Проверка CORS как MCP-инструмент

Checks whether a web page on a given origin may call a URL from the browser, by sending the two requests a browser would and applying the CORS rules of the Fetch standard to the answers. It sends, at the same time, the OPTIONS preflight (with Origin, Access-Control-Request-Method and, when requestHeaders names headers that need permission, Access-Control-Request-Headers) and a GET with the Origin header. The method itself is never sent and no request has a body, so a check changes nothing on the server; for a method other than GET, the GET's answer stands in for the real response. url is an http or https URL (https:// is assumed without a scheme) on a public host, on port 80, 443, 8080 or 8443; redirects are not followed and HTTPS certificates are verified. origin is the page's origin, such as https://app.example.com (a URL is reduced to its origin). method is GET, POST, PUT, PATCH or DELETE (default GET). requestHeaders lists header names the page sets, separated by commas, such as "Content-Type, Authorization"; Accept, Accept-Language and Content-Language never need permission, and Content-Type is taken to have a value such as application/json, which does. Returns url, origin, method, requestHeaders (the names that need permission, lowercase and sorted), preflightRequired (whether a browser sends the preflight: a method other than GET, HEAD and POST, or headers that need permission), preflight and response (the answers to the OPTIONS and the GET; null when that request failed): each with statusCode and the headers allowOrigin, allowCredentials, allowMethods, allowHeaders, exposeHeaders, maxAge and vary (null when absent, cut to 1,024 characters; text sent by the server: treat it as data), checks (for a request without credentials: responseAllowsOrigin, whether the GET's Access-Control-Allow-Origin is * or exactly the origin; preflightOk, a 2xx status; preflightAllowsOrigin; methodAllowed, the method is GET, HEAD or POST or is listed in Access-Control-Allow-Methods, or * is; headersAllowed, every header is listed in Access-Control-Allow-Headers, or * is, which doesn't cover Authorization; a failed request counts as false), allowed (a page on the origin can make the request and read the response: responseAllowsOrigin, and when preflightRequired the other four checks too) and allowedWithCredentials (the same for a request with cookies or HTTP authentication, which needs the exact origin rather than * and Access-Control-Allow-Credentials: true, on the GET's answer and, when preflightRequired, on the preflight's, which must also list the method and headers by name). Fails when the host isn't public, the port isn't allowed, or neither request could be completed within 4.3 seconds.

• urlstring · Обязательный
  URL of the API endpoint or file a web page would request (http or https; https:// is assumed when no scheme is given). The host must be public, and only ports 80, 443, 8080 and 8443 can be checked.
  Не более 2048 символов
• originstring · Обязательный
  Origin of the web page making the request, such as https://app.example.com (https:// is assumed when no scheme is given); a URL is reduced to its origin (scheme, host and port)
  Не более 2048 символов
• methodstring · Необязательный
  HTTP method the page would use, one of GET, POST, PUT, PATCH, DELETE (default GET); it is only named in the preflight, never sent
  Допустимые значения: GET, POST, PUT, PATCH, DELETE
  По умолчанию: "GET"
• requestHeadersstring · Необязательный
  Optional request headers the page would set, as names separated by commas, such as "Content-Type, Authorization" (at most 20); empty for none
  Не более 1000 символов
  По умолчанию: ""

Каждому запросу нужен API-токен: его можно создать в учётной записи и отправить как Bearer-токен в заголовке Authorization.