MCP OAuth Metadata Debugger

\n Debug OAuth metadata discovery for MCP servers\n

\n\n \n );\n}\n\n// Results page\nfunction ResultsPage(\n { serverUrl, result }: { serverUrl: string; result: DebugResult },\n) {\n return (\n \n

\n MCP OAuth Metadata Debugger\n

\n Debug OAuth metadata discovery for MCP servers\n

\n \n ← New Debug\n \n

\n\n

\n Server:{\" \"}\n \n {serverUrl}\n \n

\n\n

Discovery Steps

\n {result.steps.map((step, index) => (\n \n ))}\n

\n\n {/* Success - Authorization URL found */}\n {result.authorizationUrl && (\n

\n \n \n \n This server looks to be configured correctly\n

\n Successfully generated an authorization URL:\n

\n \n {result.authorizationUrl}\n

\n )}\n \n \n );\n}\n\n// Routes\napp.get(\"/\", (c) => c.html());\n\napp.get(\"/debug\", async (c) => {\n let serverUrl = c.req.query(\"serverUrl\");\n\n if (!serverUrl) {\n return c.redirect(\"/\");\n }\n\n if (!serverUrl.startsWith(\"http\")) {\n serverUrl = `https://${serverUrl}`;\n }\n\n const result = await runOAuthDebugFlow(serverUrl);\n return c.html();\n});\n\n// For val.town\nexport default app.fetch;\n\n// For local Deno development\n// @ts-ignore - Deno global\nif (typeof Deno !== \"undefined\" && Deno.env) {\n // @ts-ignore - Deno global\n const port = parseInt(Deno.env.get(\"PORT\") || \"8000\");\n console.log(`Starting OAuth debugger on http://localhost:${port}`);\n // @ts-ignore - Deno global\n Deno.serve({ port, hostname: \"0.0.0.0\" }, app.fetch);\n}",[163],"e2ccbe0c-fd59-11f0-a11d-42dde27851f2","debug-middleware.ts","019c0bab-31c2-769e-ac6c-b75c00dc4539",["D",1769722294613],"/**\n * Debug middleware for capturing HTTP request/response pairs.\n * Adapted from Inspector's debug-middleware.ts for server-side use.\n */\n\nexport interface DebugRequestResponse {\n id: string;\n label: string;\n request: {\n method: string;\n url: string;\n headers: Record;\n body?: unknown;\n };\n response: {\n status: number;\n statusText: string;\n headers: Record;\n body?: unknown;\n };\n}\n\nexport type DebugMiddlewareCallback = (\n entry: DebugRequestResponse,\n) => Promise;\n\n/**\n * Creates a fetch function that captures request/response pairs.\n */\nexport function createDebugFetch(\n onComplete: DebugMiddlewareCallback,\n): typeof fetch {\n return async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n let requestBody: unknown = undefined;\n if (init?.body) {\n requestBody = parseBody(init.body);\n }\n\n let response: Response;\n try {\n response = await fetch(input, init);\n } catch (fetchError) {\n const errorMessage =\n fetchError instanceof TypeError\n ? \"Network error (CORS or connection failed)\"\n : fetchError instanceof Error\n ? fetchError.message\n : String(fetchError);\n\n const failedEntry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: 0,\n statusText: \"Failed\",\n headers: {},\n body: { error: errorMessage },\n },\n };\n\n await onComplete(failedEntry);\n throw fetchError;\n }\n\n const clonedResponse = response.clone();\n let responseBody: unknown;\n try {\n responseBody = await clonedResponse.json();\n } catch {\n try {\n responseBody = await clonedResponse.text();\n } catch {\n responseBody = null;\n }\n }\n\n const entry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: response.status,\n statusText: response.statusText,\n headers: headersToObject(response.headers),\n body: responseBody,\n },\n };\n\n await onComplete(entry);\n\n return response;\n };\n}\n\nfunction inferLabel(url: string, method: string): string {\n try {\n const parsed = new URL(url);\n return `${method} ${parsed.pathname}`;\n } catch {\n return `${method} ${url}`;\n }\n}\n\nfunction headersToObject(\n headers?: HeadersInit | Headers,\n): Record {\n if (!headers) return {};\n\n if (headers instanceof Headers) {\n const obj: Record = {};\n headers.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n if (Array.isArray(headers)) {\n return Object.fromEntries(headers);\n }\n\n return headers as Record;\n}\n\nfunction parseBody(body: BodyInit | null | undefined): unknown {\n if (!body) return undefined;\n\n if (typeof body === \"string\") {\n try {\n return JSON.parse(body);\n } catch {\n if (body.includes(\"=\") && body.includes(\"&\")) {\n const params = new URLSearchParams(body);\n const obj: Record = {};\n params.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n return body;\n }\n }\n\n if (body instanceof URLSearchParams) {\n const obj: Record = {};\n body.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n return \"[Binary or unsupported body type]\";\n}\n",[170],"e2cc91ac-fd59-11f0-a11d-42dde27851f2","StepDisplay.tsx","019c0bab-31c2-769e-ac6c-b258fbc9084b",["D",1769722294613],"/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\n\nimport type { DebugRequestResponse } from \"./debug-middleware.ts\";\n\n// Inline SVG icons (copied from Lucide patterns)\nconst CheckCircle2 = () => (\n \n \n \n);\n\nconst AlertTriangle = (\n { class: className = \"text-yellow-500\" }: { class?: string },\n) => (\n \n \n \n);\n\nconst Info = () => (\n \n \n \n);\n\ninterface StepDisplayProps {\n step: DebugRequestResponse;\n stepNumber: number;\n isComplete: boolean;\n isCurrent: boolean;\n}\n\nfunction getStatusIcon(step: DebugRequestResponse, isComplete: boolean) {\n if (!isComplete) {\n return (\n \n \n \n );\n }\n\n if (step.response.status === 0) {\n // Status 0 = special step (info, warning, or error)\n if (step.response.statusText === \"Info\") return ;\n if (step.response.statusText === \"Warning\") return ;\n return ;\n }\n\n if (step.response.status >= 400) {\n return ;\n }\n\n return ;\n}\n\nexport function StepDisplay({\n step,\n stepNumber,\n isComplete,\n isCurrent,\n}: StepDisplayProps) {\n const isSpecialStep = step.request.method === \"INFO\" ||\n step.request.method === \"WARNING\" ||\n step.request.method === \"ERROR\";\n\n const hasDetails = !isSpecialStep && step.request.url;\n\n // For special steps (info/warning/error), just show the message directly\n if (isSpecialStep) {\n return (\n

