cf-mcp 0.19.0 → 0.20.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8503e2b733dd80a28ab4e44b5435ce8ca334ba25a0bd34a3751c2b986beea8dc
-  data.tar.gz: f4b986ddb96f77b7bc97c5b56384b6aaae88ee73f1f030a184409e64c78cd317
+  metadata.gz: aa1835b909429755f2b06a50b6db8d973c68445f879413974b7b28863b6bce06
+  data.tar.gz: 6a110d101e27e125763506715bed2a92b973e9cecd709bd17a69c7088fb5e55f
 SHA512:
-  metadata.gz: e408e0273973b658e8eb883946d350b25a899d901e5f0940bbb4e9cec4e64e3d21287461fdf17141ba21b33e9b03016d4375635115b490b143476c0a5e142554
-  data.tar.gz: 7878980a0bb69c7038055106a803ee68032840ffb9fb37c684ddc99353797c133133c1485405f8342ae98052d974b7771d2e17258cf1474e27df1b90592a6dcf
+  metadata.gz: e450154e426288754d99ee28a63e4b3fa99d2394600ab8519df3f0d584844b2428f64a1c62d106053f3f3826ace1d4e4beeadd6d9f45e0100b2d7bcc3717db69
+  data.tar.gz: 7fd889d1f4ae36abed48cb84048efa8debf22a4c97d198c2d12745ad095589a3ab02feeb5c2c1d4d3221f33a38069c363214f3142b7c56bcbf0c30e04d790f54

data/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.20.0] - 2026-09-19
+
+### Added
+
+- `CF_MCP_ALLOWED_HOSTS` environment variable (comma-separated) to allow extra `Host` header values on the HTTP endpoint; set to `cf-mcp.fly.dev` in `fly.toml`
+- Support MCP protocol version 2026-07-28: stateless requests carrying their version in `_meta`, and the `server/discover` method
+- Allow the `MCP-Protocol-Version`, `Mcp-Method` and `Mcp-Name` headers in CORS preflight responses
+
+### Changed
+
+- **BREAKING:** Raised the minimum supported Ruby from 3.2 to 3.3 (`required_ruby_version` and the Standard Ruby target); 3.2 reached end of life on 2026-03-31; CI now also runs against Ruby 3.3
+- Updated `mcp` from 0.25.0 to 1.5.1
+- Updated `puma` from 7.2.1 to 8.0.2 (the gemspec constraint is now `~> 8.0`) and `rubyzip` from 3.6.0 to 3.7.0
+- Removed the `2025-03-26` protocol pin; clients using the `initialize` handshake now negotiate up to 2025-11-25
+- The web UI now calls tools through the stateless 2026-07-28 protocol
+- The web UI shows both the modern and the legacy handshake protocol versions
+- Bump Ruby to 4.0.7 in `.ruby-version`, the Dockerfile, and the CI matrix
+- Bumped GitHub Actions: `actions/checkout` to v7 and `actions/cache` to v6
+- Added least-privilege permissions, PR concurrency cancellation and a job timeout to the CI workflow, and Dependabot for GitHub Actions and Bundler
+
+### Fixed
+
+- HTTP endpoint rejected all non-loopback requests with `403 Invalid Host header` since `mcp` 0.25 enabled DNS-rebinding protection, breaking the hosted server
+
 ## [0.19.0] - 2026-09-15
 
 ### Added
@@ -306,6 +332,8 @@ This version was prepared but never released. Changes rolled into 0.17.2.
   - `cf_list_category` - List items by category
   - `cf_get_details` - Get full documentation by name
 
