fix(transport): disable DNS rebinding protection + bump to 1.0.107 (#123)

The 1.0.106 canary on mcp2 returned HTTP 421 Invalid Host header for all
proxied traffic. mcp 1.23.0 auto-enables transport_security with a
port-wildcard allowlist (127.0.0.1:*, localhost:*, [::1]:*). The
internal nginx upstream uses proxy_set_header Host with the bare host
variable, which strips the port — so the forwarded Host (127.0.0.1)
does not match the allowlist patterns and every request is rejected.

The protection is irrelevant for a loopback-only service that external
clients cannot reach. Disable it explicitly via
transport_security.enable_dns_rebinding_protection=False so the
allowlist constraint stops blocking proxied traffic.

Direct curl on mcp2 confirms: with the disable applied locally,
Host: 127.0.0.1 (no port) returns 200; without it, 421.

Author: nictuku

meta_ads_mcp/__init__.py

@@ -6,7 +6,7 @@
 
 from meta_ads_mcp.core.server import main
 
-__version__ = "1.0.106"
+__version__ = "1.0.107"
 
 __all__ = [
     'get_ad_accounts',

meta_ads_mcp/core/server.py

@@ -341,6 +341,15 @@ def main():
         # forwarded by an upstream proxy at .../mcp/ are served directly
         # instead of receiving a 307 redirect to /mcp (the SDK default).
         mcp_server.settings.streamable_http_path = "/mcp/"
+        # Disable DNS rebinding protection. The SDK auto-enables it when the
+        # server binds to a loopback host (127.0.0.1 / localhost / ::1) and
+        # ships a port-wildcard allowlist (127.0.0.1:*). An upstream nginx
+        # with `proxy_set_header Host $host;` strips the port from the Host
+        # header before forwarding, so the allowlist does not match and every
+        # request is rejected with HTTP 421 (the 1.0.106 production
+        # regression). The protection is irrelevant for a loopback-only
+        # service that no external client can reach.
+        mcp_server.settings.transport_security.enable_dns_rebinding_protection = False
 
         # Import all tool modules to ensure they are registered
         logger.info("Ensuring all tools are registered for HTTP transport")

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "meta-ads-mcp"
-version = "1.0.106"
+version = "1.0.107"
 description = "Model Context Protocol (MCP) server for Meta Ads - Use Remote MCP at pipeboard.co for easiest setup"
 readme = "README.md"
 requires-python = ">=3.10"

server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "co.pipeboard/meta-ads-mcp",
   "description": "Facebook / Meta Ads automation with AI: analyze performance, test creatives, optimize spend.",
-  "version": "1.0.106",
+  "version": "1.0.107",
   "remotes": [
     {
       "type": "streamable-http",