Packages

conduit_mcp

0.9.3
0.9.7 0.9.6 0.9.5 0.9.4 0.9.3 0.9.2 0.9.1 0.9.0 0.8.5 0.8.0 0.7.2 0.6.5 0.6.2 0.6.1 0.5.0 0.4.7 0.4.6 0.4.5 0.3.1 0.3.0

Elixir implementation of the Model Context Protocol (MCP) specification. Build MCP servers to expose tools, resources, and prompts to LLM applications like Claude Desktop and VS Code extensions. Supports both Streamable HTTP and SSE transports with configurable authentication and CORS.

HexDocs

Current section

Files

Jump to
Readme
20 Versions
8 Dependencies
Dependants
Files
Activity
conduit_mcp lib conduit_mcp plugs security_headers.ex
Raw

lib/conduit_mcp/plugs/security_headers.ex 

defmodule ConduitMcp.Plugs.SecurityHeaders do

  @moduledoc """

  Plug that adds standard security response headers to all responses.



  Sets the following headers:

  - `X-Content-Type-Options: nosniff` — prevents MIME-type sniffing

  - `X-Frame-Options: DENY` — prevents clickjacking via iframes

  - `Cache-Control: no-store` — prevents caching of API responses



  `Strict-Transport-Security` is intentionally omitted because this library

  may run behind a reverse proxy that handles TLS. Add it in your own plug

  pipeline if needed.

  """



  @behaviour Plug

  import Plug.Conn



  @impl true

  def init(opts), do: opts



  @impl true

  def call(conn, _opts) do

    conn

    |> put_resp_header("x-content-type-options", "nosniff")

    |> put_resp_header("x-frame-options", "DENY")

    |> put_resp_header("cache-control", "no-store")

  end

end