\n {getStatusIcon(step, isComplete)}\n {stepNumber}. {step.label}\n

\n \n {typeof step.response.body === \"object\" &&\n step.response.body !== null &&\n \"messageHtml\" in step.response.body\n ? raw(\n String(\n (step.response.body as { messageHtml: unknown }).messageHtml,\n ),\n )\n : typeof step.response.body === \"object\" &&\n step.response.body !== null &&\n \"message\" in step.response.body\n ? String((step.response.body as { message: unknown }).message)\n : JSON.stringify(step.response.body)}\n

\n \n );\n }\n\n // For HTTP requests, use details/summary for click-to-expand (like Inspector)\n return (\n

\n {getStatusIcon(step, isComplete)}\n \n {stepNumber}. {step.label}\n \n \n {step.response.status} {step.response.statusText}\n \n

\n\n

\n {/* Request */}\n

Request

\n {step.request.method}{\" \"}\n {step.request.url}\n

\n {Object.keys(step.request.headers).length > 0 && (\n

Headers:

\n                  {JSON.stringify(step.request.headers, null, 2)}\n

\n )}\n {step.request.body !== undefined && (\n

Body:

\n                  {typeof step.request.body === \"string\"\n                    ? step.request.body\n                    : JSON.stringify(step.request.body, null, 2)}\n

\n )}\n

\n\n {/* Response */}\n

Response

\n = 400\n ? \"text-red-600\"\n : \"text-green-600\"\n }`}\n >\n {step.response.status}\n {\" \"}\n {step.response.statusText}\n

\n {Object.keys(step.response.headers).length > 0 && (\n

Headers:

\n                  {JSON.stringify(step.response.headers, null, 2)}\n

\n )}\n {step.response.body !== undefined && (\n

Body:

\n                  {typeof step.response.body === \"string\"\n                    ? step.response.body\n                    : JSON.stringify(step.response.body, null, 2)}\n

\n )}\n

\n );\n}",[],[181],{"_104":188,"_97":189,"_162":190,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":191,"_101":33,"_170":171,"_172":192,"_174":22,"_175":-5,"_176":193,"_100":194},"e2ccbe0c-fd59-11f0-a11d-42dde27851f2","debug-middleware.ts","019c0bab-31c2-769e-ac6c-b75c00dc4539",["D",1769722294613],"/**\n * Debug middleware for capturing HTTP request/response pairs.\n * Adapted from Inspector's debug-middleware.ts for server-side use.\n */\n\nexport interface DebugRequestResponse {\n id: string;\n label: string;\n request: {\n method: string;\n url: string;\n headers: Record;\n body?: unknown;\n };\n response: {\n status: number;\n statusText: string;\n headers: Record;\n body?: unknown;\n };\n}\n\nexport type DebugMiddlewareCallback = (\n entry: DebugRequestResponse,\n) => Promise;\n\n/**\n * Creates a fetch function that captures request/response pairs.\n */\nexport function createDebugFetch(\n onComplete: DebugMiddlewareCallback,\n): typeof fetch {\n return async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n let requestBody: unknown = undefined;\n if (init?.body) {\n requestBody = parseBody(init.body);\n }\n\n let response: Response;\n try {\n response = await fetch(input, init);\n } catch (fetchError) {\n const errorMessage =\n fetchError instanceof TypeError\n ? \"Network error (CORS or connection failed)\"\n : fetchError instanceof Error\n ? fetchError.message\n : String(fetchError);\n\n const failedEntry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: 0,\n statusText: \"Failed\",\n headers: {},\n body: { error: errorMessage },\n },\n };\n\n await onComplete(failedEntry);\n throw fetchError;\n }\n\n const clonedResponse = response.clone();\n let responseBody: unknown;\n try {\n responseBody = await clonedResponse.json();\n } catch {\n try {\n responseBody = await clonedResponse.text();\n } catch {\n responseBody = null;\n }\n }\n\n const entry: DebugRequestResponse = {\n id: crypto.randomUUID(),\n label: inferLabel(url, method),\n request: {\n method,\n url,\n headers: headersToObject(init?.headers),\n body: requestBody,\n },\n response: {\n status: response.status,\n statusText: response.statusText,\n headers: headersToObject(response.headers),\n body: responseBody,\n },\n };\n\n await onComplete(entry);\n\n return response;\n };\n}\n\nfunction inferLabel(url: string, method: string): string {\n try {\n const parsed = new URL(url);\n return `${method} ${parsed.pathname}`;\n } catch {\n return `${method} ${url}`;\n }\n}\n\nfunction headersToObject(\n headers?: HeadersInit | Headers,\n): Record {\n if (!headers) return {};\n\n if (headers instanceof Headers) {\n const obj: Record = {};\n headers.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n if (Array.isArray(headers)) {\n return Object.fromEntries(headers);\n }\n\n return headers as Record;\n}\n\nfunction parseBody(body: BodyInit | null | undefined): unknown {\n if (!body) return undefined;\n\n if (typeof body === \"string\") {\n try {\n return JSON.parse(body);\n } catch {\n if (body.includes(\"=\") && body.includes(\"&\")) {\n const params = new URLSearchParams(body);\n const obj: Record = {};\n params.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n return body;\n }\n }\n\n if (body instanceof URLSearchParams) {\n const obj: Record = {};\n body.forEach((value, key) => {\n obj[key] = value;\n });\n return obj;\n }\n\n return \"[Binary or unsupported body type]\";\n}\n",[],[189],{"_104":196,"_97":197,"_162":198,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":199,"_101":33,"_170":200,"_172":201,"_174":22,"_175":-5,"_176":202,"_100":203},"e2ccd018-fd59-11f0-a11d-42dde27851f2","http.ts","019c0bab-31c2-769e-ac6c-b8176e663705",["D",1769722294613],"http","/** @jsxImportSource npm:hono@4/jsx */\n\nimport { Hono } from \"npm:hono@4\";\nimport { StepDisplay } from \"./StepDisplay.tsx\";\nimport { type DebugResult, runOAuthDebugFlow } from \"./oauth-flow.ts\";\n\nconst app = new Hono();\n\n// Layout component\nfunction Layout({ children }: { children: unknown }) {\n return (\n \n \n \n \n MCP OAuth Metadata Debugger\n \n \n \n \n

