mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
mcp-use@2.3.0
92 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Andrew Khadder
|
d0107b3484 |
Canary (#2304)
* fix(agent): count Anthropic cache tokens and stop message_delta erasing usage (#2127) * fix(agent): count Anthropic cache tokens and stop message_delta erasing usage Two counting bugs on the Anthropic path, both silent. Anthropic reports `input_tokens` net of the prompt cache and bills `cache_read_input_tokens` and `cache_creation_input_tokens` separately, so `input_tokens + output_tokens` is not what the call is charged on. It never sends `total_tokens`, so the computed branch is always the one that runs. A call billed on 21,623 tokens reported 123. `cache_creation_input_tokens` was not read anywhere in the repository, and Anthropic bills cache writes above the base rate. OpenAI is the opposite: its `cached_tokens` sits inside `prompt_tokens`, so adding it would double count. Only the Anthropic-shaped keys are summed, and a test pins that. Second, `tokenUsageFromRecord` returns every key and sets the ones it did not find to `undefined`. Anthropic's streaming `message_delta` carries `output_tokens` only, so `usage = { ...usage, ...deltaUsage }` overwrote `inputTokens` and `cachedInputTokens` with `undefined`, discarding what `message_start` had already reported. After any streamed call the whole input side of the accounting was gone, with nothing raised. `mergeTokenUsage` merges only defined values. It does not touch `totalTokens`, because whether a cache counter is additive is a provider question and that information is gone once usage has been normalised, so the caller owns the total. Three of the added tests fail on main. * fix(agent,inspector): one owner for the Anthropic total, and stop the inspector dropping cache Follow-up on the review. Four points were raised; three were right and are fixed, one would have introduced a bug and the reasoning is below. The same wrong total existed in a third place. `message_stop` recomputed it as `inputTokens + outputTokens`, so the fix at `message_delta` survived only because `??` short-circuited on the total already set. Two places knowing how Anthropic bills is how this drifts, so `message_stop` now owns it alone and `message_delta` just merges. Added an end-to-end test that drives real `message_start` then `message_delta` SSE through `streamChat`, rather than exercising `mergeTokenUsage` in isolation. On the base commit it reports `totalTokens: undefined`, not merely a wrong number, because the input counters were gone by the time `message_stop` ran. The inspector was dropping more than the new field. `InspectorTokenUsage` declares `cachedInputTokens` and `reasoningTokens`, the trace view reads them, and `inspectorTokenUsageFromUnknown` returned only `inputTokens`, `outputTokens` and `totalTokens`. Both have always rendered as absent whatever the provider sent. It also repeated the same input-plus-output total. Both fixed, and `cacheCreationInputTokens` is carried through. The merge test now seeds `cache_creation_input_tokens` too, since cache writes are billed above base rate and need the same protection as cache reads. Not done, deliberately: adding `cachedInputTokens` to the computed total inside `tokenUsageFromRecord`. On Anthropic that counter sits outside `input_tokens`; on OpenAI `cached_tokens` sits inside `prompt_tokens`. Once usage is normalised that distinction is gone, so summing it would double count OpenAI. Only the Anthropic-shaped keys are added, and a test pins the OpenAI case at 14. * style(inspector): run prettier on trace.ts format:check fails the typescript-lint job on this one file. Prettier wraps the cachedInputTokens call across three lines, the way the two calls below it already are. Formatting only, no behaviour change. * fix(inspector): aggregate cacheCreationInputTokens and stop double-counting OpenAI cache reads Addresses @khandrew1's review on #2127. addUsage dropped cacheCreationInputTokens: the field was parsed onto individual usage events but never summed, so it vanished from state.usage, the LLM span's usage, and the aggregate tokenUsage in the raw-chat payload. It is now summed alongside the other counters. The fallback total could also over-count. uncountedCache was built from the provider-neutral cachedInputTokens, but on OpenAI those tokens are already inside inputTokens, so { inputTokens: 10, outputTokens: 4, cachedInputTokens: 3 } totalled 17 instead of 14. The total now adds only the Anthropic-shaped cache_read_input_tokens, mirroring the provider-safe path in agent/src/llm/usage.ts. cachedInputTokens is still parsed and returned for observability. Two tests in trace.test.ts pin both: the OpenAI-vs-Anthropic total distinction, and that cacheCreationInputTokens survives aggregation and the LLM span. Changesets added for @mcp-use/agent and @mcp-use/inspector. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): scope loading state by chat session (#2232) * fix(inspector): give each chat session one id and one state record Chat state lived in hook-wide React state, so starting a new chat cleared the values an in-flight stream was still writing to: the fresh chat inherited the previous session's loading state and could not send. Rework it around a single identity. A session is created with one id and keeps it; that id is handed to ChatStorageProvider.createChat, so runtime state, chat history and OAuth retry all name the same chat. All of a session's state and turn machinery live in one record inside ChatSessionStore, which notifies only the subscribers of the session that changed, so a background turn keeps streaming into its own record. useChatSessions owns the lifecycle: minting ids, activating a session, reattaching to persisted chats, and reopening the session a full-page OAuth redirect interrupted. New Chat now only switches the active id. Closes #2217 * refactor(inspector): simplify chat session state * fix(inspector): harden chat session recovery --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(ci): give inspector tests the same timeout as every other package (canary) (#2290) * fix(ci): give inspector tests the same timeout as every other package Same one-line change as #2268, which targets main. canary carries the same 10s cap and is failing on it independently: run 32053629834 compressed-assets.test.ts 10230ms Test timed out in 10000ms run 32051250836 same test main is red on it too (run 32054211669). Recent margins are 10029ms, 10230ms and 10837ms, all just over the cap. The inspector is the only package at 10s; agent, client, cli and server all use 60000, and these cases mount a server and decompress the bundled app. 45 files, 217 tests still pass locally. * chore(ci): remove timeout rationale comment --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * feat(oauth): add Scalekit provider (#2272) * feat(oauth): add Scalekit provider Add oauthScalekitProvider next to Auth0 and Clerk. The verifier accepts both environment-root and resource-scoped issuers, binds audience to the res_… resource id, and advertises DCR plus CIMD. No Scalekit SDK. * fix(oauth): keep Scalekit resource-id audience with extra aud Always verify aud includes the resource id. Optional audience is an extra AND check, not a replacement. Drop the new v1 provider page. * fix(oauth): drop Scalekit issuerBoundAccessTokens option Scalekit binds tokens to the resource id. The dashboard will own that opt-in. Keep the static oauthMetadata copy because mcp-use requires it. Custom claims stay on ctx.auth.payload. * docs: drop v1 and legacy skill changes * docs: fix Scalekit environment variables --------- Co-authored-by: Saif Shines <saifshine7@gmail.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): add a test script so pnpm test covers this package (#2289) * fix(inspector): add a test script so pnpm test covers this package The root test script is `pnpm run -r test`, and the inspector only had test:unit. pnpm skips a package with no matching script and reports nothing, so 217 unit tests were absent from the workspace-wide run: $ pnpm --filter @mcp-use/inspector test (no output) $ pnpm --filter @mcp-use/inspector test:unit Test Files 45 passed (45) Tests 217 passed (217) CI is unaffected; its step calls test:unit directly. This is the documented `pnpm test` contributors run. Uses run mode rather than watch, matching tunnel, so a recursive run cannot sit waiting on a watcher. * chore(inspector): remove test-only changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * fix(types): align pnpm workspace tooling (#2301) * docs: update TypeScript release changelogs * fix(inspector): use secure chat session ids --------- Co-authored-by: Arthi Arumugam <62213284+arthi-arumugam-git@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Mert Çetin <97505365+merttcetn@users.noreply.github.com> Co-authored-by: Ayaan Gazali <ayaangazali.work@gmail.com> Co-authored-by: saif-at-scalekit <saif.shaik@scalekit.com> Co-authored-by: Saif Shines <saifshine7@gmail.com> |
||
|
Andrew Khadder
|
64480f083c |
docs(examples): add json-render generative UI example (#2222)
* docs(examples): add json-render generative UI example * style(examples): format generative UI view * fix(examples): guard incomplete streamed UI elements * docs: add generative UI guide |
||
|
Andrew Khadder
|
b6a720b912 | docs: move Skills over MCP navigation (#2248) | ||
|
Andrew Khadder
|
c83d1d9737 |
Merge remote-tracking branch 'origin/main' into canary
# Conflicts: # libraries/typescript/packages/server/specs/CLI_SPEC.md # libraries/typescript/packages/server/specs/SPEC.md # libraries/typescript/packages/server/specs/VIEWS_SPEC.md |
||
|
Andrew Khadder
|
859dcca632 | fix docs SEO metadata and migration redirect (#2181) | ||
|
Enrico
|
6911124f34 | feat: add Skills over MCP | ||
|
Andrew Khadder
|
33e30cb8e3 |
Canary (#2117)
* fix(cli): report success from mcp-use typecheck (#2099) `tsc --noEmit` prints nothing on a clean project, so `mcp-use typecheck` exited 0 with no output at all, which is indistinguishable from the command hanging or silently failing. Print `[mcp-use] no type errors (<duration>ms)` on exit code 0, matching the existing `[mcp-use] built ... (<duration>ms)` line from `build`. Failing runs are untouched and still show only the compiler's own diagnostics. Closes #2083 * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: sync main into canary (#2119) * chore(release): exit prerelease mode and publish npm README hotfix Publishes mcp-use 2.0.1 and @mcp-use/inspector 20.0.1 with the repository README included in the mcp-use package tarball. * chore(release): exit prerelease mode and publish npm README metadata hotfix Publishes mcp-use 2.0.2 and @mcp-use/inspector 20.0.2 after preparing README metadata before npm publication. * chore(release): exit prerelease mode and commit npm package README Publishes mcp-use 2.0.3 and @mcp-use/inspector 20.0.3 with a committed package-root README. * chore(release): exit prerelease mode and fix npm README assets Fix npm README asset and repository links, publish mcp-use 2.0.4, and keep Inspector aligned at 20.0.4. * Update libraries/typescript/packages/server/README.md Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Signed-off-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> * docs: sync migration guide link --------- Signed-off-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> * fix(cli): say whether `start` mounted the inspector (#2100) * fix(cli): say whether start mounted the inspector `mcp-use dev` advertises the inspector in its banner, but `mcp-use start` says nothing about it and `${basePath}/inspector` 404s unless `--with-inspector` was passed. With no hint, that reads as a broken production build rather than an opt-in. Plain `start` now prints that the inspector is not mounted and how to mount it, and `--with-inspector` prints the URL it was mounted at, which was previously silent too. Closes #2084 * fix(cli): drop the inspector-not-mounted line from start Per review: most people running start do not want the inspector, so announcing its absence is noise. Plain start is now silent about the inspector again, and only the --with-inspector path prints its URL. Updates the spec, the changeset, and swaps the test to pin the silence instead of the message. * chore(typescript): version packages (canary) * chore: upgrade changesets cli to 2.31.1 (#2121) * fix(ci): pin pnpm in the docs workflow so the job can start (#2116) The docs job fails in "Set up pnpm" before it generates anything: Error: No pnpm version is specified. pnpm/action-setup@v4 was used with no version:, so it falls back to reading packageManager from package_json_file, which defaults to the repository root. This repo has no root package.json, so the step could never succeed and the check was red on every branch including main. Pins 11.13.1, matching all nine action-setup uses in ci.yml and the packageManager field in libraries/typescript/package.json. * fix(cli): support package-manager dev arg forwarding (#2124) * fix(cli): support package-manager dev arg forwarding (MCP-2549) * chore: add MCP-2549 changeset * fix(cli): normalize forwarded arguments across commands * chore(typescript): version packages (canary) * docs: fix TypeScript README links into the removed mcp-use package (#2114) The v2 merge deleted libraries/typescript/packages/mcp-use, but the TypeScript README still pointed at it in four places: the three logo sources at the top of the page, and the documentation link at the bottom. The logo now uses the absolute raw.githubusercontent.com URL that every sibling package README already uses, and the docs link points at packages/server, which is where the mcp-use package lives in v2 and what the create-mcp-use-app and inspector READMEs already link to. * fix(create-mcp-use-app): drop stale main field and give templates distinct descriptions (#2085) * fix(create-mcp-use-app): drop stale main field and give templates distinct descriptions Two small things in the scaffolded package.json, both visible as soon as you generate a project. main pointed at dist/index.js. v2 builds emit .mcp-use/build instead, so that path never exists and main never resolves. These templates are apps you run with mcp-use start, not packages anyone imports, and .mcp-use is gitignored build output, so the field is dropped rather than repointed. All three templates also carried the description 'an mcp-use server'. --list-templates reads that field, so the three were indistinguishable from the CLI, and every generated project inherited the same string. Each now says what it actually gives you. Closes #2080 Closes #2081 * chore: add changeset for the template package.json fixes * fix(create-mcp-use-app): stop discarding the template description updatePackageJson overwrote description with a generic "<name>: an mcp-use server" on every scaffold, so the per-template descriptions only ever reached --list-templates and never the generated project. It now fills that in only when the template has no description of its own, which keeps the previous behaviour for templates without one. * chore(typescript): version packages (canary) * fix(client): stop leaking parent env to stdio servers (#2125) Port the security fix from #1949 to the v2 client package and verify the child process receives only safe defaults plus explicitly configured variables. Co-authored-by: VihaanAgarwal <72850668+VihaanAgarwal@users.noreply.github.com> * chore(typescript): version packages (canary) * fix(client): bound conformance auth scenarios (#2126) * fix(client): make stdio errlog actually receive the child's stderr (#2086) * fix(client): make stdio errlog actually receive the child's stderr StdioConnectionManager takes an errlog stream and documents that the child server's stderr is piped to it, but the transport was created without stderr: "pipe". The SDK defaults to "inherit", which leaves transport.stderr null, so the forwarding block guarding on it never ran and the child's stderr always went to the parent instead. Spawn with stderr: "pipe" by default, spread so an explicit mode in server params still wins. Tests spawn real child processes: one checks a custom errlog receives the output, one checks stderr: "ignore" still opts out. * chore: drop stray version.ts that does not belong on beta Left over from a main checkout; packages/mcp-use does not exist on this branch. * fix(client): expose stderr mode on the public stdio APIs Per review, the compatibility escape hatch only worked for callers that built StdioConnectionManager directly. StdioConnector did not accept or forward stderr and StdioServerConfig did not expose it, so users of the normal public APIs could not opt back into inherited stderr. - Add a StdioStderrMode of "pipe" | "inherit" | "ignore", default "pipe". - Accept it on StdioConnector and StdioServerConfig, forward it into StdioServerParameters, and thread it through the config path. - Apply the default after the spread so an explicit stderr: undefined no longer defeats it. - Only forward transport.stderr when the mode leaves a readable stream. - Pipe with { end: false } and unpipe on close, since errlog is caller-owned and may be reused across reconnects. - Handle stream errors instead of letting a destroyed errlog surface as an unhandled 'error' event. Tests now start the transport before asserting, so the non-pipe cases are exercised against a real child instead of passing by construction. * fix(client): handle errlog write errors --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): block loopback proxy targets by default (#2134) mountInspector defaulted oauthProxyAllowLoopback to true, and the standalone CLI hardcoded it — including in the published Docker image, which runs the CLI with NODE_ENV=production on a public port. A publicly reachable inspector could therefore proxy requests to the host's loopback services (SSRF), while RFC1918/metadata targets were already blocked. - mountInspector: default allowLoopback to false; local dev tooling opts in - CLI: allow loopback unless NODE_ENV=production; INSPECTOR_ALLOW_LOOPBACK overrides either way - Express-adapter test opts in explicitly (it proxies to its own 127.0.0.1 echo server); new regression test covers the default and the opt-in * chore(typescript): version packages (canary) * docs: add v2 changelog updates * chore: remove retired beta release flow (#2141) * fix: keep prerelease versioning visible to Knip (#2142) * fix: patch dependency vulnerabilities (#2151) * fix: patch vulnerable dependencies * fix: use mcp-use in client demo servers * chore(typescript): version packages (canary) --------- Signed-off-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: Ayaan Gazali <ayaangazali.work@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com> Co-authored-by: VihaanAgarwal <72850668+VihaanAgarwal@users.noreply.github.com> |
||
|
Andrew Khadder
|
db46159c84 |
v2 docs fixes (#2139)
* Set V2 as the default documentation version * Reorganize documentation navigation and redirects * Remove deprecated repository content * Rename Manufact deployment guide |
||
|
Pietro Zullo
|
d391b6383e | docs: update OG image (MCP-2169) (#2137) | ||
|
Enrico Toniato
|
e1c8aa4685 |
fix: prepare v2 stable release channels and launch surfaces (#2106)
* fix: prepare v2 stable release channels * fix: normalize peers only when exiting prerelease |
||
|
Enrico
|
f6634fb688 |
Update README.md and docs.json for TypeScript v2 migration and new banner
- Updated migration guide link in README.md to point to the correct TypeScript v2 documentation. - Added a new warning banner in docs.json to announce that mcp-use v2 is now in beta. - Enhanced TypeScript SDK description in docs.json to clarify documentation for both V1 and V2. - Restructured documentation sections in docs.json for better organization and clarity. |
||
|
Enrico Toniato
|
ef8187a67d | fix(typescript): support runtime-first view deployments (#2028) | ||
|
Enrico
|
2768f5bfec | Merge main into beta | ||
|
Andrew Khadder
|
0bdaed15fb |
feat(react): add shared view state (#1976)
* feat(react): add shared view state * docs(react): document shared view state |
||
|
Ayaan Gazali
|
9978343d63 |
docs(inspector): add self-hosting guide (#1861)
* docs(inspector): add self-hosting guide The inspector README and feature table reference self-hosting with Docker, but the docs site had no page for it (mcp-use.com/docs/inspector/self-hosting 404s). Add the guide based on the README's self-hosting section: Docker Hub image, docker run / compose deployment, environment variables, and how self-hosting compares to the hosted and CLI options. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(inspector): bind examples to loopback, add exposure warning and air-gapped transfer steps Addresses review feedback on #1861: - trim wordy intro sentence - quick start and deployment examples now bind 127.0.0.1 to avoid exposing the Inspector proxy on all interfaces; added Warning with reverse-proxy/firewall guidance for remote access - add docker save/load transfer steps for air-gapped hosts Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: ayaanmacmini3 <ayaanmacmini3@ayaanmacmini3s-Mac-mini.local> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Enrico
|
1e548836d8 |
feat(docs): add migration page and enhance documentation clarity
- Added a new migration page to the TypeScript client documentation for better guidance on transitioning between versions. - Updated descriptions in various documentation files to improve clarity and consistency, including the MCPClient and Code Mode sections. - Revised links and examples to ensure they reflect the latest structure and best practices for using the MCP client. |
||
|
Andrew Khadder
|
68afda5885 |
docs(typescript): review and rewrite TypeScript docs (MCP-2466) (#1780)
* docs: remove stale feedback block and orphaned anchor from docs.json * chore(docs): make Typescript more prominent * chore(docs): Update `welcome.mdx` * docs: rewrite TypeScript quickstart and welcome pages Refocus the quickstart on create-mcp-use-app (scaffold, run, and deploy a first MCP server) and drop the agent/client/server primer table and diagram. Convert the welcome page's server + widget example from Tabs to CodeGroup and tighten the intro wording. * docs: remove stale server templates page and fix its references Delete the typescript/server/templates page and repoint the home templates tip to the quickstart, which now covers create-mcp-use-app. * docs(typescript): fix dead example links to real example paths The 'see a full example' links pointed at GitHub folders that 404 or contain only a README. Corrected to the real runnable examples under libraries/typescript/packages/mcp-use/examples/, verified against origin/main (incl. matching cd commands): - installation: examples/server -> packages/.../examples/server - client-configuration: a .py link -> real TS multi-server example - code-mode: examples/client/* -> examples/agent/code-mode/* - elicitation, sampling, notifications: server/X -> server/features/X - supabase: server/supabase -> server/deployment/supabase - clerk: restore missing packages/mcp-use/ path segment Quickstart links were already fixed by the quickstart rewrite (e6903716). Part of the docs audit (MCP-2466). * docs(typescript): rewrite Agent and Client introduction pages Rewrite the Agent and Client intro pages to be task-oriented and scannable: concise feature lists with cross-links, runnable quick-start examples, and added API reference sections. Drop stale CodeSandbox embeds and outdated model names. * docs(typescript): fix MCPServer class name casing in server reference The API Reference heading, prose, and class signature used McpServer; the real SDK export is MCPServer. Corrected all three occurrences in server/index.mdx. * docs: add redirect for bare /typescript/server path Routes the bare /typescript/server path to its index page now that the server section has been restructured. Claude-Session: https://claude.ai/code/session_015uioJjKTAZXGQpbXHUHZWp * docs(typescript): fix broken code examples across MCP Server & Apps section Fix all 102 confirmed code defects found in the MCP Server & MCP Apps documentation audit (47 pages, 401 code blocks), verified against the mcp-use@1.32 SDK source. The recurring patterns that made copy-pasted examples fail to compile or run are now corrected everywhere they appeared: - server.start() -> await server.listen() (no start() method exists) - bare-object tool returns wrapped in object()/text() response helpers; catch blocks renamed so they no longer shadow the error() helper - prompt messages use role:"user" with typed { type:"text" } content instead of the invalid role:"system" + bare-string shape - auth reads ctx.auth.user.userId (not ctx.auth.userId); user fields live under ctx.auth.user, scopes/permissions stay top-level - security: remove verifyJwt: process.env.NODE_ENV === 'production' from all six OAuth provider pages (off-prod it skips signature verification and accepts forged tokens); rely on the secure default, with a warning never to disable it - correct import subpaths: Logger/MCPClient from mcp-use, response helpers and server symbols from mcp-use/server, MCPClient as BrowserMCPClient from mcp-use/browser; drop the unexported getMcpAppsBridge - useWidget generics use the real <TProps, TState, TOutput, ...> order; remove the non-existent notifyIntrinsicHeight (auto-size via McpUseProvider) - fix the deployment URL to <id>.run.mcp-use.com/mcp, add missing z/helper imports, add the --branch/--dockerfile CLI options, and clean up em dashes and bare/malformed code fences Each page was fixed and then independently re-verified against the SDK source, with a repo-wide pattern sweep confirming no instances remain. Structural IA changes (moving widget-components to /react/, orphan redirects) are intentionally deferred to the docs rewrite. * docs(typescript): restructure MCP Server & MCP Apps IA Promote MCP Apps to its own top-level section in the TypeScript SDK Docs tab and move the 9 React widget-component pages out of /server/widget-components/ into /typescript/react/. - Move 9 React component pages to typescript/react/ (git renames) with 9 redirects - Promote MCP Apps to a top-level group (Overview pages + React subgroup) - Remove the duplicate MCP Apps group from the Home product nav; rehome guides/chatgpt-apps-flow under MCP Apps so it no longer orphans - Move cli-reference out of MCP Server into a new Tooling group - Relocate response-helpers -> Core Components, openapi -> Advanced Features, nextjs-drop-in -> Deployment - Repoint all widget-components links to /typescript/react/ - Fix 3 broken anchor links (inspector CLI env var, mcp-apps metadata, auth providers) Structure-only change; no page content rewrites. Refs MCP-2466. * docs: refresh TypeScript server app docs * docs: add TypeScript API reference * docs: streamline TypeScript server navigation * docs: rewrite core TypeScript server guides * docs: rewrite advanced TypeScript server guides * docs: rewrite TypeScript server OAuth guides * docs: rewrite TypeScript server session storage guides * docs: rewrite MCP Apps section * docs: add TypeScript MCP client API reference * docs: add TypeScript MCP agent API reference * docs: reorder TypeScript API reference nav * docs: reorganize TypeScript tooling nav * docs: rewrite inspector guides * docs: rewrite MCP server tunneling guide * docs: rewrite CLI client and reference docs * docs: finalize TypeScript documentation rewrite * docs: move inspector updates under get started * Fix Mintlify validation errors * Fix Mintlify broken links * docs: update Manufact Cloud deployment guide * chore: retrigger Mintlify docs preview * Fix MDX comment syntax on home page * docs: rework TypeScript server examples * docs: fix server docs links * docs: restore SDK links in home sidebar * docs: move SDK links to end of home sidebar |
||
|
pietrozullo
|
ad42b4bb3e |
docs: noindex auto-generated Python API reference instead of searchable flag
The searchable: false approach on the API Reference tab was inert on visible tabs. Switch to per-page noindex: true frontmatter, which keeps pages in the sidebar but excludes them from search indexing (search engines, internal docs search, and AI context) so generic queries like "CLI" surface curated guides instead of the generated reference. Applied to all 73 existing reference pages and emitted by the generator on every regeneration. Closes MCP-2398 |
||
|
pietrozullo
|
648ac110b3 |
docs: exclude auto-generated Python API reference from docs search
Set searchable: false on the Python SDK API Reference tab so generic queries (e.g. "CLI") surface curated guides instead of the generated reference, while keeping the reference visible in the sidebar. The generator now emits this flag on every regeneration. Closes MCP-2398 |
||
|
Andrew Khadder
|
25ae46eb6a |
Canary (#1657)
* Add MCP server instructions to TypeScript docs and templates (#1601) * Add MCP server instructions to TypeScript docs and templates * Address MCP instructions review feedback * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Potential fix for code scanning alert no. 78: Incomplete string escaping or encoding (#1661) * Potential fix for code scanning alert no. 78: Incomplete string escaping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * fix(inspector): enhance user experience with copy button for messages Added a copy button to user messages in the inspector, improving usability by allowing users to easily copy message content. This change addresses user feedback for better interaction within the chat interface. Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(mcp-use): bump hono to 4.12.23 for CVE-2026-47674 (#1663) Address Dependabot alert #222 by upgrading the direct hono dependency and raising the pnpm override floor to the patched release. * chore(typescript): version packages (canary) * Handle paginated cloud lists (#1619) * chore(typescript): version packages (canary) * Add OpenAPI-based server generation to the TypeScript SDK (#1583) * Add OpenAPI constructor to MCPServer * Add OpenAPI server example * Simplify OpenAPI example run instructions * Format OpenAPI server generation files * Use live weather.gov OpenAPI spec in example * Clarify weather.gov example path selection * Document OpenAPI server generation * Fix OpenAPI docs example and sidebar placement * Add OpenAPI server tool generation * chore(typescript): version packages (canary) * Fix idle cleanup of session refs (#1624) Co-authored-by: Deepak kudi <deepakkudi23@adsl-172-10-9-116.dsl.sndg02.sbcglobal.net> * chore(typescript): version packages (canary) * fix(cli): check repo access across all GitHub installations (#1629) * fix(cli): check repo access across all GitHub installations getGitHubRepos() only fetched repos from the first installation linked to the organization, so deploys of repos owned by any other installation failed the access check with "GitHub App doesn't have access" even when the app had all-repositories access. Aggregate repos across every installation instead, tolerating per-installation fetch errors. Fixes MCP-2358 * chore(changeset): add changeset for cli repo access fix * chore(typescript): version packages (canary) * docs: add v1.30.0 and inspector v8.0.0 changelog entries Document the canary release wave covering OpenAPI server generation, MCP instructions, session cleanup, and CLI fixes. Co-authored-by: Cursor <cursoragent@cursor.com> * test(agent): skip MCPAgent Quick Start when OPENAI_API_KEY is unset Conditionally skip the docs example test in fork PR CI where secrets are unavailable, with Prettier-correct indentation for describe.skipIf. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(openapi): prevent ReDoS in slugifyToolName regex Split the ambiguous leading/trailing underscore trim pattern and cap input length before regex processing to satisfy CodeQL js/polynomial-redos. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(openapi): remove polynomial regex in slugifyToolName Replace the end-anchored `_+$` trim (and `^_+`) with single-character `_$`/`^_` trims. Because underscore runs are already collapsed to a single `_` by the preceding replace, the edge trims never need a quantifier, eliminating the O(n^2) backtracking that CodeQL flagged as js/polynomial-redos. Drop the now-unnecessary length cap. Co-authored-by: Cursor <cursoragent@cursor.com> * chore(openapi): remove explanatory comment in slugifyToolName Co-authored-by: Cursor <cursoragent@cursor.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Rohith Matam <81304757+Rohithmatham12@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Puneet Dixit <puneetdixit4321@gmail.com> Co-authored-by: Deepak kudi <deepakkudi23@adsl-172-10-9-116.dsl.sndg02.sbcglobal.net> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|
Andrew Khadder
|
83271e869f |
Canary (#1508)
* chore: remove unused mcp-use source files (#1476) * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * docs(cli): clarify inspector skipped-in-production log + start section (#1505) * docs(cli): clarify inspector skipped-in-production log + start section The runtime log "[INSPECTOR] Skipped in production (use --with-inspector flag during build)" reads as if the flag can be passed to `mcp-use start`, which it can't (the flag is only registered under `build`). The new wording spells out the rebuild command, and `cli-reference.mdx` gains a short note under `start` pointing at the build flag for inspector-in-production. Closes #1495 * docs(cli): apply reviewer reword on inspector note * chore(typescript): version packages (canary) * chore(inspector): remove unused source files (#1510) Drops the 18 inspector files reported by `pnpm knip` from libraries/typescript and stops generating the unused client-side version.ts (the client reads the version from the window.__INSPECTOR_VERSION__ global injected by the server). Part of #1446. * chore(typescript): version packages (canary) * chore(typescript): prune 187 unused exports and 161 unused export types flagged by knip (#1511) * chore(typescript): prune 161 unused exported types flagged by knip Phase 2 of #1450: remove or de-export types that knip flags as unused. Skipped tuning knip.json (Phase 1) — focused only on the type cleanup. For each flagged type: - Used only within its source file → drop `export` - Re-exported through a barrel but never imported downstream → remove the re-export - Genuinely dead → delete No public-API removals: types exposed through the `mcp-use`, `@mcp-use/cli`, `@mcp-use/inspector`, or `create-mcp-use-app` package entry points remain exported. `client.ts` switches from inline `import("...")` to a top-level import so knip can see the `ToolSearchResponse` usage. Verified `pnpm knip` reports 0 unused types (down from 161) and `pnpm build` passes across all packages. * chore(typescript): prune 187 unused exports flagged by knip Closes #1450. * chore(typescript): fix prettier formatting * chore(typescript): delete orphaned PropsSelect.tsx Removing the unused barrel re-export in the prior commit left this file with no consumers. * chore(typescript): version packages (canary) * ci(knip): enforce knip and clear final baseline findings (#1512) * chore(knip): clear remaining baseline findings so knip passes clean - Mark `src/index.tsx` as an entry for create-mcp-use-app so its CLI dependencies (chalk, commander, ink, ora, tar, react, etc.) stop being flagged as unused. - Add `lsof`, `sleep`, and `dev` to ignoreBinaries for the mcp-use workspace — these appear in example scripts and are either system utilities or pnpm script names, not npm-resolvable binaries. - Turn off the `optionalPeerDependencies` rule. Optional peer deps (langchain/langfuse/e2b/etc.) are loaded conditionally by design; flagging them as referenced is noise. After this change `pnpm exec knip` exits 0 against canary. * ci(knip): enforce knip in CI The baseline is now clean (canary + previous PRs cleared all findings), so drop `--no-exit-code` and let the job fail when knip reports issues. Also generate `packages/mcp-use/src/version.ts` before knip runs so the gitignored `version.js` imports resolve. * chore(deps): bump better-auth in /libraries/typescript (#1515) Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.1 to 1.6.11. - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth) --- updated-dependencies: - dependency-name: better-auth dependency-version: 1.6.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: tighten PR readiness and docs hygiene (#1509) * docs: tighten review readiness and doc links * docs: anchor api-reference redirect and fix missed node note Move the /typescript/server/api-reference target from a bare redirect to an anchored one (#mcpserver-api-reference) so existing "API Reference" links land on the renamed section directly. Drop the self-link in server/index.mdx and bring the commonjs example's Node note in line with the package engines range. --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * feat(server/oauth): allow Supabase URL override for self-hosted/local instances (#1517) * feat(server/oauth): allow overriding Supabase URL for self-hosted/local instances `oauthSupabaseProvider` previously hardcoded `https://${projectId}.supabase.co`, preventing use against local Supabase (`http://localhost:54321`) or self-hosted deployments — even though those instances expose the same OAuth 2.1 server. Add an optional `supabaseUrl` config (and `MCP_USE_OAUTH_SUPABASE_URL` env var) that overrides the projectId-derived URL. `projectId` is now optional when `supabaseUrl` is set; hosted-project users are unaffected. Closes mcp-use/mcp-oauth-supabase-template#2 * test(server/oauth): trim supabase provider tests to factory contract Drop low-value string-concatenation and pre-existing-behavior tests; keep the two that cover the new behavior (supabaseUrl alone is accepted; empty config throws). Isolate process.env in the factory describe so the "throws when neither configured" assertion isn't defeated by local MCP_USE_OAUTH_SUPABASE_* env vars. * docs(server/oauth): document supabaseUrl override for local/self-hosted Supabase * chore(typescript): version packages (canary) * chore: use cross-platform clean commands (#1523) * chore: use cross-platform clean commands * chore: add empty changeset for cross-platform clean scripts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy (#1483) * fix(server/oauth): use URL constructor to avoid double slash in metadata proxy The DCR-direct metadata proxy was string-concatenating a path onto the issuer, which canonically ends with a trailing slash: `${issuer}/.well-known/oauth-authorization-server` // → "https://tenant.auth0.com//.well-known/oauth-authorization-server" Auth0 returns 404 for any path starting with "//", which broke OAuth discovery end-to-end against real Auth0 tenants in DCR-direct mode. new URL(path, base) normalizes the join regardless of trailing slash, so this works for any provider whose canonical issuer ends with "/". Fixes #1482. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(server/oauth): normalize issuer trailing slash instead of using URL constructor `new URL("/.well-known/...", issuer)` resolves the leading-slash path against the issuer's origin, stripping any path on the issuer. That breaks providers like Supabase whose issuer is `https://<project>.supabase.co/auth/v1`. Replace with a trailing-slash-stripping template literal, which handles both Auth0 (issuer ends with `/`) and Supabase (issuer has a path). * chore(changeset): trim oauth metadata fix entry * chore(changeset): drop issue reference --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * test(inspector): add OAuth e2e against emulated Google issuer (#1481) * test(inspector): add OAuth e2e test using emulated Google issuer Covers the inspector's OAuth redirect flow end-to-end against an `emulate`-backed Google issuer + MCP server in oauthProxy mode, run twice across the Direct and Via Proxy connection-type matrix. Both variants share one fixture in serial mode since the registered redirect URI pins the MCP server to a fixed port. * test(inspector): switch loop to factory to satisfy no-loop-func The for-loop variant captured the mutable `fixture` binding from beforeAll, which eslint's no-loop-func flags. Hoisting the body into a small factory keeps the shared fixture without the closure-over-loop pattern. * test(inspector): close emulator if MCPServer setup fails Wrap post-createEmulator work in try/catch so the emulator port doesn't stay bound when MCPServer construction or listen() throws. * chore(typescript): version packages (canary) * fix(inspector): surface MCP server auth failures with reconnect banner (#1485) * fix(inspector): surface MCP server auth failures with reconnect banner (MCP-2111) When the hosted inspector's chat backend returns 401 because the upstream MCP server rejected the user's OAuth token (e.g. Linear token expired), the inspector previously threw a generic `HTTP error! status: 401` and the cloud response misleadingly pointed users at the Manufact account login. The chat now recognises the cloud's `{ error: "mcp_auth_required", mcpServerUrl }` response and renders an inline banner above the input ("Reconnect to <server>") with a button that calls `connection.authenticate()`. Reconnect refreshes the OAuth token in localStorage; the banner clears on success and chat resumes. Pairs with a cloud-side change that drops the misleading `loginUrl` field from the 401 response. * fix(inspector): harden mcp_auth_required handling - Drop the no-op setMessages filter in the 401 branch; the optimistic assistant message is only added after the response check, so there's nothing to remove. - Guard `new URL(serverUrl)` in McpReconnectBanner so a malformed URL falls back to the raw string instead of crashing the chat tab. * refactor(inspector): rename mcpAuthRequired to mcpServerAuthRequired The hook's internal state was already named `mcpServerAuthRequired`, but the returned key and clear callback used the shorter `mcpAuthRequired`, forcing the ChatTab consumer to re-alias them. The shorter name was also ambiguous in a codebase that has two distinct auth flows: the Manufact account login (429 path) and the upstream MCP server OAuth (401 path). Align the public surface of `useChatMessages` with the internal state and the consumer's local name. The backend wire value `"mcp_auth_required"` is unchanged. * chore(inspector): remove mcpServerAuthRequired comment * chore(typescript): version packages (canary) * fix(inspector): keep tab count badges visible in collapsed mode (#1490) * fix(inspector): keep tab count badges visible in collapsed mode * Keep tab badges aligned in collapsed mode * extract TabCountBadge and fix badge visibility * chore(typescript): version packages (canary) * fix(inspector): drop unused TabCountBadge barrel re-export (#1533) The only consumer (LayoutHeader.tsx) imports TabCountBadge directly from ./shared/TabCountBadge, so the re-export in shared/index.ts is unused. Knip flagged it and started failing CI on canary after the TabCountBadge change landed. * chore(typescript): version packages (canary) * feat(inspector): add local LLM provider support for chat in Inspector (#1395) * feat(inspector): integrate ollama provider * feat(inspector): integrate lmstudio provider * fix(inspector): preserve no-icon behavior for openai-compatible provider * refactor(inspector): remove LM Studio provider and address PR feedback * fix(inspector): remove duplicate ollama union members Collapses the accidental `"ollama" | "ollama"` duplicates in ProviderName, MCPChatMessageEventData, and LLMConfig. * refactor(inspector): drop LLM proxy and call Ollama directly Ollama allows localhost origins by default, so the inspector talks to the daemon over CORS and skips the server-side proxy entirely. Surface an OLLAMA_ORIGINS hint when the browser fetch fails so tunneled or remote setups know what to configure. Theme the Ollama logo and tighten its size so the non-circular mark sits cleanly next to the other provider icons. * chore(inspector): revert gratuitous field reorders Restore original ordering of temperature/baseUrl and useCallback deps; remove stray blank line in vite.config.ts to keep the diff focused. * test(inspector): add unit tests for parseNDJSON * refactor(inspector): tighten Ollama provider integration - Guard Ollama streamChat against duplicate tool-call emissions when a chunk's tool_calls are repeated by proxies/forks - Key the models cache on (provider, baseUrl) for any base-url provider so openai-compatible no longer serves stale entries on URL changes; normalize Ollama variants (trailing slash, /api suffix) to one entry - Move OllamaCorsError into the Ollama provider module - Replace hand-written provider unions in telemetry events and server shared-utils with ProviderName - Single-source DEFAULT_OLLAMA_BASE_URL from ollama/utils.ts - Drop the unrelated tempApiKey/tempModel trim() drift in saveLLMConfig - Make OPENROUTER_ICON_URL module-private, clean up merge-artifact blank lines * chore: simplify changeset * style(inspector): apply prettier to shared-utils * fix(inspector): drop unused export on DEFAULT_BASE_URLS DEFAULT_BASE_URLS is only consumed by getDefaultBaseUrl in the same module. Knip flagged the export as unused and failed CI. * ci: retrigger after canary knip fix (#1533) --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): resolve CodeQL polynomial-regex alert in Ollama url normalizer (#1534) * fix(inspector): replace trailing-slash regex in Ollama url normalizer CodeQL flagged `/\/+$/` in `normalizeOllamaBaseUrl` as a polynomial regular expression on uncontrolled input. Swap the regex for an explicit linear scan and add unit tests covering the trimming behaviour plus a pathological-input case. * chore: drop unit test for trivial regex refactor * chore: drop accidentally committed .antigravitycli symlink * chore(typescript): version packages (canary) * chore: remove dead typescript-format-and-lint pre-commit hook (#1541) The hook entry pointed to `.git/hooks/typescript-pre-commit.sh`, a path that is never tracked and was never populated by any setup step, so the hook could not run for anyone. TypeScript formatting and linting are already handled by Husky (libraries/typescript/.husky/pre-commit), installed automatically via `pnpm install`'s `prepare` script. Closes #1536 * fix(inspector): stop ToolInputForm from mutating live tool inputSchema (#1545) * fix(inspector): stop ToolInputForm from mutating live tool inputSchema `ToolInputForm` was writing `required: boolean` onto each property of the live tool inputSchema during render. `required` is not valid as a per- property boolean — it belongs on the parent object as a `string[]`. Anthropic's draft 2020-12 validator rejected the resulting payload with `tools.0.custom.input_schema invalid`, breaking the Inspector chat after any tool had been opened in the Tools tab. Replace the mutation with a local `isRequired` const used only for the `*` indicator render. Fixes MCP-1970. * chore(inspector): trim comment on schema-mutation fix * chore: remove verbose comment * style(inspector): apply prettier to ToolInputForm * chore(typescript): version packages (canary) * Improve tab switch animation timing (#1544) * chore(ui): improve tab switch animation timing * chore(changeset): add changeset for tab animation improvement * chore(typescript): version packages (canary) * fix(inspector): propagate server alias updates through mcp server wrapper (#1539) * fix(inspector): propagate server alias updates through McpServerWrapper onUpdate * chore: add changeset for mcp-use server alias propagation fix --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * chore(typescript): add 3-day install cooldown via pnpm minimumReleaseAge (#1516) Blocks `pnpm install` from fetching npm versions published less than 3 days ago, mitigating supply-chain attacks where a malicious release is typically yanked within hours of discovery. The setting (introduced in pnpm 10.16) lives in pnpm-workspace.yaml — in modern pnpm only auth/registry config is read from .npmrc, so putting it there would be silently ignored. Workspace-published names (`mcp-use`, `@mcp-use/*`, `create-mcp-use-app`) are exempted so the cooldown never interferes with local development or fresh releases of our own packages. * fix(react): improve server management in McpClientProvider (#1561) Refactor server removal and update logic to use a ref for synchronous access to the latest server state. This change prevents React's warning about updating a component during rendering by ensuring that teardown side effects (`disconnect()` and `clearStorage()`) are executed outside of the state updater functions. The ref is updated in a useEffect hook to maintain the latest server state for event handlers. * chore(typescript): version packages (canary) * fix(inspector): forward MCP image tool results as image content (#1487) * fix(inspector): forward MCP image tool results as image content (MCP-1941) Previously, the inspector's chat loop and provider adapters serialized MCP tool results with JSON.stringify, which buried the base64 `data` field of `image` content blocks inside a text payload. Vision-capable models received a wall of base64 text instead of the image. Extract MCP `content` blocks into provider-neutral `ContentPart[]` and route image bytes through each provider's vision channel: - Anthropic: image blocks inside `tool_result.content` (base64 source). - OpenAI: tool role keeps text; image bytes forwarded as a follow-up user turn with `image_url` parts. - Google: `functionResponse.response` keeps text/metadata; image bytes forwarded as a follow-up user turn with `inlineData` parts. Text-only tool results keep the legacy `content: string` path on every provider. * style(inspector): apply prettier formatting * chore(inspector): drop unused export on collapseToString Only called internally by toolResultToContent — knip flagged it as an unused export. * fix(inspector): propagate MCP isError flag and fix image example tools - Add isToolResultError() helper and use it in toolLoop + replay so tool calls that return { isError: true } are flagged the same as thrown errors on both live and saved-conversation paths. - Pick a no-content fallback for OpenAI's tool role when there are no image parts to forward. - Replace via.placeholder.com URLs in the everything example with real base64-encoded bytes fetched from picsum.photos, since the image() helper expects MCP ImageContent base64 data, not URLs. * style(inspector): apply prettier formatting * chore(typescript): version packages (canary) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL (#1552) * fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL Browsers cannot resolve 0.0.0.0 as a destination, and the MCP SDK's OAuth resource validator does strict origin equality — so the inspector auto-connecting to http://0.0.0.0:PORT/mcp mismatches the resource metadata published as http://localhost:PORT (which goes through normalizeUrlHost in server-helpers.ts). Result: OAuth-protected mcp-use apps fail at the inspector's post-callback validation with "Protected resource X does not match expected Y". Mirror the existing normalization for the autoConnect URL and the banner log so both reflect the browser-reachable host. Closes #1551 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: add changeset for inspector autoConnect loopback normalization --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): align widget Vite base with /mcp-use/widgets (#1560) * fix(cli): align widget Vite base with /mcp-use/widgets/ when MCP_URL is set * chore: add changeset for cli widget base path fix * chore: format widget-paths.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(cli): headless screenshot with auto-sizing and external MCP server support (#1579) * feat(cli): headless screenshot command with auto-sizing and external MCP server support - Make width/height optional; when omitted, clips to the widget's natural rendered size by reading body[data-view-*] rect attrs set by the preview page - Add useBundleReadinessSignal in ViewPreview that uses ResizeObserver to wait for the iframe to stabilize before setting data-view-ready, serializing the iframe's bounding rect so the CLI can clip tightly instead of capturing the full viewport - Switch ViewPreviewBundle to displayMode="inline" so widgets auto-size to content height - Add inlineWidthOverride prop to MCPAppsRenderer to bypass the 768px inline cap when screenshotting at an explicit width - Fix extractViewName to handle external MCP server URIs (ui://<server>/<name>.html) by flattening to <server>-<name>; previously only ui://widget/ was handled, causing React Router to fail to match the preview route for third-party servers like Excalidraw * chore: add changeset for screenshot auto-sizing and external MCP fix * fix(cli): unexport CaptureScreenshotResult to satisfy knip * chore(typescript): version packages (canary) * feat(auth): enhance OAuth callback handling with improved state management and user feedback (#1580) * feat(auth): enhance OAuth callback handling with improved state management and user feedback - Introduced a module-level cache for in-flight authorization promises to prevent duplicate network requests during the same page load. - Added utility functions to determine if the current window is a popup and to render user-friendly messages for closing the window after authentication. - Improved handling of redirect flows and popup scenarios to ensure a seamless user experience, including error handling and messaging for lost opener situations. * fix(auth): BroadcastChannel fallback when popup opener is severed Popup callback now broadcasts success/failure over a same-origin BroadcastChannel("mcp_auth_callback") in the lost-opener branch, and useMcp subscribes to that channel alongside the existing window.message listener. Without this, popups whose window.opener was severed by COOP or cross-origin intermediate redirects would save tokens but leave the parent stuck in `authenticating`. Matches the dual-transport pattern used by oidc-client-ts and MSAL.js for the same COOP scenario. * chore(auth): unexport MCP_AUTH_BROADCAST_CHANNEL to satisfy knip It's only used inside callback.ts; the parent side hard-codes the same string in useMcp.ts. Removing the export drops knip's "unused export" finding while keeping a single source-of-truth comment that links the two files. * fix(mcp-use): split langchain agents out of mcp-use/browser entry Move MCPAgent, RemoteAgent, adapters, and observability to mcp-use/browser/agent so Next.js clients importing MCPClient only no longer pull @langchain/* into the browser bundle. * chore: format browser bundle test file * chore(typescript): version packages (canary) * fix(inspector): add copy button to user messages (#1556) * fix(inspector): add copy button to user messages Extract CopyButton into a shared component and add it to UserMessage, matching the existing assistant message UX. Resolves #1555 * chore: add inspector copy button changeset --------- Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(server): add publicLandingPage option for OAuth-protected servers (#1550) * feat(server): add publicLandingPage option for OAuth-protected servers * fix(server): keep public landing auth gate in oauth setup * docs(server): add public landing page example * chore(server): format mcp endpoint * chore(server): simplify accept header lookup * chore(server): restore mcp mount diff * fix(server): align oauth exports with canary * chore(server): format oauth exports * fix(server): remove unused oauth barrel exports --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * Move mcp-apps template pnpm settings to workspace config (#1602) * fix(inspector): widget fullscreen above embedded host chrome (MCP-2181) (#1605) * fix(inspector): portal widget fullscreen above host chrome MCP-2181: cloud chat headers at z-50 covered the fullscreen exit control because the overlay used z-40 inside a nested stacking context. Portals the fullscreen shell to document.body at z-[100], sets data-mcp-widget-fullscreen for hosts, and shows the Apps SDK exit navbar in CSS fullscreen fallback. * fix(inspector): native fullscreen first, no portal remount (MCP-2181) Revert conditional createPortal that remounted widgets on fullscreen toggle. Use requestFullscreen() as the primary path; apply CSS z-[100] overlay only when the API fails. Keep exit navbar and data-mcp-widget-fullscreen for both. * refactor(inspector): consolidate widget fullscreen into shared hook Extract useWidgetFullscreenControls for native-first fullscreen + CSS fallback. Removes duplicated handlers, unused helpers, and OpenAI edge-case branches from MCPAppsRenderer and OpenAIComponentRenderer. * fix(inspector): preserve widget state when entering fullscreen (MCP-2181) Route ui/request-display-mode through native fullscreen handling, target requestFullscreen on the iframe wrapper, and avoid resetting load state on display-mode-only changes. Stabilize OpenAI iframe listeners so chat re-renders do not flash the skeleton. * style(inspector): format OpenAIComponentRenderer for Prettier * fix(inspector): fullscreen shell includes navbar and fills viewport Promote the outer widget shell via requestFullscreen so FullscreenNavbar stays visible and bg-background fills the screen instead of browser black letterboxing around a nested iframe wrapper. * fix(inspector): PiP portal and sandbox remount bridge reconnect (MCP-2181) Port PiP to document.body with z-[100]. Re-run AppBridge when the sandbox iframe remounts; keep the host spinner until initCount recovers. Unify display-mode document attributes for optional host chrome hiding. * fix(inspector): resend widget data after PiP remount * chore(typescript): version packages (canary) * Hash Claude resource domains from authored ui.domain (#1599) * Apply Claude resource domain hashing for UI metadata * chore: format Claude domain helper * fix(inspector): drop unused widget-fullscreen exports to satisfy knip (#1607) widget-fullscreen.ts (added in #1605) exported several symbols that nothing outside the file consumes, plus pre-emptive @deprecated aliases for an API that never shipped. Only useWidgetDisplayModeControls is used (by MCPAppsRenderer and OpenAIComponentRenderer). - Unexport internal-only constants, the WidgetDisplayMode type, and the useWidgetDisplayModeDocumentChrome helper - Remove the dead useWidgetFullscreenControls / useWidgetFullscreenDocumentChrome aliases * test(agent): drop live Langfuse API integration tests (#1608) The observability integration tests queried the live Langfuse REST API (via getRecentTraces) to verify traces landed. cloud.langfuse.com has been returning 403 Forbidden for both ingestion and queries, failing the 'should send traces to Langfuse when observability is enabled' test and reddening canary CI. Remove the two tests that depend on the live API (the failing test and the already-skipped manual-trace test) plus the now-unused getRecentTraces helper. Keep the two tests that verify observability enable/disable behavior locally with no network dependency. * chore(typescript): version packages (canary) * fix(oauth): redact token verification errors (#1573) * fix(oauth): redact token verification errors * chore: add oauth error redaction changeset --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(inspector): skip emulate oauth tests in builtin e2e (#1609) * chore: add codex to gitignore (#1612) * fix(docs): update server API reference links (#1611) * fix(mcp-use): pin published dependency versions (#1610) * docs(changelog): document v1.29.0 / inspector v7.0.0 release TypeScript changelog gains a v1.29.0 entry (public landing pages, Supabase URL override, Claude UI-resource domain hashing, OAuth callback + React-provider hardening). Inspector changelog gains a major v7.0.0 entry (local Ollama provider, image tool results, MCP-server reconnect banner, widget fullscreen/PiP rework). * Fix builtin inspector auto-connect to use HTTP (#1613) * Switch builtin inspector auto-connect to HTTP * Use plain URL autoConnect in builtin e2e helper * Fix built-in inspector auto-connect to use HTTP * chore(typescript): version packages (canary) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: asim48-ctrl <asim48@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Truffle <truffleagent@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: SSharma1103 <shivamsharma11032009@gmail.com> Co-authored-by: Polæ <steven@polae.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> Co-authored-by: Udaykumar Dhokia <udaykumardhokia@gmail.com> Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Jefsky Wong <hwj3344@hotmail.com> Co-authored-by: Jefsky <jefsky@users.noreply.github.com> Co-authored-by: Ritwij Aryan Parmar <88580521+RitwijParmar@users.noreply.github.com> |
