header ‘mcp-protocol-version’ is not allowed according to header ‘Access-Control-Allow-Headers’ from CORS preflight response

[thomas-0816]

using llama.cpp webui, the firefox browser console gives:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:8081/mcp. (Reason: header ‘mcp-protocol-version’ is not allowed according to header ‘Access-Control-Allow-Headers’ from CORS preflight response).

Describe the bug
StreamableHttpServerTransport::createRequestHandler() has
'Access-Control-Allow-Headers' => 'Content-Type, Mcp-Session-Id, Last-Event-ID, Authorization',

To Reproduce
create a mcp server and add it to llama.cpp webui
refresh llama.cpp webui, firefox browser console gives:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:8081/mcp. (Reason: header ‘mcp-protocol-version’ is not allowed according to header ‘Access-Control-Allow-Headers’ from CORS preflight response).

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:8081/mcp. (Reason: CORS request did not succeed). Status code: (null).

Expected behavior
no error

Logs
If applicable, add logs to help explain your problem.

Additional context

I changed

'Access-Control-Allow-Headers' => 'Content-Type, Mcp-Session-Id, Last-Event-ID, Authorization',

to

'Access-Control-Allow-Headers' => 'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization',

in server/src/Transports/StreamableHttpServerTransport.php to fix the issue (see

server/src/Transports/StreamableHttpServerTransport.php

Line 170 in d2c5833

'Access-Control-Allow-Headers' => 'Content-Type, Mcp-Session-Id, Last-Event-ID, Authorization',

).

PHP code used

<?php

require_once __DIR__ . '/vendor/autoload.php';

use PhpMcp\Schema\ServerCapabilities;
use PhpMcp\Server\Server;
use PhpMcp\Server\Transports\StreamableHttpServerTransport;
use Psr\Log\LoggerInterface;
use Psr\Log\LoggerTrait;

try {
    $server = Server::make()
        ->withServerInfo('My Mcp Server', '0.1')
        ->withCapabilities(ServerCapabilities::make())
        ->withTool(
            fn (string $city): float => $city === 'Berlin' ? 21.42 : 0.0,
            name: 'get_weather',
            description: 'Get temperature of a city'
        )
        ->withPrompt(
            fn (string $city): array => [['role' => 'user', 'content' => "Get temperature in {$city}"]],
            name: 'weather_prompt'
        )
        ->withLogger(new class implements LoggerInterface {
            use LoggerTrait;

            public function log($level, string|Stringable $message, array $context = []): void
            {
                fwrite(STDERR, new DateTime()->format('Y-m-d H:i:s.u ') . json_encode(func_get_args()) . PHP_EOL);
            }
        })
        ->build()
        ->listen(new StreamableHttpServerTransport('127.0.0.1', 8081, '/mcp', stateless: true));
} catch (Throwable $exception) {
    fwrite(STDERR, 'error ' . (string) $exception . PHP_EOL);
    exit(1);
}