davinci-resolve-mcp 4.7.3 → 4.7.5

package/CHANGELOG.md

@@ -2,6 +2,54 @@
 
 Release history for the DaVinci Resolve MCP Server. The latest release is summarized in the root README; older entries live here to keep the README focused.
 
+## What's New in v4.7.5 — the control panel serves on the `::1` loopback it accepts
+
+### Fixed
+
+- **`open_control_panel(host="::1")` was accepted by both loopback guards and could
+  never start.** ([#242](https://github.com/samuelgursky/davinci-resolve-mcp/pull/242), @Dev-next-gen)
+  The panel's `ThreadingHTTPServer` is AF_INET, so binding `("::1", port)` raised
+  `socket.gaierror` and the tool reported "Control panel child exited (rc=1) before
+  serving" — while the panel's own `--host` refusal message listed `::1` as allowed.
+  Behind it, the launch URL, the pidfile URL and the `/api/boot` probe URL were all
+  written `http://::1:<port>/`, which neither a browser nor urllib parses.
+  `make_panel_server()` now uses an AF_INET6 subclass for an IPv6 literal, and the
+  three URLs bracket the host. The Host/Origin gate already accepted `[::1]`; IPv4
+  and `localhost` take the same paths as before. Guard test:
+  `tests/test_control_panel_ipv6_loopback.py` launches the real panel on `::1`
+  through `_open_control_panel`, GETs `/` over IPv6, parses the issued URL, and probes
+  `/api/boot` with the issued token; it skips on a host with no IPv6 loopback and ran
+  (did not skip) on the macOS landing machine.
+
+## What's New in v4.7.4 — the networked transport can serve a client on another machine
+
+### Fixed
+
+- **`--transport streamable-http` / `sse` bound to a LAN address answered every
+  request with HTTP 421.** ([#241](https://github.com/samuelgursky/davinci-resolve-mcp/issues/241), reported with the diagnosis by @TeamCLP)
+  `src/server.py` builds `FastMCP(...)` without a host, so the SDK (1.30.0)
+  auto-enables DNS-rebinding protection pinned to loopback
+  (`allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"]`). `run_networked` then
+  set `settings.host` to `DAVINCI_MCP_HOST` but never touched
+  `settings.transport_security`, and the app handed that loopback-only allowlist to
+  the transport middleware. The 421 came after the bearer check, so a wrong token
+  still got 401 and the bind looked healthy — a non-loopback bind could never serve
+  anyone, including an instance the control panel's Start button launched.
+  Reproduced on v4.7.3 with the real SDK app before the fix (LAN Host → 421, wrong
+  token → 401, loopback → 200).
+  - New `transport_security_for(host, extra_hosts)` in `src/utils/mcp_transport.py`,
+    applied **before** the app is built (the app reads the setting once). Loopback
+    binds are untouched. A specific non-loopback bind keeps protection ON with an
+    allowlist of the bind host, loopback, and any names in the new
+    **`DAVINCI_MCP_ALLOWED_HOSTS`** (comma-separated, for clients that reach the box
+    by a DNS name); IPv6 literals are bracketed. A wildcard bind (`0.0.0.0` / `::`)
+    with no names listed turns the Host check off with a warning, since a client
+    never sends the wildcard as its Host — the bearer token remains on every request.
+  - `tests/test_mcp_transport_host_allowlist.py`: the policy table plus the real
+    streamable-http app through `run_networked` — LAN Host 200, wrong token 401,
+    loopback 200, foreign Host still 421. `SECURITY.md` and `docs/install.md`
+    describe the allowlist and the new variable.
+
 ## What's New in v4.7.3 — a false spelling no longer grants permission on six opt-in flags
 
 ### Fixed

package/README.md

@@ -2,7 +2,7 @@
 
 English | [简体中文](README.zh-CN.md)
 
-[![Version](https://img.shields.io/badge/version-4.7.3-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.5-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#server-modes)

package/README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 简体中文
 
-[![Version](https://img.shields.io/badge/version-4.7.3-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
+[![Version](https://img.shields.io/badge/version-4.7.5-blue.svg)](https://github.com/samuelgursky/davinci-resolve-mcp/releases)
 [![npm](https://img.shields.io/npm/v/davinci-resolve-mcp.svg?label=npm&color=CB3837)](https://www.npmjs.com/package/davinci-resolve-mcp)
 [![API Coverage](https://img.shields.io/badge/API%20Coverage-100%25-brightgreen.svg)](docs/reference/api-coverage.md)
 [![Tools](https://img.shields.io/badge/MCP%20Tools-37%20(389%20full)-blue.svg)](#服务器模式)
@@ -12,7 +12,7 @@
 [![Python](https://img.shields.io/badge/python-3.10+-green.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
-> 本翻译对应 v4.7.3 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
+> 本翻译对应 v4.7.5 版 README。如与英文原版有出入，以 [英文原版](README.md) 为准。
 
 一个 Model Context Protocol (MCP) 服务器，让 AI 助手通过官方脚本 API 控制 DaVinci Resolve Studio（达芬奇）。它提供完整的 API 覆盖，外加带护栏的工作流助手，涵盖剪辑、媒体池整理、渲染设置、审阅标记、调色、Fusion、Fairlight、项目生命周期任务、扩展开发，以及不碰源媒体的媒体分析。
 

package/SECURITY.md

@@ -24,7 +24,11 @@ Their posture:
 - **Loopback only.** The panel refuses any bind host other than
   `127.0.0.1` / `localhost` / `::1` — the bind address is not a tool parameter
   an AI can widen. The transport defaults to loopback and logs a loud warning
-  if `DAVINCI_MCP_HOST` points elsewhere.
+  if `DAVINCI_MCP_HOST` points elsewhere. On a non-loopback bind its
+  DNS-rebinding allowlist is the bind host plus loopback, extended by
+  `DAVINCI_MCP_ALLOWED_HOSTS` (comma-separated names clients will use); on a
+  wildcard bind (`0.0.0.0` / `::`) with that variable unset the Host check is
+  off and the bearer token is the only gate, and the log says so.
 - **Bearer token on every request.** Each panel launch generates a fresh
   `secrets.token_urlsafe(32)` token, passed to the child via environment (not
   argv) and delivered to the browser in the URL fragment (`#token=…`), which

package/docs/install.md

@@ -237,6 +237,18 @@ Network scripting permits remote control of Resolve. Prefer Local mode when
 remote access is unnecessary; otherwise restrict access with host firewall and
 network controls.
 
