Skip to content

Commit 8fa013c

Browse files
Remove misleading comment and add details on why the current design choice was made.
Realted Issue: #827
1 parent 5441767 commit 8fa013c

File tree

1 file changed

+27
-1
lines changed

1 file changed

+27
-1
lines changed

src/mcp/server/sse.py

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,36 @@ class SseServerTransport:
7575
def __init__(self, endpoint: str) -> None:
7676
"""
7777
Creates a new SSE server transport, which will direct the client to POST
78-
messages to the relative or absolute URL given.
78+
messages to the relative path given.
79+
80+
Args:
81+
endpoint: A relative path where messages should be posted (e.g., "/messages/")
82+
83+
Note:
84+
We use relative paths instead of full URLs for several reasons:
85+
1. Security: Prevents cross-origin requests by ensuring clients only connect
86+
to the same origin they established the SSE connection with
87+
2. Flexibility: The server can be mounted at any path without needing to
88+
know its full URL
89+
3. Portability: The same endpoint configuration works across different
90+
environments (development, staging, production)
91+
92+
Raises:
93+
ValueError: If the endpoint is a full URL instead of a relative path
7994
"""
8095

8196
super().__init__()
97+
98+
# Validate that endpoint is a relative path and not a full URL
99+
if "://" in endpoint or endpoint.startswith("//"):
100+
raise ValueError(
101+
"Endpoint must be a relative path (e.g., '/messages/'), not a full URL."
102+
)
103+
104+
# Ensure endpoint starts with a forward slash
105+
if not endpoint.startswith("/"):
106+
endpoint = "/" + endpoint
107+
82108
self._endpoint = endpoint
83109
self._read_stream_writers = {}
84110
logger.debug(f"SseServerTransport initialized with endpoint: {endpoint}")

0 commit comments

Comments
 (0)