||
|
pietrozullo
|
1092e1e5e9 | Remove launch week banner from docs | ||
|
Pietro Zullo
|
8348c59a53 |
docs: reorganize, fix accuracy, and update for agent readability (#1502)
* docs: reorganize navigation and clean up content - Remove 'Misc' group with misplaced blog posts - Remove 'Libraries' redirect group from Home nav - Simplify 'Dev Tools' group (flatten Inspector, CLI, Tunneling) - Remove individual changelog versions from Python nav (keep summary) - Remove changelog from TypeScript 'Get Started' group - Remove tunneling duplicate from Python Development group - Rewrite mcp101 as clean MCP concepts page (was pitch deck) - Delete typescript/blog posts (not technical docs) - Add redirects for deleted blog post URLs * docs: fix content accuracy and remove sloppy language - Fix broken python/server/mcp-apps link in home page - Remove informal pitch-speak from python/server/index.mdx - Fix grammar error in typescript/server/index.mdx - Update typescript/client/logging.mdx: remove fake 'coming soon' API code - Fix non-existent model name gpt-5.1 in typescript quickstart - Fix mcp_use naming in development contributing guide * docs: fix incorrect TypeScript server API calls in inspector docs - Replace server.addTool() with server.tool() (correct mcp-use API) - Add missing zod import to debugging-chatgpt-apps example * docs: fix fake model names (gpt-5.1 → gpt-4o) in agent docs * docs: update model names, fix APIs, and add agent visibility hints - Replace all deprecated model names with latest: gpt-4.1, gpt-4.1-mini, claude-sonnet-4-6, claude-opus-4-7, gemini-2.5-flash across all docs - Fix TypeScript server.tool() API in installation.mdx (old positional string form) - Fix TypeScript agent.run() in quickstart.mdx (deprecated string form → object) - Remove broken manufact.com/docs/llms.txt hidden hints from 5 pages - Add <Visibility for="agents"> block to mcp101.mdx with install commands, key classes, and API signatures for agent-oriented navigation - Add LangChain provider install note to Python quickstart (mcp-use agent requires a separate langchain-* provider package) - Update model name cards in Python llm-integration.mdx * docs: clean up remaining stale model names and improve accuracy - Update supported model lists in Python and TypeScript llm-integration pages - Fix cost optimization table to use current model IDs - Update TypeScript agent overview supported providers list * docs: add LangChain provider install to TypeScript quickstart agent section The MCPAgent requires a separate @langchain/* provider package; this was not mentioned before the code example that imports from @langchain/openai. * docs: update to latest flagship model IDs (May 2026) - OpenAI: gpt-4.1 → gpt-5.5, gpt-4.1-mini → gpt-5.5-mini - Google: gemini-2.5-flash → gemini-3.1-flash, gemini-2.5-pro → gemini-3.1-pro - Groq: llama-3.1-* → llama-4-scout-17b-16e-instruct - Anthropic (claude-opus-4-7, claude-sonnet-4-6) already current, no change * docs: replace all em dashes with hyphens * docs: restore llms.txt hints using Visibility component * docs: simplify TypeScript logging page to unsupported notice only * docs: rewrite mcp101 to explain MCP protocol with mcp-use examples and doc links * docs: remove goal.md * docs: revert nav changes, keep only Misc group removal and blog redirects * docs: reorder mcp101 to Server/App -> Client/Inspector -> Agent, restore title * docs: add code examples for Resources and Prompts in mcp101 * docs: remove em dashes from mcp101 * docs: add MCPClient code examples to mcp101 * docs: add React client example to mcp101 * docs: add agent code examples to mcp101 * docs: expand MCP Apps section in mcp101 with example and links * docs: restore Contacts, Socials, and Founders sections to mcp101 * docs: add context-setting intro paragraph to mcp101 for new readers * docs: add MCP stores section to mcp101 intro with Claude, ChatGPT, Cursor * docs: fix Claude store link * docs: fix ChatGPT store link * docs: fix Cursor store link * docs: replace store Cards with linked image grid * docs: add captions to store images * docs: add Notifications to client primitives table in mcp101 * docs: add lead-in paragraph before resource cards at bottom of mcp101 * docs: move resource cards to end of page after Contacts/Socials/Founders * docs: demote Contacts/Socials/Founders to bold text to remove from TOC * docs: move Contacts/Socials/Founders to very end of mcp101 * docs: add Resources and Contacts section headers, link official MCP docs * chore(docs): update site metadata, footer links, and rename mcp_use to mcp-use * update docs metadata + images * docs: enhance MCP section by highlighting the reach of MCP stores with 1 billion weekly active users * api ref |
||
|
pietrozullo
|
7e8919bed3 | chore(docs): integration | ||
|
Andrew Khadder
|
78cfc8a74d |
Canary (#1434)
* feat(mcp-use): add Clerk OAuth provider for TypeScript (#1429) * feat(mcp-use): add Clerk OAuth provider * docs: add Clerk OAuth provider documentation page * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(cli): propagate --env/--env-file to server on deploy redeploys (#1433) The deploy command only forwarded `--env`/`--env-file` values when creating a brand-new server (where they ride on the createServer body). On redeploys to an existing linked server, env vars were parsed and shown in the preview, then silently dropped before createDeployment. Now upserts each entry against /api/v1/servers/{id}/env-variables (PATCH for existing keys, POST for new ones) before triggering the deployment. Closes MCP-1995 * chore(typescript): version packages (canary) * chore(typescript): adopt Knip to find and remove unused code (#1359) * chore(typescript): adopt knip at workspace root Add Knip as a dev dependency at the TypeScript workspace root with a root-level knip.json covering all packages. Consolidates the existing per-package Knip setup in @mcp-use/inspector into the shared config and delegates its check-deps script to the root install. Adds `pnpm knip`, `pnpm knip:deps`, and `pnpm knip:production` scripts and documents them in the TypeScript README. Baseline configuration suppresses known false positives (build-generated version.js, Tailwind/ Scarf deps, nested example and template workspaces, test helpers and servers). Actual dead-code removal is deferred to follow-up PRs. Refs MCP-1707 * ci: add warning-only Knip step Runs `pnpm knip --no-exit-code --no-progress` on TypeScript-affecting PRs/pushes and writes the report to the GitHub Actions step summary. Stays non-blocking by design — tighten to a failing check once the baseline cleanup PRs land. * chore(inspector): drop redundant check-deps script Root-level pnpm knip:deps already covers all workspaces, so the inspector-only wrapper just duplicated the same delegation. Devs needing scoped output can use pnpm knip --workspace packages/inspector. * chore(typescript): drop changeset for dev-only knip adoption * feat(inspector): support custom base URL for OpenAI-compatible providers (#1437) * feat(inspector): support custom base URL for OpenAI-compatible providers * feat(inspector): add support for OpenAI-compatible providers with configurable base URL Co-authored-by: Copilot <copilot@github.com> * refactor(inspector): simplify openai-compatible plumbing - Widen ProviderName union to include "openai-compatible" and drop the resolveProvider helper; the providers dispatcher fall-throughs from "openai-compatible" to the openai impl, so callers can pass the UI provider name straight through. - openai.ts: extract buildEndpoint/buildHeaders, strip trailing slashes on baseUrl, and skip Authorization header when apiKey is empty. - ConfigurationDialog: defensive parsing of /models response, surface CORS hint on fetch failure, mention CORS requirement in helper text, move "OpenAI Compatible" to end of dropdown. - useConfig: persist openai-compatible base URL per-provider in localStorage (mirrors api keys), restore on switch + cross-tab sync. - Drop openai-compatible logo references in ChatHeader / ChatLandingForm / ConfigurationDialog dropdown. * style(inspector): apply prettier formatting * chore(changeset): bump @mcp-use/inspector to minor for openai-compatible provider --------- Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat: integrate OpenRouter as a first-class LLM provider (fixes #1402) (#1403) * feat(inspector): integrate OpenRouter as a first-class LLM provider Adds OpenRouter to the inspector chat configuration. Selecting OpenRouter routes through the existing OpenAI provider with an override base URL and the required HTTP-Referer / X-Title headers, so users get multi-model access (OpenAI, Anthropic, Google, etc.) from a single API key without duplicating provider plumbing. Co-authored-by: Andrew Khadder <andrew@mcp-use.com> Closes #1402 * fix(inspector): use inspector.mcp-use.com as OpenRouter HTTP-Referer * feat(inspector): swap OpenRouter favicon.ico for inline gray SVG Drops the runtime fetch to openrouter.ai/favicon.ico in favor of an inline data-URL'd SVG with a neutral #94A3B8 fill. Follow-up will lift this onto the provider CDN alongside the other provider marks. * fix(inspector): stop OpenRouter SVG curves from being implicitly filled The two arrow-body paths are open curves; with the parent svg's fill set, the browser implicitly closed them and filled the resulting region, producing visual artifacts at small sizes. Mark those two paths fill="none" so only their strokes render. * fix(inspector): use OpenRouter SVG in ChatLandingForm chip The landing-form provider chip was hardcoded to the CDN png URL, which 404s for the openrouter provider and rendered a broken-image blob clipped by rounded-full styling. Match the ChatHeader behavior and fall back to OPENROUTER_ICON_URL. * fix(inspector): set OpenRouter X-Title to mcp-use Inspector * refactor(inspector): drop OpenRouter baseUrl path special-case Set OpenRouter's baseUrl to the API root (/api/v1) and let buildEndpoint append /chat/completions like the rest of the OpenAI-compatible flow, removing the includes("/chat/completions") short-circuit that only existed to defuse the path baked into the override. * style(inspector): apply prettier formatting * chore(inspector): drop redundant baseUrl jsdoc comment --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(auth): pre-registered OAuth client credentials and scopes in Inspector (#1400) * feat(auth): pre-registered OAuth client credentials and scopes Wires clientId, clientSecret, and scope end-to-end from the Inspector's Authentication dialog through useMcp into BrowserOAuthClientProvider's staticClientInfo. When clientId is set the SDK skips Dynamic Client Registration (required for proxy-mode servers like Slack/WorkOS that strip registration_endpoint). When clientSecret is also set, the SDK auto-switches token-endpoint auth from "none" to client_secret_basic / client_secret_post, supporting providers that don't support PKCE. * refactor(inspector): extract OAuthStaticConfig type and builder helper Replaces six inline copies of `{ clientId?; clientSecret?; scope? }` and two copy-pasted trim+spread builders with a shared `OAuthStaticConfig` type and `buildOAuthStaticConfig()` helper in connectionUpdates.ts. Also widens ServerConnectionModal's connection/onConnect types so the `as { oauth?: ... }` structural cast can go away (the modal was passing oauth in the spread without declaring it on the callback type). * docs: document pre-registered OAuth client credentials Updates client authentication, useMcp, and inspector connection-settings docs to cover the new oauth.{clientId, clientSecret, scope} option and the proxy-mode/confidential-client cases it unlocks. Replaces the inaccurate snake_case OAuth params table with the actual camelCase API shape. * chore(typescript): version packages (canary) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry (#1443) * fix(inspector): honor MCP_USE_ANONYMIZED_TELEMETRY in browser telemetry The env var previously disabled Node-side telemetry and the inspector's server-side proxy, but the in-browser posthog-js init triggered by useMcp still fired POSTs to https://eu.i.posthog.com that ad/tracker blockers flag. The inspector server now mirrors the env var into a runtime flag (window.__MCP_USE_ANONYMIZED_TELEMETRY__) and localStorage before the client bundle runs; both mcp-use's browser telemetry and the inspector's own client telemetry honor that flag, so a single env var disables every telemetry path. * fix(inspector): drop sticky localStorage write; honor opt-out in Vite dev The previous revision mirrored MCP_USE_ANONYMIZED_TELEMETRY=false into localStorage, which persisted across sessions even after the env var was unset. Switch to a per-page window flag only — unsetting the env var fully restores defaults on the next page load. Also extend the opt-out to pure-Vite dev mode via a transformIndexHtml plugin, so the env var works whether the inspector is served by the backend or by Vite directly. * chore(typescript): version packages (canary) * fix(inspector): drop trailing-slash regex flagged by CodeQL The /\/+$/ regex on user-supplied base URLs triggered js/polynomial-redos. Most servers normalize a double slash in `${baseUrl}/path` fine, so just drop the stripping rather than working around the alert. * docs(changelog): add v1.27.0 / inspector v5.0.0 release notes --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Siddhant Rai <47355538+siiddhantt@users.noreply.github.com> Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com> |
||
|
Luigi Pederzani
|
6b2db4a2b0 |
docs: reorganize docs and examples around MCP Servers + MCP Apps (#1363)
Reshape docs, examples, and indexes to mirror the README narrative:
MCP Servers + MCP Apps are primary; MCP Agent and MCP Client are
present but secondary. Remove duplicated concepts, deprecated pages,
and stale examples; add redirects for removed paths.
Docs
- Rewrite home/index.mdx: tagline + MCP Server / MCP App split cards,
quickstart tabs, MCP Apps widget snippet, Templates teaser, Inspector,
Deploy, Agent+Client in a collapsed accordion.
- New home/templates.mdx gallery (Chart Builder, Diagram Builder, Slide
Deck, Maps Explorer, Widget Gallery, and more) with demo URLs and
deploy buttons, mirroring the README.
- Simplify python/typescript welcome.mdx: drop duplicated "What is MCP?"
/ "Why mcp-use?" (single pointer to home/mcp101); server-first Next
Steps; fix broken Python links.
- docs.json: Home product reshaped (Welcome, MCP Apps, Templates, Dev
Tools + CLI reference, Concepts, Libraries, Misc). Python
Integrations collapsed into MCP Agents → LLM Adapters.
fastapi_mount added to Python MCP Server Overview. TS MCP Apps adds
creating-mcp-apps-server; OAuth Providers gets keycloak + custom.
Empty API Reference, misrouted Community, and Blog tabs removed from
TS SDK.
- Delete: ui-widgets.mdx, mcp-ui-resources.mdx,
comparison-with-other-implementations.mdx, api-reference.mdx (empty),
typescript/development/security.mdx, python/blog/middleware.mdx,
python/server/auth/index.mdx.
- Redirects: old paths → current equivalents.
- CLI reference: new "What's New" card group (HMR, --tunnel, skills
add, generate-types); cross-link from `start` to Tunneling guide.
Examples
- Rewrite libraries/typescript/.../examples/server/ui/mcp-ui/ as a
programmatic MCP Apps widget gallery (welcome-card, quick-poll,
task-card) using server.uiResource({ type: "mcpApps", htmlTemplate }).
Removes deprecated UIResource / rawHtml / remoteDom patterns.
- Delete empty server/ui/apps-sdk/.
- Fix stale docs URL in server/ui/mcp-apps/apps-sdk/index.ts.
- Update examples/README.md and TS examples README: add Templates
pointer (github.com/mcp-use/mcp-use#templates + docs/home/templates),
list previously-missing examples (mcp-apps, files, model-context,
middleware, session-management, better-auth, Python orphans), flag
apps-sdk as legacy.
|
||
|
Andrew Khadder
|
1bdec92bae |
Canary (#1387)
* fix(cli): add auto-port discovery to mcp-use start command (#1377) * fix(cli): add auto-port discovery to mcp-use start command When port 3000 (or the configured port) is already in use, the start command now automatically finds and uses the next available port instead of failing silently — matching the behavior already present in dev. * chore: add changeset for auto-port discovery fix in cli * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(cli): add ORG column to deployments list (#1378) * feat(cli): add ORG column to deployments list output Closes #1673 * chore: add changeset for deployments list ORG column * chore(typescript): version packages (canary) * feat(cli): add --org flag to login for non-interactive org selection (#1379) * feat(cli): add --org flag to login for non-interactive org selection (MCP-1670) Agents invoking `mcp-use login` could authenticate in the browser but then got stuck on the post-login org picker because they have no way to write to the running process's stdin. `--org <slug|id|name>` now picks the organization up-front and skips the prompt, matching the resolver already used by `mcp-use deploy --org`. When login runs without a TTY and no `--org` is supplied, the command now fails fast with a message pointing at the flag instead of hanging. The org resolver is extracted into a pure `resolveOrgFromOption()` helper in `src/commands/auth.ts`, covered by real unit tests in `tests/auth.test.ts`. * refactor(cli): dedupe org-resolution logic via resolveOrgFromOption Reuse the helper added for `login --org` from `deploy --org` and `applyOrgOption` (used by `servers`/`logs`/`env`) so the slug/id/name matching lives in one place. Also tighten a JSDoc and fix a misleading test name. * style(cli): apply prettier formatting to resolveOrgFromOption * test(cli): use generic 'Personal' org name in auth test fixtures * fix(cli): surface org-selection errors from login instead of swallowing them The try/catch around testAuth also wrapped the new org-selection branches, silently eating the "--org not found" and "no TTY for interactive selection" throws and leaving the user logged in without an org. * chore(typescript): version packages (canary) * feat(cli): drop-in MCP server inside Next.js apps via --mcp-dir (#1332) * feat(typescript): Add scopes customization to oauth providers * refactor: move scopesSupported to BaseOAuthConfig and remove test file * feat(typescript): add scopesSupported to better auth provider * fix: return scopesSupported properly for Better Auth provider factory * docs(oauth): add scopesSupported to provider docs * chore: format * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(typescript): add missing fields to CustomProviderConfig to match docs (#1136) The Custom Provider docs show config fields (userInfoEndpoint, jwksUri, clientId, clientSecret, mode, scopes, audience) that don't exist in the code. This adds all documented fields to CustomProviderConfig and CustomOAuthConfig, implements the corresponding getters on CustomOAuthProvider, and resolves alias pairs (jwksUrl/jwksUri, scopes/scopesSupported). * style: fix prettier formatting in custom oauth provider * fix: add OAuthProvider interface methods and fix unsafe type casts - Add getClientId(), getUserInfoEndpoint(), getAudience() as optional methods on OAuthProvider interface so new CustomOAuthProvider getters are callable without type casting - Make CustomOAuthConfig.jwksUrl optional (users provide their own verifyToken, JWKS URL isn't always needed) - Fix jwksUrl fallback from empty string to undefined in factory to avoid silent runtime failures - Replace unsafe (provider as any).config?.clientId with type-safe provider.getClientId?.() in routes.ts - Add getClientId() to WorkOSOAuthProvider for the pre-registered client detection in direct mode metadata * fix(typescript): remove scopes alias from CustomProviderConfig in favor of scopesSupported * fix(typescript): remove jwksUri alias from CustomProviderConfig in favor of jwksUrl * chore: update changeset to reflect jwksUrl and scopesSupported field names * fix: inline jwksUrl and scopesSupported in CustomOAuthProvider constructor * fix: simplify oauthCustomProvider by spreading config into constructor * fix: remove redundant comments from CustomProviderConfig * chore(typescript): version packages (canary) * fix(inspector): hide thinking indicator when assistant message has parts (#1315) * fix(inspector): hide thinking indicator when assistant message has parts When streaming via the server-side path, content is delivered through the parts array while the message's content field stays empty until the stream reader fully closes. The isThinking check only looked at content, causing a window where the thinking indicator reappeared after the done event but before setIsLoading(false) ran in the finally block. Now we check parts first — if any parts exist, the model has produced output and we should not show the thinking indicator. * chore: add changeset for thinking indicator fix * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in Google provider (#1317) * fix(mcp-use): use catchall instead of z.record() to avoid propertyNames in JSON Schema output z.record() in @langchain/core's serializer emits a `propertyNames` keyword for constrained or enum key types. Google's Generative AI API rejects schemas containing `propertyNames`, breaking tool calls when using the Google provider. Switching to z.object({}).catchall() produces identical runtime behavior but serializes to clean `additionalProperties` without `propertyNames`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: add changeset for Google provider propertyNames fix --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(typescript): version packages (canary) * Major/cli/device flow (#1294) * fix(inspector): sync URL tab param on tab change to preserve state on refresh When switching tabs via header clicks, keyboard shortcuts, or command palette, only React state was updated but the URL was not. This meant refreshing the page would lose the active tab. Now all tab changes also update the ?tab= query parameter using navigate() with replace:true. Closes #1157 * fix: update import paths for Windows compatibility and modify postins… (#1255) * fix: update import paths for Windows compatibility and modify postinstall script in package.json templates - Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms. - Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation. * fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility - Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems. * changeset * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * chore: add changeset * chore(typescript): version packages (canary) * feat(auth): enhance login command with API key option and implement device code flow - Updated the login command to allow non-interactive login using an API key. - Introduced device code flow for authentication, including functions to request device codes and poll for access tokens. - Refactored API key creation to use access tokens and updated related utility functions for better authentication handling. * refactor(cli): improve code formatting and readability in authentication commands - Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks. - Removed unused import in `auth.ts` to clean up the codebase. - Enhanced error messages for clarity in authentication processes. * refactor(logging): change logger level from info to debug for various messages - Updated multiple logging statements across the codebase to use `logger.debug` instead of `logger.info` for routine messages, enhancing log clarity and reducing noise in production logs. - This change applies to session management, agent initialization, and connection handling, ensuring that only significant events are logged at the info level. * fix(oauth): correct Auth0 issuer handling and improve token validation - Updated the Auth0 issuer to include a trailing slash to comply with token validation requirements. - Separated baseUrl from issuer to prevent double-slash URLs in JWKS, auth, and token endpoints. - Added direct mode for the Auth0 provider to enable MCP clients to communicate directly for OAuth flows. - Enhanced protected resource metadata to include scopes_supported, ensuring clients request appropriate scopes during authorization. * update * lint --------- Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> * chore(typescript): version packages (canary) * refactor(cli): update authentication and organization handling (#1326) - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * fix(inspector): use correct OAuth callback URL when mounted at /inspector (#1323) * fix(inspector): use correct OAuth callback URL when mounted at /inspector The BrowserOAuthClientProvider defaulted redirect_uri to /oauth/callback but the React Router (basename="/inspector") only mounts OAuthCallback at /inspector/oauth/callback, causing a blank screen after auth. Root fix: add defaultCallbackUrl prop to McpClientProvider so the inspector declares the correct path once at the provider level. All addServer calls inherit it automatically — no per-connection wiring needed. Removes the "Redirect URL" field from the auth dialog: it was never actually passed to the connection and couldn't be set to a value the inspector would handle. * chore: bump mcp-use changeset to minor (new public API prop) * docs: document defaultCallbackUrl in McpClientProvider; remove redirectUrl from inspector connection-settings * chore(typescript): version packages (canary) * Device flow 2 (#1329) * refactor(cli): update authentication and organization handling - Replaced ProfileInfo with OrgInfo in authentication and organization commands to better reflect the context of the data being handled. - Updated promptOrgSelection function to work with organizations instead of profiles, including changes to the related logic for selecting and displaying organizations. - Refactored loginCommand to utilize organization data, ensuring the correct organization is set in the configuration. - Adjusted API interactions to align with the new organization structure, including updates to the config management for backward compatibility. - Cleaned up unused comments and improved code readability across affected files. * refactor(cli): streamline organization ID resolution in deploy command - Replaced the previous method of resolving the organization ID with a direct call to api.resolveOrganizationId() for improved clarity and efficiency. - Removed unnecessary comments and code related to organization ID handling, enhancing overall code readability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Fix/cli/git create (#1331) * refactor(cli): enhance deployment command and GitHub integration - Added new GitHub API methods for creating repositories and retrieving installation IDs. - Introduced git utility functions for initializing repositories, adding remotes, and committing changes. - Improved environment variable parsing and error handling in the deployment command. - Cleaned up code for better readability and maintainability. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deployment command options and improve code readability - Added a new option for specifying the deployment region in the CLI. - Rearranged and cleaned up command options for better organization. - Improved error handling and logging in the deployment process. - Refactored code for better readability and maintainability across several files. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(cli, mcp-use): drop-in MCP server inside Next.js apps Adds a --mcp-dir flag to `mcp-use dev/build/start` and matching mcp-use.config.json `mcpDir` option so a developer can drop a single `src/mcp/` folder into an existing Next.js repo and get a working MCP server + widgets — no sibling package, no restructure, no second codebase. CLI (@mcp-use/cli) - New `--mcp-dir <dir>` flag on dev/build/start. When set, defaults the server entry to `<dir>/index.ts` and the widgets dir to `<dir>/resources`. `mcp-use.config.json` supports the same value via a new `mcpDir` field. - Widget Vite builds now register `vite-tsconfig-paths` against the project's tsconfig when present, so widgets can `import '@/components/...'` and resolve through the app's own paths. Tailwind `@source` also scans the project's `src/` so classes on shared components come through. - Auto-shim Next.js server-runtime modules when `next` is detected in the project's package.json: `server-only`, `client-only`, `next/cache`, `next/headers`, `next/navigation`, `next/server`. Ships both an ESM loader (for `import`) and a CJS `Module._resolveFilename` patch (for the `require()` calls tsx emits when compiling TS in a non-`type: module` package). Covers both the HMR in-process path and the tsx-watch subprocess path via `NODE_OPTIONS`. - Loads Next.js's env cascade (`.env` / `.env.development` / `.env.local` / `.env.development.local`) so tools transitively imported from the app find the vars they expect without the user mirroring them by hand. - Replaces tsImport-with-namespace (which causes tsx's resolver to bail on transitive `@/*` imports) with a namespace-less tsx/esm + tsx/cjs register pair, then native dynamic `import()` with `?t=` cache-busting on reload. This is what finally makes `@/lib/...` imports resolve in HMR mode. mcp-use (runtime) - `mountWidgets` at both call sites in MCPServer now reads `process.env.MCP_USE_WIDGETS_DIR` (set by the CLI when --mcp-dir is used) as the default. Nothing in user code changes. - `mount-widgets-dev.ts` loads `vite-tsconfig-paths` from the user's project when a root tsconfig.json exists and installs it in front of the dev Vite server's plugin chain. The hardcoded `"@": resources` alias now only fires as a fallback. Tailwind `@source` auto-extends to scan `<projectRoot>/src` under the same conditions. Validated end-to-end against a real Next.js 16 + React 19 app: node .../cli/dist/index.cjs dev --mcp-dir src/mcp → tsx resolves @/lib/assistant/tools through project tsconfig → server-only / next/cache / next/headers shims pass → .env.local loads (FLAGS, Supabase keys) → tools/list returns both tools with correct Apps SDK widget metadata → tools/call returns structured props + text output → /mcp-use/widgets/contact_card/ serves the widget HTML with @/components resolved via the project's own tsconfig paths * fix(inspector): detect Hono via duck-typing, not instanceof `mountInspector(app)` chooses between a fast Hono-direct path and a slow Express-compat bridge based on `app instanceof Hono`. When the host (`mcp-use`) and `@mcp-use/inspector` resolve different copies of `hono` from `node_modules` — common in apps with deps that pin their own hono version (`@hono/node-server`, `@browserbasehq/stagehand`, etc.) — `instanceof` returns false even for a real Hono app. The Express bridge then runs against a Hono `Context` and crashes on every request trying to read `req.headers.host`. Switch to a duck-type check: Hono exposes `.fetch(Request) => Response`, Express does not. The check is unambiguous in practice and works regardless of which physical hono module produced the app. Surfaces in the new Next.js drop-in flow (--mcp-dir) because Next.js apps invariably have other deps that bundle hono. * fix(widgets): pin React across HMR reloads to keep hooks dispatcher alive When a widget lives in an existing app (the --mcp-dir drop-in flow), Vite's walk-up react resolution from `.mcp-use/<widget>/` could land on a different physical `node_modules/react` than the one item-brain's shared components see. After an HMR re-optimize, the new React module instance replaced the running one and React's hooks dispatcher snapped to null, producing "Cannot read properties of null (reading 'useState')" on the next render. First load was fine; only post-edit renders crashed. Pin react / react-dom / react/jsx-runtime / react/jsx-dev-runtime to the absolute paths of the user-project's installed copies via a tiny `resolveId` plugin scoped to client (browser) resolution only. SSR mode deliberately falls through to default resolution because the metadata- extraction pass uses `ssrLoadModule` and ESM-evaluating CJS `react/index.js` crashes with `module is not defined`. The plugin honors `options.ssr` and returns `null` in that case; SSR also gets react/react-dom marked as external for belt-and-braces. Validated on a real Next.js 16 + React 19 app: edit the widget tsx mid-flight → no React errors, widget HTML still serves 200, tools/call returns updated structuredContent. * fix(widgets): rely on Vite dedupe instead of pinning React paths The previous fix pinned `react` and `react-dom` to the user-project's absolute file paths via a custom `resolveId` plugin. That made Vite serve the raw CJS files via `@fs/`, skipping the optimizeDeps pre-bundling that converts them to ESM with named exports. Result: the browser failed with "does not provide an export named 'jsxDEV'" (the first React subpath it tried to load) and would have failed on `react/index.js` next ("module is not defined") because the raw CJS has no ESM default export. Drop the plugin and broaden Vite's `dedupe` list to cover every React entrypoint the widget code might import: react react-dom react/jsx-runtime react/jsx-dev-runtime react-dom/client `dedupe` ensures Vite resolves a single instance of each module regardless of importer location, which is what protects the hooks dispatcher across HMR cycles. The original concern (duplicate React post-edit producing "Cannot read properties of null (reading 'useState')") is the dedupe contract — `dedupe` is the supported way to enforce it, and it doesn't bypass optimizeDeps. Also drop the now-unused SSR external for React (added defensively when the alias was breaking SSR; no longer relevant). Verified end-to-end: react/react-dom/jsx-dev-runtime all serve from .vite/deps/*.js?v=<hash> (pre-bundled ESM), HMR cycle clean, no useState/jsxDEV errors after editing the widget mid-flight. * chore: address PR review + fix prettier/CI Prettier: - `prettier --write` on the three files flagged by format:check (cli/src/index.ts, cli/src/utils/project-config.ts, mcp-use/src/server/widgets/mount-widgets-dev.ts). No logic changes. project-config.ts: - `loadProjectConfig`: distinguish ENOENT from JSON parse errors. Malformed mcp-use.config.json now throws `Invalid JSON in <path>: <reason>` instead of being silently ignored. - `resolvePort`: validate each source (CLI flag, PORT env, config.port) against `Number.isInteger(…) && 0 ≤ n ≤ 65535`. Invalid values at one level fall through to the next, so `--port abc` or `PORT=abc` no longer advertise NaN. - Tests: add `tests/project-config.test.ts` — 23 unit tests covering `loadProjectConfig` (missing / valid / malformed), `resolveMcpDir`, `resolveWidgetsDir`, `resolveEntryFile` (every precedence level + mcpDir-specific errors + legacy fallback), and `resolvePort` (NaN handling + out-of-range + per-source fallthrough). mcp-server.ts: - `mountWidgets` call: match the comment's intent by only forwarding `resourcesDir` when `MCP_USE_WIDGETS_DIR` is set. When unset, `mountWidgets` applies its own default, so the spread pattern keeps the runtime behavior identical while letting future default-logic changes take effect. mount-widgets-dev.ts: - `vite-tsconfig-paths` resolution now falls back to `@mcp-use/cli`'s bundled copy when the user's project doesn't have it installed directly. pnpm/strict hoisting configurations couldn't resolve it through `userProjectRequire` alone, which silently dropped `@/*`-alias support for Next.js drop-in projects. - Extract the Tailwind `@source "<projectSrc>"` line computation into a module-level `computeProjectSrcSourceLine` helper. Both CSS generation sites (initial mount + on-the-fly HMR) now call the same function, which also fixes the indentation mismatch Copilot flagged in the second block. * fix(cli): drop shadowed require("node:url") in HMR onImport callback The outer destructure at the top of the HMR block already pulls in `fileURLToPath` from `node:url`. The inline `require("node:url")` inside the `onImport` callback re-declares it (making the outer binding unused) and uses CJS `require()` in an ESM file — tripping two eslint rules: - @typescript-eslint/no-unused-vars on the outer `fileURLToPath` - @typescript-eslint/no-require-imports on the inner require Use the outer binding directly. Functionally identical; eslint clean. * fix(cli): make `build` and `start` work for --mcp-dir projects Two shared failures for drop-in Next.js projects: 1. `generateToolRegistryTypesForServer` still used tsx's `tsImport`, which wraps tsx in a generated namespace. tsx's resolver then bails with `return nextResolve(...)` for any specifier whose parent URL doesn't carry that namespace — so transitive `@/lib/...` imports from the user entry never hit tsx's tsconfig-paths resolver and fail with `Cannot find package '@/lib'`. Mirror the dev-path fix: detect Next.js, install the server-runtime shims in-process, namespace-less `tsx/esm/api.register()` + `tsx/cjs/api.register()`, then native dynamic `import()`. 2. `transpileWithEsbuild(projectPath)` tried to walk every `.ts`/`.tsx` file in the project's `tsconfig.include` patterns. For a Next.js app that's `src/app/**/*`, `tailwind.config.ts`, RSC-only files, etc. — none of which are meant to be runtime-compiled by an MCP build. esbuild chokes on the first `require()` it sees in `tailwind.config.ts` and prints `Cannot find tsconfig file "tsconfig.json"`. Fix: in `--mcp-dir` mode, skip the full-project transpile and skip the `tsc --noEmit` type-check (the host Next.js app owns both). Record the `.ts` source as the entry point in the manifest. `mcp-use start` then runs it through tsx at boot — same setup as `mcp-use dev`, minus HMR — so the `@/*` aliases and the Next.js server-runtime shims are active in production too. Start's entry resolution now also includes `<mcpDir>/index.ts` / `.tsx` as fallback candidates, and spawns `node <tsx-bin> <file>` (with `withNextShimsEnv`) when the resolved entry is a TS file. Also: stop swallowing `findServerFile` errors silently. A misconfigured `--mcp-dir` previously cascaded into a manifest without an `entryPoint` and a confusing "No built server file found" at start time. Now it logs the underlying error immediately. * feat(inspector): improve navbar UX with smart tab collapsing, deploy button, settings menu, and expanded telemetry UI changes: - Move Chat tab to first position with always-expanded label and separator - Active tab label stays visible when navbar is collapsed - Add Deploy button linking to manufact.com/signup with inspector referrer - Move Tunnel button between Add to Client and Deploy, restyle with violet theme - Show Tunnel button in mobile layout - Consolidate theme toggle, command palette, and GitHub into a settings dropdown - Add "Report a Bug" menu item pre-filling GitHub issue with inspector label New telemetry events: - mcp_tunnel_action: track tunnel start/stop with success status - mcp_deploy_click: track Deploy button clicks with referrer - mcp_chat_configured: track chat API key setup (provider + model, no API key) - mcp_tab_navigation: track tab switches with previous/current tab - mcp_add_to_client: track which client users connect to (cursor, vscode, claude, etc.) - mcp_session_duration: fire on page unload with duration, tabs visited, tools executed Wired up existing unused events: - mcp_server_connection: fires when server transitions to ready (deduplicated) - mcp_server_removed: fires when user removes a server Engagement/retention metrics computable in PostHog from existing user_id (localStorage). * feat(inspector): add inspector environment to telemetry * chore: fix lint * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(react): restore window.fetch interceptor when useMcp unmounts (Via Proxy → Direct) (#1337) * fix(react): restore window.fetch interceptor when useMcp unmounts When a proxy-mode connection is torn down (e.g. switching from "Via Proxy" to "Direct" in the inspector), the BrowserOAuthClientProvider's window.fetch interceptor was never removed. The new direct connection would then route its OAuth discovery requests through the old proxy, which rewrites the `resource` field to the proxy URL, causing the "Protected resource does not match" error. Fix: call restoreFetch() in the useMcp useEffect cleanup so the interceptor is always torn down when the hook unmounts. Closes #1334 * chore: add changeset for proxy fetch interceptor teardown fix * fix(tests): count all console channels in useMcp logLevel isolation test The per-instance isolation test compared cumulative console.log counts before and after rendering a logLevel: "debug" instance. Debug-level output routes to console.debug, not console.log, so the counter never moved and `0 > 0` failed once .tsx tests started running. Snapshot log/info/debug/warn counts after the silent render (asserting all four are 0 — silent really is silent), then take the delta on log/info/debug after the debug render and assert > 0. * chore(typescript): version packages (canary) * refactor(cli): enhance deploy command with GitHub authorization handling (#1343) - Introduced GitHubAuthRequiredError to manage authorization requirements for personal accounts. - Updated deployCommand to handle repository creation errors and prompt for authorization when necessary. - Improved organization ID resolution and uncommitted changes checks during deployment. - Cleaned up code for better readability and maintainability. * chore(typescript): version packages (canary) * chore(cli): drop mcp-use.config.json, add shim tests + docs Remove the project-config.ts utility and mcp-use.config.json support — the --mcp-dir, --entry, and --widgets-dir CLI flags are sufficient, and the config file layer added maintenance surface without a clear user request. - Inline resolveEntryFile / resolveWidgetsDir into src/index.ts - Add unit tests for the Next.js shim noop exports (cache, headers, navigation, server) covering the contract those stubs promise to user code - Add unit tests for detectNextJsProject() and the loadNextJsEnvFiles() cascade ordering - Document --mcp-dir / --entry / --widgets-dir on dev/build/start in the CLI reference * chore(cli, mcp-use): centralize shim registry + guard widgets against server-only imports - Extract the Next.js server-runtime module list into `next-shims-registry.json`, loaded by both `next-shims-loader.mjs` (ESM) and `next-shims-cjs.cjs` (CJS). Adds a startup sanity check in the loader that throws if the registry and the per-module stub bodies drift out of sync. - Add a Vite plugin to both the CLI widget build (`buildWidgets`) and the `mount-widgets-dev` dev server that fails the build with an actionable error when a widget (or a module it transitively imports) pulls in a Next.js server-only specifier. The error names the offending specifier, the importing file, and points the user at moving the call into an MCP tool. * refactor(cli, mcp-use): replace vite-tsconfig-paths with Vite's native resolve.tsconfigPaths Vite 8 supports tsconfig paths resolution natively via `resolve.tsconfigPaths`, which makes the plugin redundant (and triggers a deprecation warning on every widget build/dev start). Drop the dependency and swap the plugin wiring for the native option at all three call sites: the metadata SSR server, the production widget build, and the dev mount in mcp-use. Also deletes the user-project-require / cli-fallback resolution dance in mount-widgets-dev.ts, which only existed to locate a copy of the plugin under pnpm strict-hoisting. Net -111 lines. * chore: remove changesets from PR * chore: restore next-js-drop-in changeset * fix(cli): fail `mcp-use build` when any widget fails Previously a widget whose Vite build threw (e.g. via the server-only guard) was caught, logged in red, and silently dropped from the result — the outer `build` command still printed `✓ Build complete!` and exited 0, emitting a manifest with zero widgets. CI couldn't tell a broken build from a widget-less project. Now `buildWidgets` tracks per-widget status and throws an aggregate error when any entry fails. The `build` command's outer try/catch turns that into `process.exit(1)` with a clear summary line ("N widget(s) failed to build: name1, name2"). Dev mode is unaffected — widget errors there surface in Vite's browser overlay as before. Regression test in tests/build-failure.test.ts spawns the real CLI against a fixture with a widget that imports a nonexistent module and asserts non-zero exit + no "Build complete" line. * chore: scope PR to next-js drop-in only Remove unrelated bleed that came in via the canary merge: - Revert CHANGELOG.md, package.json, and canary-side inspector/ mcp-use source changes to their origin/canary state. These are unrelated inspector UI work, proxy-fetch cleanup, and version bumps that belong to other PRs. - Delete changesets from other PRs (fix-proxy-fetch-interceptor-teardown, inspector-ui-improvements, late-lies-tan) and the stale pre.json — canary is no longer in pre-release mode. Net result: the PR diff against canary is now 16 files, all next-js drop-in scope (CLI, shims, tests, mcp-server widget env-var plumbing, dev-side widget guard, and docs). * fix(cli): surface git failures during deploy and normalize main (#1354) * refactor(cli): enhance deploy command with improved error handling and Git command execution - Introduced GitCommandError class for better error management during Git operations. - Updated deployCommand to handle Git initialization, adding remotes, and pushing changes with actionable error messages. - Refactored git utility functions to throw errors on failure, ensuring users receive clear feedback on issues encountered during deployment. * fix(cli): streamline error logging in deploy command for Git failures - Consolidated error logging for GitCommandError to improve readability. - Enhanced conditional checks for specific Git errors, ensuring clearer output for users during deployment failures. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Potential fix for pull request finding 'CodeQL / Uncontrolled command line' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * refactor(cli): enhance deploy command with improved API session handling (#1356) - Introduced ApiUnauthorizedError for better error management during API authentication failures. - Added functions to prompt for reauthentication on 401 errors and ensure valid API sessions during deployment. - Updated GitHub connection status retrieval to handle reauthentication seamlessly. - Refactored deployCommand to improve organization ID resolution and error handling, enhancing overall user experience during deployment. * chore(typescript): version packages (canary) * feat: add copy/export chat button to MCPUse inspector (#1324) * feat: add copy/export chat button to MCPUse inspector * chore: copy/export chat button changeset * fix(inspector): improve copy/export chat UI and reliability * fix(inspector): fix blank assistant messages and polish chat export/copy format * fix(inspector): remove error role type * fix(inspector): skip any message copy that has no text content * fix(inspector): clean up chat export/copy implementation - Move changeset to correct location (out of copy/ subdirectory) - Use existing copyToClipboard and downloadJSON utilities - Remove includeToolCalls option; tools always included in markdown output - Render parts in order so tools appear inline with surrounding text - Replace ...m spread in JSON export with clean field projection - Remove <details> wrapper, fragile startsWith heuristic, and noise comments - Fix revokeObjectURL race condition with setTimeout in markdown export * test(inspector): add E2E tests for chat copy and export functionality Add data-testid attributes to copy/export buttons in ChatHeader and add three Playwright E2E tests covering copy to clipboard, export as JSON, and export as Markdown. * style(inspector): fix prettier formatting in ChatHeader --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(react): add colorScheme prop to McpUseProvider and ThemeProvider (#1365) - Introduced a new `colorScheme` prop in `McpUseProvider` to control the document's color scheme based on the active theme. - Updated `ThemeProvider` to apply the color scheme only when the `colorScheme` prop is enabled, preventing issues with iframe backgrounds when themes differ. - Enhanced documentation for both components to clarify the behavior and default values of the new prop. * chore(typescript): version packages (canary) * remove changeset * chore(release): release version 2.2.0 for @mcp-use/inspector and mcp-use - Enhanced chat functionality with "Copy Chat" and "Export Chat" buttons. - Removed hard dependencies on `@langchain/*` packages, allowing direct API calls. - Configured hosted chat URL to be set at runtime via `MANUFACT_CHAT_URL`. - Fixed issues with environment variable handling in server entrypoints. - Updated dependencies to latest versions, ensuring compatibility and stability. * feat: add Next.js drop-in feature to TypeScript server - Updated `docs.json` to include the new "nextjs-drop-in" feature in the TypeScript server documentation. - Enhanced `pnpm-lock.yaml` with dependencies for the Next.js drop-in feature, including `@tailwindcss/vite`, `@vitejs/plugin-react`, and `next`. - Added a new test application configuration in `pnpm-lock.yaml` to support the Next.js drop-in functionality. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: Andrew Khadder <andrew.khadder@gmail.com> Co-authored-by: Andrew Khadder <54488379+khandrew1@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: pederzh <luigipederzani@gmail.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Pallavi Kumari <pallavilpmt1995@gmail.com> Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * fix(cli): respect --org flag when a linked deployment exists in a different org (#1380) * fix(cli): respect --org flag when a linked deployment exists in a different org When `--org` is specified and a linked server exists in `.mcp-use/project.json`, check the server's organizationId before redeploying. If it belongs to a different org, skip the link and create a new server in the specified org instead of silently deploying to the wrong one. Closes MCP-1672 * fix(cli): name target org in linked-server mismatch warning Capture resolvedOrgName/resolvedOrgSlug in Step 2 and interpolate them into the Step 6 warning so users see which org the new server will be created in, not just "the specified org". * chore(cli): add changeset for --org linked-server override fix * chore(typescript): version packages (canary) * fix(cli): validate token on login and unify 401 handling (#1383) * fix(cli): validate token on login and handle 401s uniformly (MCP-1671) `mcp-use login` short-circuited on file presence alone, so a revoked or expired API key still produced "You are already logged in" and subsequent commands blew up with a raw 401 dump. Login now calls `testAuth()` after the `isLoggedIn()` check — on `ApiUnauthorizedError` it clears the stale config and falls through to the device-auth flow; network/other errors preserve the old message so offline users aren't forced through re-auth. Extracts a shared `handleCommandError(error, context)` helper in `utils/errors.ts` that converts `ApiUnauthorizedError` into a friendly "session expired — run `npx mcp-use login`" hint. Wired through `whoami`, `org`, `servers`, `deployments`, and `env` (which previously had no try/catch at all, so errors leaked as stack traces). `deploy`'s richer `promptReauthenticateOn401` flow is untouched. * refactor(cli): simplify login re-auth flow and chalk test mock Flatten the loginCommand re-auth branch in auth.ts to use an explicit needsReauth boolean instead of a try/catch with implicit fall-through and duplicated "already logged in" branches. Trim WHAT comments; keep the WHY on the catch (network/disk errors get the benefit of the doubt). Replace the Proxy-based chalk mock in errors.test.ts with a plain object covering the exact chains handleCommandError uses. Tighten the JSDoc on handleCommandError to drop the redundant "print a friendly error and exit" half. * fix(cli): send 401 re-auth hint to stderr The hint was going to stdout while the error header went to stderr, so `2>/dev/null` would swallow the header and leave a stray-looking success line, and scripts piping stdout would see noise after a failed command. Route both to stderr so they stay together. * chore(typescript): version packages (canary) * fix(inspector): add Open Graph and Twitter Card meta tags to hosted inspector (#1376) * fix(inspector): add Open Graph and Twitter Card meta tags to hosted inspector The hosted inspector at inspector.mcp-use.com was served with no og:*, twitter:*, or meta description tags, so links shared on Slack, X, LinkedIn, Discord, etc. had no preview card. Adds a description plus full OG and Twitter Card blocks to both the Vite-built index.html (what prod serves today) and the CDN shell path in shared-static.ts, along with a branded inspector-cover.png used as the social image. Closes MCP-1710 * refactor(inspector): ship OG cover image in inspector package Moves inspector-cover.png from docs/images/ to the inspector's public/ folder so it ships with @mcp-use/inspector via dist/web/. Adds a Hono route for /inspector/inspector-cover.png (registered ahead of SPA/CDN shell fallbacks and active in both modes) so the file is served with image/png instead of getting swallowed by the SPA fallback. Updates the og:image and twitter:image URLs in both the Vite build and the CDN shell path to the self-hosted https://inspector.mcp-use.com/inspector/ inspector-cover.png. * refactor(inspector): serve OG image from CDN instead of bundled file Point og:image and twitter:image meta tags to https://inspector-cdn.mcp-use.com/inspector-cover.png and remove the bundled public/inspector-cover.png and its local file-serving route. * chore(typescript): version packages (canary) * fix(inspector): preserve URL path in OAuth authorize redirect (#1360) * fix(inspector): preserve URL path in OAuth authorize redirect When an OAuth provider uses a basePath (e.g. /api/auth), the authenticate() function strips the URL to just the origin, causing the authorization redirect to go to the wrong URL. Preserve the pathname component when constructing baseUrl for the auth() call. Closes #1333 * chore: add changeset for oauth basepath fix * style: run prettier on useMcp.ts --------- Co-authored-by: Andrew Khadder <andrew@manufact.com> * chore(typescript): version packages (canary) * feat(inspector): inline elicitation requests in chat thread (#1336) * feat(inspector): add InlineElicitationCard component for chat-inline elicitation * feat(inspector): render inline elicitation cards in MessageList * feat(inspector): pass elicitation handlers from ChatTab to MessageList * feat(inspector): suppress elicitation toast when chat tab is active * chore: format InlineElicitationCard and add changeset * refactor(inspector): extract shared elicitation form primitives Deduplicate form-rendering logic between ElicitationRequestDisplay (panel) and InlineElicitationCard (chat) by extracting a shared module: - schemaHelpers: enum/one-of/any-of choice parsing - useElicitationForm: form state, schema-default init, required-field validation - ElicitationFormFields: parameterized field renderer (boolean, number, select, enum, multi-select, textarea, input) Both callers now consume these pieces while keeping their distinct chrome (panel header/footer/toast vs. compact card + collapsed-after-response). Test IDs preserved so e2e coverage is unaffected. * chore: apply prettier formatting to shared elicitation primitives * chore(typescript): version packages (canary) * feat(skills): consolidate deprecated mcp-builder and chatgpt-app-builder skills (#1375) * feat(skills): consolidate mcp-builder and chatgpt-app-builder into mcp-apps-builder content Replace deprecated redirect stubs with the full mcp-apps-builder