minia2a
A service provider that operates hosted MCP endpoints and local stdio packages, offering remote MCP endpoints that require no installation and no API key, along with corresponding npx local packages.
Timeline (last 90 days)
minia2a's CORS check test suite contains 17 cases, including negative assertion cases (such as a known-open entry now being allowed must fail, and a header that was once in the live list and later disappeared must fail).
The minia2a gateway team encountered CORS list omissions four times in production, on 2026-10-02, 2026-10-14, 2026-10-17, and 2026-10-18 respectively.
In the 2026-10-02 incident, the exposed list omitted PAYMENT-REQUIRED and PAYMENT-RESPONSE, so the browser client could receive the 402 but could not parse the acceptable payment terms.
In the 2026-10-14 incident, the request list omitted X-Payer-Signature, causing the preflight to fail before the 402 challenge could be retrieved.
In the 2026-10-18 incident, X-Minia2a-Refund was not in the exposed list, X-Agent-ID was not in the request list, and PUT was not in the method list, even though the route was registered.
minia2a's durable fix is to derive the CORS lists by grep-scanning the code, sorting every client-facing header name into one of four buckets—listed, same-origin only, non-client signal, or known open—and the check fails on any unclassified name.
When a browser-side agent initiates a paid call, if the preflight request fails due to a missing header name, no 402, 400, or timeout will appear in the server logs, because the request never left the browser.
The registry record JSON published by minia2a declares only the npm package and the stdio transport, with the remotes field set to null, causing downstream clients to be unable to discover its hosted endpoint.
minia2a's hosted transport is placed in a separate record that declares only remotes and contains no packages array, coexisting with its stdio package record.
After the fix, the MCP registry now returns two records under the minia2a namespace (a stdio package and a remote endpoint), whereas previously the directory showed only the local package.
2 more timeline events
All Facts (11)
minia2a's CORS check test suite contains 17 cases, including negative assertion cases (such as a known-open entry now being allowed must fail, and a header that was once in the live list and later disappeared must fail).
50%UnverifiedWhen a browser-side agent initiates a paid call, if the preflight request fails due to a missing header name, no 402, 400, or timeout will appear in the server logs, because the request never left the browser.
50%Unverifiedminia2a's durable fix is to derive the CORS lists by grep-scanning the code, sorting every client-facing header name into one of four buckets—listed, same-origin only, non-client signal, or known open—and the check fails on any unclassified name.
50%Unverifiedminia2a operates a hosted MCP endpoint at https://minia2a.uk/mcp, requiring no installation and no API key, and responding to initialize and tools/list requests over streamable HTTP.
50%Unverifiedminia2a's /.well-known/mcp.json carries the pointer {"type":"streamable-http","endpoint":"https://minia2a.uk/mcp"}, but registry clients read the registry record rather than this file.
50%UnverifiedThe minia2a gateway team encountered CORS list omissions four times in production, on 2026-10-02, 2026-10-14, 2026-10-17, and 2026-10-18 respectively.
50%UnverifiedIn the 2026-10-02 incident, the exposed list omitted PAYMENT-REQUIRED and PAYMENT-RESPONSE, so the browser client could receive the 402 but could not parse the acceptable payment terms.
50%UnverifiedIn the 2026-10-14 incident, the request list omitted X-Payer-Signature, causing the preflight to fail before the 402 challenge could be retrieved.
50%UnverifiedIn the 2026-10-18 incident, X-Minia2a-Refund was not in the exposed list, X-Agent-ID was not in the request list, and PUT was not in the method list, even though the route was registered.
50%Unverifiedminia2a's hosted transport is placed in a separate record that declares only remotes and contains no packages array, coexisting with its stdio package record.
50%UnverifiedThe registry record JSON published by minia2a declares only the npm package and the stdio transport, with the remotes field set to null, causing downstream clients to be unable to discover its hosted endpoint.
50%