{"record":{"id":"0234347b6a3ec39e","repo":"vercel/ai","slug":"mcp-sse-transport-error-endpoint-origin-does-not","errorCode":null,"errorMessage":"MCP SSE Transport Error: Endpoint origin does not match connection origin: ${endpoint.origin}","messagePattern":"MCP SSE Transport Error: Endpoint origin does not match connection origin: (.+?)","errorType":"exception","errorClass":"MCPClientError","httpStatus":null,"severity":"error","filePath":"packages/mcp/src/tool/mcp-sse-transport.ts","lineNumber":183,"sourceCode":"                  }\n                  return;\n                }\n\n                const { event, data } = value;\n\n                if (event === 'endpoint') {\n                  if (this.endpoint) {\n                    continue;\n                  }\n\n                  const endpoint = new URL(data, this.url);\n\n                  if (endpoint.origin !== this.url.origin) {\n                    this.connected = false;\n                    this.endpoint = undefined;\n                    this.sseConnection?.close();\n                    this.abortController?.abort();\n                    throw new MCPClientError({\n                      message: `MCP SSE Transport Error: Endpoint origin does not match connection origin: ${endpoint.origin}`,\n                    });\n                  }\n\n                  this.endpoint = endpoint;\n                  this.connected = true;\n                  resolve();\n                } else if (isMessageEvent(event)) {\n                  try {\n                    const message = await parseJSONRPCMessage(data);\n                    this.onmessage?.(message);\n                  } catch (error) {\n                    const e = new MCPClientError({\n                      message:\n                        'MCP SSE Transport Error: Failed to parse message',\n                      cause: error,\n                    });\n                    this.onerror?.(e);","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/mcp/src/tool/mcp-sse-transport.ts#L165-L201","documentation":"The MCP spec forbids the server's advertised message-posting endpoint from pointing at a different origin than the SSE connection, because that would leak messages/API keys cross-origin. processEvents validates the endpoint event's URL origin against this.url.origin and throws MCPClientError if they differ.","triggerScenarios":"The server's SSE 'endpoint' event returns an absolute URL on another origin (misconfigured base URL behind a proxy, or a malicious/compromised server); client connects via https://api.example.com but server advertises http://localhost:8080/message.","commonSituations":"Reverse proxies that rewrite the endpoint to an internal address; servers configured with an external URL different from the one the client dialed; man-in-the-middle or misconfigured multi-domain setups.","solutions":["Fix the MCP server/proxy to advertise an endpoint on the same origin as the SSE URL (same scheme+host+port), or use a relative endpoint URL","Connect to the same public origin the server advertises (adjust your client URL or DNS/proxy so origins match)","If a proxy rewrites the endpoint, configure it to preserve or rewrite consistently to the public origin"],"exampleFix":"// before\n// server sends: event: endpoint data: http://internal-host:8080/messages\n// after\n// server sends: event: endpoint data: /messages  (same origin as SSE connection)","handlingStrategy":"validation","validationCode":"// validate the server endpoint before connecting\nconst serverUrl = new URL(process.env.MCP_SSE_URL);\nif (serverUrl.origin !== expectedOrigin) throw new Error('MCP server URL origin mismatch with expected origin');","typeGuard":"function originsMatch(endpointUrl: string | URL, connectionUrl: URL): boolean {\n  return new URL(endpointUrl).origin === connectionUrl.origin;\n}","tryCatchPattern":"try {\n  await client.connect();\n} catch (error) {\n  if (MCPClientError.isInstance(error) && error.message.includes('origin does not match')) {\n    // fix proxy/server endpoint advertisement, then reconnect\n  } else throw error;\n}","preventionTips":["Configure the MCP server/proxy to advertise a same-origin (or relative) endpoint URL","Connect to the public origin the server actually advertises","Treat cross-origin endpoints as a security red flag; never bypass the check"],"tags":["security","sse","origin-mismatch"],"backgroundTag":"origin-mismatch","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}