Better CORS defaults for SSE transport

[jspahrsummers]

It's likely that most MCP servers accessible over SSE should be contactable by frontend web applications, which means the right CORS headers need to be set. The SDK should likely opt-in to this by default, with an opt-out available.

See also modelcontextprotocol/typescript-sdk#143.

[panz2018]

I have developed web servers that integrate MCP SSE functionality:

• Using FastAPI: fastapi_mcp_sse
• Using Starlette: starlette_mcp_sse

These servers can be extended with custom routes while retaining full MCP SSE capabilities. Thus, it is possible to add CORS or any other functions using FastAPI or Starlette functions.

[ezyang]

Even if the default isn't changed, there should be some way to set it from mcp run. Otherwise the built in serving commands are just fundamentally not serious for real use.

[ezyang]

It's so easy to just hard code your own SSE server though... the missed opportunity here is ensuring all MCP's have a standardized way to do the SSE server