\n {getStatusIcon(step, isComplete)}\n {stepNumber}. {step.label}\n

\n \n {typeof step.response.body === \"object\" &&\n step.response.body !== null &&\n \"messageHtml\" in step.response.body\n ? raw(String((step.response.body as { messageHtml: unknown }).messageHtml))\n : typeof step.response.body === \"object\" &&\n step.response.body !== null &&\n \"message\" in step.response.body\n ? String((step.response.body as { message: unknown }).message)\n : JSON.stringify(step.response.body)}\n

\n \n );\n }\n\n // For HTTP requests, use details/summary for click-to-expand (like Inspector)\n return (\n

\n {getStatusIcon(step, isComplete)}\n \n {stepNumber}. {step.label}\n \n \n {step.response.status} {step.response.statusText}\n \n

\n\n

\n {/* Request */}\n

Request

\n {step.request.method}{\" \"}\n {step.request.url}\n

\n {Object.keys(step.request.headers).length > 0 && (\n

Headers:

\n                  {JSON.stringify(step.request.headers, null, 2)}\n

\n )}\n {step.request.body !== undefined && (\n

Body:

\n                  {typeof step.request.body === \"string\"\n                    ? step.request.body\n                    : JSON.stringify(step.request.body, null, 2)}\n

\n )}\n

\n\n {/* Response */}\n

Response

\n = 400 ? \"text-red-600\" : \"text-green-600\"}`}\n >\n {step.response.status}\n {\" \"}\n {step.response.statusText}\n

\n {Object.keys(step.response.headers).length > 0 && (\n

Headers:

\n                  {JSON.stringify(step.response.headers, null, 2)}\n

\n )}\n {step.response.body !== undefined && (\n

Body:

\n                  {typeof step.response.body === \"string\"\n                    ? step.response.body\n                    : JSON.stringify(step.response.body, null, 2)}\n

