Part of the hosted on-behalf-of MCP server proposal (#297).
Scope
Make the transport allowed hosts and origins configurable so the server survives being fronted by a proxy or load balancer. DNS-rebinding protection otherwise rejects the public Host header with 421 Misdirected Request.
Acceptance criteria
Behind a proxy with a public Host header the server does not return 421; the default localhost-only behavior is preserved when the allowlist is unset.
Dependencies
Builds on the HTTP transport profile (#300).
Part of the hosted on-behalf-of MCP server proposal (#297).
Scope
Make the transport allowed hosts and origins configurable so the server survives being fronted by a proxy or load balancer. DNS-rebinding protection otherwise rejects the public Host header with
421 Misdirected Request.Acceptance criteria
Behind a proxy with a public Host header the server does not return
421; the default localhost-only behavior is preserved when the allowlist is unset.Dependencies
Builds on the HTTP transport profile (#300).