Add Auth debugger tab #355

pcarleton · 2025-04-29T15:46:54Z

Motivation and Context

Adds a step-by-step auth debugger, going through the different client steps for a server.

How Has This Been Tested?

I've tested this locally against the python example auth SSE server:
modelcontextprotocol/python-sdk#610

I also tested against:

Asana: https://mcp.asana.com/sse
Sentry: https://mcp.sentry.dev/sse
Jira: https://mcp.atlassian.com/v1/sse (fails on redirect b/c inspector isn't allowlisted)

Breaking Changes

none

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update

Checklist

I have read the MCP Documentation
My code follows the repository's style guidelines
New and existing tests pass locally
I have added appropriate error handling
I have added or updated documentation as needed

Additional context

QuantGeekDev · 2025-05-08T13:08:14Z

Hey @pcarleton , I'm also working on something similar. Want to sync on discord? Maybe I can help with something. I'm using Postman since the inspector can't handle it but I was interested in what specific oauth flow you're following. Have you noticed that the specification was updated in draft a few days ago?

pcarleton · 2025-05-08T13:53:51Z

Hi @QuantGeekDev which discord?

Yes, with the new draft, we'll need to add a few more metadata endpoints to check, but that should be okay to just follow what the Typescript SDK does. I'm going to try to land this on the 2025-03-25 spec and update it from there.

QuantGeekDev · 2025-05-08T13:55:54Z

@pcarleton The modelcontextprotocol one: https://discord.gg/3uqNS3KRP2
I've got the same username as here - let's collab! How are you testing these? You have your oauth server set up locally?

pcarleton · 2025-05-08T14:07:20Z

it's testable against the python example server here:
modelcontextprotocol/python-sdk#610

Also can test against some of the public servers e.g.

ihrpr

LGTM

Breaking down into components would be good before merging
maybe make it explicit that only sse will work for now
add small banner to say which spec auth is supporing

ihrpr · 2025-05-09T14:43:53Z

client/src/App.tsx

+  const AuthDebuggerWrapper = () => (
+    <TabsContent value="auth">
+      <AuthDebugger
+        sseUrl={sseUrl}


something for the follow up (for myself) - we need to support shttp as well

true, I think it should be pretty much the same because this all happens before any MCP protocol initialization.

I've been testing this on the python simple auth server, do we have a streamable http auth example? can modify the existing one to add it if not

yeah, it should be something like this: modelcontextprotocol/python-sdk#695 will test and publish the PR

great, this seems to work.

One thing I didn't fully go through and update is the state parameter in App.tsx, it's still called sseUrl even though it can be either sse or streambleHttp. won't tackle that here, but wanted to mention while it's fresh.

ihrpr · 2025-05-09T14:51:27Z

client/src/components/AuthDebugger.tsx

+        latestError: null,
+      });
+
+      if (authState.oauthStep === "not_started") {


pattern matching would be nice (something like a state machine) to have here instead of if-else

👍 I pulled this out into a state machine... the if/else was getting unwieldy, and also made retrying steps annoying

ihrpr · 2025-05-09T14:58:56Z

client/src/components/AuthDebugger.tsx

+    const provider = new DebugInspectorOAuthClientProvider(sseUrl);
+
+    // Helper functions moved inside useCallback to avoid ESLint warning
+    const validateOAuthMetadata = async (


validateOAuthMetadata and validateClientInformation can be extracted:

avoid recreation on every render

clean up proceedToNextStep

👍 addressed w/ state machine

ihrpr · 2025-05-09T15:03:38Z

client/src/components/AuthDebugger.tsx

+    );
+  }, [authState.statusMessage]);
+
+  const renderOAuthFlow = useCallback(() => {


maybe break it down into components? Like OAuthStepItem

yea good call, I broke out the Progress flow component, and a smaller component for each step lmkwyt

olaservo · 2025-05-10T01:30:14Z

Hi Paul, I started testing with this today to see if it would play nice with my E2E Playwright testing branch, and noticed that the branch is quite a few commits behind main. Since I think there were a few auth related commits since you added this, could you pull the latest from main to verify its still working as expected? (And I'm doing the same with my own testing.)

pcarleton · 2025-05-13T10:24:46Z

ty @olaservo, I was missing the scope auth change (forgot I had hacked it in locally). I've updated the typescript sdk import so that the types for the scope parameter work properly now.

A few things still to go:

support the new auth metadata endpoint (will be another upstream typescript-sdk change)
show which spec version / auth metadata endpoint we used

ihrpr

LGTM!