\n )}\n

\n );\n}\n",[18,64],"pulls","branches","forks","envVars",{"_162":26,"_164":26},"connections",{"_162":26,"_163":26},"count","unfilledCount","emptyCount",{"_33":143,"_13":18,"_62":71,"_43":-5,"_35":36,"_144":40,"_145":24,"_37":265,"_39":26,"_65":72,"_147":-5,"_67":30,"_148":-5,"_184":266,"_17":267},{"_33":151,"_13":64,"_62":63,"_43":71,"_35":36,"_144":40,"_145":24,"_37":262,"_39":26,"_65":66,"_147":153,"_67":30,"_148":-5,"_184":263,"_17":264},{"_33":257,"_13":235,"_62":228,"_43":-5,"_35":36,"_144":258,"_145":24,"_37":259,"_39":26,"_65":72,"_147":-5,"_67":30,"_148":-5,"_184":260,"_17":261},{"_33":251,"_13":220,"_62":252,"_43":228,"_35":36,"_144":108,"_145":24,"_37":253,"_39":88,"_65":66,"_147":254,"_67":30,"_148":-5,"_184":255,"_17":256},{"_33":243,"_13":244,"_62":245,"_43":228,"_35":36,"_144":246,"_145":24,"_37":247,"_39":26,"_65":66,"_147":248,"_67":30,"_148":-5,"_184":249,"_17":250},{"_33":236,"_13":205,"_62":237,"_43":228,"_35":36,"_144":238,"_145":24,"_37":239,"_39":88,"_65":66,"_147":240,"_67":30,"_148":-5,"_184":241,"_17":242},{"_33":226,"_13":179,"_62":227,"_43":228,"_35":36,"_144":229,"_145":24,"_37":230,"_39":231,"_65":66,"_147":232,"_67":30,"_148":-5,"_184":233,"_17":234},{"_33":219,"_13":220,"_62":221,"_43":-5,"_35":36,"_144":199,"_145":24,"_37":222,"_39":26,"_65":66,"_147":223,"_67":30,"_148":-5,"_184":224,"_17":225},{"_33":212,"_13":64,"_62":213,"_43":-5,"_35":36,"_144":214,"_145":24,"_37":215,"_39":216,"_65":66,"_147":153,"_67":30,"_148":-5,"_184":217,"_17":218},{"_33":204,"_13":205,"_62":206,"_43":-5,"_35":36,"_144":207,"_145":24,"_37":208,"_39":88,"_65":66,"_147":209,"_67":30,"_148":-5,"_184":210,"_17":211},{"_33":194,"_13":195,"_62":196,"_43":-5,"_35":36,"_144":197,"_145":24,"_37":198,"_39":199,"_65":200,"_147":201,"_67":30,"_148":14,"_184":202,"_17":203},{"_33":187,"_13":188,"_62":189,"_43":-5,"_35":36,"_144":88,"_145":24,"_37":190,"_39":26,"_65":66,"_147":191,"_67":30,"_148":-5,"_184":192,"_17":193},{"_33":178,"_13":179,"_62":180,"_43":-5,"_35":36,"_144":181,"_145":24,"_37":182,"_39":88,"_65":66,"_147":183,"_67":30,"_148":-5,"_184":185,"_17":186},"17e5955a-0e80-11f1-bc19-42dde27851f2","oauth-flow.ts","a07bf1b6-fafd-11f0-8298-42dde27851f2",13,["D",1771607874435],"/**\n * OAuth debug flow logic.\n * Runs the OAuth discovery flow and captures all steps.\n * Adapted from Inspector's AuthDebuggerFlow.tsx\n */\n\nimport {\n auth,\n extractWWWAuthenticateParams,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\n\nimport { createDebugFetch, isDnsError, isConnectionError, type DebugRequestResponse } from \"./debug-middleware.ts\";\nimport { DebugOAuthProvider } from \"./DebugOAuthProvider.ts\";\n\nexport interface DebugResult {\n steps: DebugRequestResponse[];\n authorizationUrl?: string;\n codeVerifier?: string;\n}\n\n// Helper to create error/warning steps with HTML content\nfunction createErrorStep(label: string, messageHtml: string): DebugRequestResponse {\n return {\n id: crypto.randomUUID(),\n label,\n request: { method: \"ERROR\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Error\",\n headers: {},\n body: { messageHtml },\n },\n };\n}\n\nexport async function runOAuthDebugFlow(serverUrl: string): Promise {\n const steps: DebugRequestResponse[] = [];\n\n // Track discovery state to inject informational warnings (like Inspector does)\n const discoveryState = {\n prmFailed: false,\n shownPrmWarning: false,\n oauthMetadataSuccess: false,\n shownNoMetadataWarning: false,\n };\n\n const baseDebugFetch = createDebugFetch(async (entry) => {\n steps.push(entry);\n });\n\n // Wrap debugFetch to track state and inject info/warning steps\n const debugFetch: typeof fetch = async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n // Before OAuth metadata request - inject PRM warning if needed\n if (\n (url.includes(\".well-known/oauth-authorization-server\") ||\n url.includes(\".well-known/openid-configuration\")) &&\n discoveryState.prmFailed &&\n !discoveryState.shownPrmWarning\n ) {\n steps.push(createErrorStep(\n \"Error: No PRM Found\",\n `Server does not have Protected Resource Metadata. Falling back to 2025-03-26 spec authorization base URL discovery. This often is due to an incorrect server URL preventing PRM discovery. Please double-check the server URL is correct.