allowedOrigins property

List<String>? allowedOrigins
final

Allowed Origin header values for DNS-rebinding protection (MCP 2025-11-25 requires HTTP 403 Forbidden for invalid Origin headers on the Streamable HTTP transport).

When non-null, a request that carries an Origin header whose value is not in this list is rejected with 403 Forbidden before dispatch. Requests without an Origin header (non-browser clients) are not affected. When null (default), Origin is not enforced — preserving prior behavior for existing deployments (opt-in hardening).

Implementation

final List<String>? allowedOrigins;