mcp-proxy 6.4.6 → 6.5.1

package/jsr.json

@@ -3,5 +3,5 @@
   "include": ["src/index.ts", "src/bin/mcp-proxy.ts"],
   "license": "MIT",
   "name": "@punkpeye/mcp-proxy",
-  "version": "6.4.6"
+  "version": "6.5.1"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-proxy",
-  "version": "6.4.6",
+  "version": "6.5.1",
   "main": "dist/index.mjs",
   "scripts": {
     "build": "tsdown",

package/src/bin/mcp-proxy.ts

@@ -55,6 +55,12 @@ const argv = await yargs(hideBin(process.argv))
         "The timeout (in milliseconds) for initial connection to the MCP server (default: 60 seconds)",
       type: "number",
     },
+    corsAddAllowedHeader: {
+      array: true,
+      describe:
+        "Add a header name to Access-Control-Allow-Headers (defaults preserved). Repeat to add multiple, e.g. `--corsAddAllowedHeader X-API-Key`.",
+      type: "string",
+    },
     debug: {
       default: false,
       describe: "Enable debug logging",
@@ -137,6 +143,22 @@ const argv = await yargs(hideBin(process.argv))
   .help()
   .parseAsync();
 
+// Default Access-Control-Allow-Headers list — must stay in sync with
+// `defaultCorsOptions.allowedHeaders` in src/startHTTPServer.ts.
+const DEFAULT_ALLOWED_HEADERS = [
+  "Content-Type",
+  "Authorization",
+  "Accept",
+  "Mcp-Session-Id",
+  "Mcp-Protocol-Version",
+  "Last-Event-Id",
+];
+
+const corsOption =
+  argv.corsAddAllowedHeader && argv.corsAddAllowedHeader.length > 0
+    ? { allowedHeaders: [...DEFAULT_ALLOWED_HEADERS, ...argv.corsAddAllowedHeader] }
+    : undefined;
+
 // If -- separator was used, everything after -- is the command and its args
 const dashDashArgs = argv["--"] as string[] | undefined;
 
@@ -218,6 +240,7 @@ const proxy = async () => {
 
   const server = await startHTTPServer({
     apiKey: argv.apiKey,
+    cors: corsOption,
     createServer,
     eventStore: new InMemoryEventStore(),
     host: argv.host,

package/src/startHTTPServer.ts

@@ -688,7 +688,14 @@ const handleStreamRequest = async <T extends ServerLike>({
         }
       | undefined = sessionId ? activeTransports[sessionId] : undefined;
 
-    if (!sessionId) {
+    if (!sessionId) {  
+      // Return METHOD_NOT_ALLOWED so stateless clients' transport stops reconnecting
+      if (stateless) {
+        res.writeHead(405, { Allow: "POST" }).end("Method Not Allowed");
+
+        return true;
+      }
+
       res.writeHead(400).end("No sessionId");
 
       return true;