docs: ALLOWED_ORIGINS recipe for running the Inspector behind a `*.localhost` proxy

[cliffhall]

Which client?

Web

The problem

Running the Inspector behind a reverse proxy on a *.localhost name — inspector.localhost, as part of a cluster like my-api.localhost / my-app.localhost / my-mcp.localhost — works today, but only if you set ALLOWED_ORIGINS, and nothing in the docs says so or shows the shape.

The DNS-rebinding origin allow-list defaults to the loopback trio (http://localhost:PORT, http://127.0.0.1:PORT, http://[::1]:PORT), so a browser at http://inspector.localhost is rejected on every /api/* call that carries an Origin — which is the POSTs that add and connect a server. The page loads, so the failure looks like a connection problem rather than a configuration one.

Raised by the reporter of #1944, whose setup is exactly this. See #2282 for why we documented rather than changed the default.

Expected behavior

clients/web/README.md gains a short recipe in the origin allow-list section:

• the ALLOWED_ORIGINS value for a *.localhost proxy origin;
• ⚠️ the trap that makes it easy to get wrong — ALLOWED_ORIGINS replaces the default list rather than merging, so listing only the proxy origin silently breaks browsing at localhost:PORT. Every origin you browse from has to be listed, loopback trio included;
• a note that the MCP Apps sandbox frame-ancestors is derived from the same list, so one entry covers the Apps tab too;
• the caveat that only the browser resolves *.localhost for free (Chrome and Firefox map it to loopback internally; the OS resolver on macOS does not, and Safari does not at all), so an MCP server URL on such a host still needs /etc/hosts or dnsmasq — the Inspector's Node backend is what dials it.

Notes

Docs only, no behavior change.