> ## Documentation Index
> Fetch the complete documentation index at: https://fastmcp-ts.docs.prefect.io/llms.txt
> Use this file to discover all available pages before exploring further.

# CorsOptions

Defined in: [server/cors.ts:16](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/cors.ts#L16)

`FastMCPOptions.http.cors` object form. `true` and omitted mean the
permissive defaults; `false` disables CORS handling entirely (no global
preflight, no headers).

## Properties

### allowedHeaders?

```ts theme={null}
optional allowedHeaders?: string[];
```

Defined in: [server/cors.ts:32](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/cors.ts#L32)

Extra request headers for `Access-Control-Allow-Headers`, added to the
defaults. The MCP protocol headers are never removed: silently dropping
one would break browser clients in ways that only surface in
production.

***

### credentials?

```ts theme={null}
optional credentials?: boolean;
```

Defined in: [server/cors.ts:40](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/cors.ts#L40)

Send `Access-Control-Allow-Credentials: true`. Requires an explicit
non-`'*'` `origin`: browsers reject `*` on credentialed requests, so
that combination is a construction-time error.

***

### exposedHeaders?

```ts theme={null}
optional exposedHeaders?: string[];
```

Defined in: [server/cors.ts:36](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/cors.ts#L36)

Extra response headers for `Access-Control-Expose-Headers`, added to
the default `Mcp-Session-Id` (legacy sessionful browser clients must
read it from the initialize response).

***

### maxAge?

```ts theme={null}
optional maxAge?: number;
```

Defined in: [server/cors.ts:42](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/cors.ts#L42)

`Access-Control-Max-Age` for preflight caching, in seconds.

***

### methods?

```ts theme={null}
optional methods?: string[];
```

Defined in: [server/cors.ts:27](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/cors.ts#L27)

`Access-Control-Allow-Methods` value; replaces the default
`GET, POST, DELETE, OPTIONS` list verbatim.

***

### origin?

```ts theme={null}
optional origin?: string | string[] | ((origin) => boolean);
```

Defined in: [server/cors.ts:24](https://github.com/PrefectHQ/fastmcp-ts/blob/main/src/server/cors.ts#L24)

Origins allowed to call the MCP endpoint from a browser, compared
against the request's `Origin` header. `'*'` (the default) allows every
origin. A string or array allows exactly those `scheme://host[:port]`
origins. A function receives the `Origin` value and returns whether it
is allowed. A function that throws denies the origin.