mcpway 0.2.0

Run MCP stdio servers over SSE, WebSocket, Streamable HTTP, and gRPC transports.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

use axum::http::header::HeaderName;
use regex::Regex;
use tower_http::cors::{AllowOrigin, CorsLayer};

use crate::config::CorsConfig;

pub fn build_cors_layer(cors: &CorsConfig) -> Option<CorsLayer> {
    match cors {
        CorsConfig::Disabled => None,
        CorsConfig::AllowAll => Some(
            CorsLayer::very_permissive()
                .expose_headers([HeaderName::from_static("mcp-session-id")]),
        ),
        CorsConfig::AllowList { raw } => {
            if raw.is_empty() {
                return None;
            }
            if raw.iter().any(|origin| origin == "*") {
                return Some(
                    CorsLayer::very_permissive()
                        .expose_headers([HeaderName::from_static("mcp-session-id")]),
                );
            }
            let mut exact = Vec::new();
            let mut regexes: Vec<Regex> = Vec::new();
            for origin in raw {
                if origin.starts_with('/') && origin.ends_with('/') && origin.len() > 2 {
                    let pattern = &origin[1..origin.len() - 1];
                    if let Ok(re) = Regex::new(pattern) {
                        regexes.push(re);
                        continue;
                    }
                }
                exact.push(origin.clone());
            }
            let allow = AllowOrigin::predicate(move |origin, _req_parts| {
                if let Ok(origin_str) = origin.to_str() {
                    if exact.iter().any(|v| v == origin_str) {
                        return true;
                    }
                    for re in &regexes {
                        if re.is_match(origin_str) {
                            return true;
                        }
                    }
                }
                false
            });
            Some(
                CorsLayer::new()
                    .allow_origin(allow)
                    .expose_headers([HeaderName::from_static("mcp-session-id")]),
            )
        }
    }
}