Canary #565

tonxxd · 2025-11-29T08:42:01Z

Oauth & more

* refactor: enhance layout structure in PromptsTab, ResourcesTab, and ToolsTab components - Wrapped header and content sections in a flex container to improve layout consistency and overflow handling. - Ensured that the UI remains responsive and visually organized across different tabs. * chore: changeset * feat: add enum input display in ToolInputForm component - Introduced a new Select dropdown for enum fields, allowing users to select from predefined options. - Implemented helper functions to resolve JSON schema references and normalize union types for better handling of input schemas.

* feat: Add OAuth examples and enhance authentication flow - Introduced new examples for OAuth integration using Auth0, Supabase, and WorkOS in the mcp-use package. - Added an OAuthCallback component to handle redirects after user authentication. - Enhanced the App component to include routing for OAuth callbacks. - Updated pnpm-lock.yaml and package.json to include the jose library for JWT handling. - Improved context management for HTTP requests to support OAuth flows. - Removed outdated notification example files to streamline the examples directory. * feat: Enhance MCP connection management and add notification examples - Added a `disconnect` method to the MCPConnection interface for better session management. - Updated McpConnectionWrapper to include new connection options for improved user experience. - Implemented connection cleanup logic in McpProvider to handle disconnections properly. - Introduced a new example demonstrating customized notifications for connected clients using the MCP server. - Added a WorkOS AuthKit OAuth example to showcase bearer token authentication and dynamic client registration. * feat: Enhance authentication documentation and add notifications section - Updated the TypeScript client authentication documentation to include new OAuth flow modes (Popup and Redirect). - Added examples for manual authentication triggers and OAuth callback handling. - Introduced a new notifications section in the server documentation with tips and examples for bidirectional notifications. - Included additional tips for complete implementation examples in both notifications and tools documentation. * lint & format * fix: Address linting issues and format code for consistency

socket-security · 2025-11-29T08:42:32Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Maintenance
langfuse-langchain@3.38.6
langfuse@3.38.6
@tanstack/react-query@5.90.10 ⏵ 5.90.11			⁺²
langchain@1.0.4
jose@6.1.2
lint-staged@15.5.2
lucide-react@0.545.0
markdown-to-jsx@7.7.17
ai@4.3.19 ⏵ 5.0.104	⁺¹	⁺⁸

View full report

socket-security · 2025-11-29T08:43:13Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

* chore: clean up pnpm workspace and lock file by removing unused packages and examples * chore: update dependencies and improve example scripts - Updated zod and related dependencies to version 4.1.13 in pnpm-lock.yaml and package.json. - Enhanced example scripts by adding notes for required environment variables and removing dotenv imports for clarity. - Refactored code to use local utility functions for JSON schema conversion and UUID generation. - Cleaned up unused dependencies in package.json for the mcp-use package. * chore: update dependencies and improve package configurations - Added `zod` version 4.1.13 to package.json and pnpm-lock.yaml. - Removed unused dependencies from various package.json files in the create-mcp-use-app templates. - Simplified install arguments in the getInstallArgs function for package managers. - Enhanced error handling for optional dependencies in the McpUseProvider and connect-adapter files. - Refactored display functions to dynamically import optional dependencies for improved performance and user experience. * format & lint * chore: changeset

tonxxd · 2025-11-29T10:14:37Z

@claude review the pr

claude · 2025-11-29T10:14:50Z

Claude finished @tonxxd's task —— View job

PR Review: OAuth & More

This is a substantial and well-implemented PR that adds comprehensive OAuth 2.0/2.1 authentication to mcp-use. I've reviewed the implementation across 100 changed files and have feedback organized by category.

🎯 Overall Assessment

Status: ✅ Ready to merge with minor recommendations

This PR successfully delivers:

Complete OAuth integration with 5 provider implementations
Well-architected authentication system
Comprehensive documentation and examples
Good security practices with appropriate warnings

🔒 Security Review

✅ Strengths

JWT Verification: Proper JWKS-based verification using the jose library
- Auth0, WorkOS, Keycloak, Supabase all implement secure token validation
- Correct use of issuer and audience validation
Development Safety: verifyJwt: false option includes clear warnings
- libraries/typescript/packages/mcp-use/src/server/oauth/providers/auth0.ts:32-34
- libraries/typescript/packages/mcp-use/src/server/oauth/providers/workos.ts:41-43
- Documentation explicitly warns against production use
CORS Configuration: Properly scoped CORS for OAuth endpoints
- libraries/typescript/packages/mcp-use/src/server/oauth/routes.ts:42-75
- Appropriate for OAuth discovery while maintaining security
Context Isolation: AsyncLocalStorage provides proper request isolation
- libraries/typescript/packages/mcp-use/src/server/context-storage.ts:13-73
- Prevents context leakage between concurrent requests

