[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_197":198,"_199":200},"routes/_app.x.$handle.$name",{"_92":91,"_31":43,"_100":82,"_26":101,"_13":14,"_102":-5,"_11":103,"_104":105,"_106":107,"_108":109,"_110":111,"_20":-5,"_112":-5,"_113":-5,"_114":24,"_115":116,"_117":118,"_119":-5,"_120":-5,"_121":122},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":-5,"_51":-5,"_18":52,"_53":-5,"_54":24,"_55":-5,"_56":-5,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":66,"_67":66,"_68":69,"_70":69,"_71":69,"_72":66,"_73":66,"_74":75,"_76":77,"_78":79,"_80":24},"version",5,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","oauth-flow.ts","latestPath","fileId","a07bf1b6-fafd-11f0-8298-42dde27851f2","name","fileType","script","content","/**\n * OAuth debug flow logic.\n * Runs the OAuth discovery flow and captures all steps.\n * Adapted from Inspector's AuthDebuggerFlow.tsx\n */\n\nimport {\n auth,\n extractWWWAuthenticateParams,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\n\nimport { createDebugFetch, type DebugRequestResponse } from \"./debug-middleware.ts\";\nimport { DebugOAuthProvider } from \"./DebugOAuthProvider.ts\";\n\nexport interface DebugResult {\n steps: DebugRequestResponse[];\n authorizationUrl?: string;\n codeVerifier?: string;\n}\n\n// Helper to create error/warning steps with HTML content\nfunction createErrorStep(label: string, messageHtml: string): DebugRequestResponse {\n return {\n id: crypto.randomUUID(),\n label,\n request: { method: \"ERROR\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Error\",\n headers: {},\n body: { messageHtml },\n },\n };\n}\n\nexport async function runOAuthDebugFlow(serverUrl: string): Promise {\n const steps: DebugRequestResponse[] = [];\n\n // Track discovery state to inject informational warnings (like Inspector does)\n const discoveryState = {\n prmFailed: false,\n shownPrmWarning: false,\n oauthMetadataSuccess: false,\n shownNoMetadataWarning: false,\n };\n\n const baseDebugFetch = createDebugFetch(async (entry) => {\n steps.push(entry);\n });\n\n // Wrap debugFetch to track state and inject info/warning steps\n const debugFetch: typeof fetch = async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n // Before OAuth metadata request - inject PRM warning if needed\n if (\n (url.includes(\".well-known/oauth-authorization-server\") ||\n url.includes(\".well-known/openid-configuration\")) &&\n discoveryState.prmFailed &&\n !discoveryState.shownPrmWarning\n ) {\n steps.push(createErrorStep(\n \"Error: No PRM Found\",\n `Server does not have Protected Resource Metadata. Falling back to 2025-03-26 spec authorization base URL discovery. This often is due to an incorrect server URL preventing PRM discovery. Please double-check the server URL is correct.`\n ));\n discoveryState.shownPrmWarning = true;\n }\n\n // Before POST /register - inject warning if no metadata found\n if (\n method === \"POST\" &&\n url.includes(\"/register\") &&\n !discoveryState.oauthMetadataSuccess &&\n !discoveryState.shownNoMetadataWarning\n ) {\n steps.push(createErrorStep(\n \"Error: No Metadata Found\",\n `Failed to discover OAuth authorization server metadata. Falling back to 2025-03-26 spec server-without-metadata mode. This is unlikely to work, and is often due to an incorrect server URL. Please check the MCP URL you entered is correct.`\n ));\n discoveryState.shownNoMetadataWarning = true;\n }\n\n // Make the actual request\n const response = await baseDebugFetch(input, init);\n\n // Track PRM discovery\n if (url.includes(\".well-known/oauth-protected-resource\")) {\n if (!response.ok) {\n discoveryState.prmFailed = true;\n }\n }\n\n // Track OAuth metadata discovery\n if (\n url.includes(\".well-known/oauth-authorization-server\") ||\n url.includes(\".well-known/openid-configuration\")\n ) {\n if (response.ok) {\n discoveryState.oauthMetadataSuccess = true;\n }\n }\n\n return response;\n };\n\n const provider = new DebugOAuthProvider(serverUrl);\n\n try {\n // Step 1: Try to