Fix: CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers

Web-audit fix skill for the mcp-cors-preflight check (MCP, SHOULD).

Goal

Serve one consistent CORS posture on the MCP endpoint, full preflight support or none.

Fix

The audit scores CORS posture, not presence. Omitting Access-Control-Allow-Origin from both the OPTIONS preflight and the POST response is a consistent no-CORS posture (a server-to-agent-only endpoint) and scores n_a with no penalty. This check fails only when the posture is partial or misconfigured: the preflight carries Access-Control-Allow-Origin on a non-2xx response, or the POST carries it while the preflight does not. To support browser-origin agents, answer the preflight with 204 (or 200) plus Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers, and mirror Access-Control-Allow-Origin on the POST response. To stay no-CORS, strip the headers from both surfaces.

Resources

• MDN CORS preflight

Copy-paste prompt

Paste this into your coding agent. Your audit adds what it observed for this check:

Verify

Re-run the audit at https://anc.dev/audit or call the audit_website MCP tool; the mcp-cors-preflight check should report pass.