skill content so both skills work standalone without requiring users to install a separate skill. * feat(create-mcp-use-app): only copy mcp-apps-builder skill during project setup Skip deprecated mcp-builder and chatgpt-app-builder skills when installing skills into new projects. * feat(skills): replace deprecated reference files with mcp-apps-builder references Old flat references/ folders in mcp-builder and chatgpt-app-builder are stale and incompatible with the updated SKILL.md. Replace them with the full mcp-apps-builder reference structure so all links resolve correctly. * chore(changeset): patch create-mcp-use-app for deprecated skill skip * chore(typescript): version packages (canary) * refactor(mcp-use): Typescript OAuth Providers (#1321) * refactor(mcp-use): remove proxy mode from built-in OAuth providers All built-in providers are now DCR-direct only. The MCP server proxies metadata discovery to the upstream and verifies bearer tokens; clients register and authenticate directly with the upstream authorization server. Removed from the public interface: - `OAuthMode` type and `OAuthProvider.getMode/getClientId/getRegistrationEndpoint` - `CustomProviderConfig`: `mode`, `clientId`, `clientSecret` - `WorkOSProviderConfig`: `clientId`, `apiKey` - `BetterAuthProviderConfig`: `clientId` - Env vars: `MCP_USE_OAUTH_WORKOS_CLIENT_ID`, `MCP_USE_OAUTH_WORKOS_API_KEY`, `MCP_USE_OAUTH_BETTER_AUTH_CLIENT_ID` are no longer read by providers Routes: deleted proxy-mode branching; extracted `createAuthorizeHandler` and `createTokenHandler` as exported factories (dormant under DCR-direct, retained for the forthcoming `oauthProxyProvider`). Metadata passthrough now always returns the upstream body including `registration_endpoint`. Docs and examples updated to reflect the single DCR flow. WorkOS example renames the API-call key to the user-owned `WORKOS_API_KEY`. Auth0 README replaces the proxy architecture diagram and flow description with DCR-direct. A dedicated `oauthProxyProvider` will follow in a future release for users who need an MCP-server-mediated OAuth flow. BREAKING CHANGE: proxy mode config fields and env vars removed; see above. * feat(mcp-use): add OAuth proxy support Adds OAuthProxyProvider enabling servers to delegate OAuth flows to an external proxy, and refactors OAuth routes/middleware/setup to support the new provider type alongside the existing built-in providers. * feat(mcp-use): add Auth0 OAuth proxy example Demonstrates using OAuthProxyProvider with Auth0 as the upstream identity provider, showing how to configure and run the proxy server. * feat(mcp-use): add jwksVerifier helper and make verifyToken explicit Replaces the implicit `jwksUrl` config field on `oauthProxy` with an explicit `verifyToken` function. Ships a built-in `jwksVerifier()` helper that covers the standard JWT+JWKS case (Auth0, Okta, Google, etc.) while leaving the door open for non-JWT providers (e.g. GitHub opaque tokens). * docs: add custom OAuth provider to sidebar navigation * docs: rewrite OAuth provider authentication docs * chore: add changeset for OAuth provider refactor * chore: format * fix(oauth): normalize Supabase provider to use verifyJwt instead of skipVerification Aligns Supabase with Auth0, WorkOS, Keycloak, and Better Auth which all use the verifyJwt boolean convention. * fix(oauth): remove clientId from Keycloak provider, add audience field Keycloak DCR-based flows never expose the client_id to the MCP server — it is issued to the OAuth client during registration. The MCP server validates tokens against issuer + JWKS only; audience should be the MCP server URL (set via Keycloak audience mapper on client scopes), not clientId. - Replace `clientId` with `audience` in KeycloakOAuthConfig and KeycloakProviderConfig - Use `audience` (not clientId) for JWT `aud` claim verification - Remove client-specific role extraction via resource_access[clientId] - Add MCP_USE_OAUTH_KEYCLOAK_AUDIENCE env var (replaces MCP_USE_OAUTH_KEYCLOAK_CLIENT_ID) * docs(oauth): rename oauthProxyProvider to oauthProxy in changeset and docstring * chore: format * fix(oauth): accept JSON and parse form-encoded token responses in proxy GitHub's /login/oauth/access_token returns application/x-www-form-urlencoded by default, which made the proxy's token handler throw "Unexpected token 'a', 'access_tok'... is not valid JSON". Send `Accept: application/json` upstream and parse the response based on its Content-Type so both JSON and form-encoded providers work. * fix(oauth): override client_id at /authorize in proxy mode The authorize handler was forwarding the incoming client_id to the upstream as-is, while /token already overrode it with proxy.clientId. Stale DCR cache on the MCP client (e.g. a synthetic UUID from a prior issuer) would reach the upstream and produce a generic 404. In proxy mode only the configured client_id is valid upstream, so enforce it here the same way /token does. * chore: drop stale inspector reference from oauth-refactor changeset * docs(oauth): flesh out Supabase example with consent page and anon sign-in Adds an auth-routes module that hosts the consent screen Supabase redirects to after /authorize, including an anonymous sign-in flow for zero-config demos. Fixes the example's package name, validates SUPABASE_PROJECT_ID at startup, and documents the dashboard setup in .env.example. * chore: changeset to minor * docs(oauth): add Keycloak example using DCR-direct provider Mirrors the Auth0 example layout (server.ts, package.json, tsconfig, README, .env.example) and wires the new oauthKeycloakProvider against a locally-hosted Keycloak realm. The example runs without additional plumbing once the companion keycloak-auth-server docker setup is up, exposing get-user-info and get-keycloak-userinfo tools over an MCP-over-HTTP server with JWT verification via the realm's JWKS. * docs(oauth): drop private-repo references from Keycloak example README The README pointed at a companion keycloak-auth-server repo that isn't being published alongside this example. Rewrite the prerequisites as a BYO-Keycloak checklist (DCR, Trusted Hosts, web-origins policies), and drop the testuser/testpassword references that only made sense inside that other repo's seeded realm. * chore: fix readme * docs(oauth): modernize Supabase example to use supabase-js SDK Replaces raw fetch with @supabase/supabase-js methods (signInAnonymously, auth.oauth.getAuthorizationDetails, approveAuthorization, denyAuthorization). Renames the anon key env var to MCP_USE_OAUTH_SUPABASE_PUBLISHABLE_KEY and drops the legacy MCP_USE_OAUTH_SUPABASE_JWT_SECRET from the example — the provider continues to accept a jwtSecret for legacy HS256 projects, but new projects use ES256+JWKS automatically. * docs(oauth): refresh TypeScript OAuth provider guides Update provider docs to reflect the refactored TypeScript OAuth providers, and trim the Keycloak guide to assume an existing instance rather than walking through Docker setup. * docs(skills): align authentication references with new OAuth provider guidelines Rewrite the authentication reference set shared across mcp-apps-builder, mcp-builder, and chatgpt-app-builder to match the refactored TypeScript OAuth providers: remote-auth vs oauthProxy split, oauthProxy + jwksVerifier recipes, Supabase publishable keys + SDK pattern, verifyJwt rename, and first-class Auth0 and Keycloak guides. * docs(oauth): add dedicated OAuth Proxy provider page Splits the OAuth Proxy content out of custom.mdx and the authentication overview into its own provider page covering Google, Okta, Azure AD, Auth0 (non-DCR), and GitHub. custom.mdx now focuses on DCR-capable providers and links to the new page; the overview links to it too. * chore(typescript): version packages (canary) * docs(changelog): document v1.25.0 / inspector v3.0.0 release wave Add Mintlify changelog entries for the canary release wave: mcp-use v1.25.0 (OAuth DCR-direct refactor, Next.js drop-in), @mcp-use/cli v3.1.0, @mcp-use/inspector v3.0.0 (inline elicitation, OG meta tags), and create-mcp-use-app v0.14.9. * chore(typescript): add experimental option for peer dependency updates Updated the TypeScript changeset configuration to include an experimental option for controlling peer dependency updates, allowing only updates when out of range. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Pietro Zullo <62951181+pietrozullo@users.noreply.github.com> Co-authored-by: Harshit Verma <therealharshit014@gmail.com> Co-authored-by: gabrielekarra <gabrielekarra@hotmail.it> Co-authored-by: salvatore.karra@elca.ch <salvatore.karra@elca.ch> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: pederzh <luigipederzani@gmail.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Pallavi Kumari <pallavilpmt1995@gmail.com> Co-authored-by: Kagura <kagura.chen28@gmail.com> |
||
|
Andrew Khadder
|
a7ad43681e |
docs: reorder TypeScript SDK sidebar to MCP Server, MCP Client, MCP Agent (#1312)
Closes MCP-1667 |
||
|
Enrico Toniato
|
6d7c4df9ef |
Canary (#1290)
* fix(inspector): sync URL tab param on tab change to preserve state on refresh
When switching tabs via header clicks, keyboard shortcuts, or command palette,
only React state was updated but the URL was not. This meant refreshing the
page would lose the active tab. Now all tab changes also update the ?tab=
query parameter using navigate() with replace:true.
Closes #1157
* feat(inspector): add editable MCP server aliases in connection settings
* fix(inspector): avoid reconnecting on alias-only edits
* chore: add changeset for server alias and updateServerMetadata
* docs: document updateServerMetadata in useMcpClient API reference
* fix: update import paths for Windows compatibility and modify postins… (#1255)
* fix: update import paths for Windows compatibility and modify postinstall script in package.json templates
- Changed import statements in `index.ts` and `mount-widgets-dev.ts` to use `pathToFileURL` for better compatibility across platforms.
- Updated `postinstall` script in `package.json` files of `blank`, `mcp-apps`, and `starter` templates to use `exit 0` instead of `true` for improved error handling during type generation.
* fix: normalize import paths in mount-widgets-dev.ts for cross-platform compatibility
- Updated import statements in `mount-widgets-dev.ts` to replace backslashes with forward slashes, ensuring consistent path handling across different operating systems.
* changeset
* chore: enter canary prerelease mode
* chore(typescript): version packages (canary)
* chore: add changeset
* chore(typescript): version packages (canary)
* chore(deps): bump hono from 4.12.8 to 4.12.12 in /libraries/typescript (#1284)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* chore(deps): bump hono from 4.12.8 to 4.12.12 in /libraries/typescript
Bumps [hono](https://github.com/honojs/hono) from 4.12.8 to 4.12.12.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.8...v4.12.12)
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.12
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* chore(deps): bump vite from 8.0.0 to 8.0.5 in /libraries/typescript (#1280)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* chore(deps): bump vite from 8.0.0 to 8.0.5 in /libraries/typescript
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.0 to 8.0.5.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.5/packages/vite)
---
updated-dependencies:
- dependency-name: vite
dependency-version: 8.0.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore: add changeset for dependabot updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(typescript): version packages (canary)
* Update architecture.md
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* Update server routing and middleware references
Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
* feat(chat): add disabledTools prop to ChatTab and useChatMessages for enhanced tool management (#1291)
* docs(readme): update MCP Apps showcase table to include repository links
* fix(architecture): update server routing and middleware usage in architecture documentation
- Changed references from `server.app` to `server` for HTTP route and middleware definitions to align with the latest API.
- Removed outdated link to middleware documentation in the resources section.
* feat(chat): add disabledTools prop to ChatTab and useChatMessages for enhanced tool management
- Introduced a new `disabledTools` prop in both `ChatTab` and `useChatMessages` to allow users to specify tools that should be excluded from the chat session.
- Updated the handling of chat messages to accommodate the new `disabledTools` feature, ensuring proper communication with the server.
* chore(typescript): version packages (canary)
* feat(auth): enhance login command with API key option and implement device code flow (#1292)
* feat(auth): enhance login command with API key option and implement device code flow
- Updated the login command to allow non-interactive login using an API key.
- Introduced device code flow for authentication, including functions to request device codes and poll for access tokens.
- Refactored API key creation to use access tokens and updated related utility functions for better authentication handling.
* refactor(cli): improve code formatting and readability in authentication commands
- Reformatted code in `index.ts`, `auth.ts`, and `api.ts` for better readability by adjusting indentation and line breaks.
- Removed unused import in `auth.ts` to clean up the codebase.
- Enhanced error messages for clarity in authentication processes.
* Revert "feat(auth): enhance login command with API key option and implement d…" (#1293)
This reverts commit
|
||
|
Enrico Toniato
|
b76df332f6 |
Canary (#1218)
* ci: enhance CI workflow with tunnel testing for dev and start commands - Added new jobs to test the development and start commands with the `--tunnel` flag in the CI workflow. - Implemented logic to start the dev server and poll for the tunnel URL, ensuring it is generated successfully. - Included cleanup steps to terminate the server processes after testing. - Enhanced error handling to report if the tunnel URL is not found in the output logs. * docs: fix changelog order (newest first) * chore: move tunnel testing from create-mcp-use-app CI to inspector E2E - Remove tunnel steps from create-mcp-use-app-tests (dev --tunnel, start --tunnel) - Add run-tunnel-test.mjs (test_tunnel) in inspector E2E scripts - Add test:e2e:tunnel script and inspector-e2e-tunnel job * chore: enter canary prerelease mode * fix: prettier format run-tunnel-test.mjs * feat: add reconnection options to conformance client (#1212) * feat: add reconnection options to conformance client - Introduced `reconnectionOptions` with a `maxRetries` setting to enhance the conformance client’s ability to handle connection issues. * fix(tests): update prompt server path in test configuration - Modified the test configuration to use the correct path for the prompt server, ensuring that the tests can locate and execute the server script properly. * chore(typescript): version packages (canary) * chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 (#1209) * chore: update dependencies to Vite 8.0.0 and @vitejs/plugin-react 6.0.0 - Bumped Vite version from ^7.3.0 to ^8.0.0 across multiple package.json files. - Updated @vitejs/plugin-react from ^5.1.4 to ^6.0.0 in various templates and packages. - Adjusted pnpm-lock.yaml to reflect these changes. - Modified build configurations to use 'rolldownOptions' instead of 'rollupOptions' for consistency. * fix: ensure consistent handling of TypeScript file paths across platforms - Updated path handling in TypeScript-related functions to ensure compatibility with Windows and other operating systems. - Refactored code to utilize `path.join` for constructing file paths, addressing issues with path separators. - Enhanced error handling in CLI tests to prevent failures due to missing build artifacts. * fix: prettier format run-tunnel-test.mjs * chore: update dependency versions in pnpm-lock.yaml and package.json - Changed the version specifier for `ai` from `^6.0.116` to `>=5.0.52`. - Updated `express-rate-limit` from `^7.5.1` to `>=8.2.2` in both `pnpm-lock.yaml` and `package.json`. - Adjusted the corresponding version in the lock file to reflect the new version of `express-rate-limit`. * test: enhance telemetry test stability with increased wait times - Updated `beforeEach` to include a delay for settling lingering telemetry. - Increased wait times from 100ms to 500ms in multiple test cases to ensure telemetry events are captured reliably. * chore(typescript): version packages (canary) * Feat/use-files (#1213) * feat(react): add useFiles hook with isSupported detection Adds useFiles() hook for file upload and download in widgets. File operations are only supported in the ChatGPT Apps SDK environment. The MCP Apps spec (SEP-1865) has deferred file handling, meaning MCP Apps clients (Claude, Goose, VS Code) do not support file operations. The hook exposes an isSupported flag computed from the presence of window.openai.uploadFile and window.openai.getFileDownloadUrl, letting widgets render graceful fallback UI in non-ChatGPT environments rather than throwing runtime errors. - isSupported: true only in ChatGPT Apps SDK hosts - upload(file): delegates to window.openai.uploadFile, returns FileMetadata - getDownloadUrl(file): delegates to window.openai.getFileDownloadUrl - Both throw a descriptive error when called with isSupported === false Also adds: - FileMetadata type ({ fileId: string }) in widget-types.ts - Optional uploadFile/getFileDownloadUrl on the API interface - examples/server/ui/files/ — file manager widget with upload, progress state, download URL retrieval, and isSupported-based fallback notice - docs/typescript/server/widget-components/usefiles.mdx — API reference with isSupported usage, FileMetadata type, and error handling guidance * feat(react): add modelVisible option to useFiles and unit tests Adds model visibility control to useFiles().upload() and 19 unit tests verifying the full hook behaviour. ### modelVisible option By default, uploaded files are tracked in widget state under `imageIds` so ChatGPT includes them in the model's conversation context (matching the post-fix behaviour of Skybridge PR #539 which fixed privateContent not being preserved during setWidgetState). Pass `{ modelVisible: false }` to upload privately — the file is still uploaded via window.openai.uploadFile but the fileId is not added to imageIds, so the model won't see it. ```ts // Model sees this (default) const { fileId } = await upload(file); // Model does not see this const { fileId } = await upload(file, { modelVisible: false }); ``` Existing imageIds and other widgetState fields are preserved when tracking a new fileId, so uploads never wipe non-file state. ### Tests (19) - isSupported: false when window/openai undefined or partial - upload() error when not supported (message includes isSupported) - upload() delegates to window.openai.uploadFile - upload() returns FileMetadata - upload() calls setWidgetState with updated imageIds - upload() appends to existing imageIds - upload() preserves other widgetState fields - upload({ modelVisible: false }) skips setWidgetState entirely - upload({ modelVisible: false }) still returns FileMetadata - getDownloadUrl() error when not supported - getDownloadUrl() delegates to window.openai.getFileDownloadUrl - getDownloadUrl() passes through fileId * docs(skill): add files reference to mcp-apps-builder skill Adds references/widgets/files.md covering: - useFiles() hook (isSupported, upload, getDownloadUrl) - isSupported guard pattern — always required, renders fallback in MCP Apps - Model visibility: modelVisible option (true = tracked in imageIds, false = private) - Storing fileId in widget state vs caching download URLs - Error handling patterns Also adds a navigation entry and decision tree node to SKILL.md. * chore(typescript): version packages (canary) * feat(mcp-use): add MCP operation-level middleware support (#1137) - Introduced a new middleware system for handling MCP operations, allowing for cross-cutting concerns like logging and authentication. - Updated `MCPServerClass` to register and manage middleware entries dynamically. - Enhanced documentation to include examples of using `server.use('mcp:...', handler)` for middleware registration. - Added new types and utility functions to support middleware composition and context management. This commit enhances the flexibility and functionality of the MCP framework by enabling developers to define custom middleware for various MCP operations. * chore(typescript): version packages (canary) * Feat/model-context (#1214) * feat(react): add ModelContext component and modelContext imperative API Adds two complementary APIs for annotating widget UI with contextual descriptions the AI model can see, without requiring explicit tool calls or storing data in developer-managed state. - <ModelContext content="..."> — lifecycle-tied React component that participates in a parent-child tree via React context (useId + ParentIdContext). Supports empty children (leaf nodes) and nesting. - modelContext.set(key, content) / .remove(key) / .clear() — module-level imperative API that works anywhere: event handlers, plain functions, outside React. Entries are always root-level nodes. Both APIs feed into a shared global registry that serializes the node tree into an indented markdown-like string on every change (batched via queueMicrotask). The string is pushed to the host via: - MCP Apps: ui/update-model-context (structuredContent.__model_context) - ChatGPT Apps SDK: setWidgetState (__model_context merged into state) useWidget wires up a registerModelContextFlush handler on mount so annotations always reach the correct protocol channel. __model_context is filtered from the developer-facing state value returned by useWidget. setState preserves existing __model_context to prevent annotations from being wiped on state updates. Also adds: - examples/server/ui/model-context/ — interactive product browser example demonstrating nesting (<ModelContext>) and imperative (modelContext.set) usage with a visual context debug panel - docs/typescript/server/widget-components/modelcontext.mdx — API reference for both APIs, nesting behavior, serialization format, and comparison with setState * test(react): add model-context unit tests; expose test helpers Adds 25 unit tests covering the full ModelContext system: - Tree serialization: empty, single, multiple root entries, nesting, whitespace trimming, blank content skipped, upsert, remove, clear - modelContext imperative API: set/remove/clear, no-op on missing key - registerModelContextFlush: immediate notification on registration, deregistration stops calls, deregistering stale handler is safe - Batched flush: multiple synchronous mutations → single handler call - Context state passed to model: full integration of set + flush handler, update, remove, clear sequences Also exposes two @internal helpers required for testing module singletons: - _resetModelContextForTesting() — resets nodes/handler/flushScheduled - _getDescriptionForTesting() — returns the current serialized string without triggering a flush * docs(skill): add model-context reference to mcp-apps-builder skill Adds references/widgets/model-context.md covering: - When to use ModelContext vs setState - <ModelContext> component: nesting, siblings, leaf nodes, lifecycle - modelContext imperative API: set/remove/clear, cleanup rules - How the tree is serialized and sent to the model - Common patterns: tab-switching, selected item, multi-level dashboard Also adds a navigation entry and decision tree node to SKILL.md. * Update title in modelcontext.mdx Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: add changeset for useFiles and ModelContext minor features --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: prefix resource and prompt tool names to avoid collisions (#937) * fix: prefix resource and prompt tool names to avoid collisions (#910) When a resource and a prompt share the same name, the LangChain tools array sent to the API contains duplicate tool names, causing a 400 error. Prefix resource tools with `resource_` and prompt tools with `prompt_` to ensure unique names. * dynamic implementation to avoid prompt resource names collisions * fix: make reserveName collision-safe and sanitize prompt names - reserveName now checks the prefixed name for conflicts too, falling back to a numeric suffix when both base and prefixed names are taken. Previously a tool named resource_foo alongside a resource named foo would silently produce a duplicate tool name. - Prompt names are now sanitized through sanitizeToolName() for consistency with resource names. * chore: add changeset for tool name collision fix --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * fix: map elicit result content to data for Zod validation (#1215) (#1216) * fix: map elicit result content to data for Zod validation The MCP SDK returns form data in result.content per the elicitation spec, but createElicitMethod was checking result.data which is always undefined. This caused Zod validation to never run, leaving result.data as undefined for tool callbacks that use ctx.elicit() with a Zod schema. Now checks result.content (SDK spec) with fallback to result.data for backward compatibility with custom handlers. Fixes #1215 * fix: also fix inspector and tests for elicit content/data mapping - Inspector: send `content` instead of `data` per MCP spec - Server: also map `content` to `data` for non-Zod-schema elicit calls (verbose API overload), so conformance server tools work correctly - Tests: update all integration test mocks to use spec-correct `content` field instead of non-standard `data`, and adjust validation error assertions to match SDK-level schema validation - Add changeset Follows up on the initial fix in b90ea51e. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): implement tunnel management functionality (#1222) - Added API endpoints for starting, stopping, and checking the status of a tunnel. - Integrated tunnel management into the Layout and LayoutHeader components, allowing users to start and stop tunnels directly from the UI. - Updated context to manage tunnel state, including a loading state for starting the tunnel. - Enhanced the user experience with visual feedback during tunnel operations and added instructions for using the tunnel URL in ChatGPT. This feature improves the overall functionality of the inspector by enabling real-time tunnel management. * chore(typescript): version packages (canary) * chore(changelog): update changelog for v0.25.0 and v1.22.0 releases - Added details for v0.25.0: introduced tunnel management for `mcp-use dev`, Vite 8 build stack, and aligned elicit payload with MCP spec. - Updated v1.22.0: included enhancements for MCP middleware, new React hooks, and fixes for elicit and adapter functionalities. - Updated dependencies for both releases. * fix(tests): update server-telemetry test to mock startServer return value - Modified the mock implementation of startServer to return an object containing close and forceClose functions, ensuring proper handling in tests. - This change prevents actual server startup during tests while maintaining the expected interface. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Gab <86735558+gabrielekarra@users.noreply.github.com> Co-authored-by: guoyangzhen <upgyz@qq.com> |
||
|
pietrozullo
|
fc918e5bc7 | python/release/1.7.0 | ||
|
Vincenzo Reina
|
d344233c50 |
feat(python): add create-mcp-use CLI with rich UI and dependency install (#1097)
* Add uvx create-mcp-use command
* Update docs
* Add docs
* feat(python/cli): improve create-mcp-use with rich UI, dependency install, and telemetry
- Use rich for colored output, spinner, and panel for get-started instructions
- Add ASCII logo matching the TypeScript CLI
- Prompt user to install dependencies after scaffolding (detects uv/pip)
- Add --install and --no-install flags for non-interactive use
- Capture install output to keep terminal clean
- Add CreateMCPUseEvent telemetry to track CLI usage
- Fix starter template pyproject.toml hatch build config for installability
* feat(python/server): auto-retry next available port when default is in use
Add port availability checking before starting uvicorn. When the
requested port is occupied, the server automatically tries the next
port (up to 10 retries) instead of crashing.
Refs #1161
* fix(python/cli): fix linting errors in create-mcp-use CLI
* Revert "feat(python/server): auto-retry next available port when default is in use"
This reverts commit
|
||
|
Pietro Zullo
|
ccfb07a8ee |
fix(python): simplify tool JSON Schema for Optional parameters (#1141)
* fix(python/server): simplify tool JSON Schema for Optional parameters
Pydantic generates {"anyOf": [{"type": "T"}, {"type": "null"}]} for
Optional[T] tool parameters. While valid JSON Schema 2020-12, this
pattern breaks description rendering in the MCP Inspector UI and fails
Gemini API validation (requires top-level type field). MCP signals
optionality via the required array, making the anyOf/null wrapper
redundant.
