StreamableHTTPTransport: option to accept any Origin and keep the Host check #684

We run a remote MCP server with StreamableHTTPTransport (stateless, JSON responses, OAuth bearer tokens). Browser-based clients on any origin may call it. Authentication is the bearer token only, with no cookies, and our CORS response allows any origin.

validate_origin accepts a cross-origin request only when its Origin is in allowed_origins:. There is no option to accept any Origin and keep the Host check. Today an app can:

• pass dns_rebinding_protection: false, which also turns off the Host check, or
• build the transport for each request and pass the request's own Origin: allowed_origins: [request.get_header("HTTP_ORIGIN")&.b].compact. This works, but it only exists to get past the check.

Proposal: accept allowed_origins: :any, which skips only the Origin check. Host validation stays on.

The Origin check protects servers where the browser adds credentials on its own: cookies, or a server on localhost. A remote server that requires a bearer token has neither, so the Origin check adds nothing there, while the Host check still does.

Happy to send a PR if this shape is acceptable.