>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3583784. --> Reported by: [mglaman](https://www.drupal.org/user/2416470) Related to !10 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>Browser-based MCP clients such as MCP Inspector send CORS preflight (OPTIONS) requests before connecting. Drupal's CORS handling (via the cors.config container parameter) must explicitly allow the MCP-specific request headers mcp-protocol-version and mcp-session-id, otherwise the preflight fails and the client cannot connect at all.</p> <p>There is currently no mechanism in mcp_server to inject these headers into the site's CORS configuration, leaving it entirely up to each site builder to discover and add them manually.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Add a CompilerPassInterface implementation (src/CompilerPass/McpCorsConfigPass.php) that runs at container compile time and merges mcp-protocol-version and mcp-session-id into cors.config['allowedHeaders'], and ensures POST is present in cors.config['allowedMethods']. The pass bails early if the cors.config parameter is not present (e.g. the cors service provider is not active).</p> <p>Register it in the module's service provider so it runs automatically when the module is installed, no site builder configuration required.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <h3 id="summary-ui-changes">User interface changes</h3> <h3 id="summary-api-changes">API changes</h3> <h3 id="summary-data-model-changes">Data model changes</h3>