feat(mcp): support configurable MCP endpoints and enhance CORS handling

- Introduce `DJANGO_MCP_ENDPOINT` for custom REST route prefixes.
- Update CORS middleware to dynamically apply allowed origins based on the configured endpoint.
- Refactor and consolidate path prefix logic for improved clarity.
- Add corresponding tests for custom MCP endpoint behavior.
- Bump version to 2.2.0.

Author: mihalikv

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-smartbase-admin"
-version = "2.1.1"
+version = "2.2.0"
 description = ""
 authors = ["SmartBase <info@smartbase.sk>"]
 readme = "README.md"

src/django_smartbase_admin/engine/configuration.py

@@ -233,7 +233,7 @@ def __init__(
         mcp_whoami_sbadmin=None,
     ) -> None:
         super().__init__()
-        self.default_view = default_view or self.default_view or []
+        self.default_view = default_view or self.default_view
         self.registered_views = registered_views or self.registered_views or []
         self.menu_items = menu_items or self.menu_items or []
         self.global_filter_form = global_filter_form or self.global_filter_form

src/django_smartbase_admin/mcp/middleware.py

@@ -2,7 +2,7 @@
 
 Browser-hosted MCP clients (claude.ai's Cowork integration, the various
 ChatGPT bridges, Cursor's web client) and custom browser dashboards
-cross-origin POST to ``/mcp/`` and send an OAuth preflight to
+cross-origin POST to the configured MCP endpoint and send an OAuth preflight to
 ``/.well-known/oauth-protected-resource``. Without
 ``Access-Control-Allow-Origin`` + matching ``-Methods`` / ``-Headers``,
 the browser blocks every request before it reaches Django.
@@ -41,8 +41,7 @@
     "https://cursor.com",
 )
 
-_MCP_PATH_PREFIXES: tuple[str, ...] = (
-    "/mcp",
+_OAUTH_PATH_PREFIXES: tuple[str, ...] = (
     "/.well-known/oauth-authorization-server",
     "/.well-known/oauth-protected-resource",
     "/oauth/",
@@ -76,8 +75,23 @@ def _allowed_request_headers() -> str:
     return ", ".join(headers)
 
 
+def _mcp_path_prefix() -> str | None:
+    endpoint = getattr(settings, "DJANGO_MCP_ENDPOINT", "mcp/")
+    endpoint = endpoint.strip("/")
+    if not endpoint:
+        return None
+    return f"/{endpoint}"
+
+
+def _path_matches_prefix(path: str, prefix: str) -> bool:
+    return path == prefix or path.startswith(f"{prefix}/")
+
+
 def _path_needs_cors(path: str) -> bool:
-    return any(path.startswith(prefix) for prefix in _MCP_PATH_PREFIXES)
+    mcp_prefix = _mcp_path_prefix()
+    if mcp_prefix and _path_matches_prefix(path, mcp_prefix):
+        return True
+    return any(path.startswith(prefix) for prefix in _OAUTH_PATH_PREFIXES)
 
 
 def _apply_cors_headers(response: HttpResponse, origin: str) -> None:

src/django_smartbase_admin/mcp/tests/test_cors_middleware.py

@@ -8,11 +8,21 @@
 
 from __future__ import annotations
 
+from django.conf import settings
 from django.http import HttpResponse
 from django.test import RequestFactory, SimpleTestCase, override_settings
 
 from django_smartbase_admin.mcp.middleware import SBAdminMCPCorsMiddleware
 
+if not settings.configured:
+    settings.configure(
+        DEFAULT_CHARSET="utf-8",
+        SECRET_KEY="test-secret-key",
+        DATABASES={
+            "default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}
+        },
+    )
+
 ORIGIN = "http://localhost:8010"
 
 
@@ -51,6 +61,19 @@ def test_mcp_rest_and_oauth_paths_are_decorated(self):
                 self._send(path, method="get")["Access-Control-Allow-Origin"], ORIGIN
             )
 
+    @override_settings(DJANGO_MCP_ENDPOINT="api/mcp/")
+    def test_configured_mcp_endpoint_is_used_for_cors(self):
+        resp = self._send("/api/mcp/rest/tools/list_rows/", preflight=True)
+
+        self.assertEqual(resp.status_code, 204)
+        self.assertEqual(resp["Access-Control-Allow-Origin"], ORIGIN)
+
+    @override_settings(DJANGO_MCP_ENDPOINT="api/mcp/")
+    def test_default_mcp_endpoint_is_not_decorated_when_endpoint_moves(self):
+        resp = self._send("/mcp/rest/tools/list_rows/", method="get")
+
+        self.assertNotIn("Access-Control-Allow-Origin", resp)
+
     def test_preflight_uses_default_allowed_headers(self):
         resp = self._send("/mcp/rest/tools/list_rows/", preflight=True)