mcp-researchpowerpack 7.1.1 → 7.1.2

package/README.md

@@ -90,7 +90,7 @@ capability with a clear error at call time.
 | `HOST` | `127.0.0.1` | bind address; cloud runtimes that set `PORT` auto-switch to `0.0.0.0`. public binds require `ALLOWED_ORIGINS`, `MCP_URL`, or `CSP_URLS` |
 | `ALLOWED_ORIGINS` | unset | comma-separated origins for host validation / cors; merged with `MCP_URL` and platform `CSP_URLS` when present |
 | `MCP_URL` | unset | public mcp url; contributes its origin to host validation and well-known resource urls |
-| `CSP_URLS` | unset | platform-provided comma-separated public origins; also contributes to host validation |
+| `CSP_URLS` | unset | platform-provided comma-separated public origins; also contributes to host validation, including the derived mcp-use `--br-main` host |
 | `NODE_ENV` | unset | `production` also requires `ALLOWED_ORIGINS`, `MCP_URL`, or `CSP_URLS`, even on a local bind |
 | `DEBUG` | unset | `1` or `2` to bump mcp-use debug verbosity |
 

package/dist/index.js

@@ -5228,18 +5228,35 @@ function normalizeOrigin(value, envName) {
     throw new Error(`${envName} must contain absolute URLs with protocol. Received: ${value}`);
   }
 }
+function expandMcpUseMainBranchOrigin(origin) {
+  const parsed = new URL(origin);
+  const hostname = parsed.hostname.toLowerCase();
+  const suffix = ".run.mcp-use.com";
+  if (!hostname.endsWith(suffix) || hostname.includes("--br-")) {
+    return [origin];
+  }
+  const slug = hostname.slice(0, -suffix.length);
+  const branchOrigin = `${parsed.protocol}//${slug}--br-main${suffix}${parsed.port ? `:${parsed.port}` : ""}`;
+  return [origin, branchOrigin];
+}
+function appendNormalizedOrigins(target, values, envName) {
+  for (const value of values) {
+    const origin = normalizeOrigin(value, envName);
+    target.push(...expandMcpUseMainBranchOrigin(origin));
+  }
+}
 function resolveAllowedOrigins(baseUrl) {
   const origins = [];
   const explicitOrigins = parseCsvEnv(process.env.ALLOWED_ORIGINS);
   if (explicitOrigins && explicitOrigins.length > 0) {
-    origins.push(...explicitOrigins.map((origin) => normalizeOrigin(origin, "ALLOWED_ORIGINS")));
+    appendNormalizedOrigins(origins, explicitOrigins, "ALLOWED_ORIGINS");
   }
   if (baseUrl) {
-    origins.push(normalizeOrigin(baseUrl, "MCP_URL"));
+    appendNormalizedOrigins(origins, [baseUrl], "MCP_URL");
   }
   const cspUrls = parseCsvEnv(process.env.CSP_URLS);
   if (cspUrls && cspUrls.length > 0) {
-    origins.push(...cspUrls.map((origin) => normalizeOrigin(origin, "CSP_URLS")));
+    appendNormalizedOrigins(origins, cspUrls, "CSP_URLS");
   }
   const uniqueOrigins = [...new Set(origins)];
   return uniqueOrigins.length > 0 ? uniqueOrigins : void 0;