⚠️ Security Concerns

Supabase HS256 Secrets (Medium Priority)
- libraries/typescript/packages/mcp-use/src/server/oauth/providers/supabase.ts:56-69
- HS256 tokens require JWT secret in server code
- Recommendation: Document that ES256 (asymmetric) is preferred for production
- The code handles both correctly, but documentation should emphasize ES256
CORS Wildcard on OAuth Endpoints
- libraries/typescript/packages/mcp-use/src/server/oauth/routes.ts:47 (origin: "*")
- Context: This is actually correct for OAuth discovery per RFC 8414
- Recommendation: Add a comment explaining why origin: "*" is intentional for .well-known/* endpoints
Direct Mode Security
- WorkOS direct mode exposes authorization server metadata
- libraries/typescript/packages/mcp-use/src/server/oauth/routes.ts:178-229
- Good: Pre-registered clients properly hide DCR endpoint (line 211)
- Recommendation: Consider rate limiting on metadata endpoints

🏗️ Architecture Review

✅ Excellent Design Patterns

Provider Abstraction: Clean OAuthProvider interface
- libraries/typescript/packages/mcp-use/src/server/oauth/providers/types.ts:15-73
- Extensible for custom providers
Dual-Mode Support: "direct" vs "proxy" modes well-implemented
- libraries/typescript/packages/mcp-use/src/server/oauth/routes.ts:6-14
- Handles different OAuth topologies appropriately
Context Enhancement: Elegant context passing
- libraries/typescript/packages/mcp-use/src/server/types/tool.ts:8-21
- Tool callbacks receive unified context with auth, sampling, and HTTP request
Zero-Config Pattern: Environment variable auto-discovery
- libraries/typescript/packages/mcp-use/src/server/oauth/providers.ts:96-116
- Good developer experience with fallback to explicit config

💡 Suggestions

Token Caching (Enhancement)
- JWKS fetching happens on every token verification
- Consider implementing JWKS response caching (the providers cache the JWKS instance but not the keys themselves)
- Would reduce latency and external calls
Middleware Ordering (Documentation)
- libraries/typescript/packages/mcp-use/src/server/oauth/middleware.ts:18-95
- Document that OAuth middleware should be applied before tool handlers
- Show example of custom middleware ordering

📝 Code Quality

✅ Strengths

Comprehensive JSDoc: All public APIs well-documented
Type Safety: Strong TypeScript usage with generics for OAuth context
Error Handling: Proper error messages and failure modes
Examples: Multiple working examples (Auth0, WorkOS, Supabase)

🔍 Minor Issues

Inconsistent Error Messages
- Some errors use template strings: Failed to fetch user from WorkOS: ${res.status}
- Others use concatenation: "Token exchange failed: " + error
- Recommendation: Standardize on template literals
Console Logging in Production Code
- Multiple console.log statements in oauth/routes.ts (lines 176, 182, 207, etc.)
- Recommendation: Use a proper logger or make logging configurable
- Consider adding a debug option to OAuth config
Type Safety for Config
- libraries/typescript/packages/mcp-use/src/server/oauth/routes.ts:204
- (provider as any).config?.clientId bypasses type checking
- Recommendation: Add config property to OAuthProvider interface or use type guards

📚 Documentation Review

✅ Excellent Documentation

Comprehensive Guide: docs/typescript/server/authentication.mdx is thorough
Multiple Examples: Auth0, WorkOS, Supabase examples included
Clear Warnings: Development-only settings properly flagged

📋 Suggestions

Security Best Practices Section
- Add section on token storage (don't log tokens, secure storage)
- Document token expiration handling
- Add guidance on refresh token rotation
Troubleshooting Guide
- Common OAuth errors and solutions
- JWKS verification failures
- CORS issues
Migration Guide
- For users upgrading from non-authenticated servers
- Backward compatibility considerations

🔧 Dependency Changes

Socket Security Alerts Review

Alert: Vite 7.2.2 → 4.5.14 downgrade with obfuscation warning

This is flagged but appears intentional for the React example:

Vite 4.x needed for specific build compatibility
Obfuscation warning is common for bundled CLI tools in Vite
Low risk for development-only dependency

New Dependencies:

@esbuild-plugins/*: For Node.js polyfills in browser builds ✅
react & react-dom: For React examples ✅
util: Browser polyfill ✅
[email protected]: Standard upgrade ✅

Recommendation: ✅ Dependency changes are appropriate

🧪 Testing Considerations

Missing Test Coverage

OAuth Provider Tests
- No tests for token verification logic
- No tests for user info extraction
- Recommendation: Add unit tests for each provider
Middleware Tests
- No tests for bearer auth middleware
- No tests for WWW-Authenticate header generation
- Recommendation: Add integration tests
Context Isolation Tests
- AsyncLocalStorage context leakage scenarios
- Recommendation: Test concurrent requests don't share context

🎨 React Integration Review

useMcp Hook Enhancements

Good additions:

preventAutoAuth option (line 70)
useRedirectFlow option (line 71)
OAuth state management in the hook

Consideration:

libraries/typescript/packages/mcp-use/src/react/useMcp.ts
Hook is getting complex with many options
Consider splitting OAuth logic into separate useOAuth hook

🔄 Inspector Integration

OAuth Callback Component

libraries/typescript/packages/inspector/src/client/components/OAuthCallback.tsx

Good:

Clean callback handling
Proper error states
Auto-redirect after success

Suggestion:

Add timeout for callback processing
Show more detailed error messages (currently just "Failed to complete authentication")

📊 Summary

Merge Readiness: ✅ YES

Must Address Before Merge: None (all issues are minor/optional)

Should Address Soon:

Add security best practices to documentation
Add rate limiting consideration for metadata endpoints
Standardize error handling and logging
Add test coverage for OAuth providers

Nice to Have:

JWKS caching optimization
Separate OAuth hook in React
Troubleshooting documentation
Token refresh example

Code Quality Score: 8.5/10

Security: 9/10
Architecture: 9/10
Documentation: 8/10
Testing: 6/10 (missing tests)

🎉 Highlights

Production-Ready OAuth: Well-implemented, secure authentication
Multiple Providers: Flexible provider system works well
Great DX: Zero-config pattern is excellent
Comprehensive Examples: Auth0, WorkOS, Supabase examples help adoption

Great work on this PR! The OAuth implementation is solid and follows best practices. The minor issues noted are primarily about polish and don't block merging.

* chore: clean up pnpm workspace and lock file by removing unused packages and examples * chore: update dependencies and improve example scripts - Updated zod and related dependencies to version 4.1.13 in pnpm-lock.yaml and package.json. - Enhanced example scripts by adding notes for required environment variables and removing dotenv imports for clarity. - Refactored code to use local utility functions for JSON schema conversion and UUID generation. - Cleaned up unused dependencies in package.json for the mcp-use package. * chore: update dependencies and improve package configurations - Added `zod` version 4.1.13 to package.json and pnpm-lock.yaml. - Removed unused dependencies from various package.json files in the create-mcp-use-app templates. - Simplified install arguments in the getInstallArgs function for package managers. - Enhanced error handling for optional dependencies in the McpUseProvider and connect-adapter files. - Refactored display functions to dynamically import optional dependencies for improved performance and user experience. * format & lint * chore: changeset * chore: update TypeScript configuration and clean up project files - Removed `.vercel/` from `.prettierignore` and `eslint.config.js` for consistency. - Deleted unused `.trigger` file to streamline project structure. - Adjusted `tsconfig.json` to maintain only necessary package paths. * chore: update pnpm workspace and package configurations - Added new example packages for mcp-use in the pnpm workspace, including client and server examples. - Updated package.json for mcp-use to reflect the new version of @modelcontextprotocol/sdk. - Enhanced McpUseProvider to dynamically load react-router-dom, improving error handling and user experience. - Refactored connect-adapter and mcp-server to utilize createRequire for dynamic imports, ensuring compatibility with user project directories. - Cleaned up pnpm-lock.yaml to include updated dependencies and improve overall project structure. * refactor: clean up whitespace and formatting in McpUseProvider, connect-adapter, and mcp-server files - Removed unnecessary blank lines to improve code readability. - Standardized formatting for better consistency across the codebase.

