@@ -232,6 +232,14 @@ func WithOriginAllowlist(allowlist []string) StreamableHTTPOption {
232232	})
233233}
234234
235+ // WithAllowAllOrigins configures the server to accept requests from any origin 
236+ func  WithAllowAllOrigins () StreamableHTTPOption  {
237+ 	return  streamableHTTPOption (func (s  * StreamableHTTPServer ) {
238+ 		// Use a special marker to indicate "allow all" 
239+ 		s .originAllowlist  =  []string {"*" }
240+ 	})
241+ }
242+ 
235243// StreamableHTTPServer is the concrete implementation of a server that supports 
236244// the MCP Streamable HTTP transport specification. 
237245type  StreamableHTTPServer  struct  {
@@ -1009,21 +1017,20 @@ func (s *StreamableHTTPServer) isValidOrigin(origin string) bool {
10091017		return  false  // Invalid URLs should always be rejected 
10101018	}
10111019
1012- 	// If no allowlist is configured, allow all valid origins 
1013- 	if  len (s .originAllowlist ) ==  0  {
1014- 		// Always allow localhost and 127.0.0.1 
1015- 		if  originURL .Hostname () ==  "localhost"  ||  originURL .Hostname () ==  "127.0.0.1"  {
1016- 			return  true 
1017- 		}
1020+ 	// Always allow localhost and 127.0.0.1 for development 
1021+ 	if  originURL .Hostname () ==  "localhost"  ||  originURL .Hostname () ==  "127.0.0.1"  {
10181022		return  true 
10191023	}
10201024
1021- 	// Always allow localhost and  127.0.0.1 
1022- 	if  originURL . Hostname ()  ==   "localhost"   ||   originURL . Hostname ( ) ==  "127.0.0.1"  {
1023- 		return  true 
1025+ 	// If no allowlist is configured, only allow localhost/ 127.0.0.1 (already checked above)  
1026+ 	if  len ( s . originAllowlist ) ==  0  {
1027+ 		return  false 
10241028	}
10251029
10261030	// Check against the allowlist 
1031+ 	if  len (s .originAllowlist ) ==  1  &&  s .originAllowlist [0 ] ==  "*"  {
1032+ 		return  true  // Explicitly configured to allow all origins 
1033+ 	}
10271034	for  _ , allowed  :=  range  s .originAllowlist  {
10281035		// Check for wildcard subdomain pattern 
10291036		if  strings .HasPrefix (allowed , "*." ) {
0 commit comments