Border

com.clawhard/borderVersion 1.0.0

Debug CORS: send the real preflight, get Chrome's exact error and the headers that fix it.

Status

Responds136 msNov 14, 2026, 13:51 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 13:51 UTC
Latency: 136 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://border.clawhard.com/mcpResponds136 msNov 14, 2026, 13:51 UTC

No sign-in

Claude Code

claude mcp add --transport http border https://border.clawhard.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: border
Remote MCP server URL: https://border.clawhard.com/mcp

Cursor

{
  "mcpServers": {
    "border": {
      "url": "https://border.clawhard.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"border","type":"http","url":"https://border.clawhard.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

2 tools

Tools of Border
	Description		Read-only	Idempotent	Open world
`border_check_cors`Use when the user hits a CORS error ("blocked by CORS policy", "No 'Access-Control-Allow-Origin' header", "preflight", "Failed to fetch" from a frontend) or is about to call a public API from browser code (React, Next.js, Vue, a browser extension page) and asks whether it will work (signals: "CORS", "works in Postman but not in the browser", "preflight 401/404", "Access-Control-Allow-Headers", "withCredentials", "credentials include"). Sends the browser's own preflight (OPTIONS with Origin, Access-Control-Request-Method and -Headers) to the live API and, for GET and HEAD, the request itself with the Origin header, then applies the Fetch standard CORS rules as Chrome implements them. Returns verdict (allowed, blocked, preflight_passed, incomplete, same_origin, unreachable), the exact Chrome console error, which step fails (preflight or response) and why, whether a preflight is needed and why, the CORS headers the server sent, warnings (missing Vary: Origin, a server that echoes any origin with credentials, unreadable response headers, Authorization covered only by *), the exact response headers that fix it, and curl commands to reproduce. Example: {"url":"https://api.example.com/v1/items","origin":"http://localhost:3000","method":"POST","headers":["Content-Type: application/json","Authorization"],"credentials":true}. Limits: public http/https APIs on ports 80 and 443 only (localhost, private and staging servers go through border_check_cors_headers with pasted curl output); never sends POST, PUT, PATCH or DELETE (those get the preflight checked only) and never sends header values for Authorization or keys; a server can answer differently to a real browser session.	Use when the user hits a CORS error ("blocked by CORS policy", "No 'Access-Control-Allow-Origin' header", "preflight", "Failed to fetch" from a frontend) or is about to call a public API from browser code (React, Next.js, Vue, a browser extension page) and asks whether it will work (signals: "CORS", "works in Postman but not in the browser", "preflight 401/404", "Access-Control-Allow-Headers", "withCredentials", "credentials include"). Sends the browser's own preflight (OPTIONS with Origin, Access-Control-Request-Method and -Headers) to the live API and, for GET and HEAD, the request itself with the Origin header, then applies the Fetch standard CORS rules as Chrome implements them. Returns verdict (allowed, blocked, preflight_passed, incomplete, same_origin, unreachable), the exact Chrome console error, which step fails (preflight or response) and why, whether a preflight is needed and why, the CORS headers the server sent, warnings (missing Vary: Origin, a server that echoes any origin with credentials, unreadable response headers, Authorization covered only by *), the exact response headers that fix it, and curl commands to reproduce. Example: {"url":"https://api.example.com/v1/items","origin":"http://localhost:3000","method":"POST","headers":["Content-Type: application/json","Authorization"],"credentials":true}. Limits: public http/https APIs on ports 80 and 443 only (localhost, private and staging servers go through border_check_cors_headers with pasted curl output); never sends POST, PUT, PATCH or DELETE (those get the preflight checked only) and never sends header values for Authorization or keys; a server can answer differently to a real browser session.	No	Yes	Yes	Yes
`border_check_cors_headers`Use when a CORS problem involves a server Border cannot reach (localhost, a dev or staging server, a private network, a custom port) or a POST, PUT, PATCH or DELETE whose real response needs checking, and the raw response headers are available from curl -i or the browser DevTools Network tab (signals: "here is the OPTIONS response", "my local API returns these headers", "CORS works on localhost but not in production", "preflight response is"). Parses the pasted OPTIONS response and/or the actual response (status line plus headers; curl -i, curl -v, curl -iL with redirects, and DevTools copies are all read) and applies the Fetch standard CORS rules as Chrome implements them, for the given page origin, method, request headers and credentials mode. Returns the same result as border_check_cors: verdict, the exact Chrome console error, the failing step and reason, warnings, the response headers that fix it, and the curl commands to capture any missing response. Nothing is fetched. Example: {"url":"http://localhost:8000/api/login","origin":"http://localhost:5173","method":"POST","headers":["Content-Type: application/json"],"credentials":true,"preflight_response":"HTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: content-type"}. Limits: the verdict is only as complete as the pasted headers; a preflighted request needs both pastes for a full answer.	Use when a CORS problem involves a server Border cannot reach (localhost, a dev or staging server, a private network, a custom port) or a POST, PUT, PATCH or DELETE whose real response needs checking, and the raw response headers are available from curl -i or the browser DevTools Network tab (signals: "here is the OPTIONS response", "my local API returns these headers", "CORS works on localhost but not in production", "preflight response is"). Parses the pasted OPTIONS response and/or the actual response (status line plus headers; curl -i, curl -v, curl -iL with redirects, and DevTools copies are all read) and applies the Fetch standard CORS rules as Chrome implements them, for the given page origin, method, request headers and credentials mode. Returns the same result as border_check_cors: verdict, the exact Chrome console error, the failing step and reason, warnings, the response headers that fix it, and the curl commands to capture any missing response. Nothing is fetched. Example: {"url":"http://localhost:8000/api/login","origin":"http://localhost:5173","method":"POST","headers":["Content-Type: application/json"],"credentials":true,"preflight_response":"HTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Headers: content-type"}. Limits: the verdict is only as complete as the pasted headers; a preflighted request needs both pastes for a full answer.	No	Yes	Yes	No

Details

Registry status: Active
Published: Nov 12, 2026
Updated: Nov 12, 2026
Website: https://border.clawhard.com/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): Developer tools Browser automationSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing