Patrick Buckley 1468ca7972 fix(examples): accept remote Host headers when bound off localhost ...

The streamable-http server bound to 0.0.0.0/a LAN IP answered TCP and
/watch but returned 421 "Invalid Host header" on /mcp for every remote
node — which broke multi-node play entirely. FastMCP freezes DNS-rebinding
protection (a localhost-only Host allowlist) at CONSTRUCTION, and this
module builds its FastMCP at import time with the default 127.0.0.1 host;
flipping settings.host in _serve afterward never updated the frozen
allowlist, so the LAN Host was always rejected.

When UNDERSTONE_HOST is off localhost, drop the allowlist in _serve before
run() — matching the SDK's own default for a non-localhost bind. The /mcp
and /watch routes are unauthenticated by design, so serve only on a trusted
network (documented).

Regression test pins the mechanism: a default FastMCP 421s a foreign Host,
a protection-disabled one accepts it. Tests 420 -> 421.

2026-06-13 04:40:40 -07:00

..

door-game

fix(examples): accept remote Host headers when bound off localhost

2026-06-13 04:40:40 -07:00

mcp-cluster-ops

chore: relicense BUSL-1.1 → Apache 2.0 for 1.6.0 (#651)

2026-06-10 21:03:16 -07:00