Dery Ferdikaandgensokyo-dev aa6c1d49fd fix(mcp)!: require allowed hosts for non-loopback HTTP binds (#7172) ...

Require operator-declared hostnames before serving MCP HTTP outside loopback, preserving Host/Origin gates. Parse hostname identities once, share typed startup recovery across CLI/MCP, and announce an admitted client URL. Generated AgentEnv bundles declare their client/service names and validate DNS/HTTP name identity before export.

Validated through real packaged HTTP requests, direct SDK connection, compiled export refusals, 184 focused tests, static and documentation checks on the refreshed main integration. Final CI and review evidence is recorded in the PR body.

BREAKING CHANGE: non-loopback deployments require MCP_ALLOWED_HOSTS or rea mcp --http --allowed-hosts; bundle names must be unchanged HTTP hostnames within the 63-octet DNS label bound.

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

2026-10-26 22:55:10 +08:00

..

2356-wasm-interface-comparison

feat(wasm): compare retained core-module interfaces (#2464)

2026-10-13 23:49:04 +08:00

agent-environments

fix(mcp)!: require allowed hosts for non-loopback HTTP binds (#7172)

2026-10-26 22:55:10 +08:00

apk-signature

feat(apk): inspect signing declarations with retained fact queries

2026-10-22 11:48:09 +00:00

solidity/cbor-metadata

feat(evm): inspect lossless Solidity terminal CBOR metadata (#2790)

2026-10-13 21:55:30 +08:00