initialize to get 401 with WWW-Authenticate header\n let resourceMetadataUrl: URL | undefined;\n\n try {\n const initResponse = await debugFetch(serverUrl, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n jsonrpc: \"2.0\",\n method: \"initialize\",\n params: {\n protocolVersion: \"2025-03-26\",\n capabilities: {},\n clientInfo: { name: \"mcp-oauth-debugger\", version: \"1.0.0\" },\n },\n id: 1,\n }),\n });\n\n if (initResponse.status === 401) {\n const params = extractWWWAuthenticateParams(initResponse);\n resourceMetadataUrl = params.resourceMetadataUrl;\n }\n } catch {\n // Network error on initial request - continue with discovery\n }\n\n // Step 2: Run SDK auth() for discovery, registration, and auth URL generation\n const result = await auth(provider, {\n serverUrl,\n resourceMetadataUrl,\n fetchFn: debugFetch,\n });\n\n // Add result step\n steps.push({\n id: crypto.randomUUID(),\n label: \"Auth Flow Result\",\n request: { method: \"INFO\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Info\",\n headers: {},\n body: {\n message: result === \"REDIRECT\"\n ? \"Successfully generated authorization URL\"\n : `Auth result: ${result}`,\n },\n },\n });\n\n return {\n steps,\n authorizationUrl: provider.authUrl?.toString(),\n codeVerifier: provider._codeVerifier ?? undefined,\n };\n } catch (error) {\n steps.push({\n id: crypto.randomUUID(),\n label: \"Flow Error\",\n request: { method: \"ERROR\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Error\",\n headers: {},\n body: {\n message: error instanceof Error ? error.message : String(error),\n },\n },\n });\n return { steps };\n }\n}\n","createdAt",["D",1769462767445],"branchVersion","branchId","ba7c0e8a-fafc-11f0-b669-42dde27851f2","id","ba7bb6c4-fafc-11f0-b669-42dde27851f2","mcp-oauth-debugger",["D",1769462381582],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_92":91,"_99":95},"org",{"_92":91,"_93":-5,"_94":95,"_18":52,"_96":97,"_98":24},"branch",{"_13":81,"_31":82,"_41":40,"_83":42,"_84":-5,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":43,"_90":91},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":193,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":-5,"_51":-5,"_18":52,"_53":-5,"_54":24,"_55":-5,"_56":-5,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":66,"_67":66,"_68":69,"_70":69,"_71":69,"_72":66,"_73":66,"_74":194,"_76":195,"_78":196,"_80":24},"tree",[172,173,174,175,176],"files",[172,173,174,175,176],"counts",{"_162":132,"_163":58,"_164":58,"_165":166,"_167":168},"contents",[123,124,125,126,127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_41":155,"_31":156,"_29":157,"_129":-5,"_39":40,"_38":158,"_130":118,"_36":159,"_13":132,"_32":33,"_34":160,"_23":24,"_133":-5,"_26":161},{"_41":148,"_31":149,"_29":150,"_129":-5,"_39":40,"_38":151,"_130":24,"_36":152,"_13":132,"_32":33,"_34":153,"_23":24,"_133":-5,"_26":154},{"_41":140,"_31":141,"_29":142,"_129":-5,"_39":40,"_38":143,"_130":24,"_36":144,"_13":132,"_32":145,"_34":146,"_23":24,"_133":43,"_26":147},{"_41":135,"_31":136,"_29":137,"_129":-5,"_39":40,"_38":58,"_130":118,"_36":138,"_13":132,"_32":33,"_34":101,"_23":24,"_133":-5,"_26":139},{"_41":128,"_31":27,"_29":30,"_129":-5,"_39":40,"_38":14,"_130":24,"_36":131,"_13":132,"_32":33,"_34":35,"_23":24,"_133":-5,"_26":134},"a07bf0e4-fafd-11f0-8298-42dde27851f2","parentId","latest",["D",1769462767445],0,"label",[27],"ba7e25bc-fafc-11f0-b669-42dde27851f2","main.ts","ba7e268e-fafc-11f0-b669-42dde27851f2",["D",1769462381595],[136],"9fca67ac-fafd-11f0-b958-42dde27851f2","http.ts","9fca6874-fafd-11f0-b958-42dde27851f2",2,["D",1769462766263],"http","/** @jsxImportSource npm:hono@4/jsx */\n\nimport { Hono } from \"npm:hono@4\";\nimport { StepDisplay } from \"./components/StepDisplay.tsx\";\nimport { runOAuthDebugFlow, type DebugResult } from \"./lib/oauth-flow.ts\";\n\nconst app = new Hono();\n\n// Layout component\nfunction Layout({ children }: { children: unknown }) {\n return (\n \n \n \n \n MCP OAuth Metadata Debugger\n \n \n \n \n

