fix: replace permissive CORS wildcard with env-configurable origin (CodeQL #1, #2)

[Copilot]

Fixes CodeQL js/cors-permissive-configuration alerts in the everything server's SSE and Streamable HTTP transports. Both transports used origin: "*", allowing cross-origin requests from any origin — a CSRF risk in deployed environments.

Description

Replaces the hardcoded CORS wildcard with an env-driven origin in both transport files:

// Before
cors({ origin: "*", ... })

// After — CORS disabled by default; opt-in via env var
const allowedOrigin: string | false = process.env.CORS_ORIGIN ?? false;
cors({ origin: allowedOrigin, ... })

• CORS_ORIGIN unset → CORS disabled (safe default)
• CORS_ORIGIN=https://inspector.example.com → single trusted origin
• CORS_ORIGIN=* → restores prior wildcard behavior explicitly

Publishing Your Server

Note: We are no longer accepting PRs to add servers to the README. Instead, please publish your server to the MCP Server Registry to make it discoverable to the MCP ecosystem.

To publish your server, follow the quickstart guide. You can browse published servers at https://registry.modelcontextprotocol.io/.

Server Details

• Server: everything
• Changes to: src/everything/transports/sse.ts, src/everything/transports/streamableHttp.ts

Motivation and Context

CodeQL flagged origin: "*" as a permissive CORS configuration in both transport entry points. Any web page could make cross-origin requests to the server, which is undesirable outside of controlled local dev setups.

How Has This Been Tested?

TypeScript build passes. CodeQL scan returns 0 alerts post-fix.

Breaking Changes

Deployments that relied on open CORS (e.g., MCP Inspector direct-connect mode) must now set CORS_ORIGIN=* or a specific origin explicitly. Local stdio usage is unaffected.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Protocol Documentation
• My changes follows MCP security best practices
• I have updated the server's README accordingly
• I have tested this with an LLM client
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have documented all environment variables and configuration options

Additional context

Both alerts (#1 SSE transport, #2 Streamable HTTP transport) were genuine — not false positives. The CORS_ORIGIN env var is documented inline in both files.