MCP OAuth Metadata Debugger

\n Debug OAuth metadata discovery for MCP servers\n

\n\n \n );\n}\n\n// Results page\nfunction ResultsPage(\n { serverUrl, result }: { serverUrl: string; result: DebugResult },\n) {\n return (\n \n

\n MCP OAuth Metadata Debugger\n

\n Debug OAuth metadata discovery for MCP servers\n

\n \n ← New Debug\n \n

\n\n

\n Server:{\" \"}\n \n {serverUrl}\n \n

\n\n

Discovery Steps

\n {result.steps.map((step, index) => (\n \n ))}\n

\n\n {/* Success - Authorization URL found */}\n {result.authorizationUrl && (\n

\n \n \n \n This server looks to be configured correctly\n

\n Successfully generated an authorization URL:\n

\n \n {result.authorizationUrl}\n

\n )}\n \n \n );\n}\n\n// Routes\napp.get(\"/\", (c) => c.html());\n\napp.get(\"/debug\", async (c) => {\n let serverUrl = c.req.query(\"serverUrl\");\n\n if (!serverUrl) {\n return c.redirect(\"/\");\n }\n\n if (!serverUrl.startsWith(\"http\")) {\n serverUrl = `https://${serverUrl}`;\n }\n\n const result = await runOAuthDebugFlow(serverUrl);\n return c.html();\n});\n\n// For val.town\nexport default app.fetch;\n\n// For local Deno development\n// @ts-ignore - Deno global\nif (typeof Deno !== \"undefined\" && Deno.env) {\n // @ts-ignore - Deno global\n const port = parseInt(Deno.env.get(\"PORT\") || \"8000\");\n console.log(`Starting OAuth debugger on http://localhost:${port}`);\n // @ts-ignore - Deno global\n Deno.serve({ port, hostname: \"0.0.0.0\" }, app.fetch);\n}",[152],"e2ccbe0c-fd59-11f0-a11d-42dde27851f2","debug-middleware.ts","019c0bab-31c2-769e-ac6c-b75c00dc4539",["D",1769722294613],"/**\n * Debug middleware for capturing HTTP request/response pairs.\n * Adapted from Inspector's debug-middleware.ts for server-side use.\n */\n\nexport interface DebugRequestResponse {\n id: string;\n label: string;\n request: {\n method: string;\n url: string;\n headers: Record;\n body?: unknown;\n };\n response: {\n status: number;\n statusText: string;\n headers: Record;\n body?: unknown;\n };\n}\n\nexport type DebugMiddlewareCallback = (\n entry: DebugRequestResponse,\n) => Promise;\n\n/**\n * Creates a fetch function that captures request/response pairs.\n */\nexport function createDebugFetch(\n onComplete: DebugMiddlewareCallback,\n): typeof fetch {\n return async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n let requestBody: unknown = undefined;\n if (init?.body) {\n requestBody = parseBody(init.body);\n }\n\n let response: Response;\n try {\n response = await fetch(input, init);\n } catch (fetchError) {\n const errorMessage =\n fetchError instanceof TypeError\n ? \"Network error (CORS or connection failed)\"\n : fetchError instanceof Error\n ? fetchError.message\n : String(fetchError);\n\n const failedEntry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: 0,\n statusText: \"Failed\",\n headers: {},\n body: { error: errorMessage },\n },\n };\n\n await onComplete(failedEntry);\n throw fetchError;\n }\n\n const clonedResponse = response.clone();\n let responseBody: unknown;\n try {\n responseBody = await clonedResponse.json();\n } catch {\n try {\n responseBody = await clonedResponse.text();\n } catch {\n responseBody = null;\n }\n }\n\n const entry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: response.status,\n statusText: response.statusText,\n headers: headersToObject(response.headers),\n body: responseBody,\n },\n };\n\n await onComplete(entry);\n\n return response;\n };\n}\n\nfunction inferLabel(url: string, method: string): string {\n try {\n const parsed = new URL(url);\n return `${method} ${parsed.pathname}`;\n } catch {\n return `${method} ${url}`;\n }\n}\n\nfunction headersToObject(\n headers?: HeadersInit | Headers,\n): Record {\n if (!headers) return {};\n\n if (headers instanceof Headers) {\n const obj: Record = {};\n headers.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n if (Array.isArray(headers)) {\n return Object.fromEntries(headers);\n }\n\n return headers as Record;\n}\n\nfunction parseBody(body: BodyInit | null | undefined): unknown {\n if (!body) return undefined;\n\n if (typeof body === \"string\") {\n try {\n return JSON.parse(body);\n } catch {\n if (body.includes(\"=\") && body.includes(\"&\")) {\n const params = new URLSearchParams(body);\n const obj: Record = {};\n params.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n return body;\n }\n }\n\n if (body instanceof URLSearchParams) {\n const obj: Record = {};\n body.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n return \"[Binary or unsupported body type]\";\n}\n",[159],"e2cc91ac-fd59-11f0-a11d-42dde27851f2","StepDisplay.tsx","019c0bab-31c2-769e-ac6c-b258fbc9084b",["D",1769722294613],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\n\nimport type { DebugRequestResponse } from \"./debug-middleware.ts\";\n\n// Inline SVG icons (copied from Lucide patterns)\nconst CheckCircle2 = () => (\n \n \n \n);\n\nconst AlertTriangle = (\n { class: className = \"text-yellow-500\" }: { class?: string },\n) => (\n \n \n \n);\n\nconst Info = () => (\n \n \n \n);\n\ninterface StepDisplayProps {\n step: DebugRequestResponse;\n stepNumber: number;\n isComplete: boolean;\n isCurrent: boolean;\n}\n\nfunction getStatusIcon(step: DebugRequestResponse, isComplete: boolean) {\n if (!isComplete) {\n return (\n \n \n \n );\n }\n\n if (step.response.status === 0) {\n // Status 0 = special step (info, warning, or error)\n if (step.response.statusText === \"Info\") return ;\n if (step.response.statusText === \"Warning\") return ;\n return ;\n }\n\n if (step.response.status >= 400) {\n return ;\n }\n\n return ;\n}\n\nexport function StepDisplay({\n step,\n stepNumber,\n isComplete,\n isCurrent,\n}: StepDisplayProps) {\n const isSpecialStep = step.request.method === \"INFO\" ||\n step.request.method === \"WARNING\" ||\n step.request.method === \"ERROR\";\n\n const hasDetails = !isSpecialStep && step.request.url;\n\n // For special steps (info/warning/error), just show the message directly\n if (isSpecialStep) {\n return (\n