+[Unreleased]: https://github.com/pusewicz/cf-mcp/compare/v0.20.0...HEAD
+[0.20.0]: https://github.com/pusewicz/cf-mcp/compare/v0.19.0...v0.20.0
 [0.19.0]: https://github.com/pusewicz/cf-mcp/compare/v0.18.0...v0.19.0
 [0.17.2]: https://github.com/pusewicz/cf-mcp/compare/v0.17.0...v0.17.2
 [0.17.1]: https://github.com/pusewicz/cf-mcp/compare/v0.17.0...v0.17.1

data/README.md

@@ -63,6 +63,12 @@ Then launch the inspector and connect using Streamable HTTP transport to:
 http://localhost:9292/http
 ```
 
+When serving under a non-loopback hostname, allow it via `CF_MCP_ALLOWED_HOSTS` (comma-separated), otherwise requests are rejected with `403 Invalid Host header`:
+
+```bash
+CF_MCP_ALLOWED_HOSTS=mcp.example.com cf-mcp http --root /path/to/cute_framework
+```
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/cf/mcp/server.rb

@@ -12,7 +12,7 @@ module CF
       CORS_HEADERS = {
         "access-control-allow-origin" => "*",
         "access-control-allow-methods" => "GET, POST, DELETE, OPTIONS",
-        "access-control-allow-headers" => "Content-Type, Accept, Mcp-Session-Id",
+        "access-control-allow-headers" => "Content-Type, Accept, MCP-Protocol-Version, Mcp-Method, Mcp-Name, Mcp-Session-Id",
         "access-control-expose-headers" => "Mcp-Session-Id"
       }.freeze
 
@@ -37,18 +37,27 @@ module CF
         new(index, revision: builder.revision).rack_app
       end
 
-      PROTOCOL_VERSION = "2025-03-26"
+      # Modern clients carry their version on every request (no handshake); legacy
+      # clients negotiate through `initialize`. Both track the SDK rather than pinning.
+      MODERN_PROTOCOL_VERSION = ::MCP::Configuration::LATEST_MODERN_PROTOCOL_VERSION
+      LEGACY_PROTOCOL_VERSION = ::MCP::Configuration::LATEST_HANDSHAKE_PROTOCOL_VERSION
       WEBSITE_URL = ENV.fetch("FLY_APP_NAME", nil) ? "https://#{ENV["FLY_APP_NAME"]}.fly.dev" : "https://cf-mcp.fly.dev"
       PUBLIC_DIR = File.join(__dir__, "public")
+      ALLOWED_HOSTS_ENV = "CF_MCP_ALLOWED_HOSTS"
 
-      def initialize(index, revision: nil)
+      # Comma-separated list of extra Host header values the HTTP transport accepts
+      # (the MCP SDK only allows loopback hosts by default).
+      def self.allowed_hosts_from_env(env = ENV)
+        env.fetch(ALLOWED_HOSTS_ENV, "").split(",").map(&:strip).reject(&:empty?)
+      end
+
+      def initialize(index, revision: nil, allowed_hosts: self.class.allowed_hosts_from_env)
         @index = index
         @revision = revision
+        @allowed_hosts = allowed_hosts
 
-        configuration = ::MCP::Configuration.new(protocol_version: PROTOCOL_VERSION)
         @server = ::MCP::Server.new(
           name: "cf-mcp",
-          configuration:,
           version: CF::MCP::VERSION,
           icons: [
             ::MCP::Icon.new(src: "#{WEBSITE_URL}/favicon.svg", mime_type: "image/svg+xml", sizes: ["any"]),
@@ -82,7 +91,7 @@ module CF
       def rack_app
         require "rack"
 
-        http_transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(@server, stateless: true)
+        http_transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(@server, stateless: true, allowed_hosts: @allowed_hosts)
         @server.transport = http_transport
 
         landing_page = build_landing_page
@@ -193,7 +202,8 @@ module CF
         ->(index, tool_classes) {
           context = TemplateContext.new(
             version: CF::MCP::VERSION,
-            protocol_version: PROTOCOL_VERSION,
+            modern_protocol_version: MODERN_PROTOCOL_VERSION,
+            legacy_protocol_version: LEGACY_PROTOCOL_VERSION,
             revision: @revision,
             revision_url: @revision && format(CUTE_FRAMEWORK_COMMIT_URL_TEMPLATE, revision: @revision),
             stats: index.stats,
@@ -219,11 +229,12 @@ module CF
       class TemplateContext
         TEMPLATES_DIR = File.join(__dir__, "templates")
 
-        attr_reader :version, :protocol_version, :revision, :revision_url, :stats, :categories, :topics, :tools, :tool_schemas_json
