[BUG] Inspector denies my client secret because its shorter than 8 characters

[argestes]

Issue

I cannot create an Oauth client for my MCP server. I'm using an identity provider that accepts shorter-than-8-chars client secrets. But I cannot add my secret since MCP Jam declines shorter than 8 characters long secrets.

How to reproduce

1. Go to Main screen
2. Click on 'Add Server'
3. Click on 'No Authentication' under 'Authentication' section
4. Select 'Oauth'
5. Click on 'Advanced'
6. Enable 'Use custom OAuth credentials'
7. Enter 'banana' as client secret
8. See error 'Client Secret must be at least 8 characters if provided'. Expected behavior: letting me save the secret.

Screenshots

Platform

• Mac App

Additional Context

Even though the spec is min 8 characters long, my backend actually doesn't care about it and expects a smaller client secret.

[dosubot]

Hi @argestes! I'm Dosu and I’m helping the inspector team.

The 8-character minimum is enforced by client-side validation in the validateClientSecret function in use-server-form.ts:

const validateClientSecret = (value: string): string | null => {
  if (value && value.length < 8) {
    return "Client Secret must be at least 8 characters if provided";
  }
  return null;
};

This was introduced in PR #393 as a security best practice [1]. There are also additional checks for max length (512 chars) and character case complexity.

Since this is purely client-side validation and your identity provider legitimately accepts shorter secrets, it seems reasonable to either remove or relax this constraint — the Inspector shouldn't be more restrictive than the actual OAuth provider the user is connecting to.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}