MCP Inspector — Tools

[R-Lawton]

Implement the MCP Inspector page with the Tools tab as shown in the Figma designs. This is the core interactive tool for connecting to MCP gateways and testing tools.

Related architecture validation: #776.

Plugin wiring

• Add console.page/route for MCP Inspector.
• Add the exposed module in package.json under consolePlugin.exposedModules.
• Run yarn i18n for new translatable strings.

Connection bar

• Card with three sections: Gateway | Connection | Status.
• Select populated by watching MCPGatewayExtension resources with useK8sWatchResource.
• A connectable extension has a current Ready=True condition. The UI does not depend on status.mcpEndpoint.
• Connection status: Icon + Connected / No connection.
• Authentication status when a gateway bearer token is in use.
• Request, warning and error counts.

Empty state

Show “No connection: Connect to a Gateway to view the MCP server tools available” until a gateway is selected.

Authentication

When the gateway returns 401, show an “Authentication required” modal with a password input for a bearer token. Keep the token in browser memory only.

The OpenShift user token and MCP gateway token are separate credentials. OIDC is not part of this issue.

Tools workspace

Left panel:

• Searchable tool selector with an icon-only refresh button.
• Tool name, MCP server name, description and annotation labels.
• Copy action.
• Inputs generated from the tool's JSON schema.
• Optional tool-specific _meta key/value rows.
• Validate-only and Run tool actions where supported.

Right panel:

• Console and server-result views.
• Response text and JSON-RPC request/response payloads.
• Aligned status and duration summary.

Prompts and Logs remain future tabs; only Tools is wired up here.

MCP transport

Browser MCP traffic is same-origin and goes through the OpenShift Console plugin proxy:

Browser
  -> /api/proxy/plugin/kuadrant-console-plugin/backend/
       api/mcp/v1/mcpgatewayextensions/{namespace}/{name}
  -> Console Plugin Go backend
  -> MCP Gateway

The Console Plugin image contains a small Go server that serves the compiled frontend and exposes the narrow MCP relay. The Kuadrant Operator deploys this image and reconciles a fixed ConsolePlugin.spec.proxy entry with authorization: UserToken. The relay does not run inside the operator process.

The frontend discovers gateways through the Console SDK and sends only the selected extension's namespace and name. It never sends a destination URL. On each relay request, the backend:

1. reads the selected MCPGatewayExtension with the Console-supplied user token;
2. requires Ready=True for the current extension generation;
3. reads the Gateway referenced by spec.targetRef with the same user token;
4. finds the target listener and derives the MCP URL from spec.publicHost, or the listener hostname, plus listener protocol and port;
5. appends /mcp and relays only the supported Streamable HTTP methods and headers.

The OpenShift token is used only for Kubernetes API reads and is never sent to the MCP Gateway. An optional MCP bearer token uses X-Kuadrant-MCP-Authorization in the browser request and becomes upstream Authorization only after target resolution. Mcp-Session-Id stays in browser memory.

This transport does not require gateway CORS, a Console CSP allowlist, MCP Gateway PR #1416, custom HTTPRoutes or status.mcpEndpoint.

Designs

Keep the interactive Figma prototype as the source design. The exported views below are convenient implementation references.

Tools — selected tool and output

Tools — searchable tool selector

Prompts — future tab reference

Logs — future tab reference

Definition of done

• Inspector discovers Ready MCPGatewayExtension resources and connects through the fixed Console plugin backend proxy.
• Backend resolves only the selected namespace/name, checks the user's Kubernetes access to the extension and Gateway, and never accepts a browser-supplied URL.
• OpenShift and optional MCP bearer credentials remain separate.
• Browser MCP traffic is same-origin and has no gateway connect-src CSP dependency.
• initialize, notifications/initialized, tool refresh and tools/call work through the backend.
• Unit tests cover the Go backend and React/MCP client.
• Playwright covers the page shell and an opt-in live tool-call journey.
• Operator deployment and ConsolePlugin.spec.proxy reconciliation are covered.
• Production authorization, outbound target policy and rollout hardening from Validate the MCP Inspector backend proxy approach #776 are addressed or split into accepted follow-up issues.
• Documentation is updated.