feat(server): add MCP_ALLOWED_HOSTS env var for DNS rebinding allowlist

[tricamtech]

Problem

When the MCP server binds to 127.0.0.1/localhost (the recommended posture when fronting with a reverse proxy or tunnel), FastMCP automatically enables its DNS rebinding protection middleware with only the localhost wildcards in the allow list — see mcp/server/fastmcp/server.py:178-181 in the upstream mcp SDK:

if transport_security is None and host in ("127.0.0.1", "localhost", "::1"):
    transport_security = TransportSecuritySettings(
        enable_dns_rebinding_protection=True,
        allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"],
    )

This is the right default for direct local clients, but it breaks the exact deployment pattern this project's README recommends in the "Remote deployment" section:

To access the vault from other machines, expose it through a reverse proxy. The server supports an optional OAuth layer for authentication when deployed remotely.

…with a Cloudflare Tunnel + Access example. With FastMCP's defaults, every request that arrives via the tunnel carries Host: vault.example.com and gets rejected:

HTTP/1.1 421 Misdirected Request
2026-04-08 ... mcp.server.transport_security WARNING Invalid Host header: vault.example.com

There's currently no way to tell vault-mcp-server about additional acceptable Host header values — the FastMCP transport_security argument is hardcoded to None, and the only escape hatches are to either disable DNS rebinding protection entirely (loses the protection) or refuse to bind to localhost.

Reproduction

VAULT_PATH=/some/markdown/dir SERVER_HOST=127.0.0.1 SERVER_PORT=8091 \
  python -m vault_mcp.server &

# Front it with anything that rewrites Host (cloudflared tunnel, nginx, traefik, etc.)
# Then from outside:
curl -X POST https://vault.example.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{...}}'
# → HTTP 421, "Invalid Host header"

Fix

Add a simple MCP_ALLOWED_HOSTS env var (comma-separated). When set, it gets merged with the localhost wildcards FastMCP would have injected anyway, and passed through as an explicit transport_security argument:

ALLOWED_HOSTS = [
    h.strip() for h in os.environ.get("MCP_ALLOWED_HOSTS", "").split(",") if h.strip()
]

if ALLOWED_HOSTS:
    from mcp.server.transport_security import TransportSecuritySettings
    _allowed = ["127.0.0.1:*", "localhost:*", "[::1]:*", *ALLOWED_HOSTS]
    _mcp_kwargs["transport_security"] = TransportSecuritySettings(
        enable_dns_rebinding_protection=True,
        allowed_hosts=_allowed,
    )
    logger.info("DNS rebinding allowed_hosts: %s", _allowed)

• Empty / unset = preserves existing behavior (let FastMCP construct its default)
• Wildcards like vault.example.com:* are honored by the underlying middleware
• Local stdio/HTTP testing isn't affected because the localhost defaults are still in the merged list

Verification

After the patch on the same setup as above:

MCP_ALLOWED_HOSTS=vault.example.com,vault.example.com:* \
  VAULT_PATH=... SERVER_HOST=127.0.0.1 SERVER_PORT=8091 \
  python -m vault_mcp.server
# Logs: DNS rebinding allowed_hosts: ['127.0.0.1:*', 'localhost:*', '[::1]:*', 'vault.example.com', 'vault.example.com:*']

curl -X POST https://vault.example.com/mcp [...]
# → HTTP 200 + valid initialize response

Notes

Found while deploying vault-mcp-server behind a Cloudflare Tunnel for cross-device access from claude.ai web. Really enjoying the section-level chunk retrieval design — it's noticeably more token-efficient than competing markdown MCP servers that dump whole files. Thanks for the project.

Sister PR to #1 (the vault_reindex is_ready guard).