From 80cb9713081f7300e74d165fa6c417b2f6a0ab61 Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Mon, 13 Jul 2026 10:07:23 +0200 Subject: [PATCH] fix: disable MCP DNS rebinding protection for Docker/proxy deployment (fixes 421 Invalid Host header) --- backend/app/mcp_server.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/app/mcp_server.py b/backend/app/mcp_server.py index 2a4552a..eacac22 100644 --- a/backend/app/mcp_server.py +++ b/backend/app/mcp_server.py @@ -122,7 +122,9 @@ _STATIC_COMPONENTS = [ # streamable_http_path="/" so that when mounted at /mcp the endpoint is /mcp/ # stateless_http=True: each request is independent (no session management) # Disable DNS rebinding protection for Docker deployment -mcp = FastMCP("hms-cms", streamable_http_path="/", stateless_http=True) +from mcp.server.transport_security import TransportSecuritySettings + +mcp = FastMCP("hms-cms", streamable_http_path="/", stateless_http=True, transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False)) # ---------------------------------------------------------------------------# # Bearer token authentication wrapper