- Implemented URL format validation in InspectorDashboard and ServerConnectionModal to ensure only valid protocols (http, https, ws, wss) are accepted. - Added error handling with user feedback using toast notifications for invalid URL formats. - Adjusted collapsedSize property in PromptsTab, ResourcesTab, and ToolsTab components for consistent UI behavior.

* Enhance create-mcp-use-app e2e tests (#561) * Add E2E tests for create-mcp-use-app with npm and yarn Co-authored-by: tonxipad <[email protected]> * feat: Add E2E tests for multiple create-mcp-use-app templates Co-authored-by: tonxipad <[email protected]> --------- Co-authored-by: Cursor Agent <[email protected]> Co-authored-by: tonxipad <[email protected]> * fix docs images * fix(inspector): enable minification for smaller build Use esbuild's built-in minifier (minify: true) instead of adding terser. Results in same compression (8.7MB -> 4.9MB, 44% reduction) with faster builds. * chore: changeset * remove test_app --------- Co-authored-by: Enrico Toniato <[email protected]> Co-authored-by: Cursor Agent <[email protected]> Co-authored-by: tonxipad <[email protected]> Co-authored-by: pietrozullo <[email protected]>

* feat(inspector): enhance ConfigurationDialog with model selection and password visibility toggle - Added a combobox for model selection using a Popover and Command components for improved user experience. - Implemented a button to toggle password visibility for the API key input field. - Updated imports to include necessary UI components for the new features. * fix(inspector): correct models and API keys display in inspector chat * feat(inspector): add checkbox support and enhance Markdown rendering - Introduced a new ListItem component to handle task list items with checkboxes in Markdown. - Updated the MarkdownRenderer to support custom table components and improved code block handling. - Added dependencies for @radix-ui/react-checkbox and updated package.json and pnpm-lock.yaml accordingly. - Refined styles in ChatHeader and ChatInputArea for better layout consistency.

.github/workflows/ci.yml

libraries/typescript/packages/mcp-use/examples/server/oauth/workos/src/server.ts

…and update README for automatic dependency installation (#571)

Signed-off-by: Enrico Toniato <[email protected]>

…ensitive information Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <[email protected]>

…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <[email protected]>

* chore(dependencies): update ai package version and add overrides for sugarss - Updated ai package from version 4.3.19 to 5.0.104 in multiple package.json files. - Added sugarss override to package.json files in apps-sdk, mcp-ui, and starter templates for compatibility. * feat(ci): add typescript-deno-test workflow for Deno compatibility testing - Introduced a new CI job to test Deno compatibility for the mcp-use package. - Updated pnpm-lock.yaml and package.json files to reference the latest version of @modelcontextprotocol/sdk from a new URL. - Ensured dependencies are installed and built correctly before running Deno tests. * deno test * fix(ci): update package command from npm to pnpm for Deno testing * refactor(mcp-use): replace LangChainAdapter with createTextStreamResponse for AI SDK compatibility - Updated multiple files to use createTextStreamResponse instead of LangChainAdapter for creating data stream responses. - Enhanced README and example files to reflect the new usage pattern. - Adjusted tests to verify compatibility with the new response handling method. * tests: added deno tests * fix(create-mcp-use-app): parse PORT environment variable to number * tests: exclude deno from vitest

- Introduced steps to create and upload deployment markers for both canary and main branches in the TypeScript release workflow. - The markers indicate successful package publication and are retained for one day.

.github/workflows/railway-deploy.yml

- Replaced LangChainAdapter with createTextStreamResponse for improved AI SDK compatibility. - Updated README and example files to reflect new usage patterns. - Added Deno compatibility tests and adjusted CI workflow for dependency management. - Fixed PORT environment variable parsing in create-mcp-use-app.

… triggers - Added a validation step to ensure that workflow runs triggered automatically are from the same repository, preventing potential security risks from forked repositories. - Updated conditions for deployment markers to incorporate the new validation step, ensuring only valid runs proceed to deployment.