`\n ));\n discoveryState.shownPrmWarning = true;\n }\n\n // Before POST /register - inject warning if no metadata found\n if (\n method === \"POST\" &&\n url.includes(\"/register\") &&\n !discoveryState.oauthMetadataSuccess &&\n !discoveryState.shownNoMetadataWarning\n ) {\n steps.push(createErrorStep(\n \"Error: No Metadata Found\",\n `Failed to discover OAuth authorization server metadata. Falling back to 2025-03-26 spec server-without-metadata mode. This is unlikely to work, and is often due to an incorrect server URL. Please check the MCP URL you entered is correct.`\n ));\n discoveryState.shownNoMetadataWarning = true;\n }\n\n // Make the actual request\n const response = await baseDebugFetch(input, init);\n\n // Track PRM discovery\n if (url.includes(\".well-known/oauth-protected-resource\")) {\n if (!response.ok) {\n discoveryState.prmFailed = true;\n }\n }\n\n // Track OAuth metadata discovery\n if (\n url.includes(\".well-known/oauth-authorization-server\") ||\n url.includes(\".well-known/openid-configuration\")\n ) {\n if (response.ok) {\n discoveryState.oauthMetadataSuccess = true;\n }\n }\n\n return response;\n };\n\n const provider = new DebugOAuthProvider(serverUrl);\n\n try {\n // Step 1: Try to initialize to get 401 with WWW-Authenticate header\n let resourceMetadataUrl: URL | undefined;\n\n try {\n const initResponse = await debugFetch(serverUrl, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n jsonrpc: \"2.0\",\n method: \"initialize\",\n params: {\n protocolVersion: \"2025-03-26\",\n capabilities: {},\n clientInfo: { name: \"mcp-oauth-debugger\", version: \"1.0.0\" },\n },\n id: 1,\n }),\n });\n\n if (initResponse.status === 401) {\n const params = extractWWWAuthenticateParams(initResponse);\n resourceMetadataUrl = params.resourceMetadataUrl;\n }\n } catch (initError) {\n // DNS or connection errors are fatal — no point continuing discovery\n let hostname = serverUrl;\n try { hostname = new URL(serverUrl).hostname; } catch { /* keep raw */ }\n\n if (isDnsError(initError)) {\n steps.push(createErrorStep(\n \"Error: DNS Resolution Failed\",\n `Could not resolve hostname ${hostname}. ` +\n `The domain does not exist or its DNS is not configured. ` +\n `Please verify the server URL is correct and that the domain is accessible.`\n ));\n return { steps };\n }\n if (isConnectionError(initError)) {\n steps.push(createErrorStep(\n \"Error: Connection Failed\",\n `Could not connect to ${hostname}. ` +\n `The hostname resolved but the connection was refused or timed out. ` +\n `Is the MCP server running and accepting connections on this URL?`\n ));\n return { steps };\n }\n // Other network errors — continue with discovery (may be CORS etc.)\n }\n\n // Step 2: Run SDK auth() for discovery, registration, and auth URL generation\n const result = await auth(provider, {\n serverUrl,\n resourceMetadataUrl,\n fetchFn: debugFetch,\n });\n\n // Add result step\n steps.push({\n id: crypto.randomUUID(),\n label: \"Auth Flow Result\",\n request: { method: \"INFO\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Info\",\n headers: {},\n body: {\n message: result === \"REDIRECT\"\n ? \"Successfully generated authorization URL\"\n : `Auth result: ${result}`,\n },\n },\n });\n\n return {\n steps,\n authorizationUrl: provider.authUrl?.toString(),\n codeVerifier: provider._codeVerifier ?? undefined,\n };\n } catch (error) {\n steps.push({\n id: crypto.randomUUID(),\n label: \"Flow Error\",\n request: { method: \"ERROR\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Error\",\n headers: {},\n body: {\n message: error instanceof Error ? error.message : String(error),\n },\n },\n });\n return { steps };\n }\n}\n","children",[],[179],"ba7e25bc-fafc-11f0-b669-42dde27851f2","main.ts","ba7e268e-fafc-11f0-b669-42dde27851f2",["D",1769462381595],"",[],[188],"44a6c288-dff8-439f-9f7b-17cc774ca87b","http.ts","9fca6874-fafd-11f0-b958-42dde27851f2",22,["D",1783417990391],4,"http","/** @jsxImportSource npm:hono@4/jsx */\n\nimport { Hono } from \"npm:hono@4\";\nimport { StepDisplay } from \"./components/StepDisplay.tsx\";\nimport { runOAuthDebugFlow, type DebugResult } from \"./lib/oauth-flow.ts\";\nimport {\n CALLBACK_PATH,\n CLIENT_ID_METADATA_DOCUMENT,\n CLIENT_METADATA_PATH,\n} from \"./lib/client-metadata.ts\";\n\nconst app = new Hono();\n\n// Layout component\nfunction Layout({ children }: { children: unknown }) {\n return (\n \n \n \n \n MCP OAuth Metadata Debugger\n \n \n \n \n

\n {children}\n

\n \n \n );\n}\n\n// Home page with form\nfunction HomePage() {\n return (\n \n

MCP OAuth Metadata Debugger

Debug OAuth metadata discovery for MCP servers

\n\n \n \n );\n}\n\n// Results page\nfunction ResultsPage({ serverUrl, result }: { serverUrl: string; result: DebugResult }) {\n return (\n \n

MCP OAuth Metadata Debugger

Debug OAuth metadata discovery for MCP servers

\n \n ← New Debug\n \n

\n\n

\n Server:{\" \"}\n {serverUrl}\n

\n\n

Discovery Steps

\n {result.steps.map((step, index) => (\n \n ))}\n

\n\n {/* Success - Authorization URL found */}\n {result.authorizationUrl && (\n

\n \n This server looks to be configured correctly\n

\n Successfully generated an authorization URL:\n

\n {result.authorizationUrl}\n

\n )}\n

\n \n );\n}\n\n// Routes\napp.get(\"/\", (c) => c.html());\n\napp.get(\"/debug\", async (c) => {\n const serverUrl = c.req.query(\"serverUrl\");\n\n if (!serverUrl) {\n return c.redirect(\"/\");\n }\n\n const result = await runOAuthDebugFlow(serverUrl);\n return c.html();\n});\n\n// Client ID Metadata Document. Authorization servers fetch this URL when they\n// see it as a client_id, and reject the document unless client_id matches it.\napp.get(CLIENT_METADATA_PATH, (c) => {\n c.header(\"Content-Type\", \"application/json\");\n c.header(\"Cache-Control\", \"public, max-age=3600\");\n return c.body(JSON.stringify(CLIENT_ID_METADATA_DOCUMENT, null, 2));\n});\n\n// Redirect target declared in the metadata document. The debugger stops at the\n// authorization URL, so this only exists to make the declared URI resolvable.\napp.get(CALLBACK_PATH, (c) => {\n const code = c.req.query(\"code\");\n const error = c.req.query(\"error\");\n\n return c.html(\n \n

Authorization Callback

\n The debugger does not exchange the authorization code — it stops once the\n authorization URL is built.\n

\n {error && (\n

\n error: {error}\n {c.req.query(\"error_description\") && (\n

{c.req.query(\"error_description\")}

\n )}\n

\n )}\n {code && (\n

Authorization code received

\n {code}\n

\n )}\n ← New Debug\n ,\n );\n});\n\n// For val.town\nexport default app.fetch;\n\n// For local Deno development\n// @ts-ignore - Deno global\nif (typeof Deno !== \"undefined\" && Deno.env) {\n // @ts-ignore - Deno global\n const port = parseInt(Deno.env.get(\"PORT\") || \"8000\");\n console.log(`Starting OAuth debugger on http://localhost:${port}`);\n // @ts-ignore - Deno global\n Deno.serve({ port, hostname: \"0.0.0.0\" }, app.fetch);\n}\n",[],[195],"1785ef9c-0e80-11f1-8e1f-42dde27851f2","debug-middleware.ts","a0087646-fafd-11f0-81c8-42dde27851f2",12,["D",1771607873802],"/**\n * Debug middleware for capturing HTTP request/response pairs.\n * Adapted from Inspector's debug-middleware.ts for server-side use.\n */\n\nexport interface DebugRequestResponse {\n id: string;\n label: string;\n request: {\n method: string;\n url: string;\n headers: Record;\n body?: unknown;\n };\n response: {\n status: number;\n statusText: string;\n headers: Record;\n body?: unknown;\n };\n}\n\nexport type DebugMiddlewareCallback = (\n entry: DebugRequestResponse,\n) => Promise;\n\n/**\n * Creates a fetch function that captures request/response pairs.\n */\nexport function createDebugFetch(\n onComplete: DebugMiddlewareCallback,\n): typeof fetch {\n return async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n let requestBody: unknown = undefined;\n if (init?.body) {\n requestBody = parseBody(init.body);\n }\n\n let response: Response;\n try {\n response = await fetch(input, init);\n } catch (fetchError) {\n const errorMessage = classifyFetchError(fetchError, url);\n\n const failedEntry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: 0,\n statusText: \"Failed\",\n headers: {},\n body: { error: errorMessage },\n },\n };\n\n await onComplete(failedEntry);\n throw fetchError;\n }\n\n const clonedResponse = response.clone();\n let responseBody: unknown;\n try {\n responseBody = await clonedResponse.json();\n } catch {\n try {\n responseBody = await clonedResponse.text();\n } catch {\n responseBody = null;\n }\n }\n\n const entry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: response.status,\n statusText: response.statusText,\n headers: headersToObject(response.headers),\n body: responseBody,\n },\n };\n\n await onComplete(entry);\n\n return response;\n };\n}\n\n// Patterns that indicate a DNS resolution failure\nconst DNS_ERROR_PATTERNS = [\n \"getaddrinfo\", // Node.js DNS lookup failure\n \"ENOTFOUND\", // Node.js: hostname not found\n \"dns error\", // Deno DNS failure\n \"Name or service not known\", // Linux DNS\n \"nodename nor servname provided\", // macOS DNS\n \"No address associated with hostname\", // Linux alternative\n \"server dns address could not be found\", // Chromium/browser\n \"ERR_NAME_NOT_RESOLVED\", // Chromium error code\n];\n\n// Patterns that indicate a connection refused / unreachable host\nconst CONNECTION_ERROR_PATTERNS = [\n \"ECONNREFUSED\", // Connection refused\n \"ECONNRESET\", // Connection reset\n \"ETIMEDOUT\", // Connection timed out\n \"EHOSTUNREACH\", // Host unreachable\n \"connection refused\",\n \"connection reset\",\n \"Connection closed\", // TLS handshake failures etc.\n];\n\n/**\n * Check if an error is a DNS resolution failure.\n */\nexport function isDnsError(error: unknown): boolean {\n const msg = error instanceof Error\n ? `${error.message} ${(error as { cause?: unknown }).cause ?? \"\"}`\n : String(error);\n return DNS_ERROR_PATTERNS.some(p => msg.toLowerCase().includes(p.toLowerCase()));\n}\n\n/**\n * Check if an error is a connection failure (not DNS).\n */\nexport function isConnectionError(error: unknown): boolean {\n const msg = error instanceof Error\n ? `${error.message} ${(error as { cause?: unknown }).cause ?? \"\"}`\n : String(error);\n return CONNECTION_ERROR_PATTERNS.some(p => msg.toLowerCase().includes(p.toLowerCase()));\n}\n\n/**\n * Produce a clear error message from a fetch failure.\n */\nfunction classifyFetchError(error: unknown, url: string): string {\n let hostname = url;\n try { hostname = new URL(url).hostname; } catch { /* keep raw url */ }\n\n if (isDnsError(error)) {\n return `DNS resolution failed for \"${hostname}\". The hostname could not be resolved — check that the URL is correct and the server's DNS is configured.`;\n }\n if (isConnectionError(error)) {\n return `Connection failed to \"${hostname}\". The host was found but the connection was refused or timed out — is the server running?`;\n }\n if (error instanceof TypeError) {\n return `Network error: could not connect to \"${hostname}\" (${error.message})`;\n }\n return error instanceof Error ? error.message : String(error);\n}\n\nfunction inferLabel(url: string, method: string): string {\n try {\n const parsed = new URL(url);\n return `${method} ${parsed.pathname}`;\n } catch {\n return `${method} ${url}`;\n }\n}\n\nfunction headersToObject(\n headers?: HeadersInit | Headers,\n): Record {\n if (!headers) return {};\n\n if (headers instanceof Headers) {\n const obj: Record = {};\n headers.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n if (Array.isArray(headers)) {\n return Object.fromEntries(headers);\n }\n\n return headers as Record;\n}\n\nfunction parseBody(body: BodyInit | null | undefined): unknown {\n if (!body) return undefined;\n\n if (typeof body === \"string\") {\n try {\n return JSON.parse(body);\n } catch {\n if (body.includes(\"=\") && body.includes(\"&\")) {\n const params = new URLSearchParams(body);\n const obj: Record = {};\n params.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n return body;\n }\n }\n\n if (body instanceof URLSearchParams) {\n const obj: Record = {};\n body.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n return \"[Binary or unsupported body type]\";\n}\n",[],[205],"18025bd6-0e80-11f1-94ac-42dde27851f2","a0c02692-fafd-11f0-81ca-42dde27851f2",14,["D",1771607874650],3,[],[64],"a03cac18-fafd-11f0-81c8-42dde27851f2","DebugOAuthProvider.ts","a03cad08-fafd-11f0-81c8-42dde27851f2",["D",1769462767042],"/**\n * OAuth provider for the debug flow.\n * Adapted from Inspector's DebugOAuthProvider.ts for server-side use.\n */\n\nimport type { OAuthClientProvider } from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\nimport type {\n OAuthClientInformation,\n OAuthClientMetadata,\n OAuthTokens,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/shared/auth.js\";\n\n/**\n * Debug OAuth provider that captures the authorization URL instead of redirecting.\n */\nexport class DebugOAuthProvider implements OAuthClientProvider {\n authUrl: URL | null = null;\n _codeVerifier: string | null = null;\n private _clientInfo: OAuthClientInformation | null = null;\n\n constructor(private serverUrl: string) {}\n\n get redirectUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/oauth/callback\";\n }\n\n // For CIMD support - use a fake URL that acts as client_id\n get clientMetadataUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/client-metadata.json\";\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return {\n redirect_uris: [this.redirectUrl],\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: \"MCP OAuth Debugger\",\n client_uri: \"https://github.com/modelcontextprotocol/inspector\",\n };\n }\n\n async redirectToAuthorization(authorizationUrl: URL): Promise {\n this.authUrl = authorizationUrl;\n }\n\n saveCodeVerifier(verifier: string): void {\n this._codeVerifier = verifier;\n }\n\n codeVerifier(): string {\n if (!this._codeVerifier) {\n throw new Error(\"No code verifier saved\");\n }\n return this._codeVerifier;\n }\n\n tokens(): OAuthTokens | undefined {\n return undefined;\n }\n\n saveTokens(_tokens: OAuthTokens): void {\n // No-op for debugging\n }\n\n clientInformation(): OAuthClientInformation | undefined {\n return this._clientInfo ?? undefined;\n }\n\n saveClientInformation(info: OAuthClientInformation): void {\n this._clientInfo = info;\n }\n}\n",[],[220],"726f5bf4-0e81-11f1-baee-42dde27851f2","40cb7732-0e80-11f1-acbb-42dde27851f2","6c8bfff0-3691-4b4c-bc95-934421001cef",21,["D",1771608455850],2,"/**\n * OAuth debug flow logic.\n * Runs the OAuth discovery flow and captures all steps.\n * Adapted from Inspector's AuthDebuggerFlow.tsx\n */\n\nimport {\n auth,\n extractWWWAuthenticateParams,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\n\nimport { createDebugFetch, checkDns, type DebugRequestResponse } from \"./debug-middleware.ts\";\nimport { DebugOAuthProvider } from \"./DebugOAuthProvider.ts\";\n\nexport interface DebugResult {\n steps: DebugRequestResponse[];\n authorizationUrl?: string;\n codeVerifier?: string;\n}\n\n// Helper to create error/warning steps with HTML content\nfunction createErrorStep(label: string, messageHtml: string): DebugRequestResponse {\n return {\n id: crypto.randomUUID(),\n label,\n request: { method: \"ERROR\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Error\",\n headers: {},\n body: { messageHtml },\n },\n };\n}\n\nexport async function runOAuthDebugFlow(serverUrl: string): Promise {\n const steps: DebugRequestResponse[] = [];\n\n // Track discovery state to inject informational warnings (like Inspector does)\n const discoveryState = {\n prmFailed: false,\n shownPrmWarning: false,\n oauthMetadataSuccess: false,\n shownNoMetadataWarning: false,\n };\n\n const baseDebugFetch = createDebugFetch(async (entry) => {\n steps.push(entry);\n });\n\n // Wrap debugFetch to track state and inject info/warning steps\n const debugFetch: typeof fetch = async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n // Before OAuth metadata request - inject PRM warning if needed\n if (\n (url.includes(\".well-known/oauth-authorization-server\") ||\n url.includes(\".well-known/openid-configuration\")) &&\n discoveryState.prmFailed &&\n !discoveryState.shownPrmWarning\n ) {\n steps.push(createErrorStep(\n \"Error: No PRM Found\",\n `Server does not have Protected Resource Metadata. Falling back to 2025-03-26 spec authorization base URL discovery. This often is due to an incorrect server URL preventing PRM discovery. Please double-check the server URL is correct.`\n ));\n discoveryState.shownPrmWarning = true;\n }\n\n // Before POST /register - inject warning if no metadata found\n if (\n method === \"POST\" &&\n url.includes(\"/register\") &&\n !discoveryState.oauthMetadataSuccess &&\n !discoveryState.shownNoMetadataWarning\n ) {\n steps.push(createErrorStep(\n \"Error: No Metadata Found\",\n `Failed to discover OAuth authorization server metadata. Falling back to 2025-03-26 spec server-without-metadata mode. This is unlikely to work, and is often due to an incorrect server URL. Please check the MCP URL you entered is correct.`\n ));\n discoveryState.shownNoMetadataWarning = true;\n }\n\n // Make the actual request\n const response = await baseDebugFetch(input, init);\n\n // Track PRM discovery\n if (url.includes(\".well-known/oauth-protected-resource\")) {\n if (!response.ok) {\n discoveryState.prmFailed = true;\n }\n }\n\n // Track OAuth metadata discovery\n if (\n url.includes(\".well-known/oauth-authorization-server\") ||\n url.includes(\".well-known/openid-configuration\")\n ) {\n if (response.ok) {\n discoveryState.oauthMetadataSuccess = true;\n }\n }\n\n return response;\n };\n\n const provider = new DebugOAuthProvider(serverUrl);\n\n try {\n // Step 1: Try to initialize to get 401 with WWW-Authenticate header\n let resourceMetadataUrl: URL | undefined;\n\n try {\n const initResponse = await debugFetch(serverUrl, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n jsonrpc: \"2.0\",\n method: \"initialize\",\n params: {\n protocolVersion: \"2025-03-26\",\n capabilities: {},\n clientInfo: { name: \"mcp-oauth-debugger\", version: \"1.0.0\" },\n },\n id: 1,\n }),\n });\n\n if (initResponse.status === 401) {\n const params = extractWWWAuthenticateParams(initResponse);\n resourceMetadataUrl = params.resourceMetadataUrl;\n }\n } catch (initError) {\n // Network error — check DNS to give a clear diagnosis\n let hostname = serverUrl;\n try { hostname = new URL(serverUrl).hostname; } catch { /* keep raw */ }\n\n const dns = await checkDns(hostname);\n if (!dns.resolved) {\n steps.push(createErrorStep(\n \"Error: DNS Resolution Failed\",\n `Could not resolve hostname ${hostname}. ` +\n `DNS lookup returned ${dns.error === \"NXDOMAIN\" ? \"NXDOMAIN (domain does not exist)\" : (dns.error ?? \"no records\")}. ` +\n `This usually means one of:
` +\n `

The URL has a typo — double-check the hostname
The server is on a private/corporate network or VPN that isn't reachable from the public internet — this tool can only debug publicly accessible servers
The domain's DNS is not configured yet

`\n ));\n return { steps };\n }\n // DNS is fine — connection-level failure\n const errorMsg = initError instanceof Error ? initError.message : String(initError);\n steps.push(createErrorStep(\n \"Error: Connection Failed\",\n `DNS resolved ${hostname} to ${dns.addresses?.join(\", \") ?? \"unknown\"}, ` +\n `but the connection failed: ${errorMsg}. ` +\n `Is the MCP server running and accepting connections on this URL?`\n ));\n return { steps };\n }\n\n // Step 2: Run SDK auth() for discovery, registration, and auth URL generation\n const result = await auth(provider, {\n serverUrl,\n resourceMetadataUrl,\n fetchFn: debugFetch,\n });\n\n // Add result step\n steps.push({\n id: crypto.randomUUID(),\n label: \"Auth Flow Result\",\n request: { method: \"INFO\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Info\",\n headers: {},\n body: {\n message: result === \"REDIRECT\"\n ? \"Successfully generated authorization URL\"\n : `Auth result: ${result}`,\n },\n },\n });\n\n return {\n steps,\n authorizationUrl: provider.authUrl?.toString(),\n codeVerifier: provider._codeVerifier ?? undefined,\n };\n } catch (error) {\n steps.push({\n id: crypto.randomUUID(),\n label: \"Flow Error\",\n request: { method: \"ERROR\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Error\",\n headers: {},\n body: {\n message: error instanceof Error ? error.message : String(error),\n },\n },\n });\n return { steps };\n }\n}\n",[],[235,179],"lib","098790c0-0e81-11f1-a3fb-42dde27851f2","4060f646-0e80-11f1-97ca-42dde27851f2",19,["D",1771608279848],"/**\n * Debug middleware for capturing HTTP request/response pairs.\n * Adapted from Inspector's debug-middleware.ts for server-side use.\n */\n\nexport interface DebugRequestResponse {\n id: string;\n label: string;\n request: {\n method: string;\n url: string;\n headers: Record;\n body?: unknown;\n };\n response: {\n status: number;\n statusText: string;\n headers: Record;\n body?: unknown;\n };\n}\n\nexport type DebugMiddlewareCallback = (\n entry: DebugRequestResponse,\n) => Promise;\n\n/**\n * Creates a fetch function that captures request/response pairs.\n */\nexport function createDebugFetch(\n onComplete: DebugMiddlewareCallback,\n): typeof fetch {\n return async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n let requestBody: unknown = undefined;\n if (init?.body) {\n requestBody = parseBody(init.body);\n }\n\n let response: Response;\n try {\n response = await fetch(input, init);\n } catch (fetchError) {\n const errorMessage = classifyFetchError(fetchError, url);\n\n const failedEntry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: 0,\n statusText: \"Failed\",\n headers: {},\n body: { error: errorMessage },\n },\n };\n\n await onComplete(failedEntry);\n throw fetchError;\n }\n\n const clonedResponse = response.clone();\n let responseBody: unknown;\n try {\n responseBody = await clonedResponse.json();\n } catch {\n try {\n responseBody = await clonedResponse.text();\n } catch {\n responseBody = null;\n }\n }\n\n const entry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: response.status,\n statusText: response.statusText,\n headers: headersToObject(response.headers),\n body: responseBody,\n },\n };\n\n await onComplete(entry);\n\n return response;\n };\n}\n\nexport interface DnsCheckResult {\n resolved: boolean;\n addresses?: string[];\n status?: number; // DNS status code (0 = NOERROR, 3 = NXDOMAIN, etc.)\n error?: string;\n}\n\n/**\n * Check if a hostname resolves via DNS-over-HTTPS (Cloudflare).\n * Works in any runtime — Deno, Node, Val Town, browsers.\n */\nexport async function checkDns(hostname: string): Promise {\n try {\n const resp = await fetch(\n `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(hostname)}&type=A`,\n { headers: { \"Accept\": \"application/dns-json\" } },\n );\n if (!resp.ok) {\n return { resolved: false, error: `DOH request failed: ${resp.status}` };\n }\n const data = await resp.json();\n // Status 0 = NOERROR, 3 = NXDOMAIN\n if (data.Status === 3) {\n return { resolved: false, status: 3, error: \"NXDOMAIN\" };\n }\n const addresses = (data.Answer ?? [])\n .filter((r: { type: number }) => r.type === 1) // A records\n .map((r: { data: string }) => r.data);\n if (addresses.length === 0) {\n return { resolved: false, status: data.Status, error: \"No A records found\" };\n }\n return { resolved: true, addresses, status: data.Status };\n } catch (e) {\n return { resolved: false, error: e instanceof Error ? e.message : String(e) };\n }\n}\n\n/**\n * Produce a clear error message from a fetch failure.\n * Does NOT do DNS checks — that's done at a higher level for richer diagnostics.\n */\nfunction classifyFetchError(error: unknown, url: string): string {\n let hostname = url;\n try { hostname = new URL(url).hostname; } catch { /* keep raw url */ }\n\n const msg = error instanceof Error ? error.message : String(error);\n return `Network error: could not connect to \"${hostname}\" (${msg})`;\n}\n\nfunction inferLabel(url: string, method: string): string {\n try {\n const parsed = new URL(url);\n return `${method} ${parsed.pathname}`;\n } catch {\n return `${method} ${url}`;\n }\n}\n\nfunction headersToObject(\n headers?: HeadersInit | Headers,\n): Record {\n if (!headers) return {};\n\n if (headers instanceof Headers) {\n const obj: Record = {};\n headers.