+The MCP server's own networked transport (`--transport streamable-http` or
+`sse`) binds `127.0.0.1:8000` by default and requires `Authorization: Bearer
+<token>` on every request (`DAVINCI_MCP_TOKEN`, or a generated one). To serve a
+client on another machine, set `DAVINCI_MCP_HOST` to the address to bind and,
+if clients reach the box by a DNS name rather than that address, list the names
+in `DAVINCI_MCP_ALLOWED_HOSTS` (comma-separated). The transport keeps
+DNS-rebinding protection on, pinned to the bind host, loopback, and those
+names; a request whose `Host` header is none of them gets 421. A wildcard bind
+(`0.0.0.0` / `::`) with no names listed turns the Host check off, since a
+client never sends the wildcard as its Host, and the bearer token is then the
+only gate. Restrict a non-loopback bind with a host firewall.
+
 Run the read-only doctor against Network mode explicitly:
 
 ```bash

package/install.py

@@ -37,7 +37,7 @@ from src.utils.update_check import (
 
 # ─── Version ──────────────────────────────────────────────────────────────────
 
-VERSION = "4.7.3"
+VERSION = "4.7.5"
 # Only hard floor: mcp[cli] requires Python 3.10+. There is no upper bound —
 # Resolve's scripting bridge loads into newer interpreters on recent builds
 # (Python 3.14 verified against Resolve Studio 20.3.2). Older Resolve builds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davinci-resolve-mcp",
-  "version": "4.7.3",
+  "version": "4.7.5",
   "description": "NPM bootstrapper for the DaVinci Resolve MCP Server.",
   "license": "MIT",
   "author": "Samuel Gursky <samgursky@gmail.com>",

package/src/analysis_dashboard.py

@@ -10,6 +10,7 @@ import json
 import os
 import re
 import secrets
+import socket
 import sqlite3
 import sys
 import threading
@@ -16289,6 +16290,23 @@ def _loopback_host(value: str) -> str:
     return value
 
 
+class _IPv6ThreadingHTTPServer(ThreadingHTTPServer):
+    address_family = socket.AF_INET6
+
+
+def make_panel_server(host: str, port: int, handler: type) -> ThreadingHTTPServer:
+    """Bind the panel. ThreadingHTTPServer is AF_INET, so `::1` needs the v6 class."""
+    bind = host.strip("[]")
+    server_cls = _IPv6ThreadingHTTPServer if ":" in bind else ThreadingHTTPServer
+    return server_cls((bind, port), handler)
+
+
+def panel_url_host(host: str) -> str:
+    """Host as it goes in a URL: an IPv6 literal must be bracketed."""
+    bind = host.strip("[]")
+    return f"[{bind}]" if ":" in bind else bind
+
+
 def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(description="Run the local Resolve MCP control panel.")
     parser.add_argument("--host", default="127.0.0.1", type=_loopback_host)
@@ -16325,10 +16343,10 @@ def main() -> None:
     state = DashboardState(args.project_name, args.project_id, args.analysis_root)
     Handler.state = state
     Handler.token = resolve_panel_token()
-    server = ThreadingHTTPServer((args.host, args.port), Handler)
+    server = make_panel_server(args.host, args.port, Handler)
     # The token rides in the URL fragment: browsers keep fragments client-side,
     # so it never appears in a request line, proxy log, or Referer.
-    url = f"http://{args.host}:{args.port}/#token={Handler.token}"
+    url = f"http://{panel_url_host(args.host)}:{args.port}/#token={Handler.token}"
     # flush: under --no-open the URL (with its token) is the only handle the
     # operator gets, and a piped/redirected stdout would otherwise hold it back.
     print(f"DaVinci Resolve MCP: {url}", flush=True)

package/src/granular/common.py

@@ -93,7 +93,7 @@ if not logging.getLogger().handlers:
         handlers=[logging.StreamHandler()],
     )
 
-VERSION = "4.7.3"
+VERSION = "4.7.5"
 logger = logging.getLogger("davinci-resolve-mcp")
 logger.info(f"Starting DaVinci Resolve MCP Server v{VERSION}")
 logger.info(f"Detected platform: {get_platform()}")

package/src/server.py

@@ -11,7 +11,7 @@ Usage:
     python src/server.py --full       # Start the 377-tool granular server instead
 """
 
-VERSION = "4.7.3"
+VERSION = "4.7.5"
 
 import base64
 import os
@@ -17491,6 +17491,11 @@ def _control_panel_read_token() -> Optional[str]:
 _CONTROL_PANEL_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "localhost", "::1"})
 
 
+def _control_panel_url_host(host: str) -> str:
+    """Host as it goes in a URL: `::1` must be written `[::1]`."""
+    return f"[{host}]" if ":" in host else host
+
+
 def _control_panel_pid_alive(pid: int) -> bool:
     """Check whether a PID is alive on this OS without killing it."""
     if not pid or pid <= 0:
@@ -17578,7 +17583,7 @@ def _control_panel_probe(host: str, port: int, timeout: float = 1.5,
     """
     import urllib.error
     import urllib.request
-    url = f"http://{host}:{port}/api/boot"
+    url = f"http://{_control_panel_url_host(host)}:{port}/api/boot"
     headers = {"Authorization": f"Bearer {token}"} if token else {}
     try:
         req = urllib.request.Request(url, headers=headers)
@@ -17838,7 +17843,7 @@ def _open_control_panel(p: Dict[str, Any]) -> Dict[str, Any]:
     # Write the pidfile so subsequent calls find it. The token travels in the
     # URL fragment — browsers never send fragments, so it stays out of every
     # request line and log.
-    url = f"http://{host}:{port}/#token={panel_token}"
+    url = f"http://{_control_panel_url_host(host)}:{port}/#token={panel_token}"
