Release v0.3.1 and v0.3.2
I added three new configuration options to the StreamableHTTP plug:
allowed_origins + validate_origin- This allows you to restrict MCP calls to certain domains. CLI clients don’t send the
Originheader though, so shouldn’t be affected.
- This allows you to restrict MCP calls to certain domains. CLI clients don’t send the
recreate_missing_session- EMCP recreates expired or unknown sessions by default. This is a trade-off to UX which I’ve motivated further in the Readme. It is not spec-compliant though, so if you want to run in “strict” mode and reject unknown sessions or force clients to re-initialize a session if it expires, you can now do so by adding
recreate_missing_session: falseto yourplug.
- EMCP recreates expired or unknown sessions by default. This is a trade-off to UX which I’ve motivated further in the Readme. It is not spec-compliant though, so if you want to run in “strict” mode and reject unknown sessions or force clients to re-initialize a session if it expires, you can now do so by adding
See the Changelog here
https://github.com/PJUllrich/emcp/blob/main/CHANGELOG.md
And documentation of these configurations here
https://github.com/PJUllrich/emcp?tab=readme-ov-file#origin-validation
