fix: allow preflight options request for streamable http

Author: TheRealSeber

src/mcp/server/streamable_http.py

@@ -286,6 +286,8 @@ async def handle_request(self, scope: Scope, receive: Receive, send: Send) -> No
             await self._handle_get_request(request, send)
         elif request.method == "DELETE":
             await self._handle_delete_request(request, send)
+        elif await request.method == "OPTIONS":
+            await self._handle_options_request(request, send)
         else:
             await self._handle_unsupported_request(request, send)
 
@@ -620,6 +622,21 @@ async def _handle_delete_request(self, request: Request, send: Send) -> None:
         )
         await response(request.scope, request.receive, send)
 
+    async def _handle_options_request(self, request: Request, send: Send) -> None:
+        """Handle OPTIONS requests for CORS preflight."""
+        headers = {
+            "Access-Control-Allow-Origin": "*",
+            "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
+            "Access-Control-Allow-Headers": request.headers.get("Access-Control-Request-Headers", "")
+        }
+
+        response = Response(
+            content=None,
+            status_code=HTTPStatus.NO_CONTENT,
+            headers=headers
+        )
+        await response(request.scope, request.receive, send)
+
     async def terminate(self) -> None:
         """Terminate the current session, closing all streams.