\n {children}\n

\n \n \n );\n}\n\n// Home page with form\nfunction HomePage() {\n return (\n \n

MCP OAuth Metadata Debugger

\n Debug OAuth metadata discovery for MCP servers\n

\n\n \n );\n}\n\n// Results page\nfunction ResultsPage(\n { serverUrl, result }: { serverUrl: string; result: DebugResult },\n) {\n return (\n \n

\n MCP OAuth Metadata Debugger\n

\n Debug OAuth metadata discovery for MCP servers\n

\n \n ← New Debug\n \n

\n\n

\n Server:{\" \"}\n \n {serverUrl}\n \n

\n\n

Discovery Steps

\n {result.steps.map((step, index) => (\n \n ))}\n

\n\n {/* Success - Authorization URL found */}\n {result.authorizationUrl && (\n

\n \n \n \n This server looks to be configured correctly\n

\n Successfully generated an authorization URL:\n

\n \n {result.authorizationUrl}\n

\n )}\n \n \n );\n}\n\n// Routes\napp.get(\"/\", (c) => c.html());\n\napp.get(\"/debug\", async (c) => {\n let serverUrl = c.req.query(\"serverUrl\");\n\n if (!serverUrl) {\n return c.redirect(\"/\");\n }\n\n if (!serverUrl.startsWith(\"http\")) {\n serverUrl = `https://${serverUrl}`;\n }\n\n const result = await runOAuthDebugFlow(serverUrl);\n return c.html();\n});\n\n// For val.town\nexport default app.fetch;\n\n// For local Deno development\n// @ts-ignore - Deno global\nif (typeof Deno !== \"undefined\" && Deno.env) {\n // @ts-ignore - Deno global\n const port = parseInt(Deno.env.get(\"PORT\") || \"8000\");\n console.log(`Starting OAuth debugger on http://localhost:${port}`);\n // @ts-ignore - Deno global\n Deno.serve({ port, hostname: \"0.0.0.0\" }, app.fetch);\n}",[],[197],{"_104":205,"_97":206,"_162":207,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":208,"_101":33,"_170":171,"_172":74,"_174":22,"_175":-5,"_176":209,"_100":210},"e2ccec2e-fd59-11f0-a11d-42dde27851f2","main.ts","019c0bab-31c2-769e-ac6c-bdc88d9662a4",["D",1769722294613],[],[206],{"_104":212,"_97":213,"_162":214,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":215,"_101":33,"_170":171,"_172":216,"_174":22,"_175":-5,"_176":217,"_100":218},"e2cceddc-fd59-11f0-a11d-42dde27851f2","oauth-flow.ts","019c0bab-31c2-769e-ac6c-c3be01ce3b61",["D",1769722294613],"/**\n * OAuth debug flow logic.\n * Runs the OAuth discovery flow and captures all steps.\n * Adapted from Inspector's AuthDebuggerFlow.tsx\n */\n\nimport {\n auth,\n extractWWWAuthenticateParams,\n} from \"npm:@modelcontextprotocol/sdk@1.25.3/client/auth.js\";\n\nimport { createDebugFetch, type DebugRequestResponse } from \"./debug-middleware.ts\";\nimport { DebugOAuthProvider } from \"./DebugOAuthProvider.ts\";\n\nexport interface DebugResult {\n steps: DebugRequestResponse[];\n authorizationUrl?: string;\n codeVerifier?: string;\n}\n\n// Helper to create error/warning steps with HTML content\nfunction createErrorStep(label: string, messageHtml: string): DebugRequestResponse {\n return {\n id: crypto.randomUUID(),\n label,\n request: { method: \"ERROR\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Error\",\n headers: {},\n body: { messageHtml },\n },\n };\n}\n\nexport async function runOAuthDebugFlow(serverUrl: string): Promise {\n const steps: DebugRequestResponse[] = [];\n\n // Track discovery state to inject informational warnings (like Inspector does)\n const discoveryState = {\n prmFailed: false,\n shownPrmWarning: false,\n oauthMetadataSuccess: false,\n shownNoMetadataWarning: false,\n };\n\n const baseDebugFetch = createDebugFetch(async (entry) => {\n steps.push(entry);\n });\n\n // Wrap debugFetch to track state and inject info/warning steps\n const debugFetch: typeof fetch = async (input, init) => {\n const url = typeof input === \"string\" ? input : input.toString();\n const method = init?.method || \"GET\";\n\n // Before OAuth metadata request - inject PRM warning if needed\n if (\n (url.includes(\".well-known/oauth-authorization-server\") ||\n url.includes(\".well-known/openid-configuration\")) &&\n discoveryState.prmFailed &&\n !discoveryState.shownPrmWarning\n ) {\n steps.push(createErrorStep(\n \"Error: No PRM Found\",\n `Server does not have Protected Resource Metadata. Falling back to 2025-03-26 spec authorization base URL discovery. This often is due to an incorrect server URL preventing PRM discovery. Please double-check the server URL is correct.`\n ));\n discoveryState.shownPrmWarning = true;\n }\n\n // Before POST /register - inject warning if no metadata found\n if (\n method === \"POST\" &&\n url.includes(\"/register\") &&\n !discoveryState.oauthMetadataSuccess &&\n !discoveryState.shownNoMetadataWarning\n ) {\n steps.push(createErrorStep(\n \"Error: No Metadata Found\",\n `Failed to discover OAuth authorization server metadata. Falling back to 2025-03-26 spec server-without-metadata mode. This is unlikely to work, and is often due to an incorrect server URL. Please check the MCP URL you entered is correct.`\n ));\n discoveryState.shownNoMetadataWarning = true;\n }\n\n // Make the actual request\n const response = await baseDebugFetch(input, init);\n\n // Track PRM discovery\n if (url.includes(\".well-known/oauth-protected-resource\")) {\n if (!response.ok) {\n discoveryState.prmFailed = true;\n }\n }\n\n // Track OAuth metadata discovery\n if (\n url.includes(\".well-known/oauth-authorization-server\") ||\n url.includes(\".well-known/openid-configuration\")\n ) {\n if (response.ok) {\n discoveryState.oauthMetadataSuccess = true;\n }\n }\n\n return response;\n };\n\n const provider = new DebugOAuthProvider(serverUrl);\n\n try {\n // Step 1: Try to initialize to get 401 with WWW-Authenticate header\n let resourceMetadataUrl: URL | undefined;\n\n try {\n const initResponse = await debugFetch(serverUrl, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n jsonrpc: \"2.0\",\n method: \"initialize\",\n params: {\n protocolVersion: \"2025-03-26\",\n capabilities: {},\n clientInfo: { name: \"mcp-oauth-debugger\", version: \"1.0.0\" },\n },\n id: 1,\n }),\n });\n\n if (initResponse.status === 401) {\n const params = extractWWWAuthenticateParams(initResponse);\n resourceMetadataUrl = params.resourceMetadataUrl;\n }\n } catch {\n // Network error on initial request - continue with discovery\n }\n\n // Step 2: Run SDK auth() for discovery, registration, and auth URL generation\n const result = await auth(provider, {\n serverUrl,\n resourceMetadataUrl,\n fetchFn: debugFetch,\n });\n\n // Add result step\n steps.push({\n id: crypto.randomUUID(),\n label: \"Auth Flow Result\",\n request: { method: \"INFO\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Info\",\n headers: {},\n body: {\n message: result === \"REDIRECT\"\n ? \"Successfully generated authorization URL\"\n : `Auth result: ${result}`,\n },\n },\n });\n\n return {\n steps,\n authorizationUrl: provider.authUrl?.toString(),\n codeVerifier: provider._codeVerifier ?? undefined,\n };\n } catch (error) {\n steps.push({\n id: crypto.randomUUID(),\n label: \"Flow Error\",\n request: { method: \"ERROR\", url: \"\", headers: {} },\n response: {\n status: 0,\n statusText: \"Error\",\n headers: {},\n body: {\n message: error instanceof Error ? error.message : String(error),\n },\n },\n });\n return { steps };\n }\n}\n",[],[213],"files",[159,179,187,195,204,211],"counts",{"_223":33,"_224":142,"_225":33,"_226":227,"_230":231},"pulls","branches","forks","envVars",{"_228":33,"_229":33},"count","emptyCount","connections",{"_228":33,"_232":33},"unfilledCount","contents",[235,238,241,244,247,250],{"_104":160,"_97":161,"_162":163,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":236,"_101":33,"_170":171,"_172":173,"_174":22,"_175":-5,"_100":237},["D",1769722294613],[161],{"_104":180,"_97":181,"_162":182,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":239,"_101":33,"_170":171,"_172":184,"_174":22,"_175":-5,"_100":240},["D",1769722294613],[181],{"_104":188,"_97":189,"_162":190,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":242,"_101":33,"_170":171,"_172":192,"_174":22,"_175":-5,"_100":243},["D",1769722294613],[189],{"_104":196,"_97":197,"_162":198,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":245,"_101":33,"_170":200,"_172":201,"_174":22,"_175":-5,"_100":246},["D",1769722294613],[197],{"_104":205,"_97":206,"_162":207,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":248,"_101":33,"_170":171,"_172":74,"_174":22,"_175":-5,"_100":249},["D",1769722294613],[206],{"_104":212,"_97":213,"_162":214,"_164":-5,"_165":143,"_166":142,"_167":168,"_106":251,"_101":33,"_170":171,"_172":216,"_174":22,"_175":-5,"_100":252},["D",1769722294613],[213],"file","upstreamProject",{"_104":151,"_97":98,"_112":-5,"_113":-5,"_110":111,"_23":256},{"_95":257,"_133":258},"pcarleton","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","upstreamBranch",{"_104":146,"_106":261,"_262":263,"_97":45,"_144":151,"_101":264,"_145":-5,"_147":-5,"_265":266,"_108":-5,"_156":22,"_110":111,"_155":257,"_16":153,"_154":98},["D",1769462381582],"updatedAt",["D",1771608455850],21,"lockfileKey","1771613120622-esm.town_v_pcarleton_mcp-oauth-debugger@21-main","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.compare.$branch",{"_95":96,"_97":98,"_99":45,"_102":273,"_278":33,"_279":280,"_281":282,"_288":22,"_289":277,"_290":291,"_294":-5},{"_104":105,"_97":98,"_106":274,"_108":-5,"_109":22,"_110":111,"_112":-5,"_113":-5,"_14":114,"_115":-5,"_116":22,"_117":-5,"_118":-5,"_119":33,"_16":120,"_121":-5,"_122":-5,"_123":124,"_125":124,"_126":127,"_128":127,"_129":127,"_130":124,"_131":124,"_23":275,"_135":276,"_140":277,"_156":22},["D",1769722294613],{"_95":96,"_133":134},{"_95":96,"_137":134,"_14":114,"_138":139},{"_101":142,"_97":45,"_104":143,"_144":105,"_145":146,"_147":148,"_149":111,"_150":151,"_152":153,"_154":98,"_155":96},"ahead","behind",11,"diff",{"_283":284,"_174":285,"_286":287},"added",[],[],"modified",[],"hasChanges","sourceBranch","targetBranch",{"_104":146,"_106":292,"_262":293,"_97":45,"_144":151,"_101":264,"_145":-5,"_147":-5,"_265":266,"_108":-5,"_156":22,"_110":111,"_155":257,"_16":153,"_154":98},["D",1769462381582],["D",1771608455850],"pull","actionData","errors"]

tobinsouth

mcp-oauth-debugger

Mergetobinsouth/mainintopcarleton/main