diff --git a/src/openjarvis/server/app.py b/src/openjarvis/server/app.py
index 423cdbfd..a2a738ac 100644
--- a/src/openjarvis/server/app.py
+++ b/src/openjarvis/server/app.py
@@ -181,7 +181,15 @@ def create_app(
 
     from fastapi.middleware.cors import CORSMiddleware
 
-    _origins = cors_origins if cors_origins is not None else ["*"]
+    _origins = (
+        cors_origins
+        if cors_origins is not None
+        else [
+            "http://localhost:5173",
+            "http://127.0.0.1:5173",
+            "tauri://localhost",
+        ]
+    )
     app.add_middleware(
         CORSMiddleware,
         allow_origins=_origins,