skills/mcp-use__mcp-use
1
0
Fork 0
mirror of https://github.com/mcp-use/mcp-use.git synced 2026-09-14 18:06:01 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
codex/a2ui-example
mcp-use__mcp-use/.github/pull_request_template.md
T
Andrew Khadder 83271e869f Canary (#1508) 
* chore: remove unused mcp-use source files (#1476)

* chore: enter canary prerelease mode

* chore(typescript): version packages (canary)

* docs(cli): clarify inspector skipped-in-production log + start section (#1505)

* docs(cli): clarify inspector skipped-in-production log + start section

The runtime log "[INSPECTOR] Skipped in production (use --with-inspector
flag during build)" reads as if the flag can be passed to `mcp-use
start`, which it can't (the flag is only registered under `build`). The
new wording spells out the rebuild command, and `cli-reference.mdx`
gains a short note under `start` pointing at the build flag for
inspector-in-production.

Closes #1495

* docs(cli): apply reviewer reword on inspector note

* chore(typescript): version packages (canary)

* chore(inspector): remove unused source files (#1510)

Drops the 18 inspector files reported by `pnpm knip` from
libraries/typescript and stops generating the unused client-side
version.ts (the client reads the version from the
window.__INSPECTOR_VERSION__ global injected by the server).

Part of #1446.

* chore(typescript): version packages (canary)

* chore(typescript): prune 187 unused exports and 161 unused export types flagged by knip (#1511)

* chore(typescript): prune 161 unused exported types flagged by knip

Phase 2 of #1450: remove or de-export types that knip flags as unused.
Skipped tuning knip.json (Phase 1) — focused only on the type cleanup.

For each flagged type:
- Used only within its source file → drop `export`
- Re-exported through a barrel but never imported downstream → remove the re-export
- Genuinely dead → delete

No public-API removals: types exposed through the `mcp-use`, `@mcp-use/cli`,
`@mcp-use/inspector`, or `create-mcp-use-app` package entry points remain
exported. `client.ts` switches from inline `import("...")` to a top-level
import so knip can see the `ToolSearchResponse` usage.

Verified `pnpm knip` reports 0 unused types (down from 161) and
`pnpm build` passes across all packages.

* chore(typescript): prune 187 unused exports flagged by knip

Closes #1450.

* chore(typescript): fix prettier formatting

* chore(typescript): delete orphaned PropsSelect.tsx

Removing the unused barrel re-export in the prior commit left this file
with no consumers.

* chore(typescript): version packages (canary)

* ci(knip): enforce knip and clear final baseline findings (#1512)

* chore(knip): clear remaining baseline findings so knip passes clean

- Mark `src/index.tsx` as an entry for create-mcp-use-app so its
  CLI dependencies (chalk, commander, ink, ora, tar, react, etc.)
  stop being flagged as unused.
- Add `lsof`, `sleep`, and `dev` to ignoreBinaries for the mcp-use
  workspace — these appear in example scripts and are either system
  utilities or pnpm script names, not npm-resolvable binaries.
- Turn off the `optionalPeerDependencies` rule. Optional peer deps
  (langchain/langfuse/e2b/etc.) are loaded conditionally by design;
  flagging them as referenced is noise.

After this change `pnpm exec knip` exits 0 against canary.

* ci(knip): enforce knip in CI

The baseline is now clean (canary + previous PRs cleared all findings),
so drop `--no-exit-code` and let the job fail when knip reports issues.
Also generate `packages/mcp-use/src/version.ts` before knip runs so the
gitignored `version.js` imports resolve.

* chore(deps): bump better-auth in /libraries/typescript (#1515)

Bumps [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) from 1.6.1 to 1.6.11.
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/better-auth@1.6.11/packages/better-auth)

---
updated-dependencies:
- dependency-name: better-auth
  dependency-version: 1.6.11
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* docs: tighten PR readiness and docs hygiene (#1509)

* docs: tighten review readiness and doc links

* docs: anchor api-reference redirect and fix missed node note

Move the /typescript/server/api-reference target from a bare redirect
to an anchored one (#mcpserver-api-reference) so existing "API Reference"
links land on the renamed section directly. Drop the self-link in
server/index.mdx and bring the commonjs example's Node note in line with
the package engines range.

