From 7e0a3fabc2606d3e30e013f0d1ba9cd4736354f8 Mon Sep 17 00:00:00 2001 From: spencerm Date: Tue, 16 Jun 2026 21:12:40 -0600 Subject: [PATCH] Fix MCP 'Invalid Host header' (421) for LAN access The streamable-HTTP transport enables DNS-rebinding protection by default, which rejects non-localhost Host headers with HTTP 421. The server is reached by LAN IP via mcp-remote (not a browser) and is gated by a bearer token, so disable the protection via TransportSecuritySettings. Co-Authored-By: Claude Opus 4.8 --- mcp-server/server.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/mcp-server/server.py b/mcp-server/server.py index 2126b72..6e20195 100644 --- a/mcp-server/server.py +++ b/mcp-server/server.py @@ -28,8 +28,18 @@ import urllib.request from typing import Any from mcp.server.fastmcp import FastMCP +from mcp.server.transport_security import TransportSecuritySettings -mcp = FastMCP("freshservice") +# The streamable-HTTP transport enables DNS-rebinding protection by default, +# which validates the Host header against an allow-list (localhost only when +# empty) and returns HTTP 421 "Invalid Host header" otherwise. This server is +# reached by LAN IP (e.g. 192.168.101.12:3839) from mcp-remote — not a browser — +# and is already gated by a bearer token, so the protection only breaks the +# connection. Disable it. +mcp = FastMCP( + "freshservice", + transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False), +) TICKET_STATUS = {2: "Open", 3: "Pending", 4: "Resolved", 5: "Closed"} TICKET_PRIORITY = {1: "Low", 2: "Medium", 3: "High", 4: "Urgent"}