helm/ai-skills-api
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix: Disable DNS rebinding protection by default to prevent 421 errors with remote access

Browse source 
- Add TransportSecuritySettings to all MCP servers
- Disable protection by default (works with Tailscale/dynamic IPs)
- Optional env vars to enable with custom allowed hosts
This commit is contained in:
Lukas Parsons 2026-03-23 01:22:47 -04:00
parent dfb684f319
commit 79da07673a
3 changed files with 52 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
mcp/gameservers.py
View file

@ -1,11 +1,27 @@
from mcp.server.fastmcp import FastMCP from mcp.server.fastmcp import FastMCP
from mcp.server.transport_security import TransportSecuritySettings
import os import os
import json import json
from pathlib import Path from pathlib import Path
from typing import Optional from typing import Optional
import subprocess import subprocess
mcp = FastMCP("gameservers") # Configure transport security to avoid 421 errors (DNS rebinding protection)
enable_protection = os.getenv("MCP_ENABLE_DNS_PROTECTION", "false").lower() == "true"
if enable_protection:
allowed_hosts = os.getenv("MCP_ALLOWED_HOSTS", "localhost:*,127.0.0.1:*,0.0.0.0:*").split(",")
allowed_origins = os.getenv("MCP_ALLOWED_ORIGINS", "http://localhost:*,http://127.0.0.1:*,http://0.0.0.0:*").split(",")
transport_security = TransportSecuritySettings(
enable_dns_rebinding_protection=True,
allowed_hosts=allowed_hosts,
allowed_origins=allowed_origins,
)
else:
transport_security = TransportSecuritySettings(
enable_dns_rebinding_protection=False,
)
mcp = FastMCP("gameservers", transport_security=transport_security)
GAME_SERVERS_DIR = Path(os.getenv("GAME_SERVERS_DIR", "/opt/game-servers")) GAME_SERVERS_DIR = Path(os.getenv("GAME_SERVERS_DIR", "/opt/game-servers"))

18
mcp/homelab.py
View file

@ -1,11 +1,27 @@
from mcp.server.fastmcp import FastMCP from mcp.server.fastmcp import FastMCP
from mcp.server.transport_security import TransportSecuritySettings
import docker import docker
import psutil import psutil
import subprocess import subprocess
import os import os
from typing import Optional from typing import Optional
mcp = FastMCP("homelab") # Configure transport security to avoid 421 errors (DNS rebinding protection)
enable_protection = os.getenv("MCP_ENABLE_DNS_PROTECTION", "false").lower() == "true"
if enable_protection:
allowed_hosts = os.getenv("MCP_ALLOWED_HOSTS", "localhost:*,127.0.0.1:*,0.0.0.0:*").split(",")
allowed_origins = os.getenv("MCP_ALLOWED_ORIGINS", "http://localhost:*,http://127.0.0.1:*,http://0.0.0.0:*").split(",")
transport_security = TransportSecuritySettings(
enable_dns_rebinding_protection=True,
allowed_hosts=allowed_hosts,
allowed_origins=allowed_origins,
)
else:
transport_security = TransportSecuritySettings(
enable_dns_rebinding_protection=False,
)
mcp = FastMCP("homelab", transport_security=transport_security)
DOCKER_CLIENT = docker.from_env() DOCKER_CLIENT = docker.from_env()

19
mcp/skills.py
View file

@ -1,4 +1,5 @@
from mcp.server.fastmcp import FastMCP from mcp.server.fastmcp import FastMCP
from mcp.server.transport_security import TransportSecuritySettings
import httpx import httpx
import os import os
import uvicorn import uvicorn
@ -19,7 +20,23 @@ Project conventions are scoped to a project identifier (recommended: git remote
Always pass the same project identifier consistently across sessions.""" Always pass the same project identifier consistently across sessions."""
mcp = FastMCP("skills", instructions=MCP_INSTRUCTIONS) # Configure transport security to avoid 421 errors (DNS rebinding protection)
# Set MCP_ENABLE_DNS_PROTECTION=true to enable with custom hosts
enable_protection = os.getenv("MCP_ENABLE_DNS_PROTECTION", "false").lower() == "true"
if enable_protection:
allowed_hosts = os.getenv("MCP_ALLOWED_HOSTS", "localhost:*,127.0.0.1:*,0.0.0.0:*").split(",")
allowed_origins = os.getenv("MCP_ALLOWED_ORIGINS", "http://localhost:*,http://127.0.0.1:*,http://0.0.0.0:*").split(",")
transport_security = TransportSecuritySettings(
enable_dns_rebinding_protection=True,
allowed_hosts=allowed_hosts,
allowed_origins=allowed_origins,
)
else:
transport_security = TransportSecuritySettings(
enable_dns_rebinding_protection=False,
)
mcp = FastMCP("skills", instructions=MCP_INSTRUCTIONS, transport_security=transport_security)
SKILLS_API_URL = os.getenv("SKILLS_API_URL", "http://helm:8675") SKILLS_API_URL = os.getenv("SKILLS_API_URL", "http://helm:8675")