Add documentation for CORS and browser client support in Streamable HTTP mode

Author: RossTarrant

docs/streamable-http.md

@@ -8,6 +8,7 @@ The Streamable HTTP mode enables the GitHub MCP Server to run as an HTTP service
 - **OAuth Metadata Endpoints** — Standard `.well-known/oauth-protected-resource` discovery for OAuth clients
 - **Scope Challenge Support** — Automatic scope validation with proper HTTP 403 responses and `WWW-Authenticate` headers
 - **Scope Filtering** — Restrict available tools based on authenticated credentials and permissions
+- **CORS & Browser Client Support** — Built-in CORS middleware and configurable cross-origin protection for browser-based MCP clients
 - **Custom Base Paths** — Support for reverse proxy deployments with customizable base URLs
 
 ## Running the Server
@@ -59,6 +60,36 @@ The OAuth protected resource metadata's `resource` attribute will be populated w
 
 This allows OAuth clients to discover authentication requirements and endpoint information automatically.
 
+## Cross-Origin & Browser Client Support
+
+The HTTP server includes built-in CORS middleware and cross-origin request handling to support browser-based MCP clients (e.g., web apps, MCP Inspector).
+
+### Default Behavior
+
+`RunHTTPServer` enables browser cross-origin support out of the box by wiring in two things:
+
+1. **CORS middleware** (`SetCorsHeaders`) — responds to preflight `OPTIONS` requests and sets `Access-Control-*` headers on all MCP endpoint responses
+2. **Cross-origin protection bypass** — bypasses the SDK's `Sec-Fetch-Site` rejection so cross-origin POST requests are allowed
+
+This is safe because the server authenticates exclusively via bearer tokens (`Authorization` header), which are not ambient credentials — a malicious cross-origin page cannot cause the browser to attach them automatically. Standard CSRF protection is therefore not required.
+
+> **Note:** CORS headers on MCP endpoints are provided by `SetCorsHeaders` middleware. OAuth metadata discovery routes (e.g., `/.well-known/oauth-protected-resource`) handle CORS independently.
+
+### Library / Custom Integrations
+
+If you embed the server as a library (using `ServerConfig` directly rather than `RunHTTPServer`), neither the CORS middleware nor the cross-origin bypass is applied automatically. To support browser clients, you must:
+
+1. Add `middleware.SetCorsHeaders` to your router
+2. Set the `CrossOriginProtection` field on `ServerConfig` with an appropriate bypass pattern
+
+The `CrossOriginProtection` options are:
+
+- **`nil`** — `RunHTTPServer` auto-bypasses (allows all origins); library consumers get the SDK default (reject cross-origin POSTs)
+- **Explicit bypass** — Create a `CrossOriginProtection` with `AddInsecureBypassPattern("/")` to allow all cross-origin requests
+- **SDK default** — Use `http.NewCrossOriginProtection()` without any bypass patterns to reject cross-origin POSTs
+
+The SDK default is appropriate when browser cross-origin clients are not required (e.g., native CLI clients only, or same-origin browser deployments where the client and server share the same origin).
+
 ## Client Configuration
 
 ### Using OAuth Authentication