⚠️ Breaking Changes
DNS Rebinding Protection Enabled by Default
Starting with MCP SDK 1.23.0, DNS rebinding protection is now enabled by default for security (CVE-2025-66416). This may affect users running behind reverse proxies.
What changed:
- Previously: All Host headers were accepted
- Now: Only localhost and 127.0.0.1 are allowed by default
If you use a reverse proxy, add your domain to the allowed hosts:
UNIFI_MCP_ALLOWED_HOSTS=localhost,127.0.0.1,your-domain.example.com
✨ New Features
Pre-Login Controller Detection (#34)
The server now performs two-phase UniFi controller detection:
- Pre-login phase: Detects controller type (UniFi OS vs standalone) before authentication to select the correct login endpoint
- Post-login verification: Confirms the API path prefix after successful login
Benefits:
- More reliable connections to UniFi OS consoles (UDM, UDR, UCG, etc.)
- Automatic selection between /api/auth/login (UniFi OS) and /api/login (standalone)
- Detection result is cached for the session
Reverse Proxy Support (#40)
New UNIFI_MCP_ALLOWED_HOSTS environment variable allows running behind reverse proxies:
Allow connections from your reverse proxy domain
UNIFI_MCP_ALLOWED_HOSTS=localhost,127.0.0.1,unifi-mcp.example.com
Enhanced Meta Tools for MCP Clients (#30)
Improved compatibility with MCP clients that don't support dynamic tool loading:
| Tool | Description |
|---|---|
| unifi_execute | Single-tool synchronous execution |
| unifi_batch | Parallel/bulk tool execution |
| unifi_batch_status | Check batch operation status |
New environment variables for tool filtering:
- UNIFI_TOOL_REGISTRATION_MODE - Control tool loading (eager, meta_only)
- UNIFI_ENABLED_CATEGORIES - Filter tools by category
- UNIFI_ENABLED_TOOLS - Enable specific tools only
🔧 Improvements
- Automatic versioning: Package version now derived from git tags (#37)
- Development console: New Makefile targets (console, console-proxy, console-direct) for easier testing
- Documentation: Network isolation constraints documented (#36)
- Test reliability: HTTP-level mocking for CI stability (#42)
📦 Dependencies
- Bumped GitHub Actions dependencies (#39)
- MCP SDK compatibility verified with 1.23.0+
🙏 Contributors
Thanks to the community contributors who helped with this release!
New Contributors
- @dependabot[bot] made their first contribution in #39
- @b3nw made their first contribution in #40
Full Changelog: v0.3.3...v0.4.0