davinci-resolve-mcp 4.7.2 → 4.7.4

package/CHANGELOG.md

@@ -2,6 +2,60 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.7.4 — the networked transport can serve a client on another machine
+
+### Fixed
+
+- **`--transport streamable-http` / `sse` bound to a LAN address answered every
+  request with HTTP 421.** ([#241](https://github.com/samuelgursky/davinci-resolve-mcp/issues/241), reported with the diagnosis by @TeamCLP)
+  `src/server.py` builds `FastMCP(...)` without a host, so the SDK (1.30.0)
+  auto-enables DNS-rebinding protection pinned to loopback
+  (`allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"]`). `run_networked` then
+  set `settings.host` to `DAVINCI_MCP_HOST` but never touched
+  `settings.transport_security`, and the app handed that loopback-only allowlist to
+  the transport middleware. The 421 came after the bearer check, so a wrong token
+  still got 401 and the bind looked healthy — a non-loopback bind could never serve
+  anyone, including an instance the control panel's Start button launched.
+  Reproduced on v4.7.3 with the real SDK app before the fix (LAN Host → 421, wrong
+  token → 401, loopback → 200).
+  - New `transport_security_for(host, extra_hosts)` in `src/utils/mcp_transport.py`,
+    applied **before** the app is built (the app reads the setting once). Loopback
+    binds are untouched. A specific non-loopback bind keeps protection ON with an
+    allowlist of the bind host, loopback, and any names in the new
+    **`DAVINCI_MCP_ALLOWED_HOSTS`** (comma-separated, for clients that reach the box
+    by a DNS name); IPv6 literals are bracketed. A wildcard bind (`0.0.0.0` / `::`)
+    with no names listed turns the Host check off with a warning, since a client
+    never sends the wildcard as its Host — the bearer token remains on every request.
+  - `tests/test_mcp_transport_host_allowlist.py`: the policy table plus the real
+    streamable-http app through `run_networked` — LAN Host 200, wrong token 401,
+    loopback 200, foreign Host still 421. `SECURITY.md` and `docs/install.md`
+    describe the allowlist and the new variable.
+
+## What's New in v4.7.3 — a false spelling no longer grants permission on six opt-in flags
+
+### Fixed
+
+- **Six opt-in permission flags were read with bare truthiness, so a client sending
+  `"false"` was granted the permission it was declining.** ([#240](https://github.com/samuelgursky/davinci-resolve-mcp/pull/240), @Dev-next-gen)
+  These open in the opposite direction from `overwrite` (v4.7.2): they default to off,
+  so the string does not perform the act, it *grants* it. On the previous code:
+  `allow_media_archive="false"` let `ArchiveProject` run with source media on (the
+  21.1.0.14 crash `archive_guard` measures); `acknowledge_trap="false"` stood the crash
+  refusal down on both archive paths and stood the trap guard in
+  `destructive_hook._trap_acknowledged` down in front of `TimelineItem.CopyGrades`;
+  `close_current="false"` closed and deleted the open project; `allow_generate`,
+  `allow_render` and `allow_switch` ran `CreateSubtitlesFromAudio`,
+  `RenderWithQuickExport` and `SetCurrentDatabase`. Nine readings in all now go through
+  `coerce_bool`. Real booleans and the true spellings are unchanged; a false or
+  unrecognised string now yields the documented refusal with its `retry_with` payload.
+  The neighbouring `dry_run` reads are deliberately untouched (a stringified `"false"`
+  there keeps the call in preview, which fails safe), and the granular tools already
+  type these as booleans. Guard test: `tests/test_permission_flags_string_false.py` —
+  one test per flag over six false spellings, asserting the effect did not happen
+  before checking the envelope; 54 of 54 subtests fail on the previous code, every one
+  on the effect. One bare opt-in read remains by choice, `allow_timeline_mismatch` on
+  `apply_trace_plan`, which gates a name mismatch rather than a destructive act.
+
 ## What's New in v4.7.2 — `overwrite="false"` no longer unlocks an install guard
 
 ### Fixed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.7.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.4-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.7.2-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.4-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.7.2 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.7.4 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/SECURITY.md

