From 07781cd681d58b04b3cac16f725216441b5a93fd Mon Sep 17 00:00:00 2001
From: ProgrammerIn-wonderland
 <30693865+ProgrammerIn-wonderland@users.noreply.github.com>
Date: Wed, 3 Jun 2026 17:48:37 -0400
Subject: [PATCH] allow overriding origin from workers.dev on mcp server
 (#3204)

---
 src/mcp-connector/src/oauth.js  | 9 ++++++++-
 src/mcp-connector/wrangler.toml | 3 ++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/mcp-connector/src/oauth.js b/src/mcp-connector/src/oauth.js
index 7cdfe3ac1..0e4c4aac9 100644
--- a/src/mcp-connector/src/oauth.js
+++ b/src/mcp-connector/src/oauth.js
@@ -29,7 +29,14 @@ const guiOrigin = () => globalThis.puter_gui_origin || DEFAULT_GUI_ORIGIN;
 const secretString = () =>
     globalThis.OAUTH_SECRET || 'puter-mcp-dev-insecure-secret-change-me';
 
-const originOf = (request) => new URL(request.url).origin;
+const originOf = (request) => {
+    let originalOrigin = new URL(request.url).origin;
+    if (originalOrigin.includes('workers.dev') && globalThis.OVERRIDE_ORIGIN) {
+        return globalThis.OVERRIDE_ORIGIN;
+    }
+    return originalOrigin;
+    
+};
 
 // ---- base64url + AES-GCM sealing ------------------------------------------
 
diff --git a/src/mcp-connector/wrangler.toml b/src/mcp-connector/wrangler.toml
index f629c1c48..2835820cc 100644
--- a/src/mcp-connector/wrangler.toml
+++ b/src/mcp-connector/wrangler.toml
@@ -16,7 +16,8 @@ no_bundle = true
 #   puter_endpoint   - Puter API origin for fs/subdomain calls (default https://api.puter.com)
 #   puter_gui_origin - Puter GUI origin for the OAuth "Sign in with Puter"
 #                      (authme) redirect (default https://puter.com)
-# [vars]
+[vars]
+# OVERRIDE_ORIGIN = "https://mcp.puter.com"
 # puter_endpoint = "https://api.puter.com"
 # puter_gui_origin = "https://puter.com"