Compliance: Hardened MCP SSE stream with manual CORS and relative paths

backend/main.py

@@ -77,32 +77,36 @@ async def process_synthesis(text: str, key: str):
     a = agent_action(record, t, k=key)
     return {"triage": t, "action": a}
 
-# ── MCP Standard (Optimized Discovery) ──────────────────────────────────
+# ── MCP Standard (Optimized Discovery & Handshake) ──────────────────────────
 
 @app.api_route("/mcp", methods=["GET", "POST", "OPTIONS"])
 async def mcp_discovery(req: Request):
-    """Initial Discovery (Supports both GET/POST for platform validation)"""
     if req.method == "OPTIONS": return Response(status_code=204)
+    # Discovery should point to a relative path for the SSE stream
     return {
         "transport": "sse",
-        "endpoint": "https://anil988-codeblue-context.hf.space/mcp/sse",
-        "tools": [{"name": "analyze_clinical_record", "description": "Synthesize records."}]
+        "endpoint": "/mcp/sse", 
+        "tools": [{"name": "analyze_clinical_record", "description": "Synthesize clinical records."}]
     }
 
 @app.get("/mcp/sse")
 async def mcp_sse_stream(req: Request):
-    """Dedicated SSE Handshake"""
+    """Handshake with manual CORS headers for SSE"""
     async def event_generator():
-        # Tell the client where to POST JSON-RPC messages
-        yield f"event: endpoint\ndata: https://anil988-codeblue-context.hf.space/mcp/invoke\n\n"
+        # Immediate endpoint event with relative path
+        yield f"event: endpoint\ndata: /mcp/invoke\n\n"
         while True:
-            await asyncio.sleep(25)
+            await asyncio.sleep(20)
             yield ": keep-alive\n\n"
-    return StreamingResponse(event_generator(), media_type="text/event-stream")
+    
+    response = StreamingResponse(event_generator(), media_type="text/event-stream")
+    response.headers["Access-Control-Allow-Origin"] = "*"
+    response.headers["Cache-Control"] = "no-cache"
+    response.headers["Connection"] = "keep-alive"
+    return response
 
 @app.post("/mcp/invoke")
 async def mcp_invoke(req: Request, x_gemini_key: str = Header(None)):
-    """JSON-RPC Invocation"""
     try: body = await req.json()
     except: return {"error": "Invalid JSON"}