@@ -24,7 +24,11 @@ Their posture:
 - **Loopback only.** The panel refuses any bind host other than
   `127.0.0.1` / `localhost` / `::1` — the bind address is not a tool parameter
   an AI can widen. The transport defaults to loopback and logs a loud warning
-  if `DAVINCI_MCP_HOST` points elsewhere.
+  if `DAVINCI_MCP_HOST` points elsewhere. On a non-loopback bind its
+  DNS-rebinding allowlist is the bind host plus loopback, extended by
+  `DAVINCI_MCP_ALLOWED_HOSTS` (comma-separated names clients will use); on a
+  wildcard bind (`0.0.0.0` / `::`) with that variable unset the Host check is
+  off and the bearer token is the only gate, and the log says so.
 - **Bearer token on every request.** Each panel launch generates a fresh
   `secrets.token_urlsafe(32)` token, passed to the child via environment (not
   argv) and delivered to the browser in the URL fragment (`#token=…`), which

package/docs/install.md

@@ -237,6 +237,18 @@ Network scripting permits remote control of Resolve. Prefer Local mode when
 remote access is unnecessary; otherwise restrict access with host firewall and
 network controls.
 
+The MCP server's own networked transport (`--transport streamable-http` or
+`sse`) binds `127.0.0.1:8000` by default and requires `Authorization: Bearer
+<token>` on every request (`DAVINCI_MCP_TOKEN`, or a generated one). To serve a
+client on another machine, set `DAVINCI_MCP_HOST` to the address to bind and,
+if clients reach the box by a DNS name rather than that address, list the names
+in `DAVINCI_MCP_ALLOWED_HOSTS` (comma-separated). The transport keeps
+DNS-rebinding protection on, pinned to the bind host, loopback, and those
+names; a request whose `Host` header is none of them gets 421. A wildcard bind
+(`0.0.0.0` / `::`) with no names listed turns the Host check off, since a
+client never sends the wildcard as its Host, and the bearer token is then the
+only gate. Restrict a non-loopback bind with a host firewall.
+
 Run the read-only doctor against Network mode explicitly:
 
 ```bash

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.7.2"
+VERSION = "4.7.4"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.7.2",
+  "version": "4.7.4",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -93,7 +93,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.7.2"
+VERSION = "4.7.4"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.7.2"
+VERSION = "4.7.4"
 
 import base64
 import os
@@ -9298,7 +9298,7 @@ def _transcription_capabilities(mp, p: Dict[str, Any]):
 
 def _subtitle_generation_probe(tl, p: Dict[str, Any]):
     settings, ignored = _normalize_auto_caption_settings(p.get("settings"), get_resolve())
-    if not p.get("allow_generate", False):
+    if not _coerce_bool(p.get("allow_generate")):
         return _ok(would_generate=True, settings=settings, ignored_settings=ignored,
                    note="Pass allow_generate=True to call CreateSubtitlesFromAudio.")
     if not _has_method(tl, "CreateSubtitlesFromAudio"):
@@ -18550,10 +18550,10 @@ def _safe_project_archive(pm, p: Dict[str, Any]) -> Dict[str, Any]:
         return _err(flag_err, code="INVALID_ARCHIVE_FLAG", category="invalid_input")
     src_media, render_cache, proxy_media = (flags["src_media"], flags["render_cache"],
                                             flags["proxy_media"])
-    if (src_media or render_cache or proxy_media) and not p.get("allow_media_archive", False):
+    if (src_media or render_cache or proxy_media) and not _coerce_bool(p.get("allow_media_archive")):
         return _err("Archive media/cache/proxy flags must stay false unless allow_media_archive=True")
     # allow_media_archive guards size; this guards the crash. Both are required.
-    if not p.get("acknowledge_trap"):
+    if not _coerce_bool(p.get("acknowledge_trap")):
         refused = archive_guard.crash_refusal("project_manager", "safe_project_archive", flags)
         if refused:
             return refused
@@ -18600,7 +18600,7 @@ def _safe_project_delete(pm, p: Dict[str, Any]) -> Dict[str, Any]:
     from src.utils.project_cleanup import delete_project_safely
     current_name = current.GetName() if current and _has_method(current, "GetName") else None
     if current_name == name:
-        if not p.get("close_current", False):
+        if not _coerce_bool(p.get("close_current")):
             return _err("Refusing to delete the currently open project; pass close_current=True")
         saved = bool(pm.SaveProject()) if p.get("save_current", True) else None
         closed = bool(pm.CloseProject(current))
@@ -18646,7 +18646,7 @@ def _safe_set_current_database(pm, p: Dict[str, Any]) -> Dict[str, Any]:
     if not isinstance(db_info, dict) or not db_info.get("DbType") or not db_info.get("DbName"):
         return _err("db_info must include DbType and DbName")
     current = _ser(pm.GetCurrentDatabase()) if _has_method(pm, "GetCurrentDatabase") else None
-    dry_run = p.get("dry_run", True) or not p.get("allow_switch", False)
+    dry_run = p.get("dry_run", True) or not _coerce_bool(p.get("allow_switch"))
     if dry_run:
         return _ok(
             would_switch=True,
@@ -19233,7 +19233,7 @@ def project_manager(action: str, params: Optional[Dict[str, Any]] = None) -> Dic
             _open_name = _open.GetName() if _open else None
         except Exception:
             _open_name = None
-        if _open_name == p["name"] and not p.get("close_current", False):
+        if _open_name == p["name"] and not _coerce_bool(p.get("close_current")):
             return _err("Refusing to delete the currently open project; pass close_current=True")
         from src.utils.project_cleanup import delete_project_safely
         deleted = delete_project_safely(pm, p["name"])
@@ -19262,7 +19262,7 @@ def project_manager(action: str, params: Optional[Dict[str, Any]] = None) -> Dic
         flags, flag_err = archive_guard.read_flags(p)
         if flag_err:
             return _err(flag_err, code="INVALID_ARCHIVE_FLAG", category="invalid_input")
-        if not p.get("acknowledge_trap"):
+        if not _coerce_bool(p.get("acknowledge_trap")):
             refused = archive_guard.crash_refusal("project_manager", "archive", flags)
             if refused:
                 return refused
@@ -20354,7 +20354,7 @@ def _safe_quick_export(proj, p: Dict[str, Any]):
         return err
     if not validation["valid"]:
         return {"success": False, "validation": validation}
-    if p.get("dry_run") or not p.get("allow_render", False):
+    if p.get("dry_run") or not _coerce_bool(p.get("allow_render")):
         return _ok(would_render=False, preset=preset, params=params, validation=validation)
     before = set()
     if target_dir and os.path.isdir(target_dir):

package/src/utils/destructive_hook.py

@@ -833,7 +833,7 @@ TRAP_REFUSAL_EXEMPT_ACTIONS: FrozenSet[Tuple[str, str]] = frozenset({
 
 def _trap_acknowledged(params: Optional[Dict[str, Any]]) -> bool:
     """Did the caller explicitly accept a known-destructive behaviour?"""
-    return bool(isinstance(params, dict) and params.get("acknowledge_trap"))
+    return isinstance(params, dict) and coerce_bool(params.get("acknowledge_trap"))
 
 
 def _trap_block_response(

package/src/utils/mcp_transport.py

@@ -13,6 +13,9 @@ it, so a logged token would outlive the session in a file the state file's
 
 Security posture:
 - Default host is loopback; a non-loopback bind logs a loud warning.
+- DNS-rebinding protection follows the bind host (see
+  ``transport_security_for``); a loopback-only allowlist on a LAN bind
+  answered every request with 421 until v4.7.4 (issue #241).
 - Every HTTP request must carry ``Authorization: Bearer <token>`` (constant-time
   compared); otherwise 401.
 - stdio (the default transport) is unaffected by anything here.
@@ -36,6 +39,75 @@ def _state_path() -> str:
 # Resolved lazily so DAVINCI_RESOLVE_MCP_STATE_DIR set by a test harness is honored.
 TRANSPORT_STATE_PATH = _state_path()
 LOOPBACK_HOSTS = {"127.0.0.1", "localhost", "::1"}
+#: Binds that listen on every interface. A client never sends one of these as
+#: its Host header, so an allowlist cannot be derived from the bind address.
+WILDCARD_HOSTS = {"0.0.0.0", "::", ""}
+ALLOWED_HOSTS_ENV = "DAVINCI_MCP_ALLOWED_HOSTS"
+
+
+def _host_pattern(name: str) -> str:
+    """`Host`-header pattern for one name: any port, IPv6 literals bracketed."""
+    name = name.strip()
+    if ":" in name and not name.startswith("["):
+        name = f"[{name}]"
+    return f"{name}:*"
+
+
+def extra_allowed_hosts(env=None):
+    """Names from $DAVINCI_MCP_ALLOWED_HOSTS (comma-separated), stripped, deduped."""
+    raw = (env if env is not None else os.environ).get(ALLOWED_HOSTS_ENV, "")
+    seen, out = set(), []
+    for name in raw.split(","):
+        name = name.strip()
+        if name and name not in seen:
+            seen.add(name)
+            out.append(name)
+    return out
+
+
+def transport_security_for(host, extra_hosts=()):
+    """The DNS-rebinding allowlist the transport should run with for `host`.
+
+    Returns None for a loopback bind: the SDK already pins the allowlist to
+    loopback when FastMCP is built without a host, and that is correct there.
+
+    Everything else exists because of issue #241. `src/server.py` builds
+    `FastMCP(...)` without a host, so the SDK (1.30.0,
+    `mcp/server/fastmcp/server.py`) auto-enables DNS-rebinding protection with
+    `allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"]`. `run_networked`
+    then set `settings.host` to the LAN address but never touched
+    `settings.transport_security`, and `streamable_http_app()` / `sse_app()`
+    hand that loopback-only allowlist to the transport middleware. Every request
+    to the LAN address therefore answered **421 Misdirected Request** — after the
+    bearer check, so a wrong token still got 401 and the bind looked healthy.
+    A non-loopback bind could never serve anyone.
+
+    - Specific non-loopback host: protection stays ON; the allowlist is the bind
+      host, the loopback names, and any extra names from
+      `$DAVINCI_MCP_ALLOWED_HOSTS` (for clients that reach the box by a DNS name
+      rather than the bound address).
+    - Wildcard bind (`0.0.0.0` / `::`): a client never sends the wildcard as its
+      Host, so with no extra names there is nothing to allow. Protection is then
+      turned OFF with a warning — the bearer token remains on every request, and
+      a rebinding page does not hold it. Set `$DAVINCI_MCP_ALLOWED_HOSTS` to keep
+      the protection on for a wildcard bind.
+    """
+    from mcp.server.transport_security import TransportSecuritySettings
+
+    if host in LOOPBACK_HOSTS:
+        return None
+    names = []
+    if host not in WILDCARD_HOSTS:
+        names.append(host)
+    names.extend(n for n in extra_hosts if n not in names)
+    if not names:
+        return TransportSecuritySettings(enable_dns_rebinding_protection=False)
+    names.extend(sorted(LOOPBACK_HOSTS))
+    return TransportSecuritySettings(
+        enable_dns_rebinding_protection=True,
+        allowed_hosts=[_host_pattern(n) for n in names],
+        allowed_origins=[f"http://{_host_pattern(n)}" for n in names],
+    )
 
 
 def resolve_token():
@@ -125,6 +197,24 @@ def run_networked(mcp, transport):
     mcp.settings.port = port
     token, generated = resolve_token()
 
+    # Must happen BEFORE the app is built: sse_app()/streamable_http_app() read
+    # settings.transport_security once, when they construct the middleware.
+    extra = extra_allowed_hosts()
+    security = transport_security_for(host, extra)
+    if security is not None:
+        mcp.settings.transport_security = security
+        if security.enable_dns_rebinding_protection:
+            logger.info("MCP transport Host allowlist: %s",
+                        ", ".join(security.allowed_hosts))
+        else:
+            logger.warning(
+                "SECURITY: MCP transport bound to %r with no %s set — a client "
+                "never sends the wildcard as its Host header, so DNS-rebinding "
+                "protection is OFF for this bind (the bearer token still gates "
+                "every request). Set %s to the names clients will use to keep "
+                "it on.", host, ALLOWED_HOSTS_ENV, ALLOWED_HOSTS_ENV,
+            )
+
     app = mcp.sse_app() if transport == "sse" else mcp.streamable_http_app()
     app.add_middleware(_auth_middleware_cls(token))