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n if (Array.isArray(headers)) {\n return Object.fromEntries(headers);\n }\n\n return headers as Record;\n}\n\nfunction parseBody(body: BodyInit | null | undefined): unknown {\n if (!body) return undefined;\n\n if (typeof body === \"string\") {\n try {\n return JSON.parse(body);\n } catch {\n if (body.includes(\"=\") && body.includes(\"&\")) {\n const params = new URLSearchParams(body);\n const obj: Record = {};\n params.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n return body;\n }\n }\n\n if (body instanceof URLSearchParams) {\n const obj: Record = {};\n body.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n return \"[Binary or unsupported body type]\";\n}\n",[],[235,205],"47821d5d-fd99-4c09-9d5c-37be49271c10","client-metadata.ts","aa06af1c-79e9-11f1-b1dd-1607ee4eb77e",23,["D",1783417991199],"/**\n * Client ID Metadata Document (CIMD) for the OAuth debugger.\n *\n * Authorization servers dereference the `client_id` URL to fetch this document,\n * so it has to be served from a real, publicly reachable HTTPS origin — the\n * deployed debugger itself. See the MCP client registration spec and\n * draft-ietf-oauth-client-id-metadata-document-00.\n */\n\nimport type { OAuthClientMetadata } from \"npm:@modelcontextprotocol/sdk@1.25.3/shared/auth.js\";\n\n/** Public origin the debugger is deployed at. Must match the live deployment. */\nexport const DEBUGGER_BASE_URL = \"https://mcp-oauth-debugger.val.run\";\n\nexport const CLIENT_METADATA_PATH = \"/client-metadata.json\";\nexport const CALLBACK_PATH = \"/oauth/callback\";\n\n/** The `client_id` used for CIMD flows: an HTTPS URL with a path component. */\nexport const CLIENT_METADATA_URL = `${DEBUGGER_BASE_URL}${CLIENT_METADATA_PATH}`;\nexport const REDIRECT_URL = `${DEBUGGER_BASE_URL}${CALLBACK_PATH}`;\n\n/**\n * Client metadata as the SDK consumes it (also the body of a DCR request, which\n * is why `client_id` is not included here).\n */\nexport const CLIENT_METADATA: OAuthClientMetadata = {\n redirect_uris: [REDIRECT_URL],\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: \"MCP OAuth Debugger\",\n client_uri: DEBUGGER_BASE_URL,\n};\n\n/**\n * The document served at {@link CLIENT_METADATA_URL}. `client_id` MUST equal the\n * URL the document is served from, or authorization servers will reject it.\n */\nexport const CLIENT_ID_METADATA_DOCUMENT = {\n client_id: CLIENT_METADATA_URL,\n ...CLIENT_METADATA,\n} as const;\n",[],[235,244],"749a1314-8f60-4864-9a50-56e97ccf58df","4095f45e-0e80-11f1-880e-42dde27851f2",["D",1783417991801],"/**\n * OAuth provider for the debug flow.\n * Adapted from Inspector's DebugOAuthProvider.ts for server-side use.\n */\n\nimport type { OAuthClientProvider } from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\nimport type {\n OAuthClientInformation,\n OAuthClientMetadata,\n OAuthTokens,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/shared/auth.js\";\nimport {\n CLIENT_METADATA,\n CLIENT_METADATA_URL,\n REDIRECT_URL,\n} from \"./client-metadata.ts\";\n\n/**\n * Debug OAuth provider that captures the authorization URL instead of redirecting.\n */\nexport class DebugOAuthProvider implements OAuthClientProvider {\n authUrl: URL | null = null;\n _codeVerifier: string | null = null;\n private _clientInfo: OAuthClientInformation | null = null;\n\n constructor(private serverUrl: string) {}\n\n get redirectUrl(): string {\n return REDIRECT_URL;\n }\n\n /**\n * CIMD client_id. The document is served by the debugger itself at this URL,\n * so authorization servers can dereference and validate it.\n */\n get clientMetadataUrl(): string {\n return CLIENT_METADATA_URL;\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return CLIENT_METADATA;\n }\n\n async redirectToAuthorization(authorizationUrl: URL): Promise {\n this.authUrl = authorizationUrl;\n }\n\n saveCodeVerifier(verifier: string): void {\n this._codeVerifier = verifier;\n }\n\n codeVerifier(): string {\n if (!this._codeVerifier) {\n throw new Error(\"No code verifier saved\");\n }\n return this._codeVerifier;\n }\n\n tokens(): OAuthTokens | undefined {\n return undefined;\n }\n\n saveTokens(_tokens: OAuthTokens): void {\n // No-op for debugging\n }\n\n clientInformation(): OAuthClientInformation | undefined {\n return this._clientInfo ?? undefined;\n }\n\n saveClientInformation(info: OAuthClientInformation): void {\n this._clientInfo = info;\n }\n}\n",[],[235,220],"40613b38-0e80-11f1-97ca-42dde27851f2",15,["D",1771607942376],[168,169,170,171],[235],["D",1771607943644],[],[18,64],["D",1771607943644],[166],[18],["D",1769462381582],{"_11":12,"_121":70},{"_11":12,"_117":-5,"_69":70,"_31":68,"_118":119,"_120":30},{"_39":108,"_13":16,"_33":36,"_109":74,"_110":-5,"_111":-5,"_112":-5,"_113":-5,"_114":-5,"_115":14,"_116":12},"ctx",{"_52":-5,"_140":305,"_306":307,"_308":309,"_310":30,"_311":30,"_312":30,"_313":24,"_314":-5,"_315":-7,"_316":-7,"_317":26,"_318":30,"_319":30,"_320":-5,"_321":30,"_322":30,"_323":30,"_324":-5},"ENV",{"_276":277,"_278":279,"_280":16,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300,"_301":302,"_303":304},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

MCP OAuth Metadata Debugger

MCP OAuth Metadata Debugger

Discovery Steps

\n \n \n \n This server looks to be configured correctly\n

Authorization Callback

\n \n This server looks to be configured correctly\n

History · components