+        attr_reader :version, :modern_protocol_version, :legacy_protocol_version, :revision, :revision_url, :stats, :categories, :topics, :tools, :tool_schemas_json
 
-        def initialize(version:, protocol_version:, revision:, revision_url:, stats:, categories:, topics:, tools:, tool_schemas_json:)
+        def initialize(version:, modern_protocol_version:, legacy_protocol_version:, revision:, revision_url:, stats:, categories:, topics:, tools:, tool_schemas_json:)
           @version = version
-          @protocol_version = protocol_version
+          @modern_protocol_version = modern_protocol_version
+          @legacy_protocol_version = legacy_protocol_version
           @revision = revision
           @revision_url = revision_url
           @stats = stats
@@ -256,7 +267,10 @@ module CF
 
         def js_content
           js = File.read(File.join(TEMPLATES_DIR, "script.js"))
-          js.sub("TOOL_SCHEMAS_PLACEHOLDER", @tool_schemas_json)
+          # Substitute the scalar placeholders first so injected content can't collide with them
+          js.sub("PROTOCOL_VERSION_PLACEHOLDER", @modern_protocol_version.to_json)
+            .sub("CLIENT_VERSION_PLACEHOLDER", @version.to_json)
+            .sub("TOOL_SCHEMAS_PLACEHOLDER", @tool_schemas_json)
             .sub("CATEGORIES_PLACEHOLDER", categories_json)
             .sub("TOPICS_PLACEHOLDER", topics_json)
             .sub("CHANGELOG_PLACEHOLDER", changelog_json)

data/lib/cf/mcp/templates/index.erb

@@ -53,7 +53,7 @@
     </tr>
     <tr>
       <th>Protocol Version</th>
-      <td><%= protocol_version %></td>
+      <td><%= modern_protocol_version %> <small>(legacy handshake up to <%= legacy_protocol_version %>)</small></td>
     </tr>
     <% if revision %>
     <tr>

data/lib/cf/mcp/templates/script.js

@@ -8,6 +8,8 @@ const TOOLS = TOOL_SCHEMAS_PLACEHOLDER;
 const CATEGORIES = CATEGORIES_PLACEHOLDER;
 const TOPICS = TOPICS_PLACEHOLDER;
 const CHANGELOG = CHANGELOG_PLACEHOLDER;
+const PROTOCOL_VERSION = PROTOCOL_VERSION_PLACEHOLDER;
+const CLIENT_VERSION = CLIENT_VERSION_PLACEHOLDER;
 
 // Helper to render topic options (used in multiple places)
 const renderTopicOptions = () =>
@@ -38,13 +40,24 @@ function useMcpToolCall() {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
-          'Accept': 'application/json, text/event-stream'
+          'Accept': 'application/json, text/event-stream',
+          'MCP-Protocol-Version': PROTOCOL_VERSION,
+          'Mcp-Method': 'tools/call',
+          'Mcp-Name': toolName
         },
         body: JSON.stringify({
           jsonrpc: '2.0',
           id: Date.now(),
           method: 'tools/call',
-          params: { name: toolName, arguments: args }
+          params: {
+            name: toolName,
+            arguments: args,
+            _meta: {
+              'io.modelcontextprotocol/protocolVersion': PROTOCOL_VERSION,
+              'io.modelcontextprotocol/clientCapabilities': {},
+              'io.modelcontextprotocol/clientInfo': { name: 'cf-mcp-dashboard', version: CLIENT_VERSION }
+            }
+          }
         })
       });
 

data/lib/cf/mcp/version.rb

@@ -2,6 +2,6 @@
 
 module CF
   module MCP
-    VERSION = "0.19.0"
+    VERSION = "0.20.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cf-mcp
 version: !ruby/object:Gem::Version
-  version: 0.19.0
+  version: 0.20.0
 platform: ruby
 authors:
 - Piotr Usewicz
@@ -29,28 +29,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.25'
+        version: '1.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.25'
+        version: '1.5'
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '8.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '8.0'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -161,14 +161,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.2.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.12
+rubygems_version: 4.0.20
 specification_version: 4
 summary: MCP server providing documentation tools for Cute Framework
 test_files: []