Duplicate access-control-allow-origin in response header

[vran-dev]

I’m integrating the GitHub MCP into an Electron app using @modelcontextprotocol/sdk. When the transport type is set to http, the request triggers a CORS exception.

Happy holidays and thanks for the great work you do all year—really appreciate it!

Request log

Request URL: https://api.githubcopilot.com/mcp/
Request Method: POST
Status Code: 200 OK

access-control-allow-headers: Content-Type, Authorization, X-MCP-Readonly, X-MCP-Toolsets, Mcp-Session-Id
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-allow-origin: *
date:Fri, 26 Dec 2025 03:42:49 GMT
mcp-session-id:5187b67a-987f-4bcb-b1f2-bee4da140384
x-github-backend:Kubernetes
x-github-request-id:34FF:57BDD:69DD0:92447:694E0439

CURL reproduce