spencerm/freshservice-claude
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix MCP 'Invalid Host header' (421) for LAN access

Browse Source 
The streamable-HTTP transport enables DNS-rebinding protection by default,
which rejects non-localhost Host headers with HTTP 421. The server is reached
by LAN IP via mcp-remote (not a browser) and is gated by a bearer token, so
disable the protection via TransportSecuritySettings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Spencer McGuire
2026-06-16 21:12:40 -06:00
parent 133b8fa569
commit 7e0a3fabc2
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
mcp-server/server.py
View File

@@ -28,8 +28,18 @@ import urllib.request
from typing import Any from typing import Any
from mcp.server.fastmcp import FastMCP from mcp.server.fastmcp import FastMCP
from mcp.server.transport_security import TransportSecuritySettings
mcp = FastMCP("freshservice") # The streamable-HTTP transport enables DNS-rebinding protection by default,
# which validates the Host header against an allow-list (localhost only when
# empty) and returns HTTP 421 "Invalid Host header" otherwise. This server is
# reached by LAN IP (e.g. 192.168.101.12:3839) from mcp-remote — not a browser —
# and is already gated by a bearer token, so the protection only breaks the
# connection. Disable it.
mcp = FastMCP(
"freshservice",
transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False),
)
TICKET_STATUS = {2: "Open", 3: "Pending", 4: "Resolved", 5: "Closed"} TICKET_STATUS = {2: "Open", 3: "Pending", 4: "Resolved", 5: "Closed"}
TICKET_PRIORITY = {1: "Low", 2: "Medium", 3: "High", 4: "Urgent"} TICKET_PRIORITY = {1: "Low", 2: "Medium", 3: "High", 4: "Urgent"}