[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_185":186,"_187":188},"routes/_app.x.$handle.$name",{"_92":91,"_31":43,"_100":82,"_26":101,"_13":14,"_102":-5,"_11":103,"_104":105,"_106":107,"_108":109,"_110":111,"_20":-5,"_112":-5,"_113":-5,"_114":24,"_115":116,"_117":118,"_119":-5,"_120":-5,"_121":122},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":-5,"_51":-5,"_18":52,"_53":-5,"_54":24,"_55":-5,"_56":-5,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":66,"_67":66,"_68":69,"_70":69,"_71":69,"_72":66,"_73":66,"_74":75,"_76":77,"_78":79,"_80":24},"version",4,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","DebugOAuthProvider.ts","latestPath","fileId","a03cad08-fafd-11f0-81c8-42dde27851f2","name","fileType","script","content","/**\n * OAuth provider for the debug flow.\n * Adapted from Inspector's DebugOAuthProvider.ts for server-side use.\n */\n\nimport type { OAuthClientProvider } from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\nimport type {\n OAuthClientInformation,\n OAuthClientMetadata,\n OAuthTokens,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/shared/auth.js\";\n\n/**\n * Debug OAuth provider that captures the authorization URL instead of redirecting.\n */\nexport class DebugOAuthProvider implements OAuthClientProvider {\n authUrl: URL | null = null;\n _codeVerifier: string | null = null;\n private _clientInfo: OAuthClientInformation | null = null;\n\n constructor(private serverUrl: string) {}\n\n get redirectUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/oauth/callback\";\n }\n\n // For CIMD support - use a fake URL that acts as client_id\n get clientMetadataUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/client-metadata.json\";\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return {\n redirect_uris: [this.redirectUrl],\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: \"MCP OAuth Debugger\",\n client_uri: \"https://github.com/modelcontextprotocol/inspector\",\n };\n }\n\n async redirectToAuthorization(authorizationUrl: URL): Promise {\n this.authUrl = authorizationUrl;\n }\n\n saveCodeVerifier(verifier: string): void {\n this._codeVerifier = verifier;\n }\n\n codeVerifier(): string {\n if (!this._codeVerifier) {\n throw new Error(\"No code verifier saved\");\n }\n return this._codeVerifier;\n }\n\n tokens(): OAuthTokens | undefined {\n return undefined;\n }\n\n saveTokens(_tokens: OAuthTokens): void {\n // No-op for debugging\n }\n\n clientInformation(): OAuthClientInformation | undefined {\n return this._clientInfo ?? undefined;\n }\n\n saveClientInformation(info: OAuthClientInformation): void {\n this._clientInfo = info;\n }\n}\n","createdAt",["D",1769462767042],"branchVersion","branchId","ba7c0e8a-fafc-11f0-b669-42dde27851f2","id","ba7bb6c4-fafc-11f0-b669-42dde27851f2","mcp-oauth-debugger",["D",1769462381582],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_92":91,"_99":95},"org",{"_92":91,"_93":-5,"_94":95,"_18":52,"_96":97,"_98":24},"branch",{"_13":81,"_31":82,"_41":40,"_83":42,"_84":-5,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":43,"_90":91},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":181,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":-5,"_51":-5,"_18":52,"_53":-5,"_54":24,"_55":-5,"_56":-5,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":66,"_67":66,"_68":69,"_70":69,"_71":69,"_72":66,"_73":66,"_74":182,"_76":183,"_78":184,"_80":24},"tree",[164,165,166,167],"files",[164,165,166,167],"counts",{"_154":133,"_155":58,"_156":58,"_157":158,"_159":160},"contents",[123,124,125,126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_41":151,"_31":27,"_29":30,"_130":-5,"_39":40,"_38":14,"_131":118,"_36":152,"_13":133,"_32":33,"_34":35,"_23":24,"_134":-5,"_26":153},{"_41":144,"_31":145,"_29":146,"_130":-5,"_39":40,"_38":147,"_131":24,"_36":148,"_13":133,"_32":33,"_34":149,"_23":24,"_134":-5,"_26":150},{"_41":136,"_31":137,"_29":138,"_130":-5,"_39":40,"_38":139,"_131":24,"_36":140,"_13":133,"_32":141,"_34":142,"_23":24,"_134":43,"_26":143},{"_41":127,"_31":128,"_29":129,"_130":-5,"_39":40,"_38":58,"_131":118,"_36":132,"_13":133,"_32":33,"_34":101,"_23":24,"_134":-5,"_26":135},"ba7e25bc-fafc-11f0-b669-42dde27851f2","main.ts","ba7e268e-fafc-11f0-b669-42dde27851f2","parentId","latest",["D",1769462381595],0,"label",[128],"9fca67ac-fafd-11f0-b958-42dde27851f2","http.ts","9fca6874-fafd-11f0-b958-42dde27851f2",2,["D",1769462766263],"http","/** @jsxImportSource npm:hono@4/jsx */\n\nimport { Hono } from \"npm:hono@4\";\nimport { StepDisplay } from \"./components/StepDisplay.tsx\";\nimport { runOAuthDebugFlow, type DebugResult } from \"./lib/oauth-flow.ts\";\n\nconst app = new Hono();\n\n// Layout component\nfunction Layout({ children }: { children: unknown }) {\n return (\n \n \n \n \n MCP OAuth Metadata Debugger\n \n \n \n \n

\n {children}\n

\n \n \n );\n}\n\n// Home page with form\nfunction HomePage() {\n return (\n \n

MCP OAuth Metadata Debugger

Debug OAuth metadata discovery for MCP servers

\n\n \n \n );\n}\n\n// Results page\nfunction ResultsPage({ serverUrl, result }: { serverUrl: string; result: DebugResult }) {\n return (\n \n

MCP OAuth Metadata Debugger

Debug OAuth metadata discovery for MCP servers

\n \n ← New Debug\n \n

\n\n

\n Server:{\" \"}\n {serverUrl}\n

\n\n

Discovery Steps

\n {result.steps.map((step, index) => (\n \n ))}\n

\n\n {/* Success - Authorization URL found */}\n {result.authorizationUrl && (\n

\n \n This server looks to be configured correctly\n

\n Successfully generated an authorization URL:\n

\n {result.authorizationUrl}\n

\n )}\n

\n \n );\n}\n\n// Routes\napp.get(\"/\", (c) => c.html());\n\napp.get(\"/debug\", async (c) => {\n const serverUrl = c.req.query(\"serverUrl\");\n\n if (!serverUrl) {\n return c.redirect(\"/\");\n }\n\n const result = await runOAuthDebugFlow(serverUrl);\n return c.html();\n});\n\n// For val.town\nexport default app.fetch;\n\n// For local Deno development\n// @ts-ignore - Deno global\nif (typeof Deno !== \"undefined\" && Deno.env) {\n // @ts-ignore - Deno global\n const port = parseInt(Deno.env.get(\"PORT\") || \"8000\");\n console.log(`Starting OAuth debugger on http://localhost:${port}`);\n // @ts-ignore - Deno global\n Deno.serve({ port, hostname: \"0.0.0.0\" }, app.fetch);\n}\n",[137],"a0087592-fafd-11f0-81c8-42dde27851f2","debug-middleware.ts","a0087646-fafd-11f0-81c8-42dde27851f2",3,["D",1769462766700],"/**\n * Debug middleware for capturing HTTP request/response pairs.\n * Adapted from Inspector's debug-middleware.ts for server-side use.\n */\n\nexport interface DebugRequestResponse {\n id: string;\n label: string;\n request: {\n method: string;\n url: string;\n headers: Record;\n body?: unknown;\n };\n response: {\n status: number;\n statusText: string;\n headers: Record;\n body?: unknown;\n };\n}\n\nexport type DebugMiddlewareCallback = (\n entry: DebugRequestResponse,\n) => Promise;\n\n/**\n * Creates a fetch function that captures request/response pairs.\n */\nexport function createDebugFetch(\n onComplete: DebugMiddlewareCallback,\n): typeof fetch {\n return async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n let requestBody: unknown = undefined;\n if (init?.body) {\n requestBody = parseBody(init.body);\n }\n\n let response: Response;\n try {\n response = await fetch(input, init);\n } catch (fetchError) {\n const errorMessage =\n fetchError instanceof TypeError\n ? \"Network error (CORS or connection failed)\"\n : fetchError instanceof Error\n ? fetchError.message\n : String(fetchError);\n\n const failedEntry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: 0,\n statusText: \"Failed\",\n headers: {},\n body: { error: errorMessage },\n },\n };\n\n await onComplete(failedEntry);\n throw fetchError;\n }\n\n const clonedResponse = response.clone();\n let responseBody: unknown;\n try {\n responseBody = await clonedResponse.json();\n } catch {\n try {\n