fix(mcp): validate HTTP origins and hosts

[fahreddinozcan]

Summary

Fixes the MCP HTTP Origin validation / permissive CORS finding reported as Cobalt PT38659_23.

• rejects foreign, null, malformed, and explicitly empty Origin values before JSON parsing or MCP dispatch
• echoes only an approved Origin and emits complete Vary headers
• validates Host values on loopback servers to prevent DNS rebinding
• binds local HTTP to 127.0.0.1 by default, with IPv6 loopback handled correctly
• keeps the production container reachable with an explicit 0.0.0.0 bind
• separates local loopback origins from exact hosted Context7/configured origins
• documents --host, CONTEXT7_MCP_HOST, and CONTEXT7_MCP_ALLOWED_ORIGINS
• adds focused unit and local/hosted end-to-end regression coverage

Linear: CTX7-2533

Validation

• MCP suite: 105 passed
• raw running-local-server matrix: 79 assertions passed across Host/Origin variants, preflights, malformed and oversized bodies, MCP calls, OAuth, discovery, methods, and routes
• listener inspection: confirmed 127.0.0.1 only; separate ::1 bind/Host/Origin smoke tests passed
• CLI suite: 314 passed
• Pi integration suite: 4 passed
• repository-wide typecheck, lint, format, build, and credentialed GitHub test workflow passed
• production Docker image built successfully
• container smoke test: health check 200, approved preflight 204 with exact ACAO, hostile preflight 403 without ACAO
• git diff --check passed

[linear-code]

CTX7-2533

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
context7	🟢 Ready	View Preview	Aug 27, 2026, 9:08 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[context7]

Docs7 for context7.com

Build	Commit	Updated (UTC)
Ready (open preview)	ff75023	2026-08-27 09:23

Open build details

Review

No problems found.

Open this review on Docs7