feat(mcp): add CORS support for browser-based MCP clients#3549
Open
feat(mcp): add CORS support for browser-based MCP clients#3549
Conversation
Enable cross-origin requests to the /mcp endpoint so browser-based clients (e.g. Claude.ai) can connect. Uses permissive CORS (Allow-Origin: *) matching monorepo precedent (Hermes/Argus). Handles OPTIONS preflight and exposes Mcp-Session-Id header for stateful clients. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 7 Skipped Deployments
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Access-Control-Allow-Origin: *) to the/mcpHTTP endpoint, matching monorepo precedent (Hermes/Argus useCorsLayer::permissive())OPTIONSpreflight requests with a 204 response and appropriate CORS headersMcp-Session-Idheader for browser-based stateful MCP clients (e.g. Claude.ai)0.1.0→0.2.0Context
The MCP server is being submitted to an MCP server directory. Browser-based clients making cross-origin requests to
mcp.pyth.networkrequire CORS headers — without them, browsers silently block all requests. The MCP SDK's deprecatedallowedOriginsconfig only validates origins but does not set CORS response headers; SDK docs recommend external middleware.Test plan
pnpm --filter @pythnetwork/mcp buildpassespnpm --filter @pythnetwork/mcp test:unit— all 132 tests passcurl -X OPTIONS -H "Origin: https://claude.ai" http://localhost:8080/mcp -D -→ 204 with CORS headerscurl -X POST -H "Origin: https://claude.ai" -H "Content-Type: application/json" -H "Accept: application/json" -d '{"jsonrpc":"2.0","method":"tools/list","id":1}' http://localhost:8080/mcp -D -→ 200 with CORS headers🤖 Generated with Claude Code