---------

Co-authored-by: Andrew Khadder <andrew@manufact.com>

* feat(server/oauth): allow Supabase URL override for self-hosted/local instances (#1517)

* feat(server/oauth): allow overriding Supabase URL for self-hosted/local instances

`oauthSupabaseProvider` previously hardcoded `https://${projectId}.supabase.co`,
preventing use against local Supabase (`http://localhost:54321`) or self-hosted
deployments — even though those instances expose the same OAuth 2.1 server.

Add an optional `supabaseUrl` config (and `MCP_USE_OAUTH_SUPABASE_URL` env var)
that overrides the projectId-derived URL. `projectId` is now optional when
`supabaseUrl` is set; hosted-project users are unaffected.

Closes mcp-use/mcp-oauth-supabase-template#2

* test(server/oauth): trim supabase provider tests to factory contract

Drop low-value string-concatenation and pre-existing-behavior tests; keep
the two that cover the new behavior (supabaseUrl alone is accepted; empty
config throws). Isolate process.env in the factory describe so the
"throws when neither configured" assertion isn't defeated by local
MCP_USE_OAUTH_SUPABASE_* env vars.

* docs(server/oauth): document supabaseUrl override for local/self-hosted Supabase

* chore(typescript): version packages (canary)

* chore: use cross-platform clean commands (#1523)

* chore: use cross-platform clean commands

* chore: add empty changeset for cross-platform clean scripts

---------

Co-authored-by: Andrew Khadder <andrew@manufact.com>

* chore(typescript): version packages (canary)

* fix(server/oauth): use URL constructor to avoid double slash in metadata proxy (#1483)

* fix(server/oauth): use URL constructor to avoid double slash in metadata proxy

The DCR-direct metadata proxy was string-concatenating a path onto the
issuer, which canonically ends with a trailing slash:

    `${issuer}/.well-known/oauth-authorization-server`
    // → "https://tenant.auth0.com//.well-known/oauth-authorization-server"

Auth0 returns 404 for any path starting with "//", which broke OAuth
discovery end-to-end against real Auth0 tenants in DCR-direct mode.

new URL(path, base) normalizes the join regardless of trailing slash, so
this works for any provider whose canonical issuer ends with "/".

Fixes #1482.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(server/oauth): normalize issuer trailing slash instead of using URL constructor

`new URL("/.well-known/...", issuer)` resolves the leading-slash path against
the issuer's origin, stripping any path on the issuer. That breaks providers
like Supabase whose issuer is `https://<project>.supabase.co/auth/v1`. Replace
with a trailing-slash-stripping template literal, which handles both Auth0
(issuer ends with `/`) and Supabase (issuer has a path).

* chore(changeset): trim oauth metadata fix entry

* chore(changeset): drop issue reference

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>

* chore(typescript): version packages (canary)

* test(inspector): add OAuth e2e against emulated Google issuer (#1481)

* test(inspector): add OAuth e2e test using emulated Google issuer

Covers the inspector's OAuth redirect flow end-to-end against an
`emulate`-backed Google issuer + MCP server in oauthProxy mode, run
twice across the Direct and Via Proxy connection-type matrix. Both
variants share one fixture in serial mode since the registered redirect
URI pins the MCP server to a fixed port.

* test(inspector): switch loop to factory to satisfy no-loop-func

The for-loop variant captured the mutable `fixture` binding from beforeAll,
which eslint's no-loop-func flags. Hoisting the body into a small factory
keeps the shared fixture without the closure-over-loop pattern.

* test(inspector): close emulator if MCPServer setup fails

Wrap post-createEmulator work in try/catch so the emulator port
doesn't stay bound when MCPServer construction or listen() throws.

* chore(typescript): version packages (canary)

* fix(inspector): surface MCP server auth failures with reconnect banner (#1485)

* fix(inspector): surface MCP server auth failures with reconnect banner (MCP-2111)

When the hosted inspector's chat backend returns 401 because the upstream
MCP server rejected the user's OAuth token (e.g. Linear token expired),
the inspector previously threw a generic `HTTP error! status: 401` and
the cloud response misleadingly pointed users at the Manufact account
login.

The chat now recognises the cloud's `{ error: "mcp_auth_required",
mcpServerUrl }` response and renders an inline banner above the input
("Reconnect to <server>") with a button that calls
`connection.authenticate()`. Reconnect refreshes the OAuth token in
localStorage; the banner clears on success and chat resumes.

