Module origin 

Origin allow-list — fail-closed default per MCP Security Warning.

SP-streamable-http §4.6: the default allow-list matches Celia’s production-hardened set (celia_phr/crates/celia-cli/src/http_server.rs:121-130):

• http://127.0.0.1* / https://127.0.0.1*
• http://localhost* / https://localhost*
• tauri://*

Any origin not on the list (and not in the operator’s extra_origins) gets a 403 + JSON-RPC -32001. Requests without an Origin header (curl / same-origin fetch) are allowed because the kernel’s loopback-bind already enforces the DNS-rebinding boundary for them; same precedent as Celia.

Functions

is_default_loopback_origin

The five default loopback / Tauri patterns. Public for tests + the --doctor self-check in adopters (e.g. atd-ref-server --doctor).

origin_allowed

Returns true when the request’s Origin header is on the default allow-list, on the extras list (verbatim match), or absent. Used by the /mcp handler as the first gate before bearer auth.