OAuth/OIDC metadata URLs per RFC 8414 and OIDC
Discovery, and mount canonical path-suffixed routes on the MCP server
when the upstream issuer includes a path component.
Fixes#1576
Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com>
* fix(server): mount OIDC discovery at root only; stop leaking error detail
Remove the unreachable, malformed OIDC path-suffix local mount (OIDC
Discovery appends the well-known segment to the issuer, so there is no
canonical form under the openid-configuration prefix, and no client flow
reaches a path-suffixed local route). Keep the RFC 8414 OAuth path-suffix
mount. Return a generic error_description to clients and log the raw
exception server-side instead of echoing it.
* style: apply prettier formatting
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com>
* chore(typescript): version packages (canary)
* fix(server/oauth): broker upstream OAuth callback through /oauth/callback (#1728)
In proxy mode the server was forwarding each MCP client's redirect_uri
straight to the upstream provider, which forced every client's callback
(Claude, ChatGPT, the inspector, ...) to be pre-registered on the
provider. Instead, /authorize now sends the upstream the server's own
/oauth/callback and packs the client's redirect_uri + state into the
upstream `state` (base64url JSON, stateless). A new GET /oauth/callback
restores them and forwards the code (or upstream error) to the client's
original callback. /token rewrites redirect_uri to the brokered callback
so it matches the authorize request (RFC 6749 §4.1.3). PKCE passes
through untouched.
Also: jwksVerifier now rejects opaque (non-JWT) access tokens with an
actionable message pointing at the missing `audience`, instead of jose's
cryptic "Invalid Compact JWS".
Only `<server-domain>/oauth/callback` needs registering upstream now.
Closes MCP-2170
* fix(inspector): route localhost MCP servers through client-side chat (MCP-2419) (#1736)
* fix(inspector): route localhost MCP servers through client-side chat (MCP-2419)
In hosted mode the Chat tab streams through the managed cloud backend
(chatApiUrl), which connects to the MCP server server-side and cannot reach a
user's localhost server. The request 502s and, lacking CORS headers, surfaces
in the browser as an opaque "Failed to fetch" / CORS error.
Loopback server URLs now fall back to client-side (in-browser) chat streaming,
which already holds a direct session to the localhost server. The configure-key
empty state shows an explanatory notice telling the user the managed key can't
reach their machine and that a personal API key is needed — only in hosted mode;
the local inspector is unchanged.
The localhost check is extracted into a shared serverUrl util (with IPv6 [::1]
bracket handling) plus unit tests, and e2e tests cover the hosted+localhost
fallback, the no-cloud-call guarantee, and the notice's presence/absence.
* fix(inspector): address PR review on MCP-2419 localhost chat fix
- serverUrl: detect the full 127.0.0.0/8 loopback range (not just
127.0.0.1), anchored so "127.example.com" is not a false positive
- serverUrl tests: cover 127.0.0.0/8 and near-loopback negatives
- e2e: stub the hosted `/api/auth/get-session` endpoint in
enableHostedChatMode so HostedUserMenu never hits the real cloud
backend (avoids CI flakiness/slowness)
- changeset: fix grammar
* style(inspector): prettier formatting for e2e test helpers
* chore(typescript): version packages (canary)
* fix(cli): use authoritative GitHub repo-access check for deploy (MCP-2467) (#1737)
The `mcp-use deploy` pre-flight repo-access check listed an installation's
repos and matched the target locally. That only inspected the first page, so
repos on later pages were wrongly reported inaccessible (MCP-2467); fully
paginating it (the prior behavior) hung on very large orgs.
Replace it with a single authoritative question per installation via the new
backend `GET /github/installations/:installationId/repos/:owner/:repo/access`
endpoint (a `repos.get` probe). The installation whose account matches the repo
owner is checked first, falling back to the others, preserving the
across-installations fix from MCP-2358 without paginating.
* chore(typescript): version packages (canary)
* chore(deps): bump esbuild from 0.27.1 to 0.28.1 in /libraries/typescript (#1734)
* chore(deps): bump esbuild from 0.27.1 to 0.28.1 in /libraries/typescript
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.27.1 to 0.28.1.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.27.1...v0.28.1)
---
updated-dependencies:
- dependency-name: esbuild
dependency-version: 0.28.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* fix(typescript): silence dev widget logs when project has no widgets (#1730)
* chore(typescript): version packages (canary)
* feat : inspector add scroll-to-bottom button (#1538)
* inspector: add scroll-to-bottom button
* fix(inspector): center chat scroll button
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* fix(cli): cleanly unsubscribe on Ctrl+C (SIGINT) (#1687)
* fix(cli): add SIGINT handler to cleanly unsubscribe from resource
Addresses #1686
* chore: add cli changeset
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* fix(inspector): update emulate oauth callback (#1743)
* refactor: centralize screenshot handling and add REPL screenshot support (#1592)
* refactor: centralize screenshot handling and add REPL screenshot support
* chore: fix knip checks
* chore: drop knip version ignore
---------
Co-authored-by: Andrew Khadder <andrew@manufact.com>
* chore(typescript): version packages (canary)
* fix(api): update base URL for remote API calls to manufact.com (#1745)
* chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml
- Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions.
* fix(workflow): remove unnecessary flag from pnpm install command in CI configuration
- Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs.
* fix(api): update base URL for remote API calls to manufact.com
- Changed the default base URL from 'https://cloud.mcp-use.com' to 'https://cloud.manufact.com' across multiple files, including MCPAgent and RemoteAgent initializations, ensuring consistency in API endpoint references.
* chore(typescript): version packages (canary)
* feat(cli): add support for custom Dockerfile path in deployment options (#1746)
* chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml
- Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions.
