@@ -232,6 +232,14 @@ func WithOriginAllowlist(allowlist []string) StreamableHTTPOption {
232
232
})
233
233
}
234
234
235
+ // WithAllowAllOrigins configures the server to accept requests from any origin
236
+ func WithAllowAllOrigins () StreamableHTTPOption {
237
+ return streamableHTTPOption (func (s * StreamableHTTPServer ) {
238
+ // Use a special marker to indicate "allow all"
239
+ s .originAllowlist = []string {"*" }
240
+ })
241
+ }
242
+
235
243
// StreamableHTTPServer is the concrete implementation of a server that supports
236
244
// the MCP Streamable HTTP transport specification.
237
245
type StreamableHTTPServer struct {
@@ -1009,21 +1017,20 @@ func (s *StreamableHTTPServer) isValidOrigin(origin string) bool {
1009
1017
return false // Invalid URLs should always be rejected
1010
1018
}
1011
1019
1012
- // If no allowlist is configured, allow all valid origins
1013
- if len (s .originAllowlist ) == 0 {
1014
- // Always allow localhost and 127.0.0.1
1015
- if originURL .Hostname () == "localhost" || originURL .Hostname () == "127.0.0.1" {
1016
- return true
1017
- }
1020
+ // Always allow localhost and 127.0.0.1 for development
1021
+ if originURL .Hostname () == "localhost" || originURL .Hostname () == "127.0.0.1" {
1018
1022
return true
1019
1023
}
1020
1024
1021
- // Always allow localhost and 127.0.0.1
1022
- if originURL . Hostname () == "localhost" || originURL . Hostname ( ) == "127.0.0.1" {
1023
- return true
1025
+ // If no allowlist is configured, only allow localhost/ 127.0.0.1 (already checked above)
1026
+ if len ( s . originAllowlist ) == 0 {
1027
+ return false
1024
1028
}
1025
1029
1026
1030
// Check against the allowlist
1031
+ if len (s .originAllowlist ) == 1 && s .originAllowlist [0 ] == "*" {
1032
+ return true // Explicitly configured to allow all origins
1033
+ }
1027
1034
for _ , allowed := range s .originAllowlist {
1028
1035
// Check for wildcard subdomain pattern
1029
1036
if strings .HasPrefix (allowed , "*." ) {
0 commit comments