- Add simplify_optional_schema() utility that collapses nullable anyOf
into flat {"type": "T"} while preserving description, default, title
- Override MCPServer.add_tool() to apply simplification after Pydantic
generates the schema
- Add 12 unit tests for the schema simplifier (test_json_schema.py)
- Add 23 unit tests for tool schema output (test_list_tool_format.py)
- Update server_example.py with representative parameter patterns
including Literal enum types
* docs(python/server): add parameter types and JSON Schema section to tools docs
Document the Python-to-JSON-Schema type mapping, required/optional/nullable
parameter patterns, and Literal enum usage. Includes a note explaining the
anyOf/null simplification that mcp-use applies automatically.
* fix(python/server): address PR review comments on json_schema.py
- Fix _simplify_property docstring: says "in place" but returns new dict
- Fix simplify_optional_schema docstring: document fast-path return when
no properties exist (returns original, not a copy)
- Wrap dict comprehension for line length
* style: format server_example.py
* docs: regenerate API reference for json_schema module
|
||
|
dhruvtiwari6
|
d4380e5d5f | fix(docs): correct Twitter/X URL to @manufact (#1145) | ||
|
Enrico Toniato
|
405fac7a0b |
Canary (#1116)
* Dev inspector no-open (#1100) * fix(inspector): respect --no-open flag in dev mode standalone The inspector standalone server.ts (used in dev mode) was ignoring the --no-open flag and always opening the browser. This fix: 1. Adds hasNoOpenFlag() helper function to utils.ts to check for --no-open flag 2. Updates server.ts to check for --no-open before auto-opening browser in dev mode 3. Also adds --no-open support to cli.ts for consistency Fixes MCP-1406 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: add changeset for inspector --no-open fix Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * Hono express middleware types (#1101) * fix: Add proper TypeScript types for Express middleware in Hono server - Added ExpressMiddleware and ExpressErrorMiddleware type definitions - Created ExtendedHonoUse type that accepts both Hono and Express middleware - Updated createHonoProxy return type to HonoWithExpressMiddleware - Removed (app as any) type assertions and used proper types - Fixes type errors when passing Express middleware to server.use() Resolves MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * test: Add Express middleware example and type tests - Created example demonstrating Express and Hono middleware compatibility - Example includes: Express middleware, Hono middleware, MCP tool, GET route, POST route - Added unit tests for Express middleware type compatibility - Example successfully runs and demonstrates all features - Added README with usage instructions Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * refactor: Use real npm middleware packages and remove type annotations - Replaced mock Express middleware with real packages: morgan and express-rate-limit - Removed all TypeScript type annotations from example code - Updated tests to use real npm packages - Updated README with correct usage examples - Server successfully runs with morgan logger and rate limiting Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * docs: Update documentation for Express middleware support - Updated architecture.md to show Express middleware is now supported - Updated tools.md note about Express middleware compatibility - Added Express middleware examples to api-reference.mdx - Enhanced middleware section in configuration.mdx with Express examples - Clarified that Express middleware is auto-detected and adapted Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: Add changeset and improve Express middleware detection robustness - Added changeset for Express middleware type fix - Improved middleware detection with pattern matching for both Express and Hono patterns - Added verification for 3-4 param functions to check Express patterns - Added Hono pattern detection for 2-param functions - Updated documentation to reflect more robust detection mechanism - Ran pnpm lint and pnpm format (all passed) Related to MCP-1391 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * Tar package deprecation (#1102) * fix: remove deprecated @types/tar and update tar to latest version - Remove @types/tar from packages/cli (tar now includes its own types) - Remove @types/tar from packages/create-mcp-use-app - Update tar in create-mcp-use-app from ^7.4.3 to ^7.5.9 Resolves MCP-1428 Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore: add changeset for tar deprecation fix Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(typescript): add client-side completion support (#1056) * feat(typescript): add client-side completion support Add complete() method to BaseConnector, MCPSession, and useMcp hook to enable requesting autocomplete suggestions for prompt arguments and resource template URIs. Key changes: - Add complete() method to BaseConnector wrapping SDK client.complete() - Add complete() method to MCPSession with delegation to connector - Add complete() method to useMcp React hook with proper state management - Fix resourceTemplates state population (was exposed but never populated) - Add refreshResourceTemplates() method to useMcp hook - Update refreshAll() to include resource templates - Add comprehensive unit and integration tests - Add detailed documentation in docs/typescript/client/completion.mdx - Update docs/typescript/client/usemcp.mdx with new methods This enables users to request autocomplete suggestions from servers that provide completion callbacks via completable() in prompt schemas and resource templates. Closes #969 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(auth): resolve OAuth flow for WorkOS across client, server, and inspector (#1058) * add proactive token refresh and credential invalidation to BrowserOAuthClientProvider * fix OAuth token refresh by removing static Authorization header from transport config * add changeset * update refresh to use official mcp sdk methods * update workos to always use proxy method since its an external provider * update autoConnect to always include proxyAddress even without bearer tokens * run format * update changeset * chore: update pnpm-lock.yaml after rebase onto main --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * improvement(auth): accept full AuthKit domain in WorkOS subdomain config (#1057) * change subdomain to include authkit.app * add changeset * chore(typescript): version packages (canary) * Fix/inspector/first render (#1060) * fix(tsconfig): include .mcp-use directory in TypeScript configuration for starter and blank templates * fix(package.json): update postinstall script to remove fallback for generate-types in mcp-apps template * fix(MessageList): enhance tool metadata retrieval by normalizing tool names for consistency with API responses * feat(inspector): enhance MCPApps components with required props handling and improved UI feedback - Added `requiredProps` to `MCPAppsDebugControls` to auto-open a popover when required props are missing, providing users with a clear indication of necessary inputs. - Updated `MCPAppsRenderer` and `MessageList` to support cancellation state, allowing for better user experience during tool execution. - Enhanced `PropsConfigDialog` to detect and display required props from widget schemas, improving the configuration process. - Introduced utility functions in `usePropsLLM` for better JSON extraction from LLM responses, ensuring accurate prop generation. * feat(inspector): enhance IframeConsole with expandable log entries and improved log formatting - Added expandable functionality to log entries, allowing users to view detailed logs on click. - Introduced a copy button for logs, enabling easy copying of log content to the clipboard. - Improved log formatting and display, including inline previews and better handling of log levels. - Updated UI elements with new icons and styles for a more intuitive user experience. * feat(inspector): add clientOptions to InspectorDashboard for enhanced capabilities - Introduced `clientOptions` with `capabilities` to support new extensions in the InspectorDashboard component. - This enhancement allows for better integration with the MCP application protocol, improving overall functionality. * feat(inspector): refine Layout component by updating validTabs and adding clientOptions - Updated the `validTabs` array in the Layout component to remove the "playground" tab. - Added `clientOptions` with specific capabilities to enhance integration with MCP application protocol, improving functionality. * feat(types): enhance type definitions with detailed documentation and examples - Updated `MCPServerClass` tool and prompt definitions to include more specific type constraints for better type safety. - Enhanced `ServerConfig`, `InputDefinition`, and various resource and tool interfaces with comprehensive JSDoc comments, including examples for clarity. - Improved overall type definitions for widgets and tools, ensuring better integration and usability within the MCP framework. - Added missing descriptions and examples to several interfaces, improving developer experience and documentation quality. * feat(mcp-apps): update server and widget integration for enhanced functionality - Refactored the MCP server setup to improve integration with MCP Apps, including updated descriptions and documentation links. - Introduced a new search tool for fruits, allowing users to filter results and display them in a visual widget. - Enhanced the product search result widget with improved loading states and detail views for selected fruits. - Removed unused dependencies and components to streamline the project structure. - Updated README files to reflect changes and provide clearer guidance for users. * feat(inspector): enhance MCPAppsRenderer and ui-resource-registration for improved widget re-initialization and metadata handling - Added logic in MCPAppsRenderer to re-read `prefersBorder` from the server upon widget re-initialization, improving responsiveness to metadata changes. - Implemented detection of widget re-initialization to ensure tool input is correctly sent to new widget instances after events like HMR page reloads. - Refactored resource registration in ui-resource-registration to dynamically resolve the latest enriched definitions, ensuring accurate metadata is used during HMR updates. - Updated read callbacks to handle dynamic URIs and maintain consistency in resource handling, enhancing overall widget functionality. * feat(widget): enhance useWidget hook and documentation for improved functionality - Updated the `useWidget` hook to support additional generic parameters for better type safety and flexibility. - Introduced new props for real-time streaming and external link handling, enhancing widget capabilities. - Improved documentation in SKILL.md and ui-widgets.mdx to clarify usage of new features, including partial argument streaming and external navigation. - Removed deprecated dependencies from package.json files across templates to streamline project setup. - Enhanced various components to utilize new props and improve user experience during tool interactions. * feat(tsconfig): enhance TypeScript configuration and widget functionality - Updated TypeScript configurations across multiple templates to include incremental builds and build info file paths, improving build performance and efficiency. - Modified the `useWidget` hook to streamline state management and enhance type safety by refining generic parameters. - Simplified the `ProductSearchResult` component by reducing unnecessary generic parameters, improving code clarity and maintainability. - Adjusted helper functions to ensure consistent type handling across the widget framework. * feat(update-check): implement update notification for mcp-use CLI - Added a new utility to check for updates of the mcp-use package and notify users if a newer version is available. - Integrated the update check into the CLI's pre-action hook, ensuring users are informed before executing commands. - Created a caching mechanism to minimize unnecessary network requests and improve performance. * feat(inspector): add file utilities for client file management - Introduced a new `file-utils.ts` module containing functions to determine content types based on file extensions, check for the existence of client files, and retrieve the client distribution path. - Updated the middleware to utilize these new utilities for improved handling of client files, including warnings when files are not found. * feat(inspector): update TypeScript and MCPApps components for improved functionality - Added TypeScript version 5.9.3 to the pnpm-lock.yaml for enhanced type safety and features. - Enhanced MCPAppsDebugControls to prevent auto-application of localStorage presets in tool context. - Refactored MCPAppsRenderer to optimize state management and prevent unnecessary re-renders, including the use of refs for tool input and output. - Improved OpenAIComponentRenderer with better state handling and batching of updates to prevent double renders. - Updated ToolsTab to streamline resource pre-fetching and reduce unnecessary renders during tool execution. - Enhanced ToolResultRenderer and ToolResultDisplay for better memoization and performance. - Introduced a new RelativeTimeDisplay component to manage time updates without affecting parent re-renders. * chore: update pnpm-lock.yaml after rebase onto main Co-authored-by: Cursor <cursoragent@cursor.com> * fix: update postinstall script in package.json templates to prevent failure on type generation * Potential fix for code scanning alert no. 81: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * feat(inspector): add HTML escaping function for safe user input handling - Introduced a new `escapeHtml` function to sanitize user input in responses, preventing potential XSS vulnerabilities. - Updated the CDN server response to utilize the `escapeHtml` function when returning 404 error messages. * chore: update TypeScript version to 5.9.3 across multiple packages and enhance component functionality - Added TypeScript version 5.9.3 to pnpm-lock.yaml and various package.json files for improved type safety. - Enhanced OpenAIComponentRenderer to optimize state updates and prevent redundant dispatches. - Updated ResourceResultDisplay to include a data-testid for better testing capabilities. - Improved debugging tools to scope props dialog interactions to the correct resource widget preview. * format * refactor(tests): update widget integration and data flow tests to align with SEP-1865 specifications - Adjusted tests to verify that widget metadata is now located on tool definitions rather than in tool call results, as per SEP-1865. - Updated assertions to check for structured content in results instead of relying on metadata properties. - Enhanced test coverage for tool invocation and output structure to ensure compliance with new standards. * package * test(widget-helper): enhance integration tests for tool metadata validation - Updated assertions to ensure manual and auto tools are defined before checking metadata properties. - Improved handling of auto tool metadata to account for potential absence of _meta. - Enhanced regex checks for output templates to ensure proper formatting and compliance with widget standards. * changeset --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): enhance MCPApps components and improve widget handling (#1063) * feat(inspector): enhance MCPApps components and improve widget handling - Added a new test_app configuration in pnpm-lock.yaml with updated dependencies for better development support. - Updated InspectorDashboard to set a default MCP_URL when not provided. - Refined ProductSearchResult and CarouselItem components to use a consistent text-danger class for better styling. - Improved error handling in InspectorDashboard for connection retries. - Streamlined MCPAppsRenderer to enhance widget re-initialization and metadata handling. - Removed deprecated dev widget endpoints and related logic to simplify the codebase. - Enhanced FormattedContentDisplay to allow toggling between formatted and plain text for better user experience. - Updated PropsConfigDialog and ResourceResultDisplay to utilize standardized metadata paths for improved prop detection. This commit focuses on enhancing the overall functionality and user experience of the MCPApps components and related widgets. * feat(inspector): enhance ToolsTab and ToolExecutionPanel for improved field handling - Introduced state management for tracking fields that should be sent as empty, allowing for explicit control over empty values in tool arguments. - Updated ToolsTab to initialize and manage sets of fields, enhancing the handling of tool input schemas. - Enhanced ToolExecutionPanel to accept and utilize the new payload structure, ensuring accurate representation of data sent during tool execution. - Added toggle functionality in ToolInputForm for explicitly sending empty objects and arrays, improving user experience and flexibility in input handling. This commit focuses on refining the input handling process within the inspector, providing users with better control over the data they send. * feat(widget): enhance useWidget hook to unwrap CallToolResult envelope - Updated the useWidget hook to unwrap the CallToolResult envelope when the OpenAI provider is used, allowing for direct access to structured content. - Improved handling of toolOutput to ensure compatibility with hosts that pass the full tool-result parameters. - Enhanced documentation comments to clarify the changes and improve understanding of the new logic. This commit focuses on refining the output handling within the useWidget hook, improving type safety and usability for developers. * feat(inspector): enhance CSP handling and widget re-execution logic - Updated the Inspector components to improve handling of Content Security Policy (CSP) settings, ensuring that widget metadata is correctly enriched with CSP directives. - Introduced logic to re-execute widgets when CSP mode changes, allowing for dynamic updates to the widget's execution context. - Enhanced the MCPAppsDebugControls and MCPAppsRenderer to better manage CSP violations and provide clearer user feedback on required props. - Refactored the PropsConfigDialog to utilize standardized metadata paths for improved prop detection and configuration. This commit focuses on refining the CSP management and widget lifecycle within the inspector, enhancing overall functionality and user experience. * refactor(tests): update weather-display widget tests for props handling - Modified tests in `aaa-ui-widgets.test.ts` to check for visibility of props wall text instead of iframe visibility, ensuring that the widget's required props are correctly validated. - Removed unnecessary iframe visibility checks in `debugger-tools.test.ts` to streamline the test flow and focus on props configuration. - Updated `navigateToResourcesAndSelectWeather` helper function to wait for props wall text, enhancing clarity on widget requirements during testing. This commit enhances the accuracy of widget tests by focusing on required props visibility, improving overall test reliability. * chore(typescript): version packages (canary) * docs: add completion page to nav and McpClientProvider example * feat(examples): add completion server and client example - Add completion server with static list, dynamic callback, and resource template - Add Node client example demonstrating prompt and resource completions - Add example:server:completion, example:client:completion, example:completion scripts - Update completion docs with run instructions --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Sidharth Shambu <sshambu@MacBookPro.lan> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(mcp-use): enhance host information and capabilities handling (#1082) * feat(mcp-use): enhance host information and capabilities handling - Added `hostInfo` and `hostCapabilities` properties to `McpAppsBridge` for storing host details during initialization. - Implemented `getHostInfo` and `getHostCapabilities` methods to retrieve host information. - Updated `useWidget` to manage and expose host information and capabilities state. - Enhanced `UseWidgetResult` type to include `hostInfo` and `hostCapabilities` for better integration with widgets. - Introduced `ClientCapabilityChecker` interface to provide structured access to client capabilities and information in the context. * feat(mcp-use): enhance client information handling and context management - Introduced `ctx.client.info()` and `ctx.client.supportsApps()` methods for improved client identification and MCP Apps support checks. - Updated `useWidget` to include `hostInfo` and `hostCapabilities` properties, enhancing widget integration with MCP Apps. - Enhanced context management in `mcp-server.ts` to provide a structured client capability checker, ensuring consistent access to client capabilities across different handlers. - Improved documentation to reflect new client and host information features, providing clearer guidance for developers. * feat(mcp-use): enhance user context handling and capabilities integration - Introduced `UserContext` to extract and normalize end-user metadata from request-level parameters, improving personalization and context awareness in tools. - Updated `createEnhancedContext` to include user context, allowing tools to access user-specific information such as locale and location. - Enhanced `toolRegistration` and `createEnhancedContext` methods to handle user metadata, ensuring consistent access across different handlers. - Improved documentation to reflect new user context features and their usage in tools and resources. * chore(typescript): version packages (canary) * feat(inspector): enhance logger middleware to filter noisy API endpoints (#1104) - Updated logger middleware to filter out noisy endpoints (telemetry, RPC stream/log) to reduce log spam. - Introduced a list of noisy paths and modified the logger function to skip logging for these paths, improving log clarity and relevance. * chore(typescript): version packages (canary) * feat(docs): add per-server elicitation and sampling callbacks examples - Introduced documentation for per-server elicitation and sampling callbacks, allowing different MCP servers to define their own callback functions. - Added TypeScript examples demonstrating how to configure `onElicitation` and `onSampling` for individual servers, enhancing flexibility in handling user interactions. - Updated precedence order tables for both elicitation and sampling to clarify callback resolution hierarchy. * fix(react): make health check and reconnection intervals configurable (fix #985) (#994) * feat(mcp-use): enhance reconnection and health check options - Updated `autoReconnect` configuration to support detailed options for reconnection and health checks, including initial delay, health check interval, and timeout settings. - Introduced `reconnectionOptions` for controlling the retry behavior of the underlying transport, allowing for more granular control over reconnection strategies. - Enhanced documentation to clarify the new configuration options and their usage, improving developer experience and flexibility in managing connections. * changeset --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(widget): enhance sendFollowUpMessage to support content block arrays (#1085) - Updated the `sendFollowUpMessage` method to accept both string shorthand and an array of `MessageContentBlock` objects, allowing for richer message content per the SEP-1865 `ui/message` specification. - Modified documentation and examples across various files to reflect the new functionality, including usage of text, image, and resource blocks. - Ensured compatibility with the ChatGPT Apps SDK, clarifying that only text blocks are utilized in that context. * chore(typescript): version packages (canary) * feat(mcp-use): add proxy server functionality and documentation (#1113) - Introduced a new `proxy` method in the `MCPServerClass` to allow mounting multiple MCP clients onto a single server, enhancing server capabilities. - Updated documentation to include a new "Proxy Servers" section, detailing usage examples and configuration options for the proxy feature. - Added relevant entries in the pnpm-lock.yaml to support the new proxy functionality, ensuring all dependencies are correctly managed. - Enhanced the `index.mdx` file to reflect the addition of the proxy server feature, improving clarity for developers on available functionalities. * chore(typescript): version packages (canary) * Feat/dashboard/embedded (#1115) * feat(inspector): enhance inspector components and improve type handling - Updated `tsup.client.ts` to include new external dependencies for better integration. - Enhanced `index.ts` by adding `InspectorProvider` and related types for improved context management. - Modified `PromptResultDisplay.tsx` to ensure error messages are returned as strings for consistency. - Changed `ListItem.tsx` to allow `description` prop to accept `ReactNode` for more flexible content. - Improved `MarkdownRenderer.tsx` to adjust list styling for better visual presentation. - Updated `RpcPanel.tsx` to include an effect for collapsing the panel on mount and refined resizing logic for better user experience. This commit focuses on enhancing the functionality and usability of the inspector components. * fix(chat): remove background styling from ChatHeader component - Updated the ChatHeader component to remove the background styling for improved visual consistency. - This change enhances the overall appearance of the chat interface by simplifying the design. * feat(inspector): fix build to allow inspector embedding - Added a changeset for the minor version update of the "@mcp-use/inspector" package. - Improved the build process to support embedding of the inspector, enhancing its integration capabilities. * chore(typescript): version packages (canary) * feat(deploy): update dashboard URL construction to use dynamic web URL (#1117) * chore(typescript): version packages (canary) * chore(changelog): update changelogs for inspector and typescript packages - Added new entries for version v0.24.0 in the inspector changelog, highlighting embedding support, logger improvements, and updates to mcp-use. - Updated typescript changelog for version v1.21.0, detailing new proxy server functionality, client-side completion support, and various enhancements and fixes. * fix(tests): update inspector and debugger tools tests for improved reliability (#1120) - Commented out modal closing logic in connection tests due to focus issues requiring multiple ESC presses. - Enhanced debugger tools tests by refining navigation and visibility checks for resource widgets and props popovers, ensuring more stable interactions. - Adjusted helper functions to prevent unnecessary button clicks when popovers are already visible, improving test performance. * chore(typescript): version packages (canary) * chore(docs): update links in README and changelogs for improved navigation - Updated documentation links in README.md and various changelogs to point to the correct URLs, enhancing accessibility to resources. - Ensured consistency across documentation by replacing relative links with absolute URLs for better clarity and user experience. * fix(widgets): update metadata handling for widget registration (#1121) - Adjusted the logic for setting widget metadata to ensure it only includes enriched CSP metadata when available, preventing undefined values. - Enhanced the registration process by refining how metadata is merged, improving overall reliability and consistency in widget definitions. * chore(typescript): version packages (canary) * feat(server): enhance landing page generation with favicon and icon support (#1122) - Added favicon and icon configuration options to the MCPServer setup, improving visual branding. - Updated landing page generation to include tools, prompts, and resources, enhancing the user experience with more detailed information. - Introduced HTML escaping function to prevent XSS vulnerabilities in user-provided content. * chore(typescript): version packages (canary) * feat(auth): enhance OAuth flow and CORS handling (#1128) * feat(auth): enhance OAuth flow and CORS handling - Introduced PKCE verifier management to prevent drift during overlapping auth attempts. - Updated CORS middleware to explicitly allow Authorization headers, ensuring compatibility with browser security policies. - Refined OAuth proxy URL inference logic to handle gateway connections more effectively. - Improved error handling for missing code verifiers during authentication state restoration. * fix(auth): improve OAuth metadata handling and logging - Updated the OAuth flow to enhance metadata resource handling, ensuring the correct resource is used for SDK validation. - Introduced logging for connection URLs and metadata responses to aid in debugging and monitoring. - Adjusted the handling of connection URLs to prevent issues with local proxy URLs during callback flows. - Enhanced error handling for metadata fetching and improved fallback mechanisms for OAuth proxy URLs. * chore(typescript): version packages (canary) * fix: use Node.js telemetry in server-side code instead of browser stub (#1086) * fix: use Node.js telemetry in server-side code instead of browser stub Server-side code was importing Telemetry from the barrel file (telemetry/index.js) which re-exports the browser implementation. The browser Telemetry class detects Node.js as "unknown" runtime and silently disables all telemetry, meaning no server events were being sent to PostHog or Scarf. Changed 6 server-side files to import from telemetry-node.js directly. Also updated the unit test mock path to match the new import. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: split tsup build to prevent telemetry-node from leaking into browser bundle mcp_agent.ts and connectors/base.ts are exported from src/browser.ts but now import from telemetry-node.ts (which contains require("node:fs/os/path/crypto")). Without a split build, these require() calls would be inlined into dist/src/browser.js, causing webpack/Vite to emit errors or polyfill Node.js built-ins in browser targets. Split tsup.config.ts into two configs: - Node/server entries: no substitution, telemetry-node.ts imports unchanged - Browser entries (src/browser.ts, src/react/index.ts): esbuild plugin transparently rewrites any telemetry-node import to telemetry-browser at build time Also removed duplicate "@modelcontextprotocol/sdk" entry in external list. * fix: preserve src/ prefix in browser build output paths tsup infers output paths from the common root of all entry points. When browser entries were split into a separate config containing only src/browser.ts and src/react/index.ts, the common root became src/, causing output to land at dist/browser.js and dist/react/index.js instead of dist/src/browser.js and dist/src/react/index.js. package.json exports expect the src/-prefixed paths, so the inspector build (and any consumer importing mcp-use/react or mcp-use/browser) would fail with ENOENT. Fix: use tsup object entry syntax with explicit output keys to force the correct dist/src/ output paths regardless of common-root inference. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * fix(mcp-use): resolve autoReconnect issues and enhance server management (#1130) * fix(mcp-use): resolve autoReconnect issues and enhance server management - Disabled unwanted GET polling when autoReconnect is false by setting maxRetries to 0. - Improved getServer() logic to correctly handle server configurations in React StrictMode, preventing duplicate server warnings. - Added a new example for dynamically adding an MCP server post-authentication, demonstrating the use of getServer guard. - Updated logging levels for server addition to reduce noise in debug output. * refactor(mcp-use): simplify server addition logic and update documentation - Removed the getServer guard from the ProtectedRoute example, as addServer is now idempotent and handles duplicate calls silently. - Updated the McpClientContextType interface to clarify that addServer can be called multiple times with the same id without issues. - Streamlined the addServer implementation to enhance readability and maintainability. --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Enrico Toniato <tonxxd@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Sidharth Shambu <49567934+shambu2k@users.noreply.github.com> Co-authored-by: Sidharth Shambu <sshambu@MacBookPro.lan> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Ashutosh Kumar Singh <161562995+Ashutosh0x@users.noreply.github.com> Co-authored-by: Luigi Pederzani <luigipederzani@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Enrico Toniato
