Summary

• Add CORS middleware to example servers to expose the Mcp-Session-Id header
• Add documentation for CORS configuration in the README
• Use minimal CORS settings (only expose required headers and methods)

Problem

Browser-based MCP clients cannot access the Mcp-Session-Id header from initialization responses due to CORS restrictions. Without this header, they cannot establish sessions with MCP servers.

Solution

This PR adds the cors npm package to example servers and configures it to expose the Mcp-Session-Id header via Access-Control-Expose-Headers. The configuration is minimal, only exposing what's necessary for MCP protocol operation.

Changes

• Add cors import and middleware to:
  • sseAndStreamableHttpCompatibleServer.ts
  • simpleStatelessStreamableHttp.ts
  • jsonResponseStreamableHttp.ts
• Add CORS configuration section to README explaining when and how to configure CORS for browser clients

Test plan

• Example servers start successfully with CORS configured
• Browser-based clients can read the Mcp-Session-Id header from responses
• CORS headers are properly set on responses

Reported-by: Jerome