\n {getStatusIcon(step, isComplete)}\n {stepNumber}. {step.label}\n

\n \n {typeof step.response.body === \"object\" &&\n step.response.body !== null &&\n \"messageHtml\" in step.response.body\n ? raw(\n String(\n (step.response.body as { messageHtml: unknown }).messageHtml,\n ),\n )\n : typeof step.response.body === \"object\" &&\n step.response.body !== null &&\n \"message\" in step.response.body\n ? String((step.response.body as { message: unknown }).message)\n : JSON.stringify(step.response.body)}\n

\n \n );\n }\n\n // For HTTP requests, use details/summary for click-to-expand (like Inspector)\n return (\n

\n {getStatusIcon(step, isComplete)}\n \n {stepNumber}. {step.label}\n \n \n {step.response.status} {step.response.statusText}\n \n

\n\n

\n {/* Request */}\n

Request

\n {step.request.method}{\" \"}\n {step.request.url}\n

\n {Object.keys(step.request.headers).length > 0 && (\n

Headers:

\n                  {JSON.stringify(step.request.headers, null, 2)}\n

\n )}\n {step.request.body !== undefined && (\n

Body:

\n                  {typeof step.request.body === \"string\"\n                    ? step.request.body\n                    : JSON.stringify(step.request.body, null, 2)}\n

\n )}\n

\n\n {/* Response */}\n

Response

\n = 400\n ? \"text-red-600\"\n : \"text-green-600\"\n }`}\n >\n {step.response.status}\n {\" \"}\n {step.response.statusText}\n

\n {Object.keys(step.response.headers).length > 0 && (\n

Headers:

\n                  {JSON.stringify(step.response.headers, null, 2)}\n

\n )}\n {step.response.body !== undefined && (\n

Body:

\n                  {typeof step.response.body === \"string\"\n                    ? step.response.body\n                    : JSON.stringify(step.response.body, null, 2)}\n