Should we do follow ups as part of a separate PR and merge this one?

pcarleton · 2025-05-13T18:36:57Z

yea this is getting pretty large, will fix w/ follow-ups.

leblancfg · 2025-05-27T15:38:36Z

@pcarleton question for you, I feel like I'm missing something: why the /oauth/callback/debug URL?

That's not standard AFAICT, why not just reuse /oauth/callback?

leblancfg · 2025-05-27T15:41:52Z

Also the authorization URL generated by the debugger isn't the same as the "connect" button. It includes the scopes_supported whereas the main "connect" button doesn't.

I feel like the Connect button also should do that though? Spec isn't exactly prescriptive but the inspector is meant for debugging. 🤔 edit: I'll open a PR actually.

pcarleton · 2025-06-03T12:34:06Z

I feel like I'm missing something: why the /oauth/callback/debug URL?

@leblancfg this was to allow for a different handler when debugging vs. when doing the normal "connect" flow. When you do the step-by-step flow, we show the token and suggest you copy-paste it. We don't want to do that in the normal flow.

pcarleton added 15 commits April 29, 2025 16:44

wip auth debugger

454a609

cleanup types and validation

cc77b84

more cleanup

d11f2db

draft test

be22205

wip clean up some

19f01e1

rm toasts

6277126

consolidate state management

ecefbdd

prettier

2f8ab16

hoist state up to App

5158c22

working with quick and guided

5dca3ed

sort out displaying debugger

cde4663

prettier

506d907

cleanup types

f4664c7

fix tests

c46df44

cleanup comment

c3a565f

pcarleton changed the title ~~[wip] auth debugger~~ Add Auth debugger tab May 8, 2025

prettier

f6053b0

pcarleton added 7 commits May 8, 2025 14:15

fixup types in tests

779621e

prettier

8e8eb41

refactor debug to avoid toasting

4a67d0c

callback shuffling

cbe6324

linting

f986114

types

10cd3e2

rm toast in test

50a4895

pcarleton marked this pull request as ready for review May 8, 2025 14:11

pcarleton requested a review from olaservo May 8, 2025 14:29

ihrpr previously approved these changes May 9, 2025

View reviewed changes

pcarleton and others added 4 commits May 12, 2025 12:02

Merge branch 'main' into pcarleton/auth-debugger

bcfb332

bump typescript sdk version to 0.11.2 for scope parameter passing

bf4b810

use proper scope handling

70b965f

test scope parameter passing

415ca4c

pcarleton dismissed ihrpr’s stale review via 415ca4c May 12, 2025 14:01

pcarleton added 9 commits May 13, 2025 09:24

move functions and s/sseUrl/serverUrl/

fddcf8f

extract status message into component

79ef9ab

refactor progress and steps into components

dc875a0

fix test

0824277

rename quick handler

6407465

one less click

f36c133

last step complete

3ec4069

add state machine

78c9c21

test and types

adaa023

Merge branch 'main' into pcarleton/auth-debugger

78ed3c7

ihrpr approved these changes May 13, 2025

View reviewed changes

pcarleton merged commit 5e8e78c into main May 13, 2025
5 checks passed

pcarleton deleted the pcarleton/auth-debugger branch May 13, 2025 18:37

oidebrett mentioned this pull request May 15, 2025

When using Streamable HTTP transport, the oauth flow is not triggered when the server returns 401 #358

Closed

yexuanyang mentioned this pull request May 25, 2025

mcp_oauth_server example can not be tested in mcp inspector v0.13 modelcontextprotocol/rust-sdk#217

Closed

leblancfg mentioned this pull request May 27, 2025

Connection with OAuth doesn't include scopes #454

Open

Add Auth debugger tab #355

Add Auth debugger tab #355

Conversation

pcarleton commented Apr 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

How Has This Been Tested?

Breaking Changes

Types of changes

Checklist

Additional context

Uh oh!

QuantGeekDev commented May 8, 2025

Uh oh!

pcarleton commented May 8, 2025

Uh oh!

QuantGeekDev commented May 8, 2025

Uh oh!

pcarleton commented May 8, 2025

Uh oh!

ihrpr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

olaservo commented May 10, 2025

Uh oh!

pcarleton commented May 13, 2025

Uh oh!

ihrpr left a comment

Choose a reason for hiding this comment

Uh oh!

pcarleton commented May 13, 2025

Uh oh!

Uh oh!

leblancfg commented May 27, 2025

Uh oh!

leblancfg commented May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pcarleton commented Jun 3, 2025

Uh oh!

Uh oh!

pcarleton commented Apr 29, 2025 •

edited

Loading

leblancfg commented May 27, 2025 •

edited

Loading