From c5c4ee771b0ffa70a15c6ae4b5c273d7d62f7200 Mon Sep 17 00:00:00 2001
From: Max Isbey <224885523+maxisbey@users.noreply.github.com>
Date: Fri, 13 Mar 2026 10:47:27 +0000
Subject: [PATCH 1/4] docs(examples): add DNS rebinding protection to low-level
 transport examples
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The low-level example servers use SseServerTransport and
StreamableHTTPSessionManager directly, bypassing the auto-enable logic
in sse_app()/streamable_http_app() that was added in v1.23.0
(GHSA-9h52-p55h-vw2f).

Per the advisory guidance, low-level transport users should explicitly
configure TransportSecuritySettings. These examples now demonstrate the
correct pattern — the allowlist matches what the high-level API
auto-configures for localhost binds.

Github-Issue: #2269
---
 docs/experimental/tasks-server.md                        | 9 ++++++++-
 .../simple-pagination/mcp_simple_pagination/server.py    | 9 ++++++++-
 .../servers/simple-prompt/mcp_simple_prompt/server.py    | 9 ++++++++-
 .../simple-resource/mcp_simple_resource/server.py        | 9 ++++++++-
 .../mcp_simple_streamablehttp_stateless/server.py        | 5 +++++
 .../mcp_simple_streamablehttp/server.py                  | 5 +++++
 .../mcp_simple_task_interactive/server.py                | 9 ++++++++-
 examples/servers/simple-task/mcp_simple_task/server.py   | 9 ++++++++-
 examples/servers/simple-tool/mcp_simple_tool/server.py   | 9 ++++++++-
 .../sse-polling-demo/mcp_sse_polling_demo/server.py      | 5 +++++
 10 files changed, 71 insertions(+), 7 deletions(-)

diff --git a/docs/experimental/tasks-server.md b/docs/experimental/tasks-server.md
index 761dc5de5..46be22a1e 100644
--- a/docs/experimental/tasks-server.md
+++ b/docs/experimental/tasks-server.md
@@ -418,6 +418,7 @@ from starlette.routing import Mount
 from mcp.server import Server
 from mcp.server.experimental.task_context import ServerTaskContext
 from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
+from mcp.server.transport_security import TransportSecuritySettings
 from mcp.types import (
     CallToolResult, CreateTaskResult, TextContent, Tool, ToolExecution, TASK_REQUIRED,
 )
@@ -463,7 +464,13 @@ async def handle_tool(name: str, arguments: dict) -> CallToolResult | CreateTask
 
 
 def create_app():
-    session_manager = StreamableHTTPSessionManager(app=server)
+    session_manager = StreamableHTTPSessionManager(
+        app=server,
+        security_settings=TransportSecuritySettings(
+            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+        ),
+    )
 
     @asynccontextmanager
     async def lifespan(app: Starlette) -> AsyncIterator[None]:
diff --git a/examples/servers/simple-pagination/mcp_simple_pagination/server.py b/examples/servers/simple-pagination/mcp_simple_pagination/server.py
index bac27a0f1..c6794caeb 100644
--- a/examples/servers/simple-pagination/mcp_simple_pagination/server.py
+++ b/examples/servers/simple-pagination/mcp_simple_pagination/server.py
@@ -163,11 +163,18 @@ def main(port: int, transport: str) -> int:
 
     if transport == "sse":
         from mcp.server.sse import SseServerTransport
+        from mcp.server.transport_security import TransportSecuritySettings
         from starlette.applications import Starlette
         from starlette.responses import Response
         from starlette.routing import Mount, Route
 
-        sse = SseServerTransport("/messages/")
+        sse = SseServerTransport(
+            "/messages/",
+            security_settings=TransportSecuritySettings(
+                allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+                allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+            ),
+        )
 
         async def handle_sse(request: Request):
             async with sse.connect_sse(request.scope, request.receive, request._send) as streams:  # type: ignore[reportPrivateUsage]
diff --git a/examples/servers/simple-prompt/mcp_simple_prompt/server.py b/examples/servers/simple-prompt/mcp_simple_prompt/server.py
index 6cf99d4b6..1f964e43c 100644
--- a/examples/servers/simple-prompt/mcp_simple_prompt/server.py
+++ b/examples/servers/simple-prompt/mcp_simple_prompt/server.py
@@ -85,11 +85,18 @@ def main(port: int, transport: str) -> int:
 
     if transport == "sse":
         from mcp.server.sse import SseServerTransport
+        from mcp.server.transport_security import TransportSecuritySettings
         from starlette.applications import Starlette
         from starlette.responses import Response
         from starlette.routing import Mount, Route
 
-        sse = SseServerTransport("/messages/")
+        sse = SseServerTransport(
+            "/messages/",
+            security_settings=TransportSecuritySettings(
+                allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+                allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+            ),
+        )
 
         async def handle_sse(request: Request):
             async with sse.connect_sse(request.scope, request.receive, request._send) as streams:  # type: ignore[reportPrivateUsage]
diff --git a/examples/servers/simple-resource/mcp_simple_resource/server.py b/examples/servers/simple-resource/mcp_simple_resource/server.py
index b9b6a1d96..9cc15a589 100644
--- a/examples/servers/simple-resource/mcp_simple_resource/server.py
+++ b/examples/servers/simple-resource/mcp_simple_resource/server.py
@@ -78,11 +78,18 @@ def main(port: int, transport: str) -> int:
 
     if transport == "sse":
         from mcp.server.sse import SseServerTransport
+        from mcp.server.transport_security import TransportSecuritySettings
         from starlette.applications import Starlette
         from starlette.responses import Response
         from starlette.routing import Mount, Route
 
-        sse = SseServerTransport("/messages/")
+        sse = SseServerTransport(
+            "/messages/",
+            security_settings=TransportSecuritySettings(
+                allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+                allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+            ),
+        )
 
         async def handle_sse(request: Request):
             async with sse.connect_sse(request.scope, request.receive, request._send) as streams:  # type: ignore[reportPrivateUsage]
diff --git a/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py b/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
index cb4a6503c..c1a53d0fc 100644
--- a/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
+++ b/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
@@ -8,6 +8,7 @@
 from mcp import types
 from mcp.server import Server, ServerRequestContext
 from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
+from mcp.server.transport_security import TransportSecuritySettings
 from starlette.applications import Starlette
 from starlette.middleware.cors import CORSMiddleware
 from starlette.routing import Mount
@@ -110,6 +111,10 @@ def main(
         event_store=None,
         json_response=json_response,
         stateless=True,
+        security_settings=TransportSecuritySettings(
+            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+        ),
     )
 
     async def handle_streamable_http(scope: Scope, receive: Receive, send: Send) -> None:
diff --git a/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py b/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
index 2f2a53b1b..48ad2ef50 100644
--- a/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
+++ b/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
@@ -7,6 +7,7 @@
 from mcp import types
 from mcp.server import Server, ServerRequestContext
 from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
+from mcp.server.transport_security import TransportSecuritySettings
 from starlette.applications import Starlette
 from starlette.middleware.cors import CORSMiddleware
 from starlette.routing import Mount
@@ -132,6 +133,10 @@ def main(
         app=app,
         event_store=event_store,  # Enable resumability
         json_response=json_response,
+        security_settings=TransportSecuritySettings(
+            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+        ),
     )
 
     # ASGI handler for streamable HTTP connections
diff --git a/examples/servers/simple-task-interactive/mcp_simple_task_interactive/server.py b/examples/servers/simple-task-interactive/mcp_simple_task_interactive/server.py
index 6938b6552..eba4532f2 100644
--- a/examples/servers/simple-task-interactive/mcp_simple_task_interactive/server.py
+++ b/examples/servers/simple-task-interactive/mcp_simple_task_interactive/server.py
@@ -16,6 +16,7 @@
 from mcp.server import Server, ServerRequestContext
 from mcp.server.experimental.task_context import ServerTaskContext
 from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
+from mcp.server.transport_security import TransportSecuritySettings
 from starlette.applications import Starlette
 from starlette.routing import Mount
 
@@ -149,7 +150,13 @@ async def app_lifespan(app: Starlette) -> AsyncIterator[None]:
 @click.command()
 @click.option("--port", default=8000, help="Port to listen on")
 def main(port: int) -> int:
-    session_manager = StreamableHTTPSessionManager(app=server)
+    session_manager = StreamableHTTPSessionManager(
+        app=server,
+        security_settings=TransportSecuritySettings(
+            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+        ),
+    )
     starlette_app = create_app(session_manager)
     print(f"Starting server on http://localhost:{port}/mcp")
     uvicorn.run(starlette_app, host="127.0.0.1", port=port)
diff --git a/examples/servers/simple-task/mcp_simple_task/server.py b/examples/servers/simple-task/mcp_simple_task/server.py
index 50ae3ca9a..7b91bff53 100644
--- a/examples/servers/simple-task/mcp_simple_task/server.py
+++ b/examples/servers/simple-task/mcp_simple_task/server.py
@@ -10,6 +10,7 @@
 from mcp.server import Server, ServerRequestContext
 from mcp.server.experimental.task_context import ServerTaskContext
 from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
+from mcp.server.transport_security import TransportSecuritySettings
 from starlette.applications import Starlette
 from starlette.routing import Mount
 
@@ -69,7 +70,13 @@ async def work(task: ServerTaskContext) -> types.CallToolResult:
 @click.command()
 @click.option("--port", default=8000, help="Port to listen on")
 def main(port: int) -> int:
-    session_manager = StreamableHTTPSessionManager(app=server)
+    session_manager = StreamableHTTPSessionManager(
+        app=server,
+        security_settings=TransportSecuritySettings(
+            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+        ),
+    )
 
     @asynccontextmanager
     async def app_lifespan(app: Starlette) -> AsyncIterator[None]:
diff --git a/examples/servers/simple-tool/mcp_simple_tool/server.py b/examples/servers/simple-tool/mcp_simple_tool/server.py
index 9fe71e5b7..6bf9a9247 100644
--- a/examples/servers/simple-tool/mcp_simple_tool/server.py
+++ b/examples/servers/simple-tool/mcp_simple_tool/server.py
@@ -67,11 +67,18 @@ def main(port: int, transport: str) -> int:
 
     if transport == "sse":
         from mcp.server.sse import SseServerTransport
+        from mcp.server.transport_security import TransportSecuritySettings
         from starlette.applications import Starlette
         from starlette.responses import Response
         from starlette.routing import Mount, Route
 
-        sse = SseServerTransport("/messages/")
+        sse = SseServerTransport(
+            "/messages/",
+            security_settings=TransportSecuritySettings(
+                allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+                allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+            ),
+        )
 
         async def handle_sse(request: Request):
             async with sse.connect_sse(request.scope, request.receive, request._send) as streams:  # type: ignore[reportPrivateUsage]
diff --git a/examples/servers/sse-polling-demo/mcp_sse_polling_demo/server.py b/examples/servers/sse-polling-demo/mcp_sse_polling_demo/server.py
index c8178c35a..43deb6b6e 100644
--- a/examples/servers/sse-polling-demo/mcp_sse_polling_demo/server.py
+++ b/examples/servers/sse-polling-demo/mcp_sse_polling_demo/server.py
@@ -21,6 +21,7 @@
 from mcp import types
 from mcp.server import Server, ServerRequestContext
 from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
+from mcp.server.transport_security import TransportSecuritySettings
 from starlette.applications import Starlette
 from starlette.routing import Mount
 from starlette.types import Receive, Scope, Send
@@ -157,6 +158,10 @@ def main(port: int, log_level: str, retry_interval: int) -> int:
         app=app,
         event_store=event_store,
         retry_interval=retry_interval,
+        security_settings=TransportSecuritySettings(
+            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
+            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+        ),
     )
 
     async def handle_streamable_http(scope: Scope, receive: Receive, send: Send) -> None:

From 2ea2b19800e81a993744645d68cd63f17e700d71 Mon Sep 17 00:00:00 2001
From: Max Isbey <224885523+maxisbey@users.noreply.github.com>
Date: Fri, 13 Mar 2026 11:39:24 +0000
Subject: [PATCH 2/4] refactor(examples): migrate task/polling examples to
 streamable_http_app()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

simple-task, simple-task-interactive, and sse-polling-demo demonstrate
tasks and SSE polling — transport wiring is incidental. Migrate them to
Server.streamable_http_app(), which handles session manager creation,
lifespan, routing, and DNS rebinding auto-enable in one call.

simple-streamablehttp and simple-streamablehttp-stateless stay on the
low-level API since demonstrating manual StreamableHTTPSessionManager
wiring is their purpose.
---
 .../mcp_simple_task_interactive/server.py     | 27 +-----------
 .../simple-task/mcp_simple_task/server.py     | 25 +----------
 .../mcp_sse_polling_demo/server.py            | 43 +++----------------
 3 files changed, 7 insertions(+), 88 deletions(-)

diff --git a/examples/servers/simple-task-interactive/mcp_simple_task_interactive/server.py b/examples/servers/simple-task-interactive/mcp_simple_task_interactive/server.py
index eba4532f2..bc06e1208 100644
--- a/examples/servers/simple-task-interactive/mcp_simple_task_interactive/server.py
+++ b/examples/servers/simple-task-interactive/mcp_simple_task_interactive/server.py
@@ -6,8 +6,6 @@
 - ServerTaskContext.elicit() and ServerTaskContext.create_message() queue requests properly
 """
 
-from collections.abc import AsyncIterator
-from contextlib import asynccontextmanager
 from typing import Any
 
 import click
@@ -15,10 +13,6 @@
 from mcp import types
 from mcp.server import Server, ServerRequestContext
 from mcp.server.experimental.task_context import ServerTaskContext
-from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
-from mcp.server.transport_security import TransportSecuritySettings
-from starlette.applications import Starlette
-from starlette.routing import Mount
 
 
 async def handle_list_tools(
@@ -135,29 +129,10 @@ async def handle_call_tool(
 server.experimental.enable_tasks()
 
 
-def create_app(session_manager: StreamableHTTPSessionManager) -> Starlette:
-    @asynccontextmanager
-    async def app_lifespan(app: Starlette) -> AsyncIterator[None]:
-        async with session_manager.run():
-            yield
-
-    return Starlette(
-        routes=[Mount("/mcp", app=session_manager.handle_request)],
-        lifespan=app_lifespan,
-    )
-
-
 @click.command()
 @click.option("--port", default=8000, help="Port to listen on")
 def main(port: int) -> int:
-    session_manager = StreamableHTTPSessionManager(
-        app=server,
-        security_settings=TransportSecuritySettings(
-            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-        ),
-    )
-    starlette_app = create_app(session_manager)
+    starlette_app = server.streamable_http_app()
     print(f"Starting server on http://localhost:{port}/mcp")
     uvicorn.run(starlette_app, host="127.0.0.1", port=port)
     return 0
diff --git a/examples/servers/simple-task/mcp_simple_task/server.py b/examples/servers/simple-task/mcp_simple_task/server.py
index 7b91bff53..7583cd8f0 100644
--- a/examples/servers/simple-task/mcp_simple_task/server.py
+++ b/examples/servers/simple-task/mcp_simple_task/server.py
@@ -1,18 +1,11 @@
 """Simple task server demonstrating MCP tasks over streamable HTTP."""
 
-from collections.abc import AsyncIterator
-from contextlib import asynccontextmanager
-
 import anyio
 import click
 import uvicorn
 from mcp import types
 from mcp.server import Server, ServerRequestContext
 from mcp.server.experimental.task_context import ServerTaskContext
-from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
-from mcp.server.transport_security import TransportSecuritySettings
-from starlette.applications import Starlette
-from starlette.routing import Mount
 
 
 async def handle_list_tools(
@@ -70,23 +63,7 @@ async def work(task: ServerTaskContext) -> types.CallToolResult:
 @click.command()
 @click.option("--port", default=8000, help="Port to listen on")
 def main(port: int) -> int:
-    session_manager = StreamableHTTPSessionManager(
-        app=server,
-        security_settings=TransportSecuritySettings(
-            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-        ),
-    )
-
-    @asynccontextmanager
-    async def app_lifespan(app: Starlette) -> AsyncIterator[None]:
-        async with session_manager.run():
-            yield
-
-    starlette_app = Starlette(
-        routes=[Mount("/mcp", app=session_manager.handle_request)],
-        lifespan=app_lifespan,
-    )
+    starlette_app = server.streamable_http_app()
 
     print(f"Starting server on http://localhost:{port}/mcp")
     uvicorn.run(starlette_app, host="127.0.0.1", port=port)
diff --git a/examples/servers/sse-polling-demo/mcp_sse_polling_demo/server.py b/examples/servers/sse-polling-demo/mcp_sse_polling_demo/server.py
index 43deb6b6e..14bc174c4 100644
--- a/examples/servers/sse-polling-demo/mcp_sse_polling_demo/server.py
+++ b/examples/servers/sse-polling-demo/mcp_sse_polling_demo/server.py
@@ -12,19 +12,13 @@
     uv run mcp-sse-polling-demo --port 3000
 """
 
-import contextlib
 import logging
-from collections.abc import AsyncIterator
 
 import anyio
 import click
+import uvicorn
 from mcp import types
 from mcp.server import Server, ServerRequestContext
-from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
-from mcp.server.transport_security import TransportSecuritySettings
-from starlette.applications import Starlette
-from starlette.routing import Mount
-from starlette.types import Receive, Scope, Send
 
 from .event_store import InMemoryEventStore
 
@@ -150,41 +144,14 @@ def main(port: int, log_level: str, retry_interval: int) -> int:
         on_call_tool=handle_call_tool,
     )
 
-    # Create event store for resumability
-    event_store = InMemoryEventStore()
-
-    # Create session manager with event store and retry interval
-    session_manager = StreamableHTTPSessionManager(
-        app=app,
-        event_store=event_store,
+    starlette_app = app.streamable_http_app(
+        event_store=InMemoryEventStore(),
         retry_interval=retry_interval,
-        security_settings=TransportSecuritySettings(
-            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-        ),
-    )
-
-    async def handle_streamable_http(scope: Scope, receive: Receive, send: Send) -> None:
-        await session_manager.handle_request(scope, receive, send)
-
-    @contextlib.asynccontextmanager
-    async def lifespan(starlette_app: Starlette) -> AsyncIterator[None]:
-        async with session_manager.run():
-            logger.info(f"SSE Polling Demo server started on port {port}")
-            logger.info("Try: POST /mcp with tools/call for 'process_batch'")
-            yield
-            logger.info("Server shutting down...")
-
-    starlette_app = Starlette(
         debug=True,
-        routes=[
-            Mount("/mcp", app=handle_streamable_http),
-        ],
-        lifespan=lifespan,
     )
 
-    import uvicorn
-
+    logger.info(f"SSE Polling Demo server starting on port {port}")
+    logger.info("Try: POST /mcp with tools/call for 'process_batch'")
     uvicorn.run(starlette_app, host="127.0.0.1", port=port)
     return 0
 

From 8bcf9e97dc1603614da77767c9fd4d5c5ff12b51 Mon Sep 17 00:00:00 2001
From: Max Isbey <224885523+maxisbey@users.noreply.github.com>
Date: Fri, 13 Mar 2026 13:54:08 +0000
Subject: [PATCH 3/4] refactor(examples): migrate all HTTP examples to
 streamable_http_app()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per review from pcarleton on #2291:

- simple-streamablehttp, simple-streamablehttp-stateless: use
  app.streamable_http_app() with CORS wrapped around the returned
  Starlette app. Removes manual StreamableHTTPSessionManager wiring.

- simple-tool, simple-prompt, simple-resource, simple-pagination:
  replace --transport sse (legacy) with --transport streamable-http
  using app.streamable_http_app(). READMEs updated to match.

- docs/experimental/tasks-server.md: use server.streamable_http_app()
  instead of manual wiring.

All 9 examples now get DNS rebinding protection via the auto-enable in
streamable_http_app() — zero explicit TransportSecuritySettings needed.
Verified live: 45/45 probes pass (421 for bad Host, 403 for bad Origin).
---
 docs/experimental/tasks-server.md             | 29 +------------
 examples/servers/simple-pagination/README.md  |  6 +--
 .../mcp_simple_pagination/server.py           | 36 ++--------------
 examples/servers/simple-prompt/README.md      |  6 +--
 .../simple-prompt/mcp_simple_prompt/server.py | 36 ++--------------
 examples/servers/simple-resource/README.md    |  6 +--
 .../mcp_simple_resource/server.py             | 36 ++--------------
 .../server.py                                 | 37 +---------------
 .../mcp_simple_streamablehttp/server.py       | 42 ++-----------------
 examples/servers/simple-tool/README.md        |  6 +--
 .../simple-tool/mcp_simple_tool/server.py     | 36 ++--------------
 11 files changed, 34 insertions(+), 242 deletions(-)

diff --git a/docs/experimental/tasks-server.md b/docs/experimental/tasks-server.md
index 46be22a1e..b350ee3bb 100644
--- a/docs/experimental/tasks-server.md
+++ b/docs/experimental/tasks-server.md
@@ -408,17 +408,10 @@ For custom error messages, call `task.fail()` before raising.
 For web applications, use the Streamable HTTP transport:
 
 ```python
-from collections.abc import AsyncIterator
-from contextlib import asynccontextmanager
-
 import uvicorn
-from starlette.applications import Starlette
-from starlette.routing import Mount
 
 from mcp.server import Server
 from mcp.server.experimental.task_context import ServerTaskContext
-from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
-from mcp.server.transport_security import TransportSecuritySettings
 from mcp.types import (
     CallToolResult, CreateTaskResult, TextContent, Tool, ToolExecution, TASK_REQUIRED,
 )
@@ -463,28 +456,8 @@ async def handle_tool(name: str, arguments: dict) -> CallToolResult | CreateTask
     return CallToolResult(content=[TextContent(type="text", text=f"Unknown: {name}")], isError=True)
 
 
-def create_app():
-    session_manager = StreamableHTTPSessionManager(
-        app=server,
-        security_settings=TransportSecuritySettings(
-            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-        ),
-    )
-
-    @asynccontextmanager
-    async def lifespan(app: Starlette) -> AsyncIterator[None]:
-        async with session_manager.run():
-            yield
-
-    return Starlette(
-        routes=[Mount("/mcp", app=session_manager.handle_request)],
-        lifespan=lifespan,
-    )
-
-
 if __name__ == "__main__":
-    uvicorn.run(create_app(), host="127.0.0.1", port=8000)
+    uvicorn.run(server.streamable_http_app(), host="127.0.0.1", port=8000)
 ```
 
 ## Testing Task Servers
diff --git a/examples/servers/simple-pagination/README.md b/examples/servers/simple-pagination/README.md
index e732b8efb..4cab40fd3 100644
--- a/examples/servers/simple-pagination/README.md
+++ b/examples/servers/simple-pagination/README.md
@@ -4,14 +4,14 @@ A simple MCP server demonstrating pagination for tools, resources, and prompts u
 
 ## Usage
 
-Start the server using either stdio (default) or SSE transport:
+Start the server using either stdio (default) or Streamable HTTP transport:
 
 ```bash
 # Using stdio transport (default)
 uv run mcp-simple-pagination
 
-# Using SSE transport on custom port
-uv run mcp-simple-pagination --transport sse --port 8000
+# Using Streamable HTTP transport on custom port
+uv run mcp-simple-pagination --transport streamable-http --port 8000
 ```
 
 The server exposes:
diff --git a/examples/servers/simple-pagination/mcp_simple_pagination/server.py b/examples/servers/simple-pagination/mcp_simple_pagination/server.py
index c6794caeb..c94f2ac3d 100644
--- a/examples/servers/simple-pagination/mcp_simple_pagination/server.py
+++ b/examples/servers/simple-pagination/mcp_simple_pagination/server.py
@@ -10,7 +10,6 @@
 import click
 from mcp import types
 from mcp.server import Server, ServerRequestContext
-from starlette.requests import Request
 
 T = TypeVar("T")
 
@@ -143,10 +142,10 @@ async def handle_get_prompt(ctx: ServerRequestContext, params: types.GetPromptRe
 
 
 @click.command()
-@click.option("--port", default=8000, help="Port to listen on for SSE")
+@click.option("--port", default=8000, help="Port to listen on for HTTP")
 @click.option(
     "--transport",
-    type=click.Choice(["stdio", "sse"]),
+    type=click.Choice(["stdio", "streamable-http"]),
     default="stdio",
     help="Transport type",
 )
@@ -161,37 +160,10 @@ def main(port: int, transport: str) -> int:
         on_get_prompt=handle_get_prompt,
     )
 
-    if transport == "sse":
-        from mcp.server.sse import SseServerTransport
-        from mcp.server.transport_security import TransportSecuritySettings
-        from starlette.applications import Starlette
-        from starlette.responses import Response
-        from starlette.routing import Mount, Route
-
-        sse = SseServerTransport(
-            "/messages/",
-            security_settings=TransportSecuritySettings(
-                allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-                allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-            ),
-        )
-
-        async def handle_sse(request: Request):
-            async with sse.connect_sse(request.scope, request.receive, request._send) as streams:  # type: ignore[reportPrivateUsage]
-                await app.run(streams[0], streams[1], app.create_initialization_options())
-            return Response()
-
-        starlette_app = Starlette(
-            debug=True,
-            routes=[
-                Route("/sse", endpoint=handle_sse, methods=["GET"]),
-                Mount("/messages/", app=sse.handle_post_message),
-            ],
-        )
-
+    if transport == "streamable-http":
         import uvicorn
 
-        uvicorn.run(starlette_app, host="127.0.0.1", port=port)
+        uvicorn.run(app.streamable_http_app(), host="127.0.0.1", port=port)
     else:
         from mcp.server.stdio import stdio_server
 
diff --git a/examples/servers/simple-prompt/README.md b/examples/servers/simple-prompt/README.md
index 48e796e19..c837da876 100644
--- a/examples/servers/simple-prompt/README.md
+++ b/examples/servers/simple-prompt/README.md
@@ -4,14 +4,14 @@ A simple MCP server that exposes a customizable prompt template with optional co
 
 ## Usage
 
-Start the server using either stdio (default) or SSE transport:
+Start the server using either stdio (default) or Streamable HTTP transport:
 
 ```bash
 # Using stdio transport (default)
 uv run mcp-simple-prompt
 
-# Using SSE transport on custom port
-uv run mcp-simple-prompt --transport sse --port 8000
+# Using Streamable HTTP transport on custom port
+uv run mcp-simple-prompt --transport streamable-http --port 8000
 ```
 
 The server exposes a prompt named "simple" that accepts two optional arguments:
diff --git a/examples/servers/simple-prompt/mcp_simple_prompt/server.py b/examples/servers/simple-prompt/mcp_simple_prompt/server.py
index 1f964e43c..74b71b3f3 100644
--- a/examples/servers/simple-prompt/mcp_simple_prompt/server.py
+++ b/examples/servers/simple-prompt/mcp_simple_prompt/server.py
@@ -2,7 +2,6 @@
 import click
 from mcp import types
 from mcp.server import Server, ServerRequestContext
-from starlette.requests import Request
 
 
 def create_messages(context: str | None = None, topic: str | None = None) -> list[types.PromptMessage]:
@@ -69,10 +68,10 @@ async def handle_get_prompt(ctx: ServerRequestContext, params: types.GetPromptRe
 
 
 @click.command()
-@click.option("--port", default=8000, help="Port to listen on for SSE")
+@click.option("--port", default=8000, help="Port to listen on for HTTP")
 @click.option(
     "--transport",
-    type=click.Choice(["stdio", "sse"]),
+    type=click.Choice(["stdio", "streamable-http"]),
     default="stdio",
     help="Transport type",
 )
@@ -83,37 +82,10 @@ def main(port: int, transport: str) -> int:
         on_get_prompt=handle_get_prompt,
     )
 
-    if transport == "sse":
-        from mcp.server.sse import SseServerTransport
-        from mcp.server.transport_security import TransportSecuritySettings
-        from starlette.applications import Starlette
-        from starlette.responses import Response
-        from starlette.routing import Mount, Route
-
-        sse = SseServerTransport(
-            "/messages/",
-            security_settings=TransportSecuritySettings(
-                allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-                allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-            ),
-        )
-
-        async def handle_sse(request: Request):
-            async with sse.connect_sse(request.scope, request.receive, request._send) as streams:  # type: ignore[reportPrivateUsage]
-                await app.run(streams[0], streams[1], app.create_initialization_options())
-            return Response()
-
-        starlette_app = Starlette(
-            debug=True,
-            routes=[
-                Route("/sse", endpoint=handle_sse),
-                Mount("/messages/", app=sse.handle_post_message),
-            ],
-        )
-
+    if transport == "streamable-http":
         import uvicorn
 
-        uvicorn.run(starlette_app, host="127.0.0.1", port=port)
+        uvicorn.run(app.streamable_http_app(), host="127.0.0.1", port=port)
     else:
         from mcp.server.stdio import stdio_server
 
diff --git a/examples/servers/simple-resource/README.md b/examples/servers/simple-resource/README.md
index df674e91e..7fb2ab7cd 100644
--- a/examples/servers/simple-resource/README.md
+++ b/examples/servers/simple-resource/README.md
@@ -4,14 +4,14 @@ A simple MCP server that exposes sample text files as resources.
 
 ## Usage
 
-Start the server using either stdio (default) or SSE transport:
+Start the server using either stdio (default) or Streamable HTTP transport:
 
 ```bash
 # Using stdio transport (default)
 uv run mcp-simple-resource
 
-# Using SSE transport on custom port
-uv run mcp-simple-resource --transport sse --port 8000
+# Using Streamable HTTP transport on custom port
+uv run mcp-simple-resource --transport streamable-http --port 8000
 ```
 
 The server exposes some basic text file resources that can be read by clients.
diff --git a/examples/servers/simple-resource/mcp_simple_resource/server.py b/examples/servers/simple-resource/mcp_simple_resource/server.py
index 9cc15a589..8d1105414 100644
--- a/examples/servers/simple-resource/mcp_simple_resource/server.py
+++ b/examples/servers/simple-resource/mcp_simple_resource/server.py
@@ -4,7 +4,6 @@
 import click
 from mcp import types
 from mcp.server import Server, ServerRequestContext
-from starlette.requests import Request
 
 SAMPLE_RESOURCES = {
     "greeting": {
@@ -62,10 +61,10 @@ async def handle_read_resource(
 
 
 @click.command()
-@click.option("--port", default=8000, help="Port to listen on for SSE")
+@click.option("--port", default=8000, help="Port to listen on for HTTP")
 @click.option(
     "--transport",
-    type=click.Choice(["stdio", "sse"]),
+    type=click.Choice(["stdio", "streamable-http"]),
     default="stdio",
     help="Transport type",
 )
@@ -76,37 +75,10 @@ def main(port: int, transport: str) -> int:
         on_read_resource=handle_read_resource,
     )
 
-    if transport == "sse":
-        from mcp.server.sse import SseServerTransport
-        from mcp.server.transport_security import TransportSecuritySettings
-        from starlette.applications import Starlette
-        from starlette.responses import Response
-        from starlette.routing import Mount, Route
-
-        sse = SseServerTransport(
-            "/messages/",
-            security_settings=TransportSecuritySettings(
-                allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-                allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-            ),
-        )
-
-        async def handle_sse(request: Request):
-            async with sse.connect_sse(request.scope, request.receive, request._send) as streams:  # type: ignore[reportPrivateUsage]
-                await app.run(streams[0], streams[1], app.create_initialization_options())
-            return Response()
-
-        starlette_app = Starlette(
-            debug=True,
-            routes=[
-                Route("/sse", endpoint=handle_sse, methods=["GET"]),
-                Mount("/messages/", app=sse.handle_post_message),
-            ],
-        )
-
+    if transport == "streamable-http":
         import uvicorn
 
-        uvicorn.run(starlette_app, host="127.0.0.1", port=port)
+        uvicorn.run(app.streamable_http_app(), host="127.0.0.1", port=port)
     else:
         from mcp.server.stdio import stdio_server
 
diff --git a/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py b/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
index c1a53d0fc..c8adc96b4 100644
--- a/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
+++ b/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
@@ -1,18 +1,11 @@
-import contextlib
 import logging
-from collections.abc import AsyncIterator
 
 import anyio
 import click
 import uvicorn
 from mcp import types
 from mcp.server import Server, ServerRequestContext
-from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
-from mcp.server.transport_security import TransportSecuritySettings
-from starlette.applications import Starlette
 from starlette.middleware.cors import CORSMiddleware
-from starlette.routing import Mount
-from starlette.types import Receive, Scope, Send
 
 logger = logging.getLogger(__name__)
 
@@ -105,36 +98,10 @@ def main(
         on_call_tool=handle_call_tool,
     )
 
-    # Create the session manager with true stateless mode
-    session_manager = StreamableHTTPSessionManager(
-        app=app,
-        event_store=None,
+    starlette_app = app.streamable_http_app(
+        stateless_http=True,
         json_response=json_response,
-        stateless=True,
-        security_settings=TransportSecuritySettings(
-            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-        ),
-    )
-
-    async def handle_streamable_http(scope: Scope, receive: Receive, send: Send) -> None:
-        await session_manager.handle_request(scope, receive, send)
-
-    @contextlib.asynccontextmanager
-    async def lifespan(app: Starlette) -> AsyncIterator[None]:
-        """Context manager for session manager."""
-        async with session_manager.run():
-            logger.info("Application started with StreamableHTTP session manager!")
-            try:
-                yield
-            finally:
-                logger.info("Application shutting down...")
-
-    # Create an ASGI application using the transport
-    starlette_app = Starlette(
         debug=True,
-        routes=[Mount("/mcp", app=handle_streamable_http)],
-        lifespan=lifespan,
     )
 
     # Wrap ASGI application with CORS middleware to expose Mcp-Session-Id header
diff --git a/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py b/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
index 48ad2ef50..4cd75c94c 100644
--- a/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
+++ b/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
@@ -1,17 +1,11 @@
-import contextlib
 import logging
-from collections.abc import AsyncIterator
 
 import anyio
 import click
+import uvicorn
 from mcp import types
 from mcp.server import Server, ServerRequestContext
-from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
-from mcp.server.transport_security import TransportSecuritySettings
-from starlette.applications import Starlette
 from starlette.middleware.cors import CORSMiddleware
-from starlette.routing import Mount
-from starlette.types import Receive, Scope, Send
 
 from .event_store import InMemoryEventStore
 
@@ -128,38 +122,10 @@ def main(
     # For production, use a persistent storage solution.
     event_store = InMemoryEventStore()
 
-    # Create the session manager with our app and event store
-    session_manager = StreamableHTTPSessionManager(
-        app=app,
-        event_store=event_store,  # Enable resumability
+    starlette_app = app.streamable_http_app(
+        event_store=event_store,
         json_response=json_response,
-        security_settings=TransportSecuritySettings(
-            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-            allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-        ),
-    )
-
-    # ASGI handler for streamable HTTP connections
-    async def handle_streamable_http(scope: Scope, receive: Receive, send: Send) -> None:
-        await session_manager.handle_request(scope, receive, send)
-
-    @contextlib.asynccontextmanager
-    async def lifespan(app: Starlette) -> AsyncIterator[None]:
-        """Context manager for managing session manager lifecycle."""
-        async with session_manager.run():
-            logger.info("Application started with StreamableHTTP session manager!")
-            try:
-                yield
-            finally:
-                logger.info("Application shutting down...")
-
-    # Create an ASGI application using the transport
-    starlette_app = Starlette(
         debug=True,
-        routes=[
-            Mount("/mcp", app=handle_streamable_http),
-        ],
-        lifespan=lifespan,
     )
 
     # Wrap ASGI application with CORS middleware to expose Mcp-Session-Id header
@@ -171,8 +137,6 @@ async def lifespan(app: Starlette) -> AsyncIterator[None]:
         expose_headers=["Mcp-Session-Id"],
     )
 
-    import uvicorn
-
     uvicorn.run(starlette_app, host="127.0.0.1", port=port)
 
     return 0
diff --git a/examples/servers/simple-tool/README.md b/examples/servers/simple-tool/README.md
index 06020b4b0..7d3759f9d 100644
--- a/examples/servers/simple-tool/README.md
+++ b/examples/servers/simple-tool/README.md
@@ -3,14 +3,14 @@ A simple MCP server that exposes a website fetching tool.
 
 ## Usage
 
-Start the server using either stdio (default) or SSE transport:
+Start the server using either stdio (default) or Streamable HTTP transport:
 
 ```bash
 # Using stdio transport (default)
 uv run mcp-simple-tool
 
-# Using SSE transport on custom port
-uv run mcp-simple-tool --transport sse --port 8000
+# Using Streamable HTTP transport on custom port
+uv run mcp-simple-tool --transport streamable-http --port 8000
 ```
 
 The server exposes a tool named "fetch" that accepts one required argument:
diff --git a/examples/servers/simple-tool/mcp_simple_tool/server.py b/examples/servers/simple-tool/mcp_simple_tool/server.py
index 6bf9a9247..226058b95 100644
--- a/examples/servers/simple-tool/mcp_simple_tool/server.py
+++ b/examples/servers/simple-tool/mcp_simple_tool/server.py
@@ -3,7 +3,6 @@
 from mcp import types
 from mcp.server import Server, ServerRequestContext
 from mcp.shared._httpx_utils import create_mcp_http_client
-from starlette.requests import Request
 
 
 async def fetch_website(
@@ -51,10 +50,10 @@ async def handle_call_tool(ctx: ServerRequestContext, params: types.CallToolRequ
 
 
 @click.command()
-@click.option("--port", default=8000, help="Port to listen on for SSE")
+@click.option("--port", default=8000, help="Port to listen on for HTTP")
 @click.option(
     "--transport",
-    type=click.Choice(["stdio", "sse"]),
+    type=click.Choice(["stdio", "streamable-http"]),
     default="stdio",
     help="Transport type",
 )
@@ -65,37 +64,10 @@ def main(port: int, transport: str) -> int:
         on_call_tool=handle_call_tool,
     )
 
-    if transport == "sse":
-        from mcp.server.sse import SseServerTransport
-        from mcp.server.transport_security import TransportSecuritySettings
-        from starlette.applications import Starlette
-        from starlette.responses import Response
-        from starlette.routing import Mount, Route
-
-        sse = SseServerTransport(
-            "/messages/",
-            security_settings=TransportSecuritySettings(
-                allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
-                allowed_origins=["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-            ),
-        )
-
-        async def handle_sse(request: Request):
-            async with sse.connect_sse(request.scope, request.receive, request._send) as streams:  # type: ignore[reportPrivateUsage]
-                await app.run(streams[0], streams[1], app.create_initialization_options())
-            return Response()
-
-        starlette_app = Starlette(
-            debug=True,
-            routes=[
-                Route("/sse", endpoint=handle_sse, methods=["GET"]),
-                Mount("/messages/", app=sse.handle_post_message),
-            ],
-        )
-
+    if transport == "streamable-http":
         import uvicorn
 
-        uvicorn.run(starlette_app, host="127.0.0.1", port=port)
+        uvicorn.run(app.streamable_http_app(), host="127.0.0.1", port=port)
     else:
         from mcp.server.stdio import stdio_server
 

From 06f1c7309de78d3067ec3e2e4fcf433e49d6a0f6 Mon Sep 17 00:00:00 2001
From: Max Isbey <224885523+maxisbey@users.noreply.github.com>
Date: Fri, 13 Mar 2026 19:24:49 +0000
Subject: [PATCH 4/4] docs: clarify CORS comment and drop stale README bullets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

streamable_http_app() enforces localhost-only Origin by default, so the
'Allow all origins' CORS comment was misleading — preflight would
succeed but the actual POST would return 403 for non-localhost origins.

Also removed README bullets that described the manual lifespan/task-group
wiring that no longer exists in these examples.
---
 examples/servers/simple-streamablehttp-stateless/README.md      | 1 -
 .../mcp_simple_streamablehttp_stateless/server.py               | 2 +-
 examples/servers/simple-streamablehttp/README.md                | 2 --
 .../simple-streamablehttp/mcp_simple_streamablehttp/server.py   | 2 +-
 4 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/examples/servers/simple-streamablehttp-stateless/README.md b/examples/servers/simple-streamablehttp-stateless/README.md
index b87250b35..a254f88d1 100644
--- a/examples/servers/simple-streamablehttp-stateless/README.md
+++ b/examples/servers/simple-streamablehttp-stateless/README.md
@@ -7,7 +7,6 @@ A stateless MCP server example demonstrating the StreamableHttp transport withou
 - Uses the StreamableHTTP transport in stateless mode (mcp_session_id=None)
 - Each request creates a new ephemeral connection
 - No session state maintained between requests
-- Task lifecycle scoped to individual requests
 - Suitable for deployment in multi-node environments
 
 ## Usage
diff --git a/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py b/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
index c8adc96b4..e2b8d2ef2 100644
--- a/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
+++ b/examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py
@@ -108,7 +108,7 @@ def main(
     # for browser-based clients (ensures 500 errors get proper CORS headers)
     starlette_app = CORSMiddleware(
         starlette_app,
-        allow_origins=["*"],  # Allow all origins - adjust as needed for production
+        allow_origins=["*"],  # Note: streamable_http_app() enforces localhost-only Origin by default
         allow_methods=["GET", "POST", "DELETE"],  # MCP streamable HTTP methods
         expose_headers=["Mcp-Session-Id"],
     )
diff --git a/examples/servers/simple-streamablehttp/README.md b/examples/servers/simple-streamablehttp/README.md
index 983636717..3eed3320e 100644
--- a/examples/servers/simple-streamablehttp/README.md
+++ b/examples/servers/simple-streamablehttp/README.md
@@ -6,9 +6,7 @@ A simple MCP server example demonstrating the StreamableHttp transport, which en
 
 - Uses the StreamableHTTP transport for server-client communication
 - Supports REST API operations (POST, GET, DELETE) for `/mcp` endpoint
-- Task management with anyio task groups
 - Ability to send multiple notifications over time to the client
-- Proper resource cleanup and lifespan management
 - Resumability support via InMemoryEventStore
 
 ## Usage
diff --git a/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py b/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
index 4cd75c94c..ec9761d1b 100644
--- a/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
+++ b/examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py
@@ -132,7 +132,7 @@ def main(
     # for browser-based clients (ensures 500 errors get proper CORS headers)
     starlette_app = CORSMiddleware(
         starlette_app,
-        allow_origins=["*"],  # Allow all origins - adjust as needed for production
+        allow_origins=["*"],  # Note: streamable_http_app() enforces localhost-only Origin by default
         allow_methods=["GET", "POST", "DELETE"],  # MCP streamable HTTP methods
         expose_headers=["Mcp-Session-Id"],
     )