Add june spec support #801

chelojimenez · 2025-11-05T01:00:41Z

Note

Adds 2025-03-26 OAuth protocol to the debugger (UI, factory, types, state machine, diagram) and improves SSE debug proxy/handling; updates 2025-06-18/11-25 flows and client naming.

OAuth Protocols:
- Add 2025-03-26 support:
  - New state machine client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts (direct RFC8414 discovery from MCP base URL, fallback endpoints, PKCE required; DCR/preregistered registration; no RFC9728/CIMD).
  - Update types.ts to include "2025-03-26", new step "discovery_start", and RegistrationStrategy2025_03_26.
  - Extend factory to create/select 2025-03-26 machines, validate strategies, defaults, supported strategies, and PROTOCOL_VERSION_INFO.
- Update 2025-06-18 and 2025-11-25 state machines:
  - Switch client name to "MCPJam Inspector" and adjust authenticated initialize requests.
  - Handle SSE responses via structured proxy body (transport === "sse").
UI:
- Add protocol option 2025-03-26 in components/OAuthFlowTab.tsx and persist preferences.
- OAuthSequenceDiagram: conditionally omit initial 401/RFC9728 steps for 2025-03-26; update discovery/PKCE labels and descriptions.
Backend Debug Proxy (server/routes/mcp/oauth.ts):
- Enhance SSE parsing to detect legacy HTTP+SSE transport; return structured payload with transport, events, isOldTransport, endpoint, mcpResponse, and rawBuffer.
- Improve error details in SSE failures.

^{Written by Cursor Bugbot for commit 1607050. This will update automatically on new commits. Configure here.}

coderabbitai · 2025-11-05T01:05:22Z

Caution

Review failed

The pull request is closed.

Walkthrough

Adds protocol version "2025-03-26" across the client and factory, including a new discovery-first debug state machine with PKCE and MCP-aware flows, and a UI dropdown option. Updates the sequence diagram for protocol-specific branching. Extends factory config and supported registration strategies to include "2025-03-26". Renames client display text from "MCP Inspector" to "MCPJam Inspector" and refines SSE handling to detect transport type. Server proxy SSE parsing changed to line-buffered stream parsing with structured SSE responses and error reporting.

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b34a3e2 and 1607050.

📒 Files selected for processing (8)

client/src/components/OAuthFlowTab.tsx (1 hunks)
client/src/components/OAuthSequenceDiagram.tsx (2 hunks)
client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts (1 hunks)
client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts (7 hunks)
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts (7 hunks)
client/src/lib/oauth/state-machines/factory.ts (6 hunks)
client/src/lib/oauth/state-machines/types.ts (2 hunks)
server/routes/mcp/oauth.ts (1 hunks)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 4

♻️ Duplicate comments (2)

client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts (2)

1207-1214: Update client name to match rebranding.

Apply this diff:

                     clientInfo: {
-                      name: "MCP Inspector",
+                      name: "MCPJam Inspector",
                       version: "1.0.0",
                     },

1267-1274: Update client name to match rebranding.

Apply this diff:

                     clientInfo: {
-                      name: "MCP Inspector",
+                      name: "MCPJam Inspector",
                       version: "1.0.0",
                     },

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 31ec7c2 and b34a3e2.

📒 Files selected for processing (8)

client/src/components/OAuthFlowTab.tsx (1 hunks)
client/src/components/OAuthSequenceDiagram.tsx (3 hunks)
client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts (1 hunks)
client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts (7 hunks)
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts (7 hunks)
client/src/lib/oauth/state-machines/factory.ts (6 hunks)
client/src/lib/oauth/state-machines/types.ts (2 hunks)
server/routes/mcp/oauth.ts (1 hunks)

🧰 Additional context used

📓 Path-based instructions (12)

**/*.{ts,tsx}

📄 CodeRabbit inference engine (CLAUDE.md)

**/*.{ts,tsx}: Prefer interfaces for defining object shapes
Constrain generics with appropriate type bounds
Use type guards to narrow unknown or union types before usage
Enforce import ordering consistently

**/*.{ts,tsx}: Prefer named exports in TypeScript modules
Use 2-space indentation
Declare types and interfaces using PascalCase

Files:

client/src/components/OAuthFlowTab.tsx
client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
client/src/lib/oauth/state-machines/types.ts
server/routes/mcp/oauth.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts
client/src/components/OAuthSequenceDiagram.tsx
client/src/lib/oauth/state-machines/factory.ts

client/src/**/*.tsx

📄 CodeRabbit inference engine (CLAUDE.md)