\n {children}\n

\n \n \n );\n}\n\n// Home page with form\nfunction HomePage() {\n return (\n \n

MCP OAuth Metadata Debugger

Debug OAuth metadata discovery for MCP servers

\n\n \n \n );\n}\n\n// Results page\nfunction ResultsPage({ serverUrl, result }: { serverUrl: string; result: DebugResult }) {\n return (\n \n

MCP OAuth Metadata Debugger

Debug OAuth metadata discovery for MCP servers

\n \n ← New Debug\n \n

\n\n

\n Server:{\" \"}\n {serverUrl}\n

\n\n

Discovery Steps

\n {result.steps.map((step, index) => (\n \n ))}\n

\n\n {/* Success - Authorization URL found */}\n {result.authorizationUrl && (\n

\n \n This server looks to be configured correctly\n

\n Successfully generated an authorization URL:\n

\n {result.authorizationUrl}\n

\n )}\n

\n \n );\n}\n\n// Routes\napp.get(\"/\", (c) => c.html());\n\napp.get(\"/debug\", async (c) => {\n const serverUrl = c.req.query(\"serverUrl\");\n\n if (!serverUrl) {\n return c.redirect(\"/\");\n }\n\n const result = await runOAuthDebugFlow(serverUrl);\n return c.html();\n});\n\n// For val.town\nexport default app.fetch;\n\n// For local Deno development\n// @ts-ignore - Deno global\nif (typeof Deno !== \"undefined\" && Deno.env) {\n // @ts-ignore - Deno global\n const port = parseInt(Deno.env.get(\"PORT\") || \"8000\");\n console.log(`Starting OAuth debugger on http://localhost:${port}`);\n // @ts-ignore - Deno global\n Deno.serve({ port, hostname: \"0.0.0.0\" }, app.fetch);\n}\n",[141],"a0087592-fafd-11f0-81c8-42dde27851f2","debug-middleware.ts","a0087646-fafd-11f0-81c8-42dde27851f2",3,["D",1769462766700],"/**\n * Debug middleware for capturing HTTP request/response pairs.\n * Adapted from Inspector's debug-middleware.ts for server-side use.\n */\n\nexport interface DebugRequestResponse {\n id: string;\n label: string;\n request: {\n method: string;\n url: string;\n headers: Record;\n body?: unknown;\n };\n response: {\n status: number;\n statusText: string;\n headers: Record;\n body?: unknown;\n };\n}\n\nexport type DebugMiddlewareCallback = (\n entry: DebugRequestResponse,\n) => Promise;\n\n/**\n * Creates a fetch function that captures request/response pairs.\n */\nexport function createDebugFetch(\n onComplete: DebugMiddlewareCallback,\n): typeof fetch {\n return async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n let requestBody: unknown = undefined;\n if (init?.body) {\n requestBody = parseBody(init.body);\n }\n\n let response: Response;\n try {\n response = await fetch(input, init);\n } catch (fetchError) {\n const errorMessage =\n fetchError instanceof TypeError\n ? \"Network error (CORS or connection failed)\"\n : fetchError instanceof Error\n ? fetchError.message\n : String(fetchError);\n\n const failedEntry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: 0,\n statusText: \"Failed\",\n headers: {},\n body: { error: errorMessage },\n },\n };\n\n await onComplete(failedEntry);\n throw fetchError;\n }\n\n const clonedResponse = response.clone();\n let responseBody: unknown;\n try {\n responseBody = await clonedResponse.json();\n } catch {\n try {\n responseBody = await clonedResponse.text();\n } catch {\n responseBody = null;\n }\n }\n\n const entry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: response.status,\n statusText: response.statusText,\n headers: headersToObject(response.headers),\n body: responseBody,\n },\n };\n\n await onComplete(entry);\n\n return response;\n };\n}\n\nfunction inferLabel(url: string, method: string): string {\n try {\n const parsed = new URL(url);\n return `${method} ${parsed.pathname}`;\n } catch {\n return `${method} ${url}`;\n }\n}\n\nfunction headersToObject(\n headers?: HeadersInit | Headers,\n): Record {\n if (!headers) return {};\n\n if (headers instanceof Headers) {\n const obj: Record = {};\n headers.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n if (Array.isArray(headers)) {\n return Object.fromEntries(headers);\n }\n\n return headers as Record;\n}\n\nfunction parseBody(body: BodyInit | null | undefined): unknown {\n if (!body) return undefined;\n\n if (typeof body === \"string\") {\n try {\n return JSON.parse(body);\n } catch {\n if (body.includes(\"=\") && body.includes(\"&\")) {\n const params = new URLSearchParams(body);\n const obj: Record = {};\n params.