Server-Sent Events (SSE) transport layer for MCP.

Provides two endpoints:

• GET /sse - Server-Sent Events stream for server-to-client messages
• POST /message - HTTP endpoint for client-to-server messages

Options

• :server_module (required) - The MCP server module to route requests to
• :cors_origin - CORS allow-origin header (default: "*")
• :cors_methods - CORS allow-methods header (default: "GET, POST, OPTIONS")
• :cors_headers - CORS allow-headers header (default: "content-type, authorization")
• :auth - Authentication plug configuration (optional)
• :base_url - Public base URL advertised in the SSE endpoint event (e.g. "https://mcp.example.com"). Defaults to deriving it from the request's Host header (sanitized). Set this when running behind a proxy.
• :allowed_origins - list of allowed Origin header values. Unset means no Origin validation (a startup warning is logged) — see ConduitMcp.Plugs.OriginValidation.

Example

{Bandit,
 plug: {ConduitMcp.Transport.SSE,
        server_module: MyApp.MCPServer,
        cors_origin: "https://myapp.com"},
 port: 4001}

With Authentication

{Bandit,
 plug: {ConduitMcp.Transport.SSE,
        server_module: MyApp.MCPServer,
        auth: [
          strategy: :bearer_token,
          token: "my-secret-token"
        ]},
 port: 4001}