FastMCPOptions.http.cors object form. true and omitted mean the
permissive defaults; false disables CORS handling entirely (no global
preflight, no headers).
Properties
allowedHeaders?
Access-Control-Allow-Headers, added to the
defaults. The MCP protocol headers are never removed: silently dropping
one would break browser clients in ways that only surface in
production.
credentials?
Access-Control-Allow-Credentials: true. Requires an explicit
non-'*' origin: browsers reject * on credentialed requests, so
that combination is a construction-time error.
exposedHeaders?
Access-Control-Expose-Headers, added to
the default Mcp-Session-Id (legacy sessionful browser clients must
read it from the initialize response).
maxAge?
Access-Control-Max-Age for preflight caching, in seconds.
methods?
Access-Control-Allow-Methods value; replaces the default
GET, POST, DELETE, OPTIONS list verbatim.
origin?
Origin header. '*' (the default) allows every
origin. A string or array allows exactly those scheme://host[:port]
origins. A function receives the Origin value and returns whether it
is allowed. A function that throws denies the origin.