enh: cors middleware & html fallback

core/server.py

@@ -10,6 +10,7 @@
 from starlette.types import Scope, Receive, Send
 from starlette.requests import Request
 from starlette.middleware import Middleware
+from starlette.middleware.cors import CORSMiddleware
 
 from fastmcp import FastMCP
 from fastmcp.server.auth.providers.google import GoogleProvider
@@ -40,6 +41,17 @@
 
 session_middleware = Middleware(MCPSessionMiddleware)
 
+# CORS middleware for OAuth endpoints - allows MCP Inspector and other browser clients
+# Note: allow_credentials=True is incompatible with allow_origins=["*"]
+# So we either allow credentials with specific origins, or allow all origins without credentials
+cors_middleware = Middleware(
+    CORSMiddleware,
+    allow_origins=["*"],  # Allow all origins for OAuth discovery
+    allow_credentials=False,  # Can't use credentials with wildcard origin
+    allow_methods=["GET", "POST", "OPTIONS"],
+    allow_headers=["*"],
+)
+
 
 class WellKnownCacheControlMiddleware:
     """Force no-cache headers for OAuth well-known discovery endpoints."""
@@ -89,15 +101,17 @@ def http_app(self, **kwargs) -> "Starlette":
         app = super().http_app(**kwargs)
 
         # Add middleware in order (first added = outermost layer)
-        app.user_middleware.insert(0, well_known_cache_control_middleware)
+        # CORS must be outermost to add headers to all responses
+        app.user_middleware.insert(0, cors_middleware)
+        app.user_middleware.insert(1, well_known_cache_control_middleware)
 
         # Session Management - extracts session info for MCP context
-        app.user_middleware.insert(1, session_middleware)
+        app.user_middleware.insert(2, session_middleware)
 
         # Rebuild middleware stack
         app.middleware_stack = app.build_middleware_stack()
         logger.info(
-            "Added middleware stack: WellKnownCacheControl, Session Management"
+            "Added middleware stack: CORS, WellKnownCacheControl, Session Management"
         )
         return app
 

gmail/gmail_tools.py

@@ -37,6 +37,19 @@
 GMAIL_REQUEST_DELAY = 0.1
 HTML_BODY_TRUNCATE_LIMIT = 20000
 GMAIL_METADATA_HEADERS = ["Subject", "From", "To", "Cc", "Message-ID", "Date"]
+LOW_VALUE_TEXT_PLACEHOLDERS = (
+    "your client does not support html",
+    "view this email in your browser",
+    "open this email in your browser",
+)
+LOW_VALUE_TEXT_FOOTER_MARKERS = (
+    "mailing list",
+    "mailman/listinfo",
+    "unsubscribe",
+    "list-unsubscribe",
+    "manage preferences",
+)
+LOW_VALUE_TEXT_HTML_DIFF_MIN = 80
 
 
 class _HTMLTextExtractor(HTMLParser):
@@ -154,16 +167,29 @@ def _format_body_content(text_body: str, html_body: str) -> str:
     """
     text_stripped = text_body.strip()
     html_stripped = html_body.strip()
+    html_text = _html_to_text(html_stripped).strip() if html_stripped else ""
+
+    plain_lower = " ".join(text_stripped.split()).lower()
+    html_lower = " ".join(html_text.split()).lower()
+    plain_is_low_value = plain_lower and (
+        any(marker in plain_lower for marker in LOW_VALUE_TEXT_PLACEHOLDERS)
+        or (
+            any(marker in plain_lower for marker in LOW_VALUE_TEXT_FOOTER_MARKERS)
+            and len(html_lower) >= len(plain_lower) + LOW_VALUE_TEXT_HTML_DIFF_MIN
+        )
+        or (
+            len(html_lower) >= len(plain_lower) + LOW_VALUE_TEXT_HTML_DIFF_MIN
+            and html_lower.endswith(plain_lower)
+        )
+    )
 
-    # Detect useless fallback: HTML comments in text, or HTML is 50x+ longer
-    use_html = html_stripped and (
-        not text_stripped
-        or "<!--" in text_stripped
-        or len(html_stripped) > len(text_stripped) * 50
+    # Prefer plain text, but fall back to HTML when plain text is empty or clearly low-value.
+    use_html = html_text and (
+        not text_stripped or "<!--" in text_stripped or plain_is_low_value
     )
 
     if use_html:
-        content = _html_to_text(html_stripped)
+        content = html_text
         if len(content) > HTML_BODY_TRUNCATE_LIMIT:
             content = content[:HTML_BODY_TRUNCATE_LIMIT] + "\n\n[Content truncated...]"
         return content

test_cors.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Quick test to verify CORS middleware is configured correctly."""
+
+import sys
+
+sys.path.insert(0, ".")
+
+# Set required env vars before importing
+import os
+
+os.environ["MCP_ENABLE_OAUTH21"] = "true"
+os.environ["WORKSPACE_MCP_STATELESS_MODE"] = "true"
+os.environ["GOOGLE_OAUTH_CLIENT_ID"] = "test"
+os.environ["GOOGLE_OAUTH_CLIENT_SECRET"] = "test"
+
+from core.server import server
+
+# Get the HTTP app
+app = server.http_app()
+
+# Check middleware stack
+print("Middleware stack:")
+for i, m in enumerate(app.user_middleware):
+    if hasattr(m, "cls"):
+        print(f"  {i}: {m.cls.__name__}")
+    else:
+        print(f"  {i}: {type(m).__name__}")
+
+print("\nChecking for CORSMiddleware...")
+has_cors = any(
+    hasattr(m, "cls") and m.cls.__name__ == "CORSMiddleware"
+    for m in app.user_middleware
+)
+print(f"CORS middleware found: {has_cors}")
+
+if has_cors:
+    print("✅ CORS middleware is configured!")
+else:
+    print("❌ CORS middleware is NOT configured!")
+    sys.exit(1)

tests/core/test_well_known_cache_control_middleware.py

@@ -51,7 +51,9 @@ async def regular_endpoint(request):
     assert "etag" not in extra.headers
 
 
-def test_configured_server_applies_no_cache_to_served_oauth_discovery_routes(monkeypatch):
+def test_configured_server_applies_no_cache_to_served_oauth_discovery_routes(
+    monkeypatch,
+):
     monkeypatch.setenv("MCP_ENABLE_OAUTH21", "true")
     monkeypatch.setenv("GOOGLE_OAUTH_CLIENT_ID", "dummy-client")
     monkeypatch.setenv("GOOGLE_OAUTH_CLIENT_SECRET", "dummy-secret")