Fix: POST response carries Access-Control-Allow-Origin

Web-audit fix skill for the mcp-cors-actual check (MCP, SHOULD).

Goal

Mirror the declared CORS posture on the actual MCP POST response.

Fix

Echo Access-Control-Allow-Origin on the actual POST response whenever the preflight declares CORS: a browser blocks the response body when the header is absent even though the preflight passed. Omitting the header from both the preflight and the POST is a consistent no-CORS posture and scores n_a with no penalty; this check fails when the preflight declares CORS but the POST omits the header.

Resources

• MDN CORS

Copy-paste prompt

Paste this into your coding agent. Your audit adds what it observed for this check:

Verify

Re-run the audit at https://anc.dev/audit or call the audit_website MCP tool; the mcp-cors-actual check should report pass.