Merge pull request #23 from Beyond-Better/staging

added Content-Security-Policy headers to both response methods in DocsEndpointHandler.ts

Author: cngarrison

deno.jsonc

@@ -1,6 +1,6 @@
 {
   "name": "@beyondbetter/bb-mcp-server",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Comprehensive library for building Deno-based MCP servers",
   "license": "MIT",
   "copyright": "2025 - Beyond Better <charlie@beyondbetter.app>",

src/lib/server/DocsEndpointHandler.ts

@@ -640,6 +640,7 @@ export class DocsEndpointHandler {
       headers: {
         'Content-Type': 'text/html; charset=utf-8',
         'Cache-Control': 'public, max-age=3600',
+        'Content-Security-Policy': "default-src 'self'; style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; script-src 'self'; img-src 'self' data:; font-src 'self' data:;",
       },
     });
   }
@@ -671,6 +672,7 @@ export class DocsEndpointHandler {
       status,
       headers: {
         'Content-Type': 'text/html; charset=utf-8',
+        'Content-Security-Policy': "default-src 'self'; style-src 'self' https://cdn.jsdelivr.net 'unsafe-inline'; script-src 'self'; img-src 'self' data:; font-src 'self' data:;",
       },
     });
   }