# `ExMCP.Transport.HTTPServer`
[🔗](https://github.com/azmaveth/ex_mcp/blob/v1.0.0/lib/ex_mcp/transport/http_server.ex#L2)

  HTTP server transport for MCP with security and CORS support.

  This module provides a Plug-compatible HTTP server that handles MCP requests
  with comprehensive security features including:

  - Origin header validation (DNS rebinding protection)
  - CORS headers with configurable policies
  - Security headers (XSS, frame options, etc.)
  - HTTPS enforcement
  - Request validation

  > #### Simplified example transport {: .warning}
  >
  > This Plug is retained as a simplified example and includes a canned
  > `initialize` response. It is not the production HTTP server path. Use
  > `ExMCP.HttpPlug` for protocol-complete HTTP deployments.

  ## Usage with Phoenix

      # In your router
      scope "/mcp" do
        forward "/", ExMCP.Transport.HTTPServer,
          handler: MyMCPHandler,
          security: %{
          validate_origin: true,
          allowed_origins: ["https://app.example.com"],
          cors: %{
            allowed_methods: ["GET", "POST", "OPTIONS"],
            allowed_headers: ["Content-Type", "Authorization"],
            allow_credentials: true
          }
        }
    end

## Usage with Plug.Router

    defmodule MyMCPRouter do
      use Plug.Router

      plug :match
      plug :dispatch

      forward "/mcp", to: ExMCP.Transport.HTTPServer,
        init_opts: [
          handler: MyMCPHandler,
          security: %{validate_origin: true}
        ]
    end

## Security Configuration

The `:security` option accepts:

- `validate_origin: boolean()` - Enable origin validation (default: true)
- `allowed_origins: [String.t()]` - List of allowed origins
- `allowed_hosts: [String.t()]` - List of allowed host headers
- `enforce_https: boolean()` - Require HTTPS for non-localhost (default: true)
- `cors: map()` - CORS configuration
- `include_security_headers: boolean()` - Include standard security headers (default: true)

# `call`

Handles HTTP requests for MCP.

# `init`

Initializes the HTTP server with configuration.

---

*Consult [api-reference.md](api-reference.md) for complete listing*