\n {getStatusIcon(step, isComplete)}\n {stepNumber}. {step.label}\n

\n \n {typeof step.response.body === \"object\" &&\n step.response.body !== null &&\n \"messageHtml\" in step.response.body\n ? raw(\n String(\n (step.response.body as { messageHtml: unknown }).messageHtml,\n ),\n )\n : typeof step.response.body === \"object\" &&\n step.response.body !== null &&\n \"message\" in step.response.body\n ? String((step.response.body as { message: unknown }).message)\n : JSON.stringify(step.response.body)}\n

\n \n );\n }\n\n // For HTTP requests, use details/summary for click-to-expand (like Inspector)\n return (\n

\n {getStatusIcon(step, isComplete)}\n \n {stepNumber}. {step.label}\n \n \n {step.response.status} {step.response.statusText}\n \n

\n\n

\n {/* Request */}\n

Request

\n {step.request.method}{\" \"}\n {step.request.url}\n

\n {Object.keys(step.request.headers).length > 0 && (\n

Headers:

\n                  {JSON.stringify(step.request.headers, null, 2)}\n

\n )}\n {step.request.body !== undefined && (\n

Body:

\n                  {typeof step.request.body === \"string\"\n                    ? step.request.body\n                    : JSON.stringify(step.request.body, null, 2)}\n

\n )}\n

\n\n {/* Response */}\n

Response

\n = 400\n ? \"text-red-600\"\n : \"text-green-600\"\n }`}\n >\n {step.response.status}\n {\" \"}\n {step.response.statusText}\n

\n {Object.keys(step.response.headers).length > 0 && (\n

Headers:

\n                  {JSON.stringify(step.response.headers, null, 2)}\n

\n )}\n {step.response.body !== undefined && (\n

Body:

\n                  {typeof step.response.body === \"string\"\n                    ? step.response.body\n                    : JSON.stringify(step.response.body, null, 2)}\n

\n )}\n

\n );\n}",[165],"e2cc665a-fd59-11f0-a11d-42dde27851f2","DebugOAuthProvider.ts","019c0bab-31c2-769e-ac6c-aee1cdc8a04f",["D",1769722294613],"/**\n * OAuth provider for the debug flow.\n * Adapted from Inspector's DebugOAuthProvider.ts for server-side use.\n */\n\nimport type { OAuthClientProvider } from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\nimport type {\n OAuthClientInformation,\n OAuthClientMetadata,\n OAuthTokens,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/shared/auth.js\";\n\n/**\n * Debug OAuth provider that captures the authorization URL instead of redirecting.\n */\nexport class DebugOAuthProvider implements OAuthClientProvider {\n authUrl: URL | null = null;\n _codeVerifier: string | null = null;\n private _clientInfo: OAuthClientInformation | null = null;\n\n constructor(private serverUrl: string) {}\n\n get redirectUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/oauth/callback\";\n }\n\n // For CIMD support - use a fake URL that acts as client_id\n get clientMetadataUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/client-metadata.json\";\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return {\n redirect_uris: [this.redirectUrl],\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: \"MCP OAuth Debugger\",\n client_uri: \"https://github.com/modelcontextprotocol/inspector\",\n };\n }\n\n async redirectToAuthorization(authorizationUrl: URL): Promise {\n this.authUrl = authorizationUrl;\n }\n\n saveCodeVerifier(verifier: string): void {\n this._codeVerifier = verifier;\n }\n\n codeVerifier(): string {\n if (!this._codeVerifier) {\n throw new Error(\"No code verifier saved\");\n }\n return this._codeVerifier;\n }\n\n tokens(): OAuthTokens | undefined {\n return undefined;\n }\n\n saveTokens(_tokens: OAuthTokens): void {\n // No-op for debugging\n }\n\n clientInformation(): OAuthClientInformation | undefined {\n return this._clientInfo ?? undefined;\n }\n\n saveClientInformation(info: OAuthClientInformation): void {\n this._clientInfo = info;\n }\n}\n",[171],"pulls","forks","envVars",{"_182":53,"_184":53},"connections",{"_182":53,"_183":53},"count","unfilledCount","emptyCount",{"_20":170,"_13":171,"_132":172,"_134":-5,"_135":21,"_136":30,"_137":112,"_22":207,"_29":53,"_139":140,"_141":174,"_143":40,"_144":-5,"_192":208,"_91":209},{"_20":164,"_13":165,"_132":166,"_134":-5,"_135":21,"_136":30,"_137":112,"_22":204,"_29":53,"_139":140,"_141":168,"_143":40,"_144":-5,"_192":205,"_91":206},{"_20":158,"_13":159,"_132":160,"_134":-5,"_135":21,"_136":30,"_137":112,"_22":201,"_29":53,"_139":140,"_141":162,"_143":40,"_144":-5,"_192":202,"_91":203},{"_20":151,"_13":152,"_132":153,"_134":-5,"_135":21,"_136":30,"_137":112,"_22":198,"_29":53,"_139":155,"_141":156,"_143":40,"_144":-5,"_192":199,"_91":200},{"_20":146,"_13":147,"_132":148,"_134":-5,"_135":21,"_136":30,"_137":112,"_22":195,"_29":53,"_139":140,"_141":92,"_143":40,"_144":-5,"_192":196,"_91":197},{"_20":130,"_13":131,"_132":133,"_134":-5,"_135":21,"_136":30,"_137":112,"_22":191,"_29":53,"_139":140,"_141":142,"_143":40,"_144":-5,"_192":193,"_91":194},["D",1769722294613],"children",[],[131],["D",1769722294613],[],[147],["D",1769722294613],[],[152],["D",1769722294613],[],[159],["D",1769722294613],[],[165],["D",1769722294613],[],[171],["D",1769722294613],{"_11":12,"_89":85},{"_11":12,"_83":-5,"_84":85,"_46":47,"_86":87,"_88":40},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":32,"_33":34,"_76":42,"_77":78,"_79":80,"_81":14,"_82":12},"ctx",{"_69":-5,"_114":247,"_248":249,"_250":251,"_252":40,"_253":40,"_254":40,"_255":112,"_256":-5,"_257":-7,"_258":-7,"_259":53,"_260":40,"_261":40,"_262":-5,"_263":40,"_264":40,"_265":40,"_266":-5},"ENV",{"_218":219,"_220":221,"_222":26,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1