fix: nine small defects from the v2.13 review (#2827)

clients/launcher/README.md

@@ -35,8 +35,8 @@ transport and sets the era that connection negotiates, so a non-legacy era
 needs no `mcp.json` entry.
 
 **Seed contents are web-specific.** When the web backend creates a missing
-writable catalog it seeds `DEFAULT_SEED_CONFIG` (`core/mcp/serverList.ts`) — a
-`filesystem-server-default` scoped to `/tmp`, the canonical
+writable catalog it seeds `defaultSeedConfig` (`core/mcp/serverList.ts`) — a
+`filesystem-server-default` scoped to the platform temp dir (`os.tmpdir()`), the canonical
 `everything-server-default`, and `example-server-default`, the MCP org's
 remote feature-reference server (Streamable HTTP, no local process and no API
 key needed) — so a first launch has something to connect to.

clients/tui/__tests__/App.test.tsx

@@ -1164,6 +1164,49 @@ describe("App (status, layout, modals)", () => {
     expect(f).toContain("alpha");
   });
 
+  it("lists tools alphabetically by name, as the web sidebar does (#2827)", async () => {
+    h.ctrl.status = "connected";
+    h.ctrl.tools = [
+      { ...sampleTool, name: "zeta" },
+      { ...sampleTool, name: "tool_10" },
+      { ...sampleTool, name: "Beta" },
+      { ...sampleTool, name: "tool_2" },
+    ];
+    const r = await mount(oneStdio());
+    await press(r, ["t"]);
+    await expectFrame(r, "Tools (4)");
+    const f = r.lastFrame() ?? "";
+    const order = ["Beta", "tool_2", "tool_10", "zeta"].map((n) =>
+      f.indexOf(n),
+    );
+    expect(order.every((i) => i >= 0)).toBe(true);
+    expect(order).toEqual([...order].sort((a, b) => a - b));
+  });
+
+  it("keeps the tool selection across an unrelated update such as a stderr line (#2827)", async () => {
+    h.ctrl.status = "connected";
+    h.ctrl.tools = [
+      { ...sampleTool, name: "zeta" },
+      { ...sampleTool, name: "beta" },
+    ];
+    const r = await mount(oneStdio());
+    await press(r, ["t", TAB, DOWN]);
+    await expectFrame(r, "▶ zeta");
+    // A new stderr array re-derives the server state; the sorted tools must
+    // keep their identity, or ToolsTab resets the cursor to the top.
+    h.ctrl.stderrLogs = [stderrLog];
+    r.rerender(
+      <App
+        mcpServers={oneStdio()}
+        clientConfig={emptyClientConfig}
+        callbackUrlConfig={callbackUrlConfig}
+      />,
+    );
+    await tick();
+    await tick();
+    expect(r.lastFrame() ?? "").toContain("▶ zeta");
+  });
+
   it("opens the tool test modal with Enter from the list pane", async () => {
     h.ctrl.status = "connected";
     h.ctrl.tools = [sampleTool];

clients/tui/__tests__/formHeader.test.ts

@@ -0,0 +1,22 @@
+import { describe, it, expect } from "vitest";
+import { untitledForm } from "../src/utils/formHeader.js";
+import { schemaToForm } from "../src/utils/schemaToForm.js";
+
+describe("untitledForm (#2827)", () => {
+  it("drops the title the modal header already shows, keeping the sections", () => {
+    const form = schemaToForm(
+      { type: "object", properties: { q: { type: "string" } } },
+      "search",
+    );
+    expect(form.title).toBe("Test Tool: search");
+    const body = untitledForm(form);
+    expect(body.title).toBeUndefined();
+    expect(body.sections).toBe(form.sections);
+  });
+
+  it("does not mutate the form the header reads", () => {
+    const form = schemaToForm(null, "noParams");
+    untitledForm(form);
+    expect(form.title).toBe("Test Tool: noParams");
+  });
+});

clients/tui/__tests__/tui-servers.test.ts

@@ -75,8 +75,8 @@ describe("loadTuiServers", () => {
 
   it("builds a single ad-hoc server from a positional target", async () => {
     const servers = await loadTuiServers({ target: ["my-server", "--flag"] });
-    expect(Object.keys(servers)).toEqual(["default"]);
-    expect(servers.default?.config).toMatchObject({
+    expect(Object.keys(servers)).toEqual(["my-server"]);
+    expect(servers["my-server"]?.config).toMatchObject({
       type: "stdio",
       command: "my-server",
       args: ["--flag"],