Pairs with a cloud-side change that drops the misleading `loginUrl`
field from the 401 response.

* fix(inspector): harden mcp_auth_required handling

- Drop the no-op setMessages filter in the 401 branch; the optimistic
  assistant message is only added after the response check, so there's
  nothing to remove.
- Guard `new URL(serverUrl)` in McpReconnectBanner so a malformed URL
  falls back to the raw string instead of crashing the chat tab.

* refactor(inspector): rename mcpAuthRequired to mcpServerAuthRequired

The hook's internal state was already named `mcpServerAuthRequired`, but
the returned key and clear callback used the shorter `mcpAuthRequired`,
forcing the ChatTab consumer to re-alias them. The shorter name was
also ambiguous in a codebase that has two distinct auth flows: the
Manufact account login (429 path) and the upstream MCP server OAuth
(401 path).

Align the public surface of `useChatMessages` with the internal state
and the consumer's local name. The backend wire value
`"mcp_auth_required"` is unchanged.

* chore(inspector): remove mcpServerAuthRequired comment

* chore(typescript): version packages (canary)

* fix(inspector): keep tab count badges visible in collapsed mode (#1490)

* fix(inspector): keep tab count badges visible in collapsed mode

* Keep tab badges aligned in collapsed mode

* extract TabCountBadge and fix badge visibility

* chore(typescript): version packages (canary)

* fix(inspector): drop unused TabCountBadge barrel re-export (#1533)

The only consumer (LayoutHeader.tsx) imports TabCountBadge directly
from ./shared/TabCountBadge, so the re-export in shared/index.ts is
unused. Knip flagged it and started failing CI on canary after the
TabCountBadge change landed.

* chore(typescript): version packages (canary)

* feat(inspector): add local LLM provider support for chat in Inspector (#1395)

* feat(inspector): integrate ollama provider

* feat(inspector): integrate lmstudio provider

* fix(inspector): preserve no-icon behavior for openai-compatible provider

* refactor(inspector): remove LM Studio provider and address PR feedback

* fix(inspector): remove duplicate ollama union members

Collapses the accidental `"ollama" | "ollama"` duplicates in
ProviderName, MCPChatMessageEventData, and LLMConfig.

* refactor(inspector): drop LLM proxy and call Ollama directly

Ollama allows localhost origins by default, so the inspector talks to
the daemon over CORS and skips the server-side proxy entirely. Surface
an OLLAMA_ORIGINS hint when the browser fetch fails so tunneled or
remote setups know what to configure. Theme the Ollama logo and tighten
its size so the non-circular mark sits cleanly next to the other
provider icons.

* chore(inspector): revert gratuitous field reorders

Restore original ordering of temperature/baseUrl and useCallback deps;
remove stray blank line in vite.config.ts to keep the diff focused.

* test(inspector): add unit tests for parseNDJSON

* refactor(inspector): tighten Ollama provider integration

- Guard Ollama streamChat against duplicate tool-call emissions when a
  chunk's tool_calls are repeated by proxies/forks
- Key the models cache on (provider, baseUrl) for any base-url provider
  so openai-compatible no longer serves stale entries on URL changes;
  normalize Ollama variants (trailing slash, /api suffix) to one entry
- Move OllamaCorsError into the Ollama provider module
- Replace hand-written provider unions in telemetry events and
  server shared-utils with ProviderName
- Single-source DEFAULT_OLLAMA_BASE_URL from ollama/utils.ts
- Drop the unrelated tempApiKey/tempModel trim() drift in saveLLMConfig
- Make OPENROUTER_ICON_URL module-private, clean up merge-artifact
  blank lines

* chore: simplify changeset

* style(inspector): apply prettier to shared-utils

* fix(inspector): drop unused export on DEFAULT_BASE_URLS

DEFAULT_BASE_URLS is only consumed by getDefaultBaseUrl in the same
module. Knip flagged the export as unused and failed CI.

* ci: retrigger after canary knip fix (#1533)

---------

Co-authored-by: Andrew Khadder <andrew@manufact.com>

* chore(typescript): version packages (canary)

* fix(inspector): resolve CodeQL polynomial-regex alert in Ollama url normalizer (#1534)

* fix(inspector): replace trailing-slash regex in Ollama url normalizer

CodeQL flagged `/\/+$/` in `normalizeOllamaBaseUrl` as a polynomial
regular expression on uncontrolled input. Swap the regex for an
explicit linear scan and add unit tests covering the trimming
behaviour plus a pathological-input case.

