MCP Server Framework - v1.0.0
    Preparing search index...

    Interface ExpressAppOptions

    Options for Express application creation.

    interface ExpressAppOptions {
        auth?: AuthOptions;
        bodyLimit?: string;
        corsCredentials?: boolean;
        corsOrigin?: readonly string[];
        enableJsonResponse?: boolean;
        eventStore?: EventStore;
        health?: HealthConfig<ServiceClient>;
        helmetCsp?: string;
        helmetFrameOptions?: "DENY" | "SAMEORIGIN" | "false";
        helmetHsts?: boolean;
        stateless?: boolean;
        trustProxy?: string | number;
    }
    Index

    Properties

    auth? bodyLimit? corsCredentials? corsOrigin? enableJsonResponse? eventStore? health? helmetCsp? helmetFrameOptions? helmetHsts? stateless? trustProxy?

    Properties

    auth?: AuthOptions

    Authentication configuration. When provided, enables OAuth 2.1 endpoints and/or bearer token validation. Health and metrics endpoints remain unauthenticated for probe access.

    bodyLimit?: string

    Maximum request body size for express.json() middleware. Accepts Express size strings (e.g. '1mb', '500kb', '2mb').

    '1mb'
    corsCredentials?: boolean

    Allow credentials in CORS requests. Only effective when corsOrigin is set.

    corsOrigin?: readonly string[]

    CORS allowed origins.

    • undefined — CORS disabled (no Access-Control headers)
    • string[] — List of allowed origins (e.g. ['https://app.example.com'])
    • Use ['*'] to allow all origins (not recommended for production)
    enableJsonResponse?: boolean

    Prefer JSON responses over SSE for simple request-response. Default: true

    eventStore?: EventStore

    Event store for stream resumability (stateful only)

    health?: HealthConfig<ServiceClient>

    Health endpoint configuration for API connectivity monitoring

    helmetCsp?: string

    Content Security Policy.

    • undefined — Helmet default CSP
    • 'false' — Disable CSP
    • Custom string — CSP directives
    helmetFrameOptions?: "DENY" | "SAMEORIGIN" | "false"

    X-Frame-Options header.

    • 'DENY' — Never allow framing (default)
    • 'SAMEORIGIN' — Allow from same origin
    • 'false' — Disable X-Frame-Options
    helmetHsts?: boolean

    Enable HSTS header. Default: false (managed by reverse proxy)

    stateless?: boolean

    Operate in stateless mode (no session IDs). Default: false

    trustProxy?: string | number

    Resolved trust proxy value for Express.

    • number for hop count
    • string for IP/CIDR/keyword (possibly comma-separated)
    • undefined when disabled

    Settings

    Member Visibility

    On This Page

    Properties