|
5a73b41355 |
Canary (#1062)
* fix(auth): resolve OAuth flow for WorkOS across client, server, and inspector (#1058) * add proactive token refresh and credential invalidation to BrowserOAuthClientProvider * fix OAuth token refresh by removing static Authorization header from transport config * add changeset * update refresh to use official mcp sdk methods * update workos to always use proxy method since its an external provider * update autoConnect to always include proxyAddress even without bearer tokens * run format * update changeset * chore: update pnpm-lock.yaml after rebase onto main --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * improvement(auth): accept full AuthKit domain in WorkOS subdomain config (#1057) * change subdomain to include authkit.app * add changeset * chore(typescript): version packages (canary) * Fix/inspector/first render (#1060) * fix(tsconfig): include .mcp-use directory in TypeScript configuration for starter and blank templates * fix(package.json): update postinstall script to remove fallback for generate-types in mcp-apps template * fix(MessageList): enhance tool metadata retrieval by normalizing tool names for consistency with API responses * feat(inspector): enhance MCPApps components with required props handling and improved UI feedback - Added `requiredProps` to `MCPAppsDebugControls` to auto-open a popover when required props are missing, providing users with a clear indication of necessary inputs. - Updated `MCPAppsRenderer` and `MessageList` to support cancellation state, allowing for better user experience during tool execution. - Enhanced `PropsConfigDialog` to detect and display required props from widget schemas, improving the configuration process. - Introduced utility functions in `usePropsLLM` for better JSON extraction from LLM responses, ensuring accurate prop generation. * feat(inspector): enhance IframeConsole with expandable log entries and improved log formatting - Added expandable functionality to log entries, allowing users to view detailed logs on click. - Introduced a copy button for logs, enabling easy copying of log content to the clipboard. - Improved log formatting and display, including inline previews and better handling of log levels. - Updated UI elements with new icons and styles for a more intuitive user experience. * feat(inspector): add clientOptions to InspectorDashboard for enhanced capabilities - Introduced `clientOptions` with `capabilities` to support new extensions in the InspectorDashboard component. - This enhancement allows for better integration with the MCP application protocol, improving overall functionality. * feat(inspector): refine Layout component by updating validTabs and adding clientOptions - Updated the `validTabs` array in the Layout component to remove the "playground" tab. - Added `clientOptions` with specific capabilities to enhance integration with MCP application protocol, improving functionality. * feat(types): enhance type definitions with detailed documentation and examples - Updated `MCPServerClass` tool and prompt definitions to include more specific type constraints for better type safety. - Enhanced `ServerConfig`, `InputDefinition`, and various resource and tool interfaces with comprehensive JSDoc comments, including examples for clarity. - Improved overall type definitions for widgets and tools, ensuring better integration and usability within the MCP framework. - Added missing descriptions and examples to several interfaces, improving developer experience and documentation quality. * feat(mcp-apps): update server and widget integration for enhanced functionality - Refactored the MCP server setup to improve integration with MCP Apps, including updated descriptions and documentation links. - Introduced a new search tool for fruits, allowing users to filter results and display them in a visual widget. - Enhanced the product search result widget with improved loading states and detail views for selected fruits. - Removed unused dependencies and components to streamline the project structure. - Updated README files to reflect changes and provide clearer guidance for users. * feat(inspector): enhance MCPAppsRenderer and ui-resource-registration for improved widget re-initialization and metadata handling - Added logic in MCPAppsRenderer to re-read `prefersBorder` from the server upon widget re-initialization, improving responsiveness to metadata changes. - Implemented detection of widget re-initialization to ensure tool input is correctly sent to new widget instances after events like HMR page reloads. - Refactored resource registration in ui-resource-registration to dynamically resolve the latest enriched definitions, ensuring accurate metadata is used during HMR updates. - Updated read callbacks to handle dynamic URIs and maintain consistency in resource handling, enhancing overall widget functionality. * feat(widget): enhance useWidget hook and documentation for improved functionality - Updated the `useWidget` hook to support additional generic parameters for better type safety and flexibility. - Introduced new props for real-time streaming and external link handling, enhancing widget capabilities. - Improved documentation in SKILL.md and ui-widgets.mdx to clarify usage of new features, including partial argument streaming and external navigation. - Removed deprecated dependencies from package.json files across templates to streamline project setup. - Enhanced various components to utilize new props and improve user experience during tool interactions. * feat(tsconfig): enhance TypeScript configuration and widget functionality - Updated TypeScript configurations across multiple templates to include incremental builds and build info file paths, improving build performance and efficiency. - Modified the `useWidget` hook to streamline state management and enhance type safety by refining generic parameters. - Simplified the `ProductSearchResult` component by reducing unnecessary generic parameters, improving code clarity and maintainability. - Adjusted helper functions to ensure consistent type handling across the widget framework. * feat(update-check): implement update notification for mcp-use CLI - Added a new utility to check for updates of the mcp-use package and notify users if a newer version is available. - Integrated the update check into the CLI's pre-action hook, ensuring users are informed before executing commands. - Created a caching mechanism to minimize unnecessary network requests and improve performance. * feat(inspector): add file utilities for client file management - Introduced a new `file-utils.ts` module containing functions to determine content types based on file extensions, check for the existence of client files, and retrieve the client distribution path. - Updated the middleware to utilize these new utilities for improved handling of client files, including warnings when files are not found. * feat(inspector): update TypeScript and MCPApps components for improved functionality - Added TypeScript version 5.9.3 to the pnpm-lock.yaml for enhanced type safety and features. - Enhanced MCPAppsDebugControls to prevent auto-application of localStorage presets in tool context. - Refactored MCPAppsRenderer to optimize state management and prevent unnecessary re-renders, including the use of refs for tool input and output. - Improved OpenAIComponentRenderer with better state handling and batching of updates to prevent double renders. - Updated ToolsTab to streamline resource pre-fetching and reduce unnecessary renders during tool execution. - Enhanced ToolResultRenderer and ToolResultDisplay for better memoization and performance. - Introduced a new RelativeTimeDisplay component to manage time updates without affecting parent re-renders. * chore: update pnpm-lock.yaml after rebase onto main Co-authored-by: Cursor <cursoragent@cursor.com> * fix: update postinstall script in package.json templates to prevent failure on type generation * Potential fix for code scanning alert no. 81: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * feat(inspector): add HTML escaping function for safe user input handling - Introduced a new `escapeHtml` function to sanitize user input in responses, preventing potential XSS vulnerabilities. - Updated the CDN server response to utilize the `escapeHtml` function when returning 404 error messages. * chore: update TypeScript version to 5.9.3 across multiple packages and enhance component functionality - Added TypeScript version 5.9.3 to pnpm-lock.yaml and various package.json files for improved type safety. - Enhanced OpenAIComponentRenderer to optimize state updates and prevent redundant dispatches. - Updated ResourceResultDisplay to include a data-testid for better testing capabilities. - Improved debugging tools to scope props dialog interactions to the correct resource widget preview. * format * refactor(tests): update widget integration and data flow tests to align with SEP-1865 specifications - Adjusted tests to verify that widget metadata is now located on tool definitions rather than in tool call results, as per SEP-1865. - Updated assertions to check for structured content in results instead of relying on metadata properties. - Enhanced test coverage for tool invocation and output structure to ensure compliance with new standards. * package * test(widget-helper): enhance integration tests for tool metadata validation - Updated assertions to ensure manual and auto tools are defined before checking metadata properties. - Improved handling of auto tool metadata to account for potential absence of _meta. - Enhanced regex checks for output templates to ensure proper formatting and compliance with widget standards. * changeset --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * feat(inspector): enhance MCPApps components and improve widget handling (#1063) * feat(inspector): enhance MCPApps components and improve widget handling - Added a new test_app configuration in pnpm-lock.yaml with updated dependencies for better development support. - Updated InspectorDashboard to set a default MCP_URL when not provided. - Refined ProductSearchResult and CarouselItem components to use a consistent text-danger class for better styling. - Improved error handling in InspectorDashboard for connection retries. - Streamlined MCPAppsRenderer to enhance widget re-initialization and metadata handling. - Removed deprecated dev widget endpoints and related logic to simplify the codebase. - Enhanced FormattedContentDisplay to allow toggling between formatted and plain text for better user experience. - Updated PropsConfigDialog and ResourceResultDisplay to utilize standardized metadata paths for improved prop detection. This commit focuses on enhancing the overall functionality and user experience of the MCPApps components and related widgets. * feat(inspector): enhance ToolsTab and ToolExecutionPanel for improved field handling - Introduced state management for tracking fields that should be sent as empty, allowing for explicit control over empty values in tool arguments. - Updated ToolsTab to initialize and manage sets of fields, enhancing the handling of tool input schemas. - Enhanced ToolExecutionPanel to accept and utilize the new payload structure, ensuring accurate representation of data sent during tool execution. - Added toggle functionality in ToolInputForm for explicitly sending empty objects and arrays, improving user experience and flexibility in input handling. This commit focuses on refining the input handling process within the inspector, providing users with better control over the data they send. * feat(widget): enhance useWidget hook to unwrap CallToolResult envelope - Updated the useWidget hook to unwrap the CallToolResult envelope when the OpenAI provider is used, allowing for direct access to structured content. - Improved handling of toolOutput to ensure compatibility with hosts that pass the full tool-result parameters. - Enhanced documentation comments to clarify the changes and improve understanding of the new logic. This commit focuses on refining the output handling within the useWidget hook, improving type safety and usability for developers. * feat(inspector): enhance CSP handling and widget re-execution logic - Updated the Inspector components to improve handling of Content Security Policy (CSP) settings, ensuring that widget metadata is correctly enriched with CSP directives. - Introduced logic to re-execute widgets when CSP mode changes, allowing for dynamic updates to the widget's execution context. - Enhanced the MCPAppsDebugControls and MCPAppsRenderer to better manage CSP violations and provide clearer user feedback on required props. - Refactored the PropsConfigDialog to utilize standardized metadata paths for improved prop detection and configuration. This commit focuses on refining the CSP management and widget lifecycle within the inspector, enhancing overall functionality and user experience. * refactor(tests): update weather-display widget tests for props handling - Modified tests in `aaa-ui-widgets.test.ts` to check for visibility of props wall text instead of iframe visibility, ensuring that the widget's required props are correctly validated. - Removed unnecessary iframe visibility checks in `debugger-tools.test.ts` to streamline the test flow and focus on props configuration. - Updated `navigateToResourcesAndSelectWeather` helper function to wait for props wall text, enhancing clarity on widget requirements during testing. This commit enhances the accuracy of widget tests by focusing on required props visibility, improving overall test reliability. * chore(typescript): version packages (canary) * refactor(docs): update documentation for MCP Apps and enhance content security policy (#1067) * refactor(docs): update documentation for MCP Apps and enhance content security policy - Changed "UI Widgets" group to "MCP Apps" in the documentation structure. - Added a new section on Content Security Policy (CSP) for MCP Apps, detailing configuration and automatic settings. - Updated references from "mcp-use Cloud" to "Manufact Cloud" across various documents for consistency. - Introduced a deprecation notice for the Apps SDK in the ChatGPT Apps flow guide. - Enhanced the inspector documentation to include CSP configuration and debugging tips. - Updated various SVG icons to a consistent color scheme and added a new Keycloak icon. - Refined CLI reference and quickstart guides to reflect changes in deployment terminology and commands. * refactor(inspector): enhance MCPApps components and improve widget handling - Updated Inspector components to refine handling of Content Security Policy (CSP) settings and widget re-execution logic. - Improved error handling in InspectorDashboard and streamlined MCPAppsRenderer for better widget re-initialization. - Enhanced PropsConfigDialog and ResourceResultDisplay to utilize standardized metadata paths for improved prop detection. - Updated various components to ensure better user experience and functionality, including state management for tool input schemas and improved logging in IframeConsole. * chore(typescript): version packages (canary) * refactor(typescript): improve create-mcp-use-app CLI prompts, install order, branding, and project structure output (#1068) * refactor: improve create-mcp-use-app CLI prompts, install order, branding, and project structure output Co-authored-by: Cursor <cursoragent@cursor.com> * add changeset * run format --------- Co-authored-by: Cursor <cursoragent@cursor.com> * chore(typescript): version packages (canary) --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
179e8003b7 |
Canary (#1045)
* feat(typescript): add everything-server example for compile-time type coverage of mcp-use APIs (#1040) * add everything-server example for compile-time type coverage of mcp-use APIs * add UseWidgetResult<Props> type annotation to validate useWidget() return type * add changeset * run format * move everything-typecheck to an independent workflow * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(inspector): enhance ToolsTab with bulk paste functionality and auto-fill dialog (#1043) * feat(inspector): enhance ToolsTab with bulk paste functionality and auto-fill dialog - Implemented bulk paste feature allowing users to paste JSON or JavaScript objects directly into input fields. - Added auto-fill dialog for confirming updates when pasted data would overwrite existing values, improving user experience. - Introduced utility functions for parsing pasted text and converting JavaScript object syntax to valid JSON. - Updated ToolInputForm and ToolExecutionPanel components to support new functionality and provide visual feedback for auto-filled fields. * feat(inspector): update ToolExecutionPanel to copy full tool definition fix(server): correctly convert nested inpout schema args for tools * chore(typescript): version packages (canary) * Fix/various (#1041) * refactor(inspector): improve MCPAppsRenderer loading logic and enhance useWidget for iframe handling (#1037) - Updated MCPAppsRenderer to replace `isReady` with `initCount` for better iframe loading state management, ensuring the spinner is hidden appropriately. - Enhanced loading logic to account for iframe initialization, improving user experience during rapid remounts. - Modified useWidget to handle transitional states in iframes without URL parameters, preventing premature rendering with empty props. * chore(typescript): version packages (canary) * feat(cli): add generate-types command for TypeScript type definitions - Introduced a new CLI command `generate-types` to generate TypeScript type definitions for tools, writing to `.mcp-use/tool-registry.d.ts`. - Added options for specifying the project directory and server entry file. - Implemented error handling for missing server files and type generation failures. - Updated `package.json` to include a post-install script that runs the `generate-types` command. - Modified `tsconfig.json` to include the generated type definitions in the TypeScript compilation process. * chore: remove outdated changeset files for inspector and mcp-use - Deleted changeset markdown files and pre.json related to previous enhancements in the inspector and mcp-use libraries to streamline the repository and eliminate deprecated entries. * chore: remove outdated changeset reference from pre.json - Deleted the "petite-rules-talk" changeset entry from pre.json to clean up the changeset list and maintain accuracy in the repository. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(changelog): update changelogs for v0.21.0 and v0.20.1 releases - Added details for v0.21.0 including bulk paste functionality and tool definition enhancements. - Included v0.20.1 updates focusing on MCPApps and widget improvements. - Updated package versions for dependencies in both changelogs. --------- Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
3334a67769 |
Canary (#1012)
* feat(dns-rebinding): implement DNS rebinding protection and examples (#1001) - Added `allowedOrigins` configuration to the `MCPServer` for DNS rebinding protection, enabling host validation for specified origins. - Updated documentation to clarify the behavior of `allowedOrigins` in development and production environments. - Introduced a new example demonstrating DNS rebinding protection, including curl commands for testing. - Enhanced server methods and middleware to support the new host validation feature. - Refactored related documentation to improve clarity on middleware and configuration options. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * fix(inspector): enhance readiness state management and tool output handling - Added a useEffect hook in OpenAIComponentRenderer to reset the readiness state when the widget URL changes, ensuring proper updates for new iframes. - Updated shared-utils to improve handling of tool output and response metadata, facilitating smoother transitions of widget states from pending to ready. * feat(mcp): defer server callbacks to avoid render-phase updates (#1002) - Introduced a mechanism to collect callbacks for server state changes and defer their execution using `queueMicrotask`, preventing potential render-phase updates during state updates. - Updated the `McpClientProvider` to push `onServerAdded` and `onServerStateChange` callbacks into an array for deferred execution, enhancing performance and stability. * chore(typescript): version packages (canary) * feat(inspector): enhance elicitation support with SEP-1330 enum schema variants (#1010) - Added detailed documentation for the Elicitation tab, outlining its features and supported schema patterns. - Implemented handling for various SEP-1330 enum schema variants in the client and server, including single-select and multi-select options. - Introduced new tests to validate the elicitation flow for all enum schema variants, ensuring correct rendering and submission behavior. - Updated examples and README files to reflect the new elicitation capabilities and SEP-1330 patterns. * chore(typescript): version packages (canary) * feat(inspector): implement partial tool input handling for streaming arguments - Added support for partial tool input in the MCPAppsRenderer, allowing for real-time updates during LLM argument generation. - Enhanced MessageList and ToolResultRenderer components to accommodate new streaming states and partial arguments. - Updated useChatMessagesClientSide to handle streaming tool call arguments, improving user experience during interactions. - Introduced new types and state management in useWidget for tracking partial tool input and streaming status. * chore(typescript): version packages (canary) * feat(inspector): enhance tool argument handling with type coercion and schema resolution (#1013) - Introduced utility functions for coercing input values based on their expected types, improving the handling of boolean, array, and object parameters. - Updated ToolsTab and ToolInputForm components to utilize new schema utilities for resolving property types and extracting enum values. - Added a new server tool for validating argument typing, ensuring correct submission of typed values. - Enhanced end-to-end tests to verify the correct behavior of typed arguments in tool execution. * chore(typescript): version packages (canary) * changelog * feat(docs): enhance documentation for streaming tool arguments and live previews - Updated guides and examples to include details on streaming tool arguments in widgets, enabling real-time updates during LLM interactions. - Added new sections in `useWidget` documentation to explain `partialToolInput` and `isStreaming` properties. - Included a new example demonstrating live previews while streaming tool arguments in the MCP Inspector and MCP Apps clients. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
ac3e2166aa |
feat(inspector): add comprehensive E2E testing infrastructure and wid… (#957)
* feat(inspector): add comprehensive E2E testing infrastructure and widget lifecycle improvements (#936) * Fix/mcp-use/pending-state (#931) * feat(inspector): enhance widget support and lifecycle management - Updated MCPAppsRenderer and OpenAIComponentRenderer to handle tool output and metadata more effectively, allowing for immediate rendering of widgets even when results are pending. - Implemented pre-fetching of widget resources in ToolsTab to improve loading states and user experience. - Added utility functions for widget detection and pre-rendering capabilities based on tool metadata. - Enhanced MessageList and ToolResultRenderer to support immediate rendering of widget tools, improving responsiveness during tool execution. - Introduced a delayed weather tool in the example server to demonstrate widget lifecycle management. These changes address Issue #930, ensuring widgets can display loading states and update seamlessly upon tool completion. * fix(inspector): emulate pending state for widgets to align with ChatGPT behavior - Added logic to ensure that the pending state is accurately reflected for widgets, enhancing user experience during tool execution. - Removed unnecessary console logs and warnings in ToolResultRenderer for cleaner code and improved performance. * feat(server): add delayed weather tool to test widget lifecycle - Introduced a new tool, `get-weather-delayed`, which simulates a 5-second delay before returning weather data. This addition aims to test and demonstrate the widget lifecycle management, addressing Issue #930. - Updated documentation to include usage instructions for the new tool, enhancing the example server's functionality. * docs(inspector): update inspector references and enhance widget lifecycle testing documentation - Changed references from "MCP Inspector" to "mcp-use Inspector" for consistency. - Added detailed instructions for testing widget lifecycle, including `isPending` transitions and console log verification. - Updated links and sections to improve clarity and usability in the documentation. * feat(inspector): enhance server connection handling in Layout component (#932) * feat(inspector): enhance server connection handling in Layout component - Added logic to redirect to the autoConnect parameter if a server URL is provided but no matching connection exists. - Updated dependencies in the useEffect hook to include connections and navigate for improved functionality. * feat(inspector): add url-parameters to inspector documentation - Included "inspector/url-parameters" in the documentation index to enhance the inspector's reference materials. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(inspector): add comprehensive E2E testing infrastructure This PR introduces a complete Playwright-based E2E testing suite for the inspector with enhanced testing capabilities across all major features. Major Changes: - Add Playwright E2E testing infrastructure with test fixtures and helpers - Implement comprehensive test coverage for: - Chat functionality and message handling - Connection management and authentication flows (OAuth, API key, custom headers) - HMR (Hot Module Reload) for tools, prompts, and resources - UI widgets and lifecycle states - Command palette and debugger tools - Add data-testid attributes across all UI components for reliable testing - Enhance ToolResultDisplay with widget props support - Add refresh functionality to inspector tabs with unique keys Testing Infrastructure: - New test helpers for connection, auth, and debugger tools - Test matrix for parameterized test scenarios - File utilities for test setup and cleanup - Mock servers for OAuth and custom authentication - Comprehensive E2E testing documentation Widget Examples: - Create widget examples for conformance testing (weather-display, status-card, etc.) - Add delayed weather tool to conformance server for lifecycle testing Breaking Changes: None * chore: update dependencies and enhance ToolsTab functionality - Updated various package versions in pnpm-lock.yaml for improved compatibility and performance. - Added new end-to-end testing scripts in inspector's package.json to facilitate Playwright testing. - Enhanced ToolsTab component to include a refresh feature, allowing for dynamic updates of tools with improved user experience. - Updated dependencies in mcp-use package.json for better stability and functionality. * fix(server): change default port from 3001 to 3000 for server startup * feat(inspector): implement E2E testing workflow and enhance component testing - Added a new GitHub Actions workflow for running Playwright E2E tests across multiple modes (mix, prod, builtin) to validate the Inspector package. - Updated Playwright configuration to improve timeout settings for CI environments and ensure reliable test execution. - Enhanced FullscreenNavbar and MCPAppsDebugControls components with data-testid attributes for better testability. - Refactored MCPAppsRenderer to support custom props and improved display mode handling. - Updated various components to include data-testid attributes for consistent testing practices. - Improved error handling and logging in sampling request display for better debugging during tests. - Adjusted test cases to accommodate longer execution times and ensure stability in E2E tests. * fix(server): refine port assignment logic for server startup - Updated the port assignment logic to ensure the correct default port is used based on command line arguments and development mode. This change clarifies the conditions under which the server will use port 3001 or 3000. * fix(inspector): enhance widget pending state emulation and improve rendering - Updated MCPAppsRenderer and OpenAIComponentRenderer for better handling of tool output and metadata, allowing immediate widget rendering during pending states. - Enhanced MessageList and ToolResultRenderer to support responsive rendering of widget tools. - Introduced a delayed weather tool example in the conformance server to demonstrate widget lifecycle management. - Updated documentation for inspector and widget lifecycle testing, including debugging guides for ChatGPT Apps. Addresses Issue #930. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(typescript): version packages (canary) * chore(typescript): update pnpm-lock.yaml and pre.json for package versions * chore(typescript): update package versions in pnpm-lock.yaml and package.json for improved compatibility (#958) * chore(typescript): version packages (canary) * chore(docs): streamline documentation structure and enhance CLI reference (#960) - Consolidated page entries in docs.json for improved readability. - Added comprehensive CLI reference documentation, detailing installation, commands, and usage examples for the @mcp-use/cli tool. - Updated changelog entries for Inspector and TypeScript to reflect recent enhancements and fixes. * chore(typescript): version packages (canary) * chore(docs): format pages in docs.json for improved readability - Reformatted the "pages" entries in docs.json to use a consistent multi-line structure for better clarity and maintainability. * chore(deps): upgrade @modelcontextprotocol/sdk to 1.26.0 (#961) - Updated SDK from ^1.25.3 to ^1.26.0 in mcp-use and inspector packages - Applied the same Zod 4 compatibility patch to SDK 1.26.0 - Patch fixes safeParse/safeParseAsync to use schema methods instead of top-level functions - Renamed patch file from version-specific to version-agnostic naming - Added changeset documenting the upgrade The SDK still requires the Zod 4 compatibility patch as the upstream fix has not been released yet. This is a drop-in replacement with no breaking changes. * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
53ae49d153 |
Canary (#933)
* Fix/mcp-use/pending-state (#931) * feat(inspector): enhance widget support and lifecycle management - Updated MCPAppsRenderer and OpenAIComponentRenderer to handle tool output and metadata more effectively, allowing for immediate rendering of widgets even when results are pending. - Implemented pre-fetching of widget resources in ToolsTab to improve loading states and user experience. - Added utility functions for widget detection and pre-rendering capabilities based on tool metadata. - Enhanced MessageList and ToolResultRenderer to support immediate rendering of widget tools, improving responsiveness during tool execution. - Introduced a delayed weather tool in the example server to demonstrate widget lifecycle management. These changes address Issue #930, ensuring widgets can display loading states and update seamlessly upon tool completion. * fix(inspector): emulate pending state for widgets to align with ChatGPT behavior - Added logic to ensure that the pending state is accurately reflected for widgets, enhancing user experience during tool execution. - Removed unnecessary console logs and warnings in ToolResultRenderer for cleaner code and improved performance. * feat(server): add delayed weather tool to test widget lifecycle - Introduced a new tool, `get-weather-delayed`, which simulates a 5-second delay before returning weather data. This addition aims to test and demonstrate the widget lifecycle management, addressing Issue #930. - Updated documentation to include usage instructions for the new tool, enhancing the example server's functionality. * docs(inspector): update inspector references and enhance widget lifecycle testing documentation - Changed references from "MCP Inspector" to "mcp-use Inspector" for consistency. - Added detailed instructions for testing widget lifecycle, including `isPending` transitions and console log verification. - Updated links and sections to improve clarity and usability in the documentation. * feat(inspector): enhance server connection handling in Layout component (#932) * feat(inspector): enhance server connection handling in Layout component - Added logic to redirect to the autoConnect parameter if a server URL is provided but no matching connection exists. - Updated dependencies in the useEffect hook to include connections and navigate for improved functionality. * feat(inspector): add url-parameters to inspector documentation - Included "inspector/url-parameters" in the documentation index to enhance the inspector's reference materials. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Enrico Toniato
|
1dcba404b4 |
Feat/mcp apps 2 (#886) (#887)
* Feat/mcp apps 2 (#886) * feat(mcp-use): implement dual-protocol support for MCP Apps and ChatGPT widgets - Added support for the MCP Apps Extension (SEP-1865) in mcp-use, enabling widgets to function with both ChatGPT and MCP Apps-compatible clients. - Introduced a new `mcpApps` widget type, allowing unified widget definitions that automatically generate protocol-specific metadata. - Created protocol adapters for transforming widget definitions into formats compatible with both protocols. - Enhanced the server and client code to handle dual-protocol metadata generation and widget registration. - Updated documentation and examples to demonstrate the new functionality and usage patterns. This implementation improves compatibility and flexibility for developers creating widgets across different platforms. * feat(cli, mcp-use): implement Zod JIT compilation patching to prevent CSP violations - Added functionality to post-process JavaScript bundles and patch Zod's JIT compilation to avoid CSP eval violations in sandboxed iframes. - Introduced a new plugin in mcp-use to transform Zod's globalConfig, ensuring compatibility with strict CSP requirements. - Enhanced error handling for asset processing to gracefully manage missing directories. These changes improve security and compatibility for applications using Zod in restricted environments. * feat(inspector): add MCP Apps debugging support and UI Playground - Implemented comprehensive debugging capabilities for MCP Apps (SEP-1865) in the inspector, including a new `MCPAppsRenderer` for rendering widgets. - Introduced a `WidgetDebugContext` to manage widget state, CSP violations, and playground settings. - Added a UI Playground tab for testing widgets with device emulation, CSP mode switching, and traffic logs. - Enhanced existing components to support the new debugging features and integrated CSP violation tracking. - Updated package dependencies to include `@modelcontextprotocol/ext-apps@^0.4.1` for improved functionality. These changes enhance the developer experience by providing robust tools for testing and debugging MCP Apps alongside existing widgets. * feat(cli, inspector, mcp-use): enhance widget metadata and logging capabilities - Updated CLI to allow the server host to default to "0.0.0.0" for broader interface listening. - Enhanced `MCPAppsRenderer` to include a console logging handler for improved debugging of MCP logging notifications. - Refactored `WeatherDisplay` widget to utilize additional user agent and context information, improving display accuracy. - Introduced new properties in `useWidget` and `widget-types` for maximum width and timezone support, enhancing widget adaptability. - Improved server helper functions to normalize URLs and manage X-Frame-Options for cross-origin iframe embedding. These changes collectively enhance the developer experience by providing better logging, improved widget context handling, and more flexible server configurations. * feat(inspector): add MCP Apps support in ResourceResultDisplay - Integrated MCP Apps detection and rendering into the ResourceResultDisplay component. - Implemented logic to check for MCP Apps resources and display corresponding badges. - Enhanced the rendering flow to prioritize MCP Apps over other widget types, improving user experience and functionality. These changes enhance the inspector's capability to handle MCP Apps, aligning with ongoing development efforts for better widget integration. * feat(inspector): enhance inspector with new components and constants for MCP Apps - Updated `tsconfig.client.json` to include constants directory for better module resolution. - Refactored `LayoutContent` to improve the handling of prompt calls with enhanced argument processing. - Introduced `PopoverSelect` and `SafeAreaInsetsEditor` components for reusable UI elements in the inspector. - Added `debug-options` and `iframe` constants for improved configuration management. - Enhanced `MCPAppsDebugControls` and `MCPAppsRenderer` to utilize new constants and improve widget rendering. - Implemented dual-protocol support in various components to streamline widget integration. These changes collectively enhance the inspector's functionality and maintainability, aligning with ongoing development efforts for better widget integration. * feat(cli): normalize browser host for server connections - Introduced a `normalizeBrowserHost` function to convert "0.0.0.0" to "localhost" for browser connections, ensuring compatibility. - Updated CLI logging to reflect the normalized host for local connections, enhancing user experience. - Refactored MCP endpoint and inspector URL generation to utilize the normalized host. These changes improve the reliability of server connections from browsers and streamline the logging output in the CLI. * refactor(inspector): optimize playground handling in OpenAIComponentRenderer - Removed stale closure handling for playground settings by directly capturing the playground state at effect run time. - Enhanced logging to provide better visibility into the stored widget data and playground configuration. - Updated comments for clarity on the handling of dynamic updates to iframe globals without reloading the widget. These changes improve the efficiency and maintainability of the OpenAIComponentRenderer component. * refactor(inspector): remove unused SearchableSelect and UIPlaygroundTab components - Deleted the SearchableSelect component, which was not utilized in the codebase, streamlining the component library. - Removed the UIPlaygroundTab component, consolidating playground functionality and reducing code complexity. These changes enhance maintainability by eliminating redundant components from the inspector package. * refactor(docs): streamline documentation for dual-protocol widget support - Consolidated and clarified documentation across various guides to emphasize dual-protocol support for MCP Apps and ChatGPT Apps SDK. - Updated descriptions and examples to reflect the latest features and best practices for widget development. - Enhanced the inspector documentation to provide clearer instructions for debugging and testing widgets in both protocols. - Removed redundant content and improved organization for better user navigation. These changes improve the overall clarity and usability of the documentation, aiding developers in leveraging the dual-protocol capabilities effectively. * refactor(inspector): optimize MCPAppsRenderer and ToolResultDisplay components - Replaced useState with useRef for containerRef in MCPAppsRenderer to prevent unnecessary state updates during ref callback. - Updated effect dependencies in MCPAppsRenderer to remove unused variables, enhancing performance. - Memoized onSendFollowUp callback in ToolResultDisplay to prevent infinite re-render loops, improving efficiency. - Enhanced WidgetDebugProvider by using useMemo for context value to minimize re-renders and added a ref for accessing current state without causing updates. These changes collectively improve the performance and maintainability of the inspector components. * feat(mcp-use): add landing page generation for browser requests - Introduced a new `generateLandingPage` function to handle browser GET requests and serve a landing page. - Updated the `mountMcp` function to detect browser requests and return the generated landing page with appropriate headers. These changes enhance user experience by providing a dedicated landing page for browser users, improving accessibility and engagement. * refactor(docs): update documentation for dual-protocol widget migration - Enhanced documentation to clarify the migration process from `appsSdk` to `mcpApps`, emphasizing the new `metadata` format. - Added examples demonstrating the updated widget registration and metadata structure for both protocols. - Included a migration checklist and field mapping reference to assist developers in transitioning to the dual-protocol support. These changes improve the clarity and usability of the documentation, aiding developers in effectively leveraging the new features. * refactor(mcp-use): map console log levels to RFC 5424 standards - Introduced a mapping of JavaScript console log levels to RFC 5424 log levels for improved logging consistency. - Updated the logging notification helper to utilize the new mapping, ensuring standardized log level reporting. These changes enhance the clarity and reliability of logging within the MCP Apps Bridge, aligning with best practices for log management. * refactor(docs): update documentation for MCP Apps migration and dual-protocol support - Enhanced the documentation to clarify the migration process from `appsSdk` to `mcpApps`, including updates to the `metadata` format. - Added detailed examples and a migration checklist to assist developers in transitioning to the new dual-protocol support. - Improved the organization and clarity of the documentation, making it easier for developers to understand and implement the changes. These updates aim to facilitate a smoother migration experience and better utilization of the new features in the MCP Apps framework. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * refactor: update templates and documentation for MCP Apps support (#888) * refactor: update templates and documentation for MCP Apps support - Replaced references from `apps-sdk` to `mcp-apps` across various files, including CI workflows, documentation, and template configurations. - Removed the deprecated `creating-apps-sdk-server` documentation and updated links to the new `creating-mcp-apps-server` guide. - Enhanced the README and other documentation files to reflect the new `mcp-apps` template usage and features. - Updated CLI commands and package.json scripts to align with the new template naming conventions. - Improved clarity in documentation regarding the migration from `apps-sdk` to `mcp-apps`, ensuring a smoother transition for developers. These changes collectively enhance the developer experience by providing clearer guidance and updated resources for working with MCP Apps. * chore: update pnpm-lock.yaml for package version adjustments and path corrections - Renamed the path for `mcp-apps` in the lock file to reflect the new directory structure. - Updated package versions for `vite` and related dependencies from 7.3.0 to 7.3.1, ensuring compatibility with the latest features. - Adjusted the path for `mcp-use` dependencies to maintain consistency with the new structure. * chore(typescript): version packages (canary) * Docs/update/fic (#889) * refactor(docs): format documentation page entries for consistency - Updated the `docs.json` file to format the `pages` entries as arrays for better readability and consistency across different groups. - Ensured that all `pages` attributes are uniformly structured, enhancing the overall organization of the documentation. * refactor(docs): improve documentation for dual-protocol widget migration - Updated documentation to clarify the migration process from `appsSdk` to `mcpApps`, including the new `metadata` format. - Added detailed examples and a migration checklist to assist developers in transitioning to the dual-protocol support. - Enhanced organization and clarity of the documentation for better usability. * chore(typescript): version packages (canary) * refactor(product-search-result): update widget descriptions for MCP Apps consistency (#890) - Revised text in the ProductSearchResult widget to replace references from "OpenAI apps sdk" to "mcp-apps specification" for clarity. - Updated the template title from "Apps SDK Template" to "MCP-Apps Template" and adjusted the description to reflect the new naming conventions, enhancing consistency across the documentation and user experience. * chore(typescript): version packages (canary) * refactor(product-search-result): update widget configuration and impr… (#891) * refactor(product-search-result): update widget configuration and improve HTML injection for MCP Apps - Cleared the connectDomains in the product search result widget to enhance security. - Removed the title prop from the Accordion component to simplify its usage. - Preserved devServerBaseUrl during HTML injection in shared routes for better compatibility with MCP Apps. - Enhanced the logging notification system in the MCP Apps Bridge to handle serialization of console arguments, improving error handling and preventing DataCloneError. - Updated protocol helpers to ensure proper merging of UI metadata, maintaining resourceUri integrity. These changes collectively improve the configuration and functionality of widgets within the MCP Apps framework, enhancing security and usability. * refactor(ci): update template configurations for consistency across workflows - Replaced the `mcp-ui` template with `blank` in CI workflows to streamline template options. - Removed outdated logging tips related to the `mcp-ui` template in the create-mcp-use-app package, enhancing clarity for developers. These changes improve the consistency and clarity of template usage in the CI processes and documentation. * refactor(inspector): enhance MCP Apps debugging and widget integration - Improved the MCPAppsRenderer and ToolResultDisplay components for better performance and maintainability. - Streamlined the handling of widget state and logging within the inspector, enhancing debugging capabilities for MCP Apps. - Updated documentation to clarify the dual-protocol support and provide clearer instructions for developers. These changes collectively enhance the developer experience by optimizing component performance and improving the clarity of documentation for MCP Apps integration. * chore(typescript): version packages (canary) * chore(package): add lodash override to package.json templates * chore(typescript): version packages (canary) * feat(mount-mcp): add helper function to construct full URL with proxy headers - Introduced `getFullUrl` function to handle URL construction considering proxy headers, improving compatibility for production deployments. - Updated landing page generation to use the constructed full URL instead of the raw request URL, enhancing accuracy in response handling. * refactor(weather): simplify weather response in starter template - Updated the weather response in the starter template to return a static sunny message instead of fetching real-time data, streamlining the functionality for demonstration purposes. * chore(typescript): version packages (canary) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
pietrozullo
|
49926b7bbf | chore(docs): linking does not work in docs and results in 404 page. remove updates page from main navigation | ||
|
pietrozullo
|
cd6408069f |
docs(python): revamp getting started pages to match TypeScript style
- Add welcome page with py_welcome.png image - Rewrite quickstart with Agent/Client/Server sections and mermaid diagram - Simplify installation page (single package, no separate sections) - Add updates symlink to changelog in getting-started - Remove configuration overview page, update broken links to specific pages - Update changelog title to "Updates" |
||
|
pietrozullo
|
be5f4d7490 | python/release1.6.0 | ||
|
Pietro Zullo
|
d789a92b4b |
feat(server): Bearer Token authentication for Python MCP server (#841)
* Fix DNS rebinding protection for cloud/proxy deployments
- Add host/port parameters to MCPServer.__init__() and pass to FastMCP
- Default host to "0.0.0.0" (cloud-friendly, disables DNS protection)
- "127.0.0.1" auto-enables DNS protection (handled by FastMCP)
- run() can override host/port, falls back to __init__ values
- Add comprehensive docstring to __init__() explaining parameters
- Update documentation
This fixes 421 Misdirected Request errors when running behind reverse
proxies (Cloudflare, nginx, etc.) where the Host header doesn't match
the auto-configured allowed_hosts for localhost.
* Fix DNS rebinding protection for cloud/proxy deployments
- Add host/port parameters to MCPServer.__init__() and pass to FastMCP
- Default host to "0.0.0.0" (cloud-friendly, disables DNS protection)
- "127.0.0.1" auto-enables DNS protection (handled by FastMCP)
- run() can override host/port and reconfigures DNS protection accordingly
- Rebuild app when host changes in run() to apply new security settings
- Add comprehensive docstring to __init__() explaining parameters
- Add unit tests for host/port configuration and run() overrides
- Update documentation
This fixes 421 Misdirected Request errors when running behind reverse
proxies (Cloudflare, nginx, etc.) where the Host header doesn't match
the auto-configured allowed_hosts for localhost.
* ruff lint
* Bump mcp minimum version to 1.23.0
Required for TransportSecuritySettings and DNS rebinding protection
auto-configuration feature that was added in v1.23.0.
* feat(server): add bearer token authentication for Python MCP server
Add HTTP-layer bearer token authentication that returns proper 401 responses.
- BearerAuthProvider: abstract base class with verify_token() method
- AccessToken: model with token, claims, and scopes fields
- AuthMiddleware: Starlette middleware returning HTTP 401 for invalid tokens
- get_access_token() / require_auth(): context helpers for tools
Usage:
```python
class MyAuth(BearerAuthProvider):
async def verify_token(self, token: str) -> AccessToken | None:
if token != "secret":
return None
return AccessToken(token=token, claims={"user": "alice"})
server = MCPServer(name="my-server", auth=MyAuth())
```
Closes #840
* autogenerate docs
* test(server): add unit and integration tests for bearer token auth
Unit tests:
- AccessToken model creation and serialization
- BearerAuthProvider abstract class and subclassing
- get_access_token/require_auth context helpers
- AuthMiddleware 401 responses, path exclusion, CORS
Integration tests:
- MCPClient connecting to bearer auth server with valid token
- Connection failure with invalid/missing token
- Tool access to user claims and scopes
* fix(server): address code review feedback for bearer auth
- Fix CORS security: allow_credentials=False with allow_origins=["*"]
- Remove dead try/except import for auth module
- Remove PII (email) from debug logs
- Add comment explaining broad exception handling in verify_token
- Add /openmcp.json to docs excluded paths list
- Remove set_access_token from public API (internal only)
- Create AuthenticationError instead of using ValueError
- Skip middleware tests on older httpx versions (TestClient compat)
* docs: update API documentation for auth module
* fix(server): address Copilot review feedback
- Fix bearer.mdx: require_auth raises AuthenticationError, not ValueError
- Fix API docs: claims and scopes are optional with defaults, not required
- Remove deprecated SSE transport from bearer_auth_server.py test server
* autogenerate docs
* fix(server): address renvins review feedback
- Improve bearer.mdx claims documentation with explanation and examples
- Remove unnecessary cast() for AuthMiddleware in server.py
- Refactor auth tests to use pytest fixtures for cleaner setup/teardown
* docs(auth): clarify that all MCP endpoints are automatically protected
- Add "What Gets Protected" section explaining automatic protection
- Clarify that get_access_token/require_auth are for accessing token data, not protection
- Update examples to show proper usage pattern
- Improve Note at bottom to be clearer
* fix(auth): prevent path prefix bypass in auth middleware
Security fix: Use exact path matching or segment-based prefix matching
instead of simple startswith() to prevent auth bypass attacks.
Before: /docs-secret would bypass auth because it starts with /docs
After: Only /docs and /docs/* bypass auth, /docs-secret requires auth
Added tests for path matching security edge cases.
* refactor(auth): update import paths for authentication components
- Changed import statements in multiple documentation files and source files to reflect the new structure, moving authentication-related imports to the `auth` submodule.
- Updated examples to ensure clarity and consistency in usage patterns for `BearerAuthProvider`, `AccessToken`, `get_access_token`, and `require_auth`.
|
||
|
Enrico Toniato
|
0144a315fd |
Canary (#815)
* chore(deps): bump hono from 4.11.1 to 4.11.4 in /libraries/typescript (#810) * chore(deps): bump hono from 4.11.1 to 4.11.4 in /libraries/typescript Bumps [hono](https://github.com/honojs/hono) from 4.11.1 to 4.11.4. - [Release notes](https://github.com/honojs/hono/releases) - [Commits](https://github.com/honojs/hono/compare/v4.11.1...v4.11.4) --- updated-dependencies: - dependency-name: hono dependency-version: 4.11.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * chore: add changeset for dependabot updates --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat(inspector): add stop functionality to inspector chat (#811) * add stop func to inspector chat * chore: apply formatting fixes and add changeset for stop functionality - Run prettier formatting on inspector files - Add changeset for stop functionality feature Co-authored-by: Joaquin Coromina <bjoaquinc@users.noreply.github.com> * fix(chat): handle cancellation of pending tool calls in MessageList and chat message hooks - Updated MessageList component to reflect tool invocation states: "error", "pending", and "result". - Implemented logic in useChatMessages and useChatMessagesClientSide hooks to mark pending tool calls as cancelled when the abort signal is triggered, updating the message state accordingly. --------- Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Joaquin Coromina <bjoaquinc@users.noreply.github.com> * Feat/cli/improve devx (#808) * feat(cli): enhance login and deployment commands with improved error handling and user prompts - Updated the login command to handle errors gracefully, providing user feedback on login failures. - Modified the deployment command to prompt users for login if not authenticated, enhancing user experience. - Removed the `fromSource` option from the deployment command, streamlining the deployment process. - Added checks for uncommitted changes in the git repository before deployment, ensuring users are aware of their current state. - Updated various commands to consistently use `npx mcp-use login` for login instructions, improving clarity. * refactor(inspector, multi-server-example): streamline authentication UI and logic - Simplified the authentication button logic in InspectorDashboard, consolidating the rendering of the authentication state and removing redundant elements. - Updated the multi-server example to directly link to the authentication URL, enhancing user experience by eliminating unnecessary prompts and improving clarity in the authentication process. * fix(multi-server-example): update Supabase URL to use placeholder for project reference - Changed the Supabase server URL in the multi-server example to use a placeholder `{PROJECT_REF}` instead of a hardcoded project reference, enhancing flexibility and usability for developers using the example. * feat(cli): enhance login and deployment commands; refactor authentication UI - Improved error handling in the login command and added user prompts for better feedback. - Updated the deployment command to prompt for login if not authenticated and removed the `fromSource` option. - Added checks for uncommitted changes before deployment. - Streamlined the authentication UI in InspectorDashboard and updated the multi-server example to link directly to the authentication URL. * feat(ci): add caching for Deno dependencies in CI workflow - Implemented a caching mechanism for Deno dependencies in the TypeScript PR preview workflow to reduce download timeouts during tests. - Added retry logic for caching attempts to enhance reliability and ensure tests can proceed even if caching fails. * fix(ServerDropdown, ShimmerButton): update theme handling and styling adjustments - Refactored theme handling in ShimmerButton to use `theme` instead of `resolvedTheme`, ensuring consistent color application based on the current theme. - Made minor styling adjustments in ServerDropdown to enhance button appearance, maintaining responsiveness and visual clarity across themes. * feat(typescript): add type definitions for React and ReactDOM - Added `@types/react` and `@types/react-dom` to the TypeScript package dependencies to improve type support for React components, enhancing development experience and type safety. * refactor(ui): enhance component type definitions and forward refs - Updated Badge and Button components to use React.forwardRef for improved ref handling. - Enhanced Checkbox and Popover components with explicit type definitions for better type safety. - Refactored DropdownMenu components to include type annotations, ensuring consistency and clarity in usage. * chore: enter canary prerelease mode * chore(typescript): version packages (canary) * feat(logging): replace Winston with built-in SimpleConsoleLogger and enhance logging configuration - Removed the `winston` dependency, introducing a built-in logging system that works in both Node.js and browser environments. - Updated logging configuration in the server documentation to reflect the new logger's API and usage. - Enhanced RPC logging with new filtering capabilities and added migration guides for users transitioning from Winston. - Added `.gitignore` files to various templates to prevent unnecessary files from being included in version control. * feat(changelog): add release images for versions 1.12.0 to 1.1.0 - Included image frames for each release in the changelog, enhancing visual representation of updates from version 1.12.0 down to 1.1.0. - Each image corresponds to the respective release title and date, improving the overall presentation of the changelog. * feat(docs): update inspector and TypeScript changelogs with new features and enhancements - Added detailed release notes for versions 0.15.0 to 0.14.1 in the inspector changelog, highlighting new functionalities like chat stop capabilities and various enhancements. - Updated TypeScript changelog with entries for versions 1.13.2 to 1.12.1, including improvements in CLI commands, dependency updates, and security fixes. - Enhanced overall documentation clarity by including images for specific releases and restructuring content for better readability. * fix(docs): correct changelog formatting and enhance clarity (#817) - Fixed formatting issues in the TypeScript changelog by ensuring proper closing tags for update sections. - Improved overall readability and structure of the changelog entries for better user experience. * chore(typescript): version packages (canary) * refactor(docs): improve formatting of pages in documentation structure - Reformatted the pages array in the documentation JSON to enhance readability and maintain consistency across different sections. - Ensured that each page entry is on a new line for better clarity and easier future modifications. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Joaquin Coromina <75667013+bjoaquinc@users.noreply.github.com> Co-authored-by: Joaquin Coromina <bjoaquinc@users.noreply.github.com> |
||
|
Pietro Zullo
|
d8d319c940 |
fix(python/server): improve debug and pretty_print_jsonrpc behavior (#814)
* fix(python/server): improve debug and pretty_print_jsonrpc behavior - Make pretty_print_jsonrpc work independently of debug_level (previously required DEBUG=2 environment variable) - Rename run_debug to debug in server.run() for consistency - Make run(debug=True) override server's debug_level if it was 0 - Remove aggressive signal handlers that broke thread compatibility (uvicorn handles SIGINT/SIGTERM gracefully) - Update all documentation to use new debug parameter name * refactor(python/server): remove unused lupo_tool function from server_example.py * docs: update signals API reference after simplification * refactor: remove unused signals.py module uvicorn already handles SIGINT/SIGTERM gracefully, so custom signal handlers are unnecessary. Removed the signals.py file and all references to setup_signal_handlers(). * chore: remove analysis files |
||
|
Vincenzo Reina
|
4997674559 |
feat(python): Intercept MCP handshake with on_initialize middleware (#769)
* Wrap server session from MCP * Update server and middleware * Update middleware example * Fix formatting and linting * Update docs * Fix monkeypatch for tests * Update docs and remove comment * feat(python): add tests, docs, and docstrings for on_initialize middleware - Add 13 unit tests covering dispatch, chain order, rejection, and context enrichment - Rewrite middleware.mdx documentation with Mintlify components (Tabs, Tips, Cards) - Add comprehensive docstring to MiddlewareServerSession documenting single-server-per-process limitation - Add docs/CLAUDE.md with documentation improvement guidelines - Regenerate API documentation * docs: highlight typed context feature in middleware docs * example: add ClientCapabilitiesGuard demonstrating typed context * style: fix linting in middleware example * docs(examples): add comprehensive docstrings to middleware_example.py - Add module docstring explaining key concepts and middleware hooks - Document each middleware class with typed context details - Organize code with section headers (CONNECTION, REQUEST, TOOL-SPECIFIC) - Add ClientCapabilitiesGuard example showing typed context usage --------- Co-authored-by: pietrozullo <pietro.zullo@gmail.com> |
||
|
pietrozullo
|
6d04f70106 | release/python1.5.2 | ||
|
Pietro Zullo
|
2c8a3f7d88 |
chore(python): docs update (#795)
* chore(docs): remove Blog section from documentation - Eliminated the Blog tab and its associated group from the documentation structure, streamlining the content for better clarity and focus on relevant topics. * chore(docs): update image links in changelog and remove obsolete images - Replaced local image paths with CDN links for releases 1.3.11, 1.3.12, 1.4.0, 1.4.1, and 1.5.0 in the changelog files. - Deleted outdated image files for releases 1.3.11 and 1.3.12 to streamline documentation and reduce clutter. * fix(docs): update documentation link for logo reference - Changed the logo href from the main site to the documentation page for better navigation and user experience. |
