From 6848640fa4649dbd327c2c0934bc58543a12d1e2 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 20 May 2026 16:43:35 +0200 Subject: [PATCH] mcp/server: disable FastMCP DNS-rebinding protection We're nftables-gated to mesh+LAN; the browser-attack threat doesn't apply, and the default whitelist (127.0.0.1/localhost/[::1] only) blocks every LAN/mesh client. Co-Authored-By: Claude Opus 4.7 (1M context) --- mcp/server.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mcp/server.py b/mcp/server.py index 10ff341..59c1bfa 100755 --- a/mcp/server.py +++ b/mcp/server.py @@ -37,6 +37,10 @@ SSH_TIMEOUT = int(os.environ.get("HOMELAB_MCP_SSH_TIMEOUT", "10")) mcp = FastMCP("homelab") mcp.settings.host = os.environ.get("HOMELAB_MCP_HOST", "0.0.0.0") mcp.settings.port = int(os.environ.get("HOMELAB_MCP_PORT", "9810")) +# FastMCP's DNS-rebinding protection only whitelists 127.0.0.1 / localhost / [::1] +# by default, which breaks any LAN/mesh client. We're already mesh+LAN-gated at +# nftables and the browser-attack threat doesn't apply to mesh-only services. +mcp.settings.transport_security.enable_dns_rebinding_protection = False def _load_inventory() -> dict: