The server as an ASGI application serving the MCP endpoint at path
(← FastMCP's http_app). Run it with mooncat, or mount it beside a moonapi
app.
Every message is its own POST, answered with one JSON object, or 202 for a
notification. Sessions, the GET stream and DELETE belong to the
revisions before 2026-07-28 and are optional there; this server keeps no
session, so GET and DELETE answer 405.
A request whose Origin header names another site is refused with 403, as
the transport requires against DNS rebinding. An origin passes when its host
is the request's own Host, a loopback address, or one listed in origins.