clients/tui/src/App.tsx

@@ -44,6 +44,7 @@ import {
 } from "@inspector/core/mcp/node/index.js";
 import { useInspectorClient } from "@inspector/core/react/useInspectorClient.js";
 import { useManagedTools } from "@inspector/core/react/useManagedTools.js";
+import { compareToolsByName } from "@inspector/core/mcp/toolOrder.js";
 import { useManagedResources } from "@inspector/core/react/useManagedResources.js";
 import { useManagedResourceTemplates } from "@inspector/core/react/useManagedResourceTemplates.js";
 import { useManagedPrompts } from "@inspector/core/react/useManagedPrompts.js";
@@ -429,9 +430,10 @@ function App({
             }),
           ...(savedSettings && { serverSettings: savedSettings }),
           // Advertise the roots configured for this server in mcp.json, as web
-          // and the CLI do. The TUI has no roots editor, but a user who set
-          // roots in the web UI expects them to apply to the same server here
-          // (#1797).
+          // and the CLI do (#1797). This is the starting list: the roots
+          // editor (#2432, `e` on the Info tab) changes it for this session
+          // through `InspectorClient.setRoots`, but never writes mcp.json, so
+          // these configured roots return on the next launch.
           roots: cleanRoots(savedSettings?.roots ?? []),
           // Per-server protocol era (SEP §7.8) from mcp.json → SDK
           // versionNegotiation; absent era defaults to legacy (#1626).
@@ -697,6 +699,15 @@ function App({
     selectedInspectorClient,
     selectedManagedToolsState,
   );
+  // Alphabetical by the name each row shows, the order the web Tools sidebar
+  // uses (#2782, #2827) — not the server's `tools/list` order. A copy (the
+  // hook's array is the store's snapshot), memoized on that snapshot alone:
+  // ToolsTab resets its selection when its list's identity changes, so a
+  // fresh array on an unrelated update (a stderr line) would lose the cursor.
+  const sortedTools = useMemo(
+    () => [...managedTools].sort(compareToolsByName),
+    [managedTools],
+  );
 
   // Resources, resource templates, prompts from managed state managers
   const selectedManagedResourcesState = useMemo(
@@ -1272,7 +1283,7 @@ function App({
       resources: managedResources,
       resourceTemplates: managedResourceTemplates,
       prompts: managedPrompts,
-      tools: managedTools,
+      tools: sortedTools,
       stderrLogs: inspectorStderrLogs, // InspectorClient manages this
     };
   }, [
@@ -1286,7 +1297,7 @@ function App({
     managedResources,
     managedResourceTemplates,
     managedPrompts,
-    managedTools,
+    sortedTools,
     inspectorStderrLogs,
   ]);
 

clients/tui/src/components/PromptTestModal.tsx

@@ -7,6 +7,7 @@ import type { Prompt, GetPromptResult } from "@modelcontextprotocol/client";
 import { promptArgsToForm } from "../utils/promptArgsToForm.js";
 import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
 import { redactErrorText, redactedJson } from "../utils/errorText.js";
+import { untitledForm } from "../utils/formHeader.js";
 
 // Helper to extract error message from various error types
 function getErrorMessage(error: unknown): string {
@@ -221,7 +222,7 @@ export function PromptTestModal({
                 </Box>
               )}
               <Form
-                form={formStructure}
+                form={untitledForm(formStructure)}
                 onSubmit={(values: object) =>
                   handleFormSubmit(values as Record<string, string>)
                 }

clients/tui/src/components/ResourceTestModal.tsx

@@ -12,6 +12,7 @@ import {
 } from "@inspector/core/mcp/uriTemplate.js";
 import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
 import { redactErrorText, redactedJson } from "../utils/errorText.js";
+import { untitledForm } from "../utils/formHeader.js";
 
 // Helper to extract error message from various error types
 function getErrorMessage(error: unknown): string {
@@ -274,7 +275,7 @@ export function ResourceTestModal({
                 </Box>
               )}
               <Form
-                form={formStructure}
+                form={untitledForm(formStructure)}
                 onSubmit={(values: object) =>
                   handleFormSubmit(values as Record<string, string>)
                 }

clients/tui/src/components/ToolTestModal.tsx

@@ -14,6 +14,7 @@ import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
 import { inlineLocalRefs } from "@inspector/core/json/localRefs.js";
 import { redactErrorText, redactedJson } from "../utils/errorText.js";
 import type { ResultFileFormat } from "@inspector/core/mcp/resultFile.js";
+import { untitledForm } from "../utils/formHeader.js";
 import {
   defaultResultFileName,
   saveResultToFile,
@@ -384,7 +385,7 @@ export function ToolTestModal({
           {state === "form" && (
             <Box flexGrow={1} width="100%">
               <Form
-                form={formStructure}
+                form={untitledForm(formStructure)}
                 onSubmit={(value: object) =>
                   void handleFormSubmit(value as Record<string, JsonValue>)
                 }

clients/tui/src/utils/formHeader.ts

@@ -0,0 +1,17 @@
+/**
+ * The form a test modal hands to `ink-form`, minus its title (#2827).
+ *
+ * Each test modal (tool, prompt, resource template) prints the form's title in
+ * its own header, because it has to stay visible in the loading and results
+ * states too — and `ink-form` prints the same `form.title` again in its own
+ * header box, so the open form showed "Test Tool: <name>" twice. The modal's
+ * header is the one that survives every state, so the copy given to the form
+ * drops it. `title` is optional in `ink-form`'s `FormStructure`; without one
+ * its header keeps the navigation hint and the section tabs.
+ */
+
+import type { FormStructure } from "ink-form";
+
+export function untitledForm(form: FormStructure): FormStructure {
+  return { ...form, title: undefined };
+}

clients/web/.storybook/main.ts

@@ -10,11 +10,5 @@ const config: StorybookConfig = {
     "@storybook/addon-onboarding",
   ],
   framework: "@storybook/react-vite",
-  previewHead: (head) => `
-    ${head}
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link href="https://fonts.googleapis.com/css2?family=Fredoka:wght@300..700&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap" rel="stylesheet" />
-  `,
 };
 export default config;

clients/web/.storybook/preview.tsx

@@ -3,6 +3,7 @@ import { MantineProvider, useMantineColorScheme } from "@mantine/core";
 import { Notifications } from "@mantine/notifications";
 import "@mantine/core/styles.css";
 import "@mantine/notifications/styles.css";
+import "../src/theme/fonts/fonts.css";
 import "../src/App.css";
 import { theme } from "../src/theme/theme";
 import { cssVariablesResolver } from "../src/theme/cssVariables";

clients/web/README.md

@@ -419,6 +419,8 @@ The origin allow-list only sees requests that carry an `Origin` header, and a br
 - The **port is not compared**, so a remapped port (`-p 127.0.0.1:8080:6274`) or a proxy on `:443` still matches; the name is what a re-pointed page cannot change. A request with no `Host` header is refused.
 - `GET /healthz` is exempt — it discloses nothing — so a probe that addresses the container by a service name keeps working.
 
+**The MCP Apps sandbox listener (`MCP_SANDBOX_PORT`, default 6275) applies the same rules** to `/sandbox`, in prod and `--dev` alike, and additionally admits the host of `MCP_SANDBOX_FULL_ADDRESS` when one is set; a refused `Host` gets the same 403 (#2827).
+
 `MCP_INSPECTOR_ALLOWED_HOSTS` is read by the prod server only; under `--dev`, Vite's own `server.allowedHosts` check applies instead (see below) — except over TLS, where Vite skips it because the certificate check already refuses a page loaded under another name.
 
 **Running the Inspector behind a `*.localhost` proxy.** A common local-dev shape gives each service a friendly name — `my-api.localhost`, `my-app.localhost`, `inspector.localhost` — instead of a set of ports. The Inspector works there, but the origin allow-list does not include those names by default, so set it explicitly:

clients/web/index.html

@@ -4,9 +4,6 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/src/theme/assets/MCP.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link href="https://fonts.googleapis.com/css2?family=Fredoka:wght@300..700&family=Roboto+Mono:ital,wght@0,100..700;1,100..700&display=swap" rel="stylesheet" />
     <title>MCP Inspector</title>
   </head>
   <body>

clients/web/public/fonts/Fredoka-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2016 The Fredoka Project Authors (https://github.com/hafontia/Fredoka-One)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.