* chore: drop unit test for trivial regex refactor

* chore: drop accidentally committed .antigravitycli symlink

* chore(typescript): version packages (canary)

* chore: remove dead typescript-format-and-lint pre-commit hook (#1541)

The hook entry pointed to `.git/hooks/typescript-pre-commit.sh`, a path
that is never tracked and was never populated by any setup step, so the
hook could not run for anyone. TypeScript formatting and linting are
already handled by Husky (libraries/typescript/.husky/pre-commit),
installed automatically via `pnpm install`'s `prepare` script.

Closes #1536

* fix(inspector): stop ToolInputForm from mutating live tool inputSchema (#1545)

* fix(inspector): stop ToolInputForm from mutating live tool inputSchema

`ToolInputForm` was writing `required: boolean` onto each property of the
live tool inputSchema during render. `required` is not valid as a per-
property boolean — it belongs on the parent object as a `string[]`.
Anthropic's draft 2020-12 validator rejected the resulting payload with
`tools.0.custom.input_schema invalid`, breaking the Inspector chat after
any tool had been opened in the Tools tab.

Replace the mutation with a local `isRequired` const used only for the
`*` indicator render.

Fixes MCP-1970.

* chore(inspector): trim comment on schema-mutation fix

* chore: remove verbose comment

* style(inspector): apply prettier to ToolInputForm

* chore(typescript): version packages (canary)

* Improve tab switch animation timing (#1544)

* chore(ui): improve tab switch animation timing

* chore(changeset): add changeset for tab animation improvement

* chore(typescript): version packages (canary)

* fix(inspector): propagate server alias updates through mcp server wrapper (#1539)

* fix(inspector): propagate server alias updates through McpServerWrapper onUpdate

* chore: add changeset for mcp-use server alias propagation fix

---------

Co-authored-by: Andrew Khadder <andrew@manufact.com>

* chore(typescript): version packages (canary)

* chore(typescript): add 3-day install cooldown via pnpm minimumReleaseAge (#1516)

Blocks `pnpm install` from fetching npm versions published less than 3
days ago, mitigating supply-chain attacks where a malicious release is
typically yanked within hours of discovery.

The setting (introduced in pnpm 10.16) lives in pnpm-workspace.yaml — in
modern pnpm only auth/registry config is read from .npmrc, so putting it
there would be silently ignored.

Workspace-published names (`mcp-use`, `@mcp-use/*`, `create-mcp-use-app`)
are exempted so the cooldown never interferes with local development or
fresh releases of our own packages.

* fix(react): improve server management in McpClientProvider (#1561)

Refactor server removal and update logic to use a ref for synchronous access to the latest server state. This change prevents React's warning about updating a component during rendering by ensuring that teardown side effects (`disconnect()` and `clearStorage()`) are executed outside of the state updater functions. The ref is updated in a useEffect hook to maintain the latest server state for event handlers.

* chore(typescript): version packages (canary)

* fix(inspector): forward MCP image tool results as image content (#1487)

* fix(inspector): forward MCP image tool results as image content (MCP-1941)

Previously, the inspector's chat loop and provider adapters serialized MCP
tool results with JSON.stringify, which buried the base64 `data` field of
`image` content blocks inside a text payload. Vision-capable models
received a wall of base64 text instead of the image.

Extract MCP `content` blocks into provider-neutral `ContentPart[]` and
route image bytes through each provider's vision channel:

- Anthropic: image blocks inside `tool_result.content` (base64 source).
- OpenAI: tool role keeps text; image bytes forwarded as a follow-up
  user turn with `image_url` parts.
- Google: `functionResponse.response` keeps text/metadata; image bytes
  forwarded as a follow-up user turn with `inlineData` parts.

Text-only tool results keep the legacy `content: string` path on every
provider.

* style(inspector): apply prettier formatting

* chore(inspector): drop unused export on collapseToString

Only called internally by toolResultToContent — knip flagged it as an
unused export.

