## Problem The MCP Streamable HTTP transport specification uses `DELETE` for explicit session termination. The `mcp_server.handle` route currently only declares `methods: [GET, POST]`, so clients sending `DELETE /_mcp` to end a session receive a 405 Method Not Allowed response. The CORS compiler pass (`McpCorsConfigPass`) also only adds `POST` to `allowedMethods`. Browser-based MCP clients that send a `DELETE` preflight (OPTIONS + DELETE) will be blocked by CORS before the request reaches Drupal. ## Expected behaviour - Route accepts `DELETE` (and `OPTIONS` for CORS preflight). - `McpCorsConfigPass` adds `DELETE` to `allowedMethods`. ## Steps to reproduce Configure an MCP client to send `DELETE /_mcp` for session cleanup. Observe 405 response. --- _This issue was identified with the assistance of Claude (Anthropic) while integrating `drupal/mcp_server` into a Drupal distribution._