Security hardening for HTTP transports and diagnostic logging.
- Validate Host and Origin before routing, session creation and backend forwarding, including default and named servers.
- Require MCP SDK 1.30 or newer for its redirect and request-body protections; raw HTTP clients no longer follow redirects automatically.
- Keep credentials, query values, session IDs and payloads out of routine transport diagnostics; preserve warnings and errors.
For wildcard binds, configure the hostname/IP and port clients use with repeatable --allowed-host, for example --host=0.0.0.0 --port=8080 --allowed-host mcp.example.com:8080. Origin policy remains separate. Public deployments still require authentication or network controls.
Upgrade with uv tool upgrade mcp-proxy or your existing package manager and restart/rebuild deployments.
Changes: #284