* fix(inspector): propagate MCP isError flag and fix image example tools

- Add isToolResultError() helper and use it in toolLoop + replay so
  tool calls that return { isError: true } are flagged the same as
  thrown errors on both live and saved-conversation paths.
- Pick a no-content fallback for OpenAI's tool role when there are
  no image parts to forward.
- Replace via.placeholder.com URLs in the everything example with
  real base64-encoded bytes fetched from picsum.photos, since the
  image() helper expects MCP ImageContent base64 data, not URLs.

* style(inspector): apply prettier formatting

* chore(typescript): version packages (canary)

* fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL (#1552)

* fix(server/inspector): normalize 0.0.0.0 to localhost in autoConnect URL

Browsers cannot resolve 0.0.0.0 as a destination, and the MCP SDK's
OAuth resource validator does strict origin equality — so the inspector
auto-connecting to http://0.0.0.0:PORT/mcp mismatches the resource
metadata published as http://localhost:PORT (which goes through
normalizeUrlHost in server-helpers.ts). Result: OAuth-protected mcp-use
apps fail at the inspector's post-callback validation with "Protected
resource X does not match expected Y".

Mirror the existing normalization for the autoConnect URL and the
banner log so both reflect the browser-reachable host.

Closes #1551

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: add changeset for inspector autoConnect loopback normalization

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>

* chore(typescript): version packages (canary)

* fix(cli): align widget Vite base with /mcp-use/widgets (#1560)

* fix(cli): align widget Vite base with /mcp-use/widgets/ when MCP_URL is set

* chore: add changeset for cli widget base path fix

* chore: format widget-paths.ts

---------

Co-authored-by: Andrew Khadder <andrew@manufact.com>

* chore(typescript): version packages (canary)

* feat(cli): headless screenshot with auto-sizing and external MCP server support (#1579)

* feat(cli): headless screenshot command with auto-sizing and external MCP server support

- Make width/height optional; when omitted, clips to the widget's natural rendered size
  by reading body[data-view-*] rect attrs set by the preview page
- Add useBundleReadinessSignal in ViewPreview that uses ResizeObserver to wait for the
  iframe to stabilize before setting data-view-ready, serializing the iframe's bounding
  rect so the CLI can clip tightly instead of capturing the full viewport
- Switch ViewPreviewBundle to displayMode="inline" so widgets auto-size to content height
- Add inlineWidthOverride prop to MCPAppsRenderer to bypass the 768px inline cap when
  screenshotting at an explicit width
- Fix extractViewName to handle external MCP server URIs (ui://<server>/<name>.html)
  by flattening to <server>-<name>; previously only ui://widget/ was handled, causing
  React Router to fail to match the preview route for third-party servers like Excalidraw

* chore: add changeset for screenshot auto-sizing and external MCP fix

* fix(cli): unexport CaptureScreenshotResult to satisfy knip

* chore(typescript): version packages (canary)

* feat(auth): enhance OAuth callback handling with improved state management and user feedback (#1580)

* feat(auth): enhance OAuth callback handling with improved state management and user feedback

- Introduced a module-level cache for in-flight authorization promises to prevent duplicate network requests during the same page load.
- Added utility functions to determine if the current window is a popup and to render user-friendly messages for closing the window after authentication.
- Improved handling of redirect flows and popup scenarios to ensure a seamless user experience, including error handling and messaging for lost opener situations.

* fix(auth): BroadcastChannel fallback when popup opener is severed

Popup callback now broadcasts success/failure over a same-origin
BroadcastChannel("mcp_auth_callback") in the lost-opener branch, and
useMcp subscribes to that channel alongside the existing window.message
listener. Without this, popups whose window.opener was severed by COOP
or cross-origin intermediate redirects would save tokens but leave the
parent stuck in `authenticating`.

Matches the dual-transport pattern used by oidc-client-ts and MSAL.js
for the same COOP scenario.

* chore(auth): unexport MCP_AUTH_BROADCAST_CHANNEL to satisfy knip

It's only used inside callback.ts; the parent side hard-codes the same
string in useMcp.ts. Removing the export drops knip's "unused export"
finding while keeping a single source-of-truth comment that links the
two files.

* fix(mcp-use): split langchain agents out of mcp-use/browser entry

Move MCPAgent, RemoteAgent, adapters, and observability to
mcp-use/browser/agent so Next.js clients importing MCPClient only
no longer pull @langchain/* into the browser bundle.

* chore: format browser bundle test file

* chore(typescript): version packages (canary)

* fix(inspector): add copy button to user messages (#1556)

* fix(inspector): add copy button to user messages

Extract CopyButton into a shared component and add it to UserMessage,
matching the existing assistant message UX.

Resolves #1555

* chore: add inspector copy button changeset

---------

Co-authored-by: Jefsky <jefsky@users.noreply.github.com>
Co-authored-by: Andrew Khadder <andrew@manufact.com>

* chore(typescript): version packages (canary)

* feat(server): add publicLandingPage option for OAuth-protected servers (#1550)

* feat(server): add publicLandingPage option for OAuth-protected servers

* fix(server): keep public landing auth gate in oauth setup

* docs(server): add public landing page example

* chore(server): format mcp endpoint

* chore(server): simplify accept header lookup

* chore(server): restore mcp mount diff

* fix(server): align oauth exports with canary

* chore(server): format oauth exports

* fix(server): remove unused oauth barrel exports

---------

Co-authored-by: Andrew Khadder <andrew@manufact.com>

* Move mcp-apps template pnpm settings to workspace config (#1602)

* fix(inspector): widget fullscreen above embedded host chrome (MCP-2181) (#1605)

* fix(inspector): portal widget fullscreen above host chrome

MCP-2181: cloud chat headers at z-50 covered the fullscreen exit control
because the overlay used z-40 inside a nested stacking context. Portals
the fullscreen shell to document.body at z-[100], sets
data-mcp-widget-fullscreen for hosts, and shows the Apps SDK exit navbar
in CSS fullscreen fallback.

* fix(inspector): native fullscreen first, no portal remount (MCP-2181)

Revert conditional createPortal that remounted widgets on fullscreen toggle.
Use requestFullscreen() as the primary path; apply CSS z-[100] overlay only
when the API fails. Keep exit navbar and data-mcp-widget-fullscreen for both.

* refactor(inspector): consolidate widget fullscreen into shared hook

Extract useWidgetFullscreenControls for native-first fullscreen + CSS
fallback. Removes duplicated handlers, unused helpers, and OpenAI edge-case
branches from MCPAppsRenderer and OpenAIComponentRenderer.

* fix(inspector): preserve widget state when entering fullscreen (MCP-2181)

Route ui/request-display-mode through native fullscreen handling, target
requestFullscreen on the iframe wrapper, and avoid resetting load state on
display-mode-only changes. Stabilize OpenAI iframe listeners so chat
re-renders do not flash the skeleton.

* style(inspector): format OpenAIComponentRenderer for Prettier

* fix(inspector): fullscreen shell includes navbar and fills viewport

Promote the outer widget shell via requestFullscreen so FullscreenNavbar
stays visible and bg-background fills the screen instead of browser black
letterboxing around a nested iframe wrapper.

* fix(inspector): PiP portal and sandbox remount bridge reconnect (MCP-2181)

Port PiP to document.body with z-[100]. Re-run AppBridge when the sandbox
iframe remounts; keep the host spinner until initCount recovers. Unify
display-mode document attributes for optional host chrome hiding.

* fix(inspector): resend widget data after PiP remount

* chore(typescript): version packages (canary)

* Hash Claude resource domains from authored ui.domain (#1599)

* Apply Claude resource domain hashing for UI metadata

* chore: format Claude domain helper

* fix(inspector): drop unused widget-fullscreen exports to satisfy knip (#1607)

widget-fullscreen.ts (added in #1605) exported several symbols that
nothing outside the file consumes, plus pre-emptive @deprecated aliases
for an API that never shipped. Only useWidgetDisplayModeControls is used
(by MCPAppsRenderer and OpenAIComponentRenderer).

- Unexport internal-only constants, the WidgetDisplayMode type, and the
  useWidgetDisplayModeDocumentChrome helper
- Remove the dead useWidgetFullscreenControls / useWidgetFullscreenDocumentChrome aliases

* test(agent): drop live Langfuse API integration tests (#1608)

The observability integration tests queried the live Langfuse REST API
(via getRecentTraces) to verify traces landed. cloud.langfuse.com has
been returning 403 Forbidden for both ingestion and queries, failing the
'should send traces to Langfuse when observability is enabled' test and
reddening canary CI.

Remove the two tests that depend on the live API (the failing test and
the already-skipped manual-trace test) plus the now-unused getRecentTraces
helper. Keep the two tests that verify observability enable/disable
behavior locally with no network dependency.

* chore(typescript): version packages (canary)

* fix(oauth): redact token verification errors (#1573)

* fix(oauth): redact token verification errors

* chore: add oauth error redaction changeset

---------

Co-authored-by: Andrew Khadder <andrew@manufact.com>

* chore(typescript): version packages (canary)

* fix(inspector): skip emulate oauth tests in builtin e2e (#1609)

* chore: add codex to gitignore (#1612)

* fix(docs): update server API reference links (#1611)

* fix(mcp-use): pin published dependency versions (#1610)

* docs(changelog): document v1.29.0 / inspector v7.0.0 release

TypeScript changelog gains a v1.29.0 entry (public landing pages, Supabase URL override, Claude UI-resource domain hashing, OAuth callback + React-provider hardening). Inspector changelog gains a major v7.0.0 entry (local Ollama provider, image tool results, MCP-server reconnect banner, widget fullscreen/PiP rework).

* Fix builtin inspector auto-connect to use HTTP (#1613)

* Switch builtin inspector auto-connect to HTTP

* Use plain URL autoConnect in builtin e2e helper

* Fix built-in inspector auto-connect to use HTTP

* chore(typescript): version packages (canary)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: asim48-ctrl <asim48@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Truffle <truffleagent@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: SSharma1103 <shivamsharma11032009@gmail.com>
Co-authored-by: Polæ <steven@polae.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Arpit Maurya <arpitbabu802@gmail.com>
Co-authored-by: Udaykumar Dhokia <udaykumardhokia@gmail.com>
Co-authored-by: Neha Prasad <nehaa9863pd@gmail.com>
Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
Co-authored-by: Jefsky Wong <hwj3344@hotmail.com>
Co-authored-by: Jefsky <jefsky@users.noreply.github.com>
Co-authored-by: Ritwij Aryan Parmar <88580521+RitwijParmar@users.noreply.github.com>
2026-06-03 13:12:45 -07:00

2.6 KiB
Raw Permalink Blame History

Pull Request Description

Language / Project Scope

Check all that apply:

  • TypeScript
  • Python
  • Documentation only
  • CI/CD or tooling

Changes

Describe the changes introduced by this PR in a concise manner.

Review Readiness

Help maintainers review this quickly:

  • The PR is scoped to one issue or one clearly related change
  • The PR description explains the user-visible problem and the fix
  • The diff avoids unrelated formatting, generated files, and bulk rewrites
  • I verified the affected package/docs path with the commands listed below
  • I checked for existing open PRs that already solve the same issue

Implementation Details

  1. List the specific implementation details
  2. Include code organization, architectural decisions
  3. Note any dependencies that were added or modified

TypeScript Checklist

Complete this section if your PR includes TypeScript changes

Packages Modified

Check all packages that were modified:

  • docs
  • tests
  • cli
  • create-mcp-use-app
  • mcp-use (server)
  • mcp-use (client)
  • inspector

Pre-commit Checklist

Ensure all of the following have been completed:

  • Ran pnpm lint:fix to auto-fix linting issues
  • Ran pnpm format to format code with Prettier
  • Ran pnpm build and build succeeds without errors
  • Ran pnpm changeset to create a changeset (if this PR includes user-facing changes)
  • Added or updated tests if needed
  • Updated documentation in docs/ folder if needed

Python Checklist

Complete this section if your PR includes Python changes

Pre-commit Checklist

Ensure all of the following have been completed:

  • Code formatted with ruff format
  • Linting passes with ruff check
  • Added or updated tests if needed
  • Updated documentation if needed

Example Usage (Before)

# Include example code showing how things worked before (if applicable)
# Use the appropriate language syntax (python, typescript, bash, etc.)

Example Usage (After)

# Include example code showing how things work after your changes
# Use the appropriate language syntax (python, typescript, bash, etc.)

Documentation Updates

  • List any documentation files that were updated
  • Explain what was changed in each file

Testing

Describe how you tested these changes:

  • Unit tests added/modified
  • Integration tests added/modified
  • Manual testing performed
  • Edge cases considered

Backwards Compatibility

Explain whether these changes are backwards compatible. If not, describe what users will need to do to adapt to these changes.

Related Issues

Closes #[issue_number]

Reference in New Issue View Git Blame Copy Permalink