davinci-resolve-mcp 4.7.3 → 4.7.4

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.7.4 — the networked transport can serve a client on another machine
+
+### Fixed
+
+- **`--transport streamable-http` / `sse` bound to a LAN address answered every
+  request with HTTP 421.** ([#241](https://github.com/samuelgursky/davinci-resolve-mcp/issues/241), reported with the diagnosis by @TeamCLP)
+  `src/server.py` builds `FastMCP(...)` without a host, so the SDK (1.30.0)
+  auto-enables DNS-rebinding protection pinned to loopback
+  (`allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"]`). `run_networked` then
+  set `settings.host` to `DAVINCI_MCP_HOST` but never touched
+  `settings.transport_security`, and the app handed that loopback-only allowlist to
+  the transport middleware. The 421 came after the bearer check, so a wrong token
+  still got 401 and the bind looked healthy — a non-loopback bind could never serve
+  anyone, including an instance the control panel's Start button launched.
+  Reproduced on v4.7.3 with the real SDK app before the fix (LAN Host → 421, wrong
+  token → 401, loopback → 200).
+  - New `transport_security_for(host, extra_hosts)` in `src/utils/mcp_transport.py`,
+    applied **before** the app is built (the app reads the setting once). Loopback
+    binds are untouched. A specific non-loopback bind keeps protection ON with an
+    allowlist of the bind host, loopback, and any names in the new
+    **`DAVINCI_MCP_ALLOWED_HOSTS`** (comma-separated, for clients that reach the box
+    by a DNS name); IPv6 literals are bracketed. A wildcard bind (`0.0.0.0` / `::`)
+    with no names listed turns the Host check off with a warning, since a client
+    never sends the wildcard as its Host — the bearer token remains on every request.
+  - `tests/test_mcp_transport_host_allowlist.py`: the policy table plus the real
+    streamable-http app through `run_networked` — LAN Host 200, wrong token 401,
+    loopback 200, foreign Host still 421. `SECURITY.md` and `docs/install.md`
+    describe the allowlist and the new variable.
+
 ## What's New in v4.7.3 — a false spelling no longer grants permission on six opt-in flags
 
 ### Fixed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.7.3-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.4-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.7.3-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.4-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.7.3 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.7.4 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/SECURITY.md

@@ -24,7 +24,11 @@ Their posture:
 - **Loopback only.** The panel refuses any bind host other than
   `127.0.0.1` / `localhost` / `::1` — the bind address is not a tool parameter
   an AI can widen. The transport defaults to loopback and logs a loud warning
-  if `DAVINCI_MCP_HOST` points elsewhere.
+  if `DAVINCI_MCP_HOST` points elsewhere. On a non-loopback bind its
+  DNS-rebinding allowlist is the bind host plus loopback, extended by
+  `DAVINCI_MCP_ALLOWED_HOSTS` (comma-separated names clients will use); on a
+  wildcard bind (`0.0.0.0` / `::`) with that variable unset the Host check is
+  off and the bearer token is the only gate, and the log says so.
 - **Bearer token on every request.** Each panel launch generates a fresh
   `secrets.token_urlsafe(32)` token, passed to the child via environment (not
   argv) and delivered to the browser in the URL fragment (`#token=…`), which

package/docs/install.md

@@ -237,6 +237,18 @@ Network scripting permits remote control of Resolve. Prefer Local mode when
 remote access is unnecessary; otherwise restrict access with host firewall and
 network controls.
 
