Closes#2289
Running the Inspector behind a reverse proxy on a *.localhost name works
today, but only with ALLOWED_ORIGINS set, and nothing said so or showed the
shape. Raised by the reporter of #1944, whose whole service cluster uses those
names.
Three things the recipe has to carry, all learned the expensive way:
- ALLOWED_ORIGINS REPLACES the default list rather than merging, so an entry
of only the proxy origin silently breaks browsing at localhost:PORT. The
loopback trio has to be listed too.
- The failure is confusing rather than obvious. A same-origin GET carries no
Origin header, so the page loads and only the POSTs that add or connect a
server are rejected — which reads as a connection problem rather than a
configuration one.
- Only the browser resolves *.localhost for free. Chrome and Firefox map those
names to loopback per RFC 6761; the OS resolver on macOS does not and Safari
does not at all, so an MCP *server* on such a host still needs /etc/hosts or
dnsmasq — the Node backend is what dials it — and with OAuth is refused by
the SDK regardless (typescript-sdk#2591).
Documented rather than changing the default: see #2282 for why ~1,100 lines of
origin and CSP code was a bad trade for removing one env var.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MvNbmAtQuWhDvzi4yXDju
Signed-off-by: cliffhall <cliff@futurescale.com>
6650c0b525