fix: allow mcp-protocol-version request header in CORS preflight

src/http.config.test.ts

@@ -107,6 +107,30 @@ describe("HTTP transport configuration", () => {
       );
     });
 
+    it("allows the mcp-protocol-version request header in preflight", async () => {
+      await start({ allowedOrigins: ["https://app.example"] });
+
+      // The official StreamableHTTPClientTransport sends mcp-protocol-version
+      // on every request after initialize, so browser preflights ask for it.
+      const preflight = await fetch(`${baseUrl}/mcp`, {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://app.example",
+          "Access-Control-Request-Method": "POST",
+          "Access-Control-Request-Headers":
+            "content-type,mcp-session-id,mcp-protocol-version",
+        },
+      });
+
+      expect(preflight.headers.get("access-control-allow-origin")).toBe(
+        "https://app.example",
+      );
+      const allowHeaders = (
+        preflight.headers.get("access-control-allow-headers") ?? ""
+      ).toLowerCase();
+      expect(allowHeaders).toContain("mcp-protocol-version");
+    });
+
     it("does not allow a non-allowlisted origin even when others are allowlisted", async () => {
       await start({ allowedOrigins: ["https://app.example"] });
 

src/http.ts

@@ -91,7 +91,7 @@ export function createHttpApp(options: HttpAppOptions): Express {
         return callback(new CorsOriginNotAllowedError(origin));
       },
       exposedHeaders: ["Mcp-Session-Id", "mcp-protocol-version"],
-      allowedHeaders: ["Content-Type", "mcp-session-id"],
+      allowedHeaders: ["Content-Type", "mcp-session-id", "mcp-protocol-version"],
     }),
   );
 

src/transport.test.ts

@@ -76,7 +76,7 @@ describe("Transport Integration Tests", () => {
       app.use(cors({
         origin: "*",
         exposedHeaders: ["Mcp-Session-Id", "mcp-protocol-version"],
-        allowedHeaders: ["Content-Type", "mcp-session-id"],
+        allowedHeaders: ["Content-Type", "mcp-session-id", "mcp-protocol-version"],
       }));
       app.use(express.json());
     });