* fix(workflow): remove unnecessary flag from pnpm install command in CI configuration
- Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs.
* feat(cli): add support for custom Dockerfile path in deployment options
- Introduced a new CLI option `--dockerfile` to specify a non-default Dockerfile path relative to the project root.
- Updated the `DeployOptions` interface to include the `dockerfile` property.
- Enhanced deployment command output to display the specified Dockerfile path, improving user feedback during deployment processes.
* refactor(cli): improve console log formatting for Dockerfile output
- Reformatted the console log statement for the Dockerfile option in the deploy command to enhance readability by breaking it into multiple lines. This change aims to maintain consistent code style and improve maintainability.
* chore(typescript): version packages (canary)
* Remove obsolete OAuth proxy callback changeset
* chore(typescript): version packages (canary)
* docs: update canary changelogs
* fix(cli): allow empty env var updates (#1750)
* chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml
- Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions.
* fix(workflow): remove unnecessary flag from pnpm install command in CI configuration
- Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs.
* fix(cli): allow empty env var updates
* Add changeset for empty env value updates
---------
Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com>
* chore(typescript): version packages (canary)
* chore(deps): bump tar from 7.5.11 to 7.5.16 in /libraries/typescript (#1744)
* chore(config): add Langfuse Cloud API endpoints to exclusion list in lychee.toml
- Updated the `lychee.toml` configuration file to include Langfuse Cloud API endpoints in the exclusion list, preventing 403 errors from bot protection during CI processes. This change ensures valid defaults for API interactions.
* fix(workflow): remove unnecessary flag from pnpm install command in CI configuration
- Updated the `bump-mcp-use-reusable.yml` workflow file to remove the `--config.dangerously-allow-all-builds=true` flag from the `pnpm install` command, streamlining the installation process during CI runs.
* chore(deps): bump tar from 7.5.11 to 7.5.16 in /libraries/typescript
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.11 to 7.5.16.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.11...v7.5.16)
---
updated-dependencies:
- dependency-name: tar
dependency-version: 7.5.16
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: Enrico <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Dhruv Tiwari <144548881+dhruvtiwari6@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Andrew Khadder <khandrew1@users.noreply.github.com>
Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kalpchaniyara <kalpchaniyara.2006@gmail.com>
Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com>
Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com>
Co-authored-by: 落尘 <cuidong111@gmail.com>
* feat(auth): add getTokenEndpoint method for OAuth token discovery (#1714)
* feat(auth): add getTokenEndpoint method for OAuth token discovery
- Implemented `getTokenEndpoint` in `BrowserOAuthClientProvider` and `OAuthSessionStore` to resolve and cache the OAuth token endpoint via server metadata discovery.
- Updated `UseMcpResult` type to include `token_endpoint` for consumers to persist the endpoint alongside tokens.
- Enhanced `useMcp` to utilize the new method for proactive token refresh.
- Added unit tests to verify the functionality of the `getTokenEndpoint` method, including caching behavior and error handling.
* refactor(auth): improve code formatting in OAuthSessionStore and related tests
- Reformatted code in `OAuthSessionStore` for better readability by breaking long lines into multiple lines.
- Updated unit tests for `OAuthSessionStore` to enhance clarity by applying similar formatting improvements.
- These changes aim to enhance maintainability and readability of the codebase.
* feat(auth): add getClientCredentials method for OAuth client information retrieval
- Implemented `getClientCredentials` in `BrowserOAuthClientProvider` and `OAuthSessionStore` to allow consumers to retrieve stored OAuth client credentials, facilitating server-side token refresh.
- Updated `UseMcpResult` type to include `client_id` and `client_secret` for better token management.
- Enhanced `useMcp` to utilize the new method for proactive token refresh, ensuring smoother authentication flows.
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore(changelog): update changelogs for v9.0.2 and v1.32.0 releases
- Added details for patch release v9.0.2 in the inspector changelog, noting the update to `mcp-use` v1.32.0 with no inspector-specific runtime changes.
- Documented minor release v1.32.0 in the TypeScript changelog, highlighting the introduction of OAuth token endpoint discovery and new methods for retrieving client credentials, along with an update to `@mcp-use/inspector`.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* feat(cli): servers update + branch-scoped env/deploy management (#1711)
* feat(cli): add servers update + branch-scoped env/deploy management
Adds `mcp-use servers update` to mutate server config in place
(productionBranch, name, description, build/start commands) without
delete/recreate, mapping flags to the backend UpdateServerBody (--branch
-> productionBranch; build/start commands nested under config).
Also completes MCP-1794 branch scoping:
- deploy --branch (defaults to current git branch) scopes env sync to the
branch's preview env
- servers env list/add/update/rm --branch; update/rm accept a KEY resolved
within the branch scope, not just a UUID
- deployments restart --branch (defaults to the deployment's branch)
Supersedes #1706 with the correct field mapping. Adds unit tests, README
docs (flags + env naming mapping), and a changeset.
* docs(skills): document servers update + branch-scoped env CLI commands
Update the mcp-apps-builder and openapi-to-mcp skills for the new CLI
surface: add the deploy `--branch` flag, document `servers update` and
`servers env` for post-deploy config, and fix the stale
`mcp-use deployments env set` reference (the real command is
`mcp-use servers env add`).
* feat(cli): map empty build/start flags to null for config unset
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore(changelog): update changelogs for v9.0.1 and v1.31.1 releases
- Added details for patch release v9.0.1 in the inspector changelog, noting the update to `mcp-use` v1.31.1 with no inspector-specific runtime changes.
- Documented patch release v1.31.1 in the TypeScript changelog, highlighting workspace dependency alignment and new features in `@mcp-use/cli`, including server updates and branch-scoped environment management.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Enrico