Follow consistent React component structure in the frontend

Files:

client/src/components/OAuthFlowTab.tsx
client/src/components/OAuthSequenceDiagram.tsx

client/src/{app,components}/**/*.tsx

📄 CodeRabbit inference engine (client/CLAUDE.md)

client/src/{app,components}/**/*.tsx: Use React functional components with React.FC typing for all UI components and pages
Define explicit Props interfaces for components, including proper children prop handling
Type event handlers with React-provided types (e.g., React.MouseEvent, FormEvent)
Follow React 19 patterns: hooks-centric components, Suspense and Error Boundaries where appropriate, and concurrent features
Maintain component isolation: avoid excessive prop drilling, use Context wisely, favor composition, and optimize renders
Build responsive layouts using the established Tailwind breakpoint system, grids, flex, and container queries
Ensure accessibility: proper ARIA attributes, keyboard navigation, focus management, and screen reader support

Files:

client/src/components/OAuthFlowTab.tsx
client/src/components/OAuthSequenceDiagram.tsx

client/src/**/*.{ts,tsx}

📄 CodeRabbit inference engine (client/CLAUDE.md)

Implement strict TypeScript types: strict prop types, event types, state interfaces, and utility types

In client code, use the @/ alias for imports

Files:

client/src/components/OAuthFlowTab.tsx
client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
client/src/lib/oauth/state-machines/types.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts
client/src/components/OAuthSequenceDiagram.tsx
client/src/lib/oauth/state-machines/factory.ts

client/src/{app,components,hooks}/**/*.{ts,tsx}

📄 CodeRabbit inference engine (client/CLAUDE.md)

Use React hooks for local state: apply useState/useReducer patterns, create custom hooks, and always clean up effects

Files:

client/src/components/OAuthFlowTab.tsx
client/src/components/OAuthSequenceDiagram.tsx

client/src/components/**/*.tsx

📄 CodeRabbit inference engine (client/CLAUDE.md)

Use Radix UI primitives for dialogs, dropdowns, form controls, and tooltips

React components in client/src/components should be functional and saved as PascalCase.tsx files

Files:

client/src/components/OAuthFlowTab.tsx
client/src/components/OAuthSequenceDiagram.tsx

client/src/{stores/servers,lib}/**/*.{ts,tsx}

📄 CodeRabbit inference engine (client/CLAUDE.md)

Persist configuration: local storage, export/import, sync, and backup/restore options

Files:

client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
client/src/lib/oauth/state-machines/types.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts
client/src/lib/oauth/state-machines/factory.ts

server/routes/**/*.ts

📄 CodeRabbit inference engine (CLAUDE.md)

server/routes/**/*.ts: Validate server responses (schema, content, status codes, headers) in route handlers
Perform input validation on incoming requests (types, sanitization, size, format)

Files:

server/routes/mcp/oauth.ts

server/**/*.ts

📄 CodeRabbit inference engine (CLAUDE.md)

server/**/*.ts: Implement robust error handling with safe error messages and log sanitization
Set appropriate security headers for backend responses
Apply rate limiting and backoff strategies to protect APIs

Use TypeScript for all backend source files

Files:

server/routes/mcp/oauth.ts

server/{app.ts,routes/**/*.ts}

📄 CodeRabbit inference engine (server/CLAUDE.md)

Use Hono.js for API routing and middleware in the app setup and all route handlers

Files:

server/routes/mcp/oauth.ts

server/{routes/mcp/**,utils/mcp-utils.ts,types/mcp.ts}

📄 CodeRabbit inference engine (server/CLAUDE.md)

Implement MCP protocol using Mastra (@mastra/core, @mastra/mcp) for MCP handling, helpers, and types

Files:

server/routes/mcp/oauth.ts

server/routes/mcp/**/*.ts

📄 CodeRabbit inference engine (server/CLAUDE.md)

Place all MCP protocol handlers under server/routes/mcp

Files:

server/routes/mcp/oauth.ts

🧠 Learnings (15)

📓 Common learnings

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Provide comprehensive MCP server testing (spec validation, OAuth flows, prompt/resource checks, error simulation)

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-10-19T23:05:54.474Z
Learning: Follow MCP specification: protocol versioning, message formats, error codes, and extensions

📚 Learning: 2025-10-19T23:06:33.450Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: client/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:06:33.450Z
Learning: Applies to client/src/{components/servers,hooks/{mcp,transport}}/**/*.{ts,tsx} : Provide transport selection UIs and logic: protocol options, configuration forms, validation rules, and presets

Applied to files:

client/src/components/OAuthFlowTab.tsx

📚 Learning: 2025-10-19T23:06:33.450Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: client/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:06:33.450Z
Learning: Applies to client/src/{hooks/mcp,stores/{chat,servers}}/**/*.{ts,tsx} : Synchronize MCP state: track connections, requests, responses, and errors consistently

Applied to files:

client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
server/routes/mcp/oauth.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts

📚 Learning: 2025-10-19T23:07:08.982Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Applies to server/utils/mcp-utils.ts : Put MCP helper utilities in server/utils/mcp-utils.ts

Applied to files:

client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
server/routes/mcp/oauth.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts

📚 Learning: 2025-10-19T23:07:08.982Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Applies to server/{routes/mcp/**,utils/mcp-utils.ts,types/mcp.ts} : Implement MCP protocol using Mastra (mastra/core, mastra/mcp) for MCP handling, helpers, and types

Applied to files:

client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
server/routes/mcp/oauth.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts
client/src/components/OAuthSequenceDiagram.tsx

📚 Learning: 2025-10-19T23:06:33.450Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: client/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:06:33.450Z
Learning: Applies to client/src/{components/servers,hooks/mcp,lib/api}/**/*.{ts,tsx} : Implement authentication setup: OAuth configuration, token management, scopes, and refresh handling

Applied to files:

client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
client/src/lib/oauth/state-machines/types.ts
server/routes/mcp/oauth.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts
client/src/components/OAuthSequenceDiagram.tsx

📚 Learning: 2025-10-19T23:07:08.982Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Applies to server/types/mcp.ts : Define MCP types in server/types/mcp.ts

Applied to files:

client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
server/routes/mcp/oauth.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts

📚 Learning: 2025-10-19T23:07:08.982Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Provide comprehensive MCP server testing (spec validation, OAuth flows, prompt/resource checks, error simulation)

Applied to files:

client/src/lib/oauth/state-machines/debug-oauth-2025-06-18.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts
client/src/components/OAuthSequenceDiagram.tsx

📚 Learning: 2025-10-19T23:06:33.450Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: client/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:06:33.450Z
Learning: Applies to client/src/{lib/api,hooks/llm}/**/*.{ts,tsx} : Implement Anthropic Claude integration: authentication flow, request formatting, stream processing, and rate limiting

Applied to files:

client/src/lib/oauth/state-machines/types.ts
client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts
client/src/components/OAuthSequenceDiagram.tsx

📚 Learning: 2025-10-19T23:07:08.982Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Applies to server/routes/transport/sse/**/*.ts : Implement Server-Sent Events (streaming, connection handling, reconnection, message formatting) under server/routes/transport/sse

Applied to files:

server/routes/mcp/oauth.ts

📚 Learning: 2025-10-19T23:07:08.982Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Applies to server/routes/mcp/**/*.ts : Place all MCP protocol handlers under server/routes/mcp

Applied to files:

server/routes/mcp/oauth.ts

📚 Learning: 2025-10-19T23:07:08.982Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Applies to server/routes/transport/http/**/*.ts : Implement streamable HTTP (chunked encoding, pools, stream/timeout handling) under server/routes/transport/http

Applied to files:

server/routes/mcp/oauth.ts

📚 Learning: 2025-10-19T23:07:08.982Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: server/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:07:08.982Z
Learning: Applies to server/routes/transport/stdio/**/*.ts : Implement STDIO transport (process spawning, stream handling, buffering, error recovery) under server/routes/transport/stdio

Applied to files:

server/routes/mcp/oauth.ts

📚 Learning: 2025-10-19T23:06:33.450Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: client/CLAUDE.md:0-0
Timestamp: 2025-10-19T23:06:33.450Z
Learning: Applies to client/src/{hooks/llm,components/chat}/**/*.{ts,tsx} : Handle response streaming: token processing, UI updates, cancellation, and error states

Applied to files:

server/routes/mcp/oauth.ts

📚 Learning: 2025-10-19T23:05:54.474Z

Learnt from: CR
Repo: MCPJam/inspector PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-10-19T23:05:54.474Z
Learning: Follow MCP specification: protocol versioning, message formats, error codes, and extensions

Applied to files:

client/src/lib/oauth/state-machines/debug-oauth-2025-11-25.ts
client/src/lib/oauth/state-machines/factory.ts

🧬 Code graph analysis (3)

client/src/lib/oauth/state-machines/types.ts (2)

client/src/lib/debug-oauth-state-machine.ts (3)

RegistrationStrategy2025_06_18 (20-20)

RegistrationStrategy2025_11_25 (21-21)

OAuthProtocolVersion (19-19)

client/src/lib/oauth-flow-types.ts (1)

OAuthProtocolVersion (10-10)

client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts (2)

client/src/lib/oauth/state-machines/types.ts (4)

OAuthFlowState (32-124)

EMPTY_OAUTH_FLOW_STATE (127-133)

OAuthStateMachine (136-142)

RegistrationStrategy2025_03_26 (158-158)

client/src/lib/jwt-decoder.ts (2)

decodeJWT (5-31)

formatJWTTimestamp (58-64)

client/src/lib/oauth/state-machines/factory.ts (1)

client/src/lib/oauth/state-machines/types.ts (1)

RegistrationStrategy2025_03_26 (158-158)

🪛 Biome (2.1.2)

client/src/lib/oauth/state-machines/debug-oauth-2025-03-26.ts

[error] 319-319: Other switch clauses can erroneously access this declaration.
Wrap the declaration in a block to restrict its access to the switch clause.

The declaration is defined in this switch clause:

Safe fix: Wrap the declaration in a block.