\n )}\n

\n );\n}",[176],"e2cc665a-fd59-11f0-a11d-42dde27851f2","DebugOAuthProvider.ts","019c0bab-31c2-769e-ac6c-aee1cdc8a04f",["D",1769722294613],"/**\n * OAuth provider for the debug flow.\n * Adapted from Inspector's DebugOAuthProvider.ts for server-side use.\n */\n\nimport type { OAuthClientProvider } from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\nimport type {\n OAuthClientInformation,\n OAuthClientMetadata,\n OAuthTokens,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/shared/auth.js\";\n\n/**\n * Debug OAuth provider that captures the authorization URL instead of redirecting.\n */\nexport class DebugOAuthProvider implements OAuthClientProvider {\n authUrl: URL | null = null;\n _codeVerifier: string | null = null;\n private _clientInfo: OAuthClientInformation | null = null;\n\n constructor(private serverUrl: string) {}\n\n get redirectUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/oauth/callback\";\n }\n\n // For CIMD support - use a fake URL that acts as client_id\n get clientMetadataUrl(): string {\n return \"https://mcp-oauth-debugger.example.com/client-metadata.json\";\n }\n\n get clientMetadata(): OAuthClientMetadata {\n return {\n redirect_uris: [this.redirectUrl],\n token_endpoint_auth_method: \"none\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: \"MCP OAuth Debugger\",\n client_uri: \"https://github.com/modelcontextprotocol/inspector\",\n };\n }\n\n async redirectToAuthorization(authorizationUrl: URL): Promise {\n this.authUrl = authorizationUrl;\n }\n\n saveCodeVerifier(verifier: string): void {\n this._codeVerifier = verifier;\n }\n\n codeVerifier(): string {\n if (!this._codeVerifier) {\n throw new Error(\"No code verifier saved\");\n }\n return this._codeVerifier;\n }\n\n tokens(): OAuthTokens | undefined {\n return undefined;\n }\n\n saveTokens(_tokens: OAuthTokens): void {\n // No-op for debugging\n }\n\n clientInformation(): OAuthClientInformation | undefined {\n return this._clientInfo ?? undefined;\n }\n\n saveClientInformation(info: OAuthClientInformation): void {\n this._clientInfo = info;\n }\n}\n",[182],"pulls","branches","forks","envVars",{"_194":20,"_196":20},"connections",{"_194":20,"_195":20},"count","unfilledCount","emptyCount",{"_32":181,"_13":182,"_144":183,"_146":-5,"_147":56,"_148":55,"_149":127,"_34":219,"_40":20,"_151":152,"_153":185,"_64":26,"_155":-5,"_204":220,"_106":221},{"_32":175,"_13":176,"_144":177,"_146":-5,"_147":56,"_148":55,"_149":127,"_34":216,"_40":20,"_151":152,"_153":179,"_64":26,"_155":-5,"_204":217,"_106":218},{"_32":169,"_13":170,"_144":171,"_146":-5,"_147":56,"_148":55,"_149":127,"_34":213,"_40":20,"_151":152,"_153":173,"_64":26,"_155":-5,"_204":214,"_106":215},{"_32":162,"_13":163,"_144":164,"_146":-5,"_147":56,"_148":55,"_149":127,"_34":210,"_40":20,"_151":166,"_153":167,"_64":26,"_155":-5,"_204":211,"_106":212},{"_32":157,"_13":158,"_144":159,"_146":-5,"_147":56,"_148":55,"_149":127,"_34":207,"_40":20,"_151":152,"_153":107,"_64":26,"_155":-5,"_204":208,"_106":209},{"_32":142,"_13":143,"_144":145,"_146":-5,"_147":56,"_148":55,"_149":127,"_34":203,"_40":20,"_151":152,"_153":154,"_64":26,"_155":-5,"_204":205,"_106":206},["D",1769722294613],"children",[],[143],["D",1769722294613],[],[158],["D",1769722294613],[],[163],["D",1769722294613],[],[170],["D",1769722294613],[],[176],["D",1769722294613],[],[182],["D",1769722294613],{"_11":12,"_105":101},{"_11":12,"_99":-5,"_100":101,"_73":74,"_102":103,"_104":26},{"_40":55,"_13":16,"_32":56,"_38":57,"_42":33,"_43":58,"_59":49,"_60":39,"_61":53,"_54":14,"_50":12},"ctx",{"_94":-5,"_129":259,"_260":261,"_262":263,"_264":26,"_265":26,"_266":26,"_267":127,"_268":-5,"_269":-7,"_270":-7,"_271":20,"_272":26,"_273":26,"_274":-5,"_275":26,"_276":26,"_277":26,"_278":-5},"ENV",{"_230":231,"_232":233,"_234":16,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Compare

Mergetobinsouth/mainintopcarleton/main