Better CORS defaults for SSE transport

[jspahrsummers]

It's likely that most MCP servers accessible over SSE should be contactable by frontend web applications, which means the right CORS headers need to be set. The SDK should likely opt-in to this by default, with an opt-out available.

See also modelcontextprotocol/python-sdk#187.

[Vikrant-Khedkar]

Hey, I am interested in fixing this. would love to discuss more

[punkpeye]

For what it is worth, https://github.com/punkpeye/fastmcp defaults to allowing CORS by default.

[mantrakp04]

+1

Edit: its a bug not an enhancement

[panz2018]

I have developed web servers that integrate MCP SSE functionality:

• Using FastAPI: fastapi_mcp_sse
• Using Starlette: starlette_mcp_sse

These servers can be extended with custom routes while retaining full MCP SSE capabilities. Thus, it is possible to add CORS support using the functions from FastAPI or Starlette.

[punkpeye]

I am not confident that cors considerations should be even part of MCP SDK. This feels very much like something that should be implemented at a framework/server level.