@mcp-z/server
    Preparing search index...

    Interface CreateHttpMcpRouterOptions

    interface CreateHttpMcpRouterOptions {
        allowedHosts?: string[];
        allowedOrigins?: string[];
        logger: Logger;
        mcpServer: McpServer | (() => McpServer);
        port: number;
    }
    Index
    allowedHosts? allowedOrigins? logger mcpServer port
    allowedHosts?: string[]

    Extra Host header values to accept, added to the loopback set for port. See allowedOrigins - same reasoning, same additive behavior.

    allowedOrigins?: string[]

    Extra Origin header values to accept, added to the loopback set for port. For a server deployed behind a public hostname (an operator-configured --base-url/BASE_URL), pass that origin here - it is the deployer's explicit declaration of the server's public identity. Loopback access (local dev tools, health checks run on the box itself) keeps working either way, since these are additive, not a replacement.

    logger: Logger
    mcpServer: McpServer | (() => McpServer)

    The MCP server to serve. Either a ready-made instance (shared across every request - only correct for a server with no per-request state) or a factory called once per request, which is what serves both protocol eras without drift: createMcpHandler builds one instance per exchange from the same factory for the modern path and the 2025-era stateless fallback alike.

    port: number

    Port the HTTP server is bound to. Used to derive the loopback Origin/Host allow-list for DNS rebinding protection (see getLoopbackOrigins / getLoopbackHosts in transports/http.ts).

    Settings
    Member Visibility

    On This Page
    Properties