dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

mcp/server: disable FastMCP DNS-rebinding protection

Browse Source 
We're nftables-gated to mesh+LAN; the browser-attack threat doesn't
apply, and the default whitelist (127.0.0.1/localhost/[::1] only) blocks
every LAN/mesh client.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
root
2026-05-20 16:43:35 +02:00
parent 1dc40ca715
commit 6848640fa4
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
mcp/server.py
View File

@@ -37,6 +37,10 @@ SSH_TIMEOUT = int(os.environ.get("HOMELAB_MCP_SSH_TIMEOUT", "10"))
mcp = FastMCP("homelab") mcp = FastMCP("homelab")
mcp.settings.host = os.environ.get("HOMELAB_MCP_HOST", "0.0.0.0") mcp.settings.host = os.environ.get("HOMELAB_MCP_HOST", "0.0.0.0")
mcp.settings.port = int(os.environ.get("HOMELAB_MCP_PORT", "9810")) mcp.settings.port = int(os.environ.get("HOMELAB_MCP_PORT", "9810"))
# FastMCP's DNS-rebinding protection only whitelists 127.0.0.1 / localhost / [::1]
# by default, which breaks any LAN/mesh client. We're already mesh+LAN-gated at
# nftables and the browser-attack threat doesn't apply to mesh-only services.
mcp.settings.transport_security.enable_dns_rebinding_protection = False
def _load_inventory() -> dict: def _load_inventory() -> dict: