mcp_origin_refused

Origin refused. Answered with 403.

What it means

The request carries an Origin header, and the MCP endpoint is deliberately not reachable from a web page.

What to do

Call it from a process, not a browser. An API key in a page is a key that has been published.

The body

{
  "type": "https://tigby.eu/problems/mcp_origin_refused",
  "title": "Origin refused",
  "status": 403,
  "detail": "…what was refused, naming this request's own values",
  "code": "mcp_origin_refused",
  "doc_url": "https://docs.tigby.eu/errors/mcp_origin_refused",
  "agent_hint": "…the next step, for software"
}

Branch on code. The detail names this request's own Handle, id or limit and is not part of the contract.