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n return body;\n }\n }\n\n if (body instanceof URLSearchParams) {\n const obj: Record = {};\n body.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n return \"[Binary or unsupported body type]\";\n}\n",[149],"a03cac18-fafd-11f0-81c8-42dde27851f2","DebugOAuthProvider.ts","a03cad08-fafd-11f0-81c8-42dde27851f2",4,["D",1769462767042],"/**\n * OAuth provider for the debug flow.\n * Adapted from Inspector's DebugOAuthProvider.ts for server-side use.\n */\n\nimport type { OAuthClientProvider } from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\nimport type {\n OAuthClientInformation,\n OAuthClientMetadata,\n OAuthTokens,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/shared/auth.js\";\n\n/**\n * Debug OAuth provider that captures the authorization URL instead of redirecting.\n */\nexport class DebugOAuthProvider implements OAuthClientProvider {\n authUrl: URL | null = null;\n _codeVerifier: string | null = null;\n private _clientInfo: OAuthClientInformation | null = null;\n\n constructor(private serverUrl: string) {}\n\n get redirectUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/oauth/callback\";\n }\n\n // For CIMD support - use a fake URL that acts as client_id\n get clientMetadataUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/client-metadata.json\";\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return {\n redirect_uris: [this.redirectUrl],\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: \"MCP OAuth Debugger\",\n client_uri: \"https://github.com/modelcontextprotocol/inspector\",\n };\n }\n\n async redirectToAuthorization(authorizationUrl: URL): Promise {\n this.authUrl = authorizationUrl;\n }\n\n saveCodeVerifier(verifier: string): void {\n this._codeVerifier = verifier;\n }\n\n codeVerifier(): string {\n if (!this._codeVerifier) {\n throw new Error(\"No code verifier saved\");\n }\n return this._codeVerifier;\n }\n\n tokens(): OAuthTokens | undefined {\n return undefined;\n }\n\n saveTokens(_tokens: OAuthTokens): void {\n // No-op for debugging\n }\n\n clientInformation(): OAuthClientInformation | undefined {\n return this._clientInfo ?? undefined;\n }\n\n saveClientInformation(info: OAuthClientInformation): void {\n this._clientInfo = info;\n }\n}\n",[156],"pulls","branches","forks","envVars",{"_169":132,"_171":132},"connections",{"_169":132,"_170":132},"count","unfilledCount","emptyCount",{"_41":155,"_31":156,"_29":157,"_129":-5,"_39":40,"_38":158,"_130":118,"_36":190,"_13":132,"_32":33,"_34":160,"_23":24,"_133":-5,"_178":191,"_26":192},{"_41":148,"_31":149,"_29":150,"_129":-5,"_39":40,"_38":151,"_130":24,"_36":187,"_13":132,"_32":33,"_34":153,"_23":24,"_133":-5,"_178":188,"_26":189},{"_41":140,"_31":141,"_29":142,"_129":-5,"_39":40,"_38":143,"_130":24,"_36":184,"_13":132,"_32":145,"_34":146,"_23":24,"_133":43,"_178":185,"_26":186},{"_41":135,"_31":136,"_29":137,"_129":-5,"_39":40,"_38":58,"_130":118,"_36":181,"_13":132,"_32":33,"_34":101,"_23":24,"_133":-5,"_178":182,"_26":183},{"_41":128,"_31":27,"_29":30,"_129":-5,"_39":40,"_38":14,"_130":24,"_36":177,"_13":132,"_32":33,"_34":35,"_23":24,"_133":-5,"_178":179,"_26":180},["D",1769462767445],"children",[],[27],["D",1769462381595],[],[136],["D",1769462766263],[],[141],["D",1769462766700],[],[149],["D",1769462767042],[],[156],["D",1769462381582],{"_92":91,"_99":95},{"_92":91,"_93":-5,"_94":95,"_18":52,"_96":97,"_98":24},{"_13":81,"_31":82,"_41":40,"_83":42,"_84":-5,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":43,"_90":91},"ctx",{"_74":-5,"_120":230,"_231":232,"_233":234,"_235":24,"_236":24,"_237":24,"_238":118,"_239":-5,"_240":-7,"_241":-7,"_242":132,"_243":24,"_244":24,"_245":-5,"_246":24,"_247":24,"_248":24,"_249":-5},"ENV",{"_201":202,"_203":204,"_205":82,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

MCP OAuth Metadata Debugger

MCP OAuth Metadata Debugger

Discovery Steps

\n \n \n \n This server looks to be configured correctly\n

\n \n This server looks to be configured correctly\n

Diff · v5