Github MCP server not working with a web based MCP client. CORS issue

[dsn12311]

Describe the bug

I have a web based IDE as an MCP client, that allows for remote MCP server configuration. It doesn't work for remote MCP server. MCP client works for another remote MCP server.

Access to fetch at 'https://api.githubcopilot.com/mcp/' from origin 'https://awesome.myinstance.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed. Have the server send the header with a valid value

Affected version

remote MCP server URL https://api.githubcopilot.com/mcp/

Steps to reproduce the behavior

1. web based MCP client
2. connect Github MCP remote server.

Expected vs actual behavior

CORS issue. It should work like it works on desktop based MCP client.

Logs

Access to fetch at 'https://api.githubcopilot.com/mcp/' from origin 'https://awesome.myinstance.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed. Have the server send the header with a valid value

[irreplacable25]

GITHUB_TOOLSETS="default,stargazers" ./github-mcp-server
Secret scanning

[d-markey]

Same here, it seems like the OPTIONS method expects an access token.

However according to https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#examples_of_access_control_scenarios:

Preflight requests and credentials

CORS-preflight requests must never include credentials. The response to a preflight request must specify Access-Control-Allow-Credentials: true to indicate that the actual request can be made with credentials.

[dsn12311]

I have another similar header issue. looks like 'Mcp-Session-Id' is not in Access-Control-Expose-Headers, so it is not accessible on the browser based MCP client.

[JoannaaKL]

Hi @dsn12311 thank you for reporting this. I added Mcp-Session-Id to Access-Control-Expose-Headers. I am looking into remaining two issues.

[dsn12311]

Thanks @JoannaaKL, confirming Mcp-Session-Id issue is fixed.

There's that The 'Access-Control-Allow-Origin' header contains multiple values '*, *'. Also, called out here #1175

[JoannaaKL]

Hey @dsn12311 can you share x-github-request-id?

[JoannaaKL]

Hi @dsn12311 fixed, if you still experience this bug please reopen this issue.