responseBody = await clonedResponse.text();\n } catch {\n responseBody = null;\n }\n }\n\n const entry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: response.status,\n statusText: response.statusText,\n headers: headersToObject(response.headers),\n body: responseBody,\n },\n };\n\n await onComplete(entry);\n\n return response;\n };\n}\n\nfunction inferLabel(url: string, method: string): string {\n try {\n const parsed = new URL(url);\n return `${method} ${parsed.pathname}`;\n } catch {\n return `${method} ${url}`;\n }\n}\n\nfunction headersToObject(\n headers?: HeadersInit | Headers,\n): Record {\n if (!headers) return {};\n\n if (headers instanceof Headers) {\n const obj: Record = {};\n headers.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n if (Array.isArray(headers)) {\n return Object.fromEntries(headers);\n }\n\n return headers as Record;\n}\n\nfunction parseBody(body: BodyInit | null | undefined): unknown {\n if (!body) return undefined;\n\n if (typeof body === \"string\") {\n try {\n return JSON.parse(body);\n } catch {\n if (body.includes(\"=\") && body.includes(\"&\")) {\n const params = new URLSearchParams(body);\n const obj: Record = {};\n params.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n return body;\n }\n }\n\n if (body instanceof URLSearchParams) {\n const obj: Record = {};\n body.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n return \"[Binary or unsupported body type]\";\n}\n",[145],"a03cac18-fafd-11f0-81c8-42dde27851f2",["D",1769462767042],[27],"pulls","branches","forks","envVars",{"_161":133,"_163":133},"connections",{"_161":133,"_162":133},"count","unfilledCount","emptyCount",{"_41":151,"_31":27,"_29":30,"_130":-5,"_39":40,"_38":14,"_131":118,"_36":178,"_13":133,"_32":33,"_34":35,"_23":24,"_134":-5,"_169":179,"_26":180},{"_41":144,"_31":145,"_29":146,"_130":-5,"_39":40,"_38":147,"_131":24,"_36":175,"_13":133,"_32":33,"_34":149,"_23":24,"_134":-5,"_169":176,"_26":177},{"_41":136,"_31":137,"_29":138,"_130":-5,"_39":40,"_38":139,"_131":24,"_36":172,"_13":133,"_32":141,"_34":142,"_23":24,"_134":43,"_169":173,"_26":174},{"_41":127,"_31":128,"_29":129,"_130":-5,"_39":40,"_38":58,"_131":118,"_36":168,"_13":133,"_32":33,"_34":101,"_23":24,"_134":-5,"_169":170,"_26":171},["D",1769462381595],"children",[],[128],["D",1769462766263],[],[137],["D",1769462766700],[],[145],["D",1769462767042],[],[27],["D",1769462381582],{"_92":91,"_99":95},{"_92":91,"_93":-5,"_94":95,"_18":52,"_96":97,"_98":24},{"_13":81,"_31":82,"_41":40,"_83":42,"_84":-5,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":43,"_90":91},"ctx",{"_74":-5,"_120":218,"_219":220,"_221":222,"_223":24,"_224":24,"_225":24,"_226":118,"_227":-5,"_228":-7,"_229":-7,"_230":133,"_231":24,"_232":24,"_233":-5,"_234":24,"_235":24,"_236":24,"_237":-5},"ENV",{"_189":190,"_191":192,"_193":82,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

MCP OAuth Metadata Debugger

MCP OAuth Metadata Debugger

Discovery Steps

\n \n \n \n This server looks to be configured correctly\n

\n \n This server looks to be configured correctly\n

Diff · v4