+The MCP server's own networked transport (`--transport streamable-http` or
+`sse`) binds `127.0.0.1:8000` by default and requires `Authorization: Bearer
+<token>` on every request (`DAVINCI_MCP_TOKEN`, or a generated one). To serve a
+client on another machine, set `DAVINCI_MCP_HOST` to the address to bind and,
+if clients reach the box by a DNS name rather than that address, list the names
+in `DAVINCI_MCP_ALLOWED_HOSTS` (comma-separated). The transport keeps
+DNS-rebinding protection on, pinned to the bind host, loopback, and those
+names; a request whose `Host` header is none of them gets 421. A wildcard bind
+(`0.0.0.0` / `::`) with no names listed turns the Host check off, since a
+client never sends the wildcard as its Host, and the bearer token is then the
+only gate. Restrict a non-loopback bind with a host firewall.
+
 Run the read-only doctor against Network mode explicitly:
 
 ```bash

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.7.3"
+VERSION = "4.7.4"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.7.3",
+  "version": "4.7.4",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/granular/common.py

@@ -93,7 +93,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.7.3"
+VERSION = "4.7.4"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.7.3"
+VERSION = "4.7.4"
 
 import base64
 import os

package/src/utils/mcp_transport.py

@@ -13,6 +13,9 @@ it, so a logged token would outlive the session in a file the state file's
 
 Security posture:
 - Default host is loopback; a non-loopback bind logs a loud warning.
+- DNS-rebinding protection follows the bind host (see
+  ``transport_security_for``); a loopback-only allowlist on a LAN bind
+  answered every request with 421 until v4.7.4 (issue #241).
 - Every HTTP request must carry ``Authorization: Bearer <token>`` (constant-time
   compared); otherwise 401.
 - stdio (the default transport) is unaffected by anything here.
@@ -36,6 +39,75 @@ def _state_path() -> str:
 # Resolved lazily so DAVINCI_RESOLVE_MCP_STATE_DIR set by a test harness is honored.
 TRANSPORT_STATE_PATH = _state_path()
 LOOPBACK_HOSTS = {"127.0.0.1", "localhost", "::1"}
+#: Binds that listen on every interface. A client never sends one of these as
+#: its Host header, so an allowlist cannot be derived from the bind address.
+WILDCARD_HOSTS = {"0.0.0.0", "::", ""}
+ALLOWED_HOSTS_ENV = "DAVINCI_MCP_ALLOWED_HOSTS"
+
+
+def _host_pattern(name: str) -> str:
+    """`Host`-header pattern for one name: any port, IPv6 literals bracketed."""
+    name = name.strip()
+    if ":" in name and not name.startswith("["):
+        name = f"[{name}]"
+    return f"{name}:*"
+
+
+def extra_allowed_hosts(env=None):
+    """Names from $DAVINCI_MCP_ALLOWED_HOSTS (comma-separated), stripped, deduped."""
+    raw = (env if env is not None else os.environ).get(ALLOWED_HOSTS_ENV, "")
+    seen, out = set(), []
+    for name in raw.split(","):
+        name = name.strip()
+        if name and name not in seen:
+            seen.add(name)
+            out.append(name)
+    return out
+
+
+def transport_security_for(host, extra_hosts=()):
+    """The DNS-rebinding allowlist the transport should run with for `host`.
+
+    Returns None for a loopback bind: the SDK already pins the allowlist to
+    loopback when FastMCP is built without a host, and that is correct there.
+
+    Everything else exists because of issue #241. `src/server.py` builds
+    `FastMCP(...)` without a host, so the SDK (1.30.0,
+    `mcp/server/fastmcp/server.py`) auto-enables DNS-rebinding protection with
+    `allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"]`. `run_networked`
+    then set `settings.host` to the LAN address but never touched
+    `settings.transport_security`, and `streamable_http_app()` / `sse_app()`
+    hand that loopback-only allowlist to the transport middleware. Every request
+    to the LAN address therefore answered **421 Misdirected Request** — after the
+    bearer check, so a wrong token still got 401 and the bind looked healthy.
+    A non-loopback bind could never serve anyone.
+
+    - Specific non-loopback host: protection stays ON; the allowlist is the bind
+      host, the loopback names, and any extra names from
+      `$DAVINCI_MCP_ALLOWED_HOSTS` (for clients that reach the box by a DNS name
+      rather than the bound address).
+    - Wildcard bind (`0.0.0.0` / `::`): a client never sends the wildcard as its
+      Host, so with no extra names there is nothing to allow. Protection is then
+      turned OFF with a warning — the bearer token remains on every request, and
+      a rebinding page does not hold it. Set `$DAVINCI_MCP_ALLOWED_HOSTS` to keep
+      the protection on for a wildcard bind.
+    """
+    from mcp.server.transport_security import TransportSecuritySettings
+
+    if host in LOOPBACK_HOSTS:
+        return None
+    names = []
+    if host not in WILDCARD_HOSTS:
+        names.append(host)
+    names.extend(n for n in extra_hosts if n not in names)
+    if not names:
+        return TransportSecuritySettings(enable_dns_rebinding_protection=False)
+    names.extend(sorted(LOOPBACK_HOSTS))
+    return TransportSecuritySettings(
+        enable_dns_rebinding_protection=True,
+        allowed_hosts=[_host_pattern(n) for n in names],
+        allowed_origins=[f"http://{_host_pattern(n)}" for n in names],
+    )
 
 
 def resolve_token():
@@ -125,6 +197,24 @@ def run_networked(mcp, transport):
     mcp.settings.port = port
     token, generated = resolve_token()
 
+    # Must happen BEFORE the app is built: sse_app()/streamable_http_app() read
+    # settings.transport_security once, when they construct the middleware.
+    extra = extra_allowed_hosts()
+    security = transport_security_for(host, extra)
+    if security is not None:
+        mcp.settings.transport_security = security
+        if security.enable_dns_rebinding_protection:
+            logger.info("MCP transport Host allowlist: %s",
+                        ", ".join(security.allowed_hosts))
+        else:
+            logger.warning(
+                "SECURITY: MCP transport bound to %r with no %s set — a client "
+                "never sends the wildcard as its Host header, so DNS-rebinding "
+                "protection is OFF for this bind (the bearer token still gates "
+                "every request). Set %s to the names clients will use to keep "
+                "it on.", host, ALLOWED_HOSTS_ENV, ALLOWED_HOSTS_ENV,
+            )
+
     app = mcp.sse_app() if transport == "sse" else mcp.streamable_http_app()
     app.add_middleware(_auth_middleware_cls(token))