From 1167ac795d55c66a859482e14f335f75c45d3d93 Mon Sep 17 00:00:00 2001
From: ajspig <dragon@monstercode.com>
Date: Tue, 21 Jul 2026 11:07:30 -0400
Subject: [PATCH]  fix: expose WWW-Authenticate header for cross-origin
 clients.

---
 mcp/src/index.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mcp/src/index.ts b/mcp/src/index.ts
index be106c34..a7e0f107 100644
--- a/mcp/src/index.ts
+++ b/mcp/src/index.ts
@@ -11,6 +11,7 @@ const CORS_HEADERS = {
   "Access-Control-Allow-Origin": CORS_ORIGIN,
   "Access-Control-Allow-Methods": CORS_METHODS,
   "Access-Control-Allow-Headers": CORS_ALLOWED_HEADERS,
+  "Access-Control-Expose-Headers": "WWW-Authenticate",
 };
 
 const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";