     state = {
         "pid": proc.pid,
         "port": port,

package/src/utils/mcp_transport.py

@@ -13,6 +13,9 @@ it, so a logged token would outlive the session in a file the state file's
 
 Security posture:
 - Default host is loopback; a non-loopback bind logs a loud warning.
+- DNS-rebinding protection follows the bind host (see
+  ``transport_security_for``); a loopback-only allowlist on a LAN bind
+  answered every request with 421 until v4.7.4 (issue #241).
 - Every HTTP request must carry ``Authorization: Bearer <token>`` (constant-time
   compared); otherwise 401.
 - stdio (the default transport) is unaffected by anything here.
@@ -36,6 +39,75 @@ def _state_path() -> str:
 # Resolved lazily so DAVINCI_RESOLVE_MCP_STATE_DIR set by a test harness is honored.
 TRANSPORT_STATE_PATH = _state_path()
 LOOPBACK_HOSTS = {"127.0.0.1", "localhost", "::1"}
+#: Binds that listen on every interface. A client never sends one of these as
+#: its Host header, so an allowlist cannot be derived from the bind address.
+WILDCARD_HOSTS = {"0.0.0.0", "::", ""}
+ALLOWED_HOSTS_ENV = "DAVINCI_MCP_ALLOWED_HOSTS"
+
+
+def _host_pattern(name: str) -> str:
+    """`Host`-header pattern for one name: any port, IPv6 literals bracketed."""
+    name = name.strip()
+    if ":" in name and not name.startswith("["):
+        name = f"[{name}]"
+    return f"{name}:*"
+
+
+def extra_allowed_hosts(env=None):
+    """Names from $DAVINCI_MCP_ALLOWED_HOSTS (comma-separated), stripped, deduped."""
+    raw = (env if env is not None else os.environ).get(ALLOWED_HOSTS_ENV, "")
+    seen, out = set(), []
+    for name in raw.split(","):
+        name = name.strip()
+        if name and name not in seen:
+            seen.add(name)
+            out.append(name)
+    return out
+
+
+def transport_security_for(host, extra_hosts=()):
+    """The DNS-rebinding allowlist the transport should run with for `host`.
+
+    Returns None for a loopback bind: the SDK already pins the allowlist to
+    loopback when FastMCP is built without a host, and that is correct there.
+
+    Everything else exists because of issue #241. `src/server.py` builds
+    `FastMCP(...)` without a host, so the SDK (1.30.0,
+    `mcp/server/fastmcp/server.py`) auto-enables DNS-rebinding protection with
+    `allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*"]`. `run_networked`
+    then set `settings.host` to the LAN address but never touched
+    `settings.transport_security`, and `streamable_http_app()` / `sse_app()`
+    hand that loopback-only allowlist to the transport middleware. Every request
+    to the LAN address therefore answered **421 Misdirected Request** — after the
+    bearer check, so a wrong token still got 401 and the bind looked healthy.
+    A non-loopback bind could never serve anyone.
+
+    - Specific non-loopback host: protection stays ON; the allowlist is the bind
+      host, the loopback names, and any extra names from
+      `$DAVINCI_MCP_ALLOWED_HOSTS` (for clients that reach the box by a DNS name
+      rather than the bound address).
+    - Wildcard bind (`0.0.0.0` / `::`): a client never sends the wildcard as its
+      Host, so with no extra names there is nothing to allow. Protection is then
+      turned OFF with a warning — the bearer token remains on every request, and
+      a rebinding page does not hold it. Set `$DAVINCI_MCP_ALLOWED_HOSTS` to keep
+      the protection on for a wildcard bind.
+    """
+    from mcp.server.transport_security import TransportSecuritySettings
+
+    if host in LOOPBACK_HOSTS:
+        return None
+    names = []
+    if host not in WILDCARD_HOSTS:
+        names.append(host)
+    names.extend(n for n in extra_hosts if n not in names)
+    if not names:
+        return TransportSecuritySettings(enable_dns_rebinding_protection=False)
+    names.extend(sorted(LOOPBACK_HOSTS))
+    return TransportSecuritySettings(
+        enable_dns_rebinding_protection=True,
+        allowed_hosts=[_host_pattern(n) for n in names],
+        allowed_origins=[f"http://{_host_pattern(n)}" for n in names],
+    )
 
 
 def resolve_token():
@@ -125,6 +197,24 @@ def run_networked(mcp, transport):
     mcp.settings.port = port
     token, generated = resolve_token()
 
+    # Must happen BEFORE the app is built: sse_app()/streamable_http_app() read
+    # settings.transport_security once, when they construct the middleware.
+    extra = extra_allowed_hosts()
+    security = transport_security_for(host, extra)
+    if security is not None:
+        mcp.settings.transport_security = security
+        if security.enable_dns_rebinding_protection:
+            logger.info("MCP transport Host allowlist: %s",
+                        ", ".join(security.allowed_hosts))
+        else:
+            logger.warning(
+                "SECURITY: MCP transport bound to %r with no %s set — a client "
+                "never sends the wildcard as its Host header, so DNS-rebinding "
+                "protection is OFF for this bind (the bearer token still gates "
+                "every request). Set %s to the names clients will use to keep "
+                "it on.", host, ALLOWED_HOSTS_ENV, ALLOWED_HOSTS_ENV,
+            )
+
     app = mcp.sse_app() if transport == "sse" else mcp.streamable_http_app()
     app.add_middleware(_auth_middleware_cls(token))