* chore(cli): update package description for clarity and feature enhancement * fix(ci): update Deno testing workflow to ensure proper dependency installation and execution - Adjusted the CI workflow for Deno compatibility testing to ensure all dependencies are correctly installed before running tests. - Updated commands to use pnpm for consistency across the workflow.

tonxxd and others added 4 commits November 29, 2025 09:32

chore: enter canary prerelease mode

bb862ea

chore(typescript): version packages (canary)

de9a383

mintlify bot deployed to staging - docs November 29, 2025 08:42 View deployment

chore(typescript): version packages (canary)

dc36c67

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 29, 2025 08:42 Inactive

chore(typescript): version packages (canary)

07d35fb

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 29, 2025 10:14 Inactive

tonxxd and others added 2 commits November 29, 2025 19:25

chore(typescript): version packages (canary)

6536a87

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 29, 2025 18:26 Inactive

tonxxd added 2 commits November 29, 2025 19:28

lint & format

9899845

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 29, 2025 18:36 Inactive

chore(typescript): version packages (canary)

f6bb6ae

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 29, 2025 18:37 Inactive

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 30, 2025 15:12 Inactive

mintlify bot deployed to staging - docs November 30, 2025 15:13 View deployment

chore(typescript): version packages (canary)

014a25d

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 30, 2025 15:13 Inactive

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 30, 2025 16:07 Inactive

github-advanced-security bot found potential problems Nov 30, 2025

View reviewed changes

.github/workflows/ci.yml Fixed Show fixed Hide fixed

.github/workflows/ci.yml Fixed Show fixed Hide fixed

chore(typescript): version packages (canary)

69dd225

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 30, 2025 16:08 Inactive

github-advanced-security bot found potential problems Nov 30, 2025

View reviewed changes

libraries/typescript/packages/mcp-use/examples/server/oauth/workos/src/server.ts Fixed Show fixed Hide fixed

tonxxd added 2 commits November 30, 2025 17:13

refactor(create-mcp-use-app): remove --no-install flag from commands …

2ffbc1a

…and update README for automatic dependency installation (#571)

Merge branch 'main' into canary

cc25df5

Signed-off-by: Enrico Toniato <[email protected]>

mintlify bot deployed to staging - docs November 30, 2025 16:15 View deployment

tonxxd and others added 3 commits November 30, 2025 17:18

Potential fix for code scanning alert no. 32: Clear-text logging of s…

07110bc

…ensitive information Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <[email protected]>

Potential fix for code scanning alert no. 18: Workflow does not conta…

2136322

…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Enrico Toniato <[email protected]>

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 30, 2025 18:31 Inactive

chore(typescript): version packages (canary)

b7ed720

railway-app bot temporarily deployed to inspector canary (mcp-use / production) November 30, 2025 18:32 Inactive

feat(ci): add deployment markers for canary and main branches (#574)

49434d2

- Introduced steps to create and upload deployment markers for both canary and main branches in the TypeScript release workflow. - The markers indicate successful package publication and are retained for one day.

github-advanced-security bot found potential problems Nov 30, 2025

View reviewed changes

.github/workflows/railway-deploy.yml Fixed Show fixed Hide fixed

tonxxd and others added 4 commits November 30, 2025 19:57

chore(typescript): version packages (canary)

49b60d2

railway-app bot deployed to inspector canary (mcp-use / production) November 30, 2025 19:49 View deployment

tonxxd merged commit 2730902 into main Nov 30, 2025
8 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Canary #565

Canary #565

tonxxd commented Nov 29, 2025

Uh oh!

socket-security bot commented Nov 29, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Nov 29, 2025 •

edited

Loading

Uh oh!

tonxxd commented Nov 29, 2025

Uh oh!

claude bot commented Nov 29, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Canary #565

Canary #565

Conversation

tonxxd commented Nov 29, 2025

Uh oh!

socket-security bot commented Nov 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Nov 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tonxxd commented Nov 29, 2025

Uh oh!

claude bot commented Nov 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review: OAuth & More

🎯 Overall Assessment

🔒 Security Review

✅ Strengths

⚠️ Security Concerns

🏗️ Architecture Review

✅ Excellent Design Patterns

💡 Suggestions

📝 Code Quality

✅ Strengths

🔍 Minor Issues

📚 Documentation Review

✅ Excellent Documentation

📋 Suggestions

🔧 Dependency Changes

Socket Security Alerts Review

🧪 Testing Considerations

Missing Test Coverage

🎨 React Integration Review

useMcp Hook Enhancements

🔄 Inspector Integration

OAuth Callback Component

📊 Summary

Merge Readiness: ✅ YES

Code Quality Score: 8.5/10

🎉 Highlights

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

socket-security bot commented Nov 29, 2025 •

edited

Loading

socket-security bot commented Nov 29, 2025 •

edited

Loading

claude bot commented Nov 29, 2025 •

edited

Loading