ha-mcp-dev 7.9.0.dev767__tar.gz → 7.9.0.dev768__tar.gz

{ha_mcp_dev-7.9.0.dev767/src/ha_mcp_dev.egg-info → ha_mcp_dev-7.9.0.dev768}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.9.0.dev767
+Version: 7.9.0.dev768
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.9.0.dev767 → ha_mcp_dev-7.9.0.dev768}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "7.9.0.dev767"
+version = "7.9.0.dev768"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-7.9.0.dev767 → ha_mcp_dev-7.9.0.dev768}/src/ha_mcp/__main__.py

@@ -318,6 +318,15 @@ def _create_server() -> "HomeAssistantSmartMCPServer":
     """Create server instance (deferred to avoid import during smoke test)."""
     from pydantic import ValidationError
 
+    # Every deferred-``mcp`` entry point funnels through here before its
+    # Streamable-HTTP app is built -- ha-mcp-web, the add-on, and the
+    # ``fastmcp run fastmcp-http.json`` container path -- so default fastmcp's
+    # DNS-rebinding guard off once, here, for all of them. Direct-construction
+    # paths (_run_oauth_server, the in-process component server) call it themselves.
+    from ha_mcp.transport_security import ensure_host_origin_guard_default_off
+
+    ensure_host_origin_guard_default_off()
+
     try:
         from ha_mcp.server import HomeAssistantSmartMCPServer
 
@@ -823,8 +832,6 @@ def _maybe_spawn_settings_sidecar() -> None:
 
 def main_dev() -> None:
     """Run server with DEBUG logging enabled (for ha-mcp-dev package)."""
-    import os
-
     os.environ["LOG_LEVEL"] = