X_MCP_ORIGIN_REFUSED
Means
an MCP request came from a browser page on another origin
Typical cause
a POST /mcp whose Origin header is present and that core's proveSameOrigin cannot show is this app: not the route's public origin and not listed in http.cors.origins — refused 403 before the bearer token is read. It does not catch a DNS-rebound name, whose Host and Origin agree: x mcp serve refuses that Host first (X_MCP_HOST_REFUSED)
Fix
curl -X POST http://localhost:3000/mcp -H 'authorization: Bearer <token>' — no Origin header; a page on a sibling origin is listed in http.cors.origins