MCP Inspector caps OAuth requests at 30 seconds

MCP Inspector now puts a 30-second deadline on every OAuth-path request, and that deadline covers the response body, not the headers alone.

Fetch resolves as soon as headers arrive. A server that answers headers fine and then stalls partway through the body could hang a caller stuck in response.json(), with no timeout to break it loose. Anyone running MCP servers behind Inspector for local development gets a session that no longer locks up when a server goes slow mid-response.

The new withOAuthRequestTimeout wrapper sets DEFAULT_OAUTH_REQUEST_TIMEOUT_MS = 30_000 and bounds the full exchange, per PR #2324. Errors now name the endpoint that failed instead of pointing at the handshake in general terms.

The timeout sits on top of a separate ordering fix. The transport chain checks content type before deciding whether traffic counts as MCP traffic. That ordering means a form-encoded token refresh is never exempt from OAuth handling, even when oauthTokenUrl points at the MCP endpoint's own URL. The PR doesn't say what the code did before this change or how the old exemption logic failed, only that getting the check's order right came from a real failure exposing it.

The open question is how many other tools built around MCP's OAuth flow share the same assumption that a fetch resolving means the whole response is safe to read.