feat: cors_allow_origins cli option

src/mcpo/__init__.py

@@ -18,6 +18,10 @@ def main(
     port: Annotated[
         Optional[int], typer.Option("--port", "-p", help="Port number")
     ] = 8000,
+    cors_allow_origins: Annotated[
+        Optional[List[str]],
+        typer.Option("--cors-allow-origins", help="CORS allowed origins"),
+    ] = ["*"],
     env: Annotated[
         Optional[List[str]], typer.Option("--env", "-e", help="Environment variables")
     ] = None,
@@ -72,6 +76,7 @@ def main(
         run(
             host,
             port,
+            cors_allow_origins=cors_allow_origins,
             config=config,
             name=name,
             description=description,

src/mcpo/main.py

@@ -124,7 +124,9 @@ async def lifespan(app: FastAPI):
                 yield
 
 
-async def run(host: str = "127.0.0.1", port: int = 8000, **kwargs):
+async def run(
+    host: str = "127.0.0.1", port: int = 8000, cors_allow_origins=["*"], **kwargs
+):
     config_path = kwargs.get("config")
     server_command = kwargs.get("server_command")
     name = kwargs.get("name") or "MCP OpenAPI Proxy"
@@ -139,7 +141,7 @@ async def run(host: str = "127.0.0.1", port: int = 8000, **kwargs):
 
     main_app.add_middleware(
         CORSMiddleware,
-        allow_origins=["*"],
+        allow_origins=cors_allow_origins or ["*"],
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],
@@ -167,7 +169,7 @@ async def run(host: str = "127.0.0.1", port: int = 8000, **kwargs):
 
             sub_app.add_middleware(
                 CORSMiddleware,
-                allow_origins=["*"],
+                allow_origins=cors_allow_origins or ["*"],
                 allow_credentials=True,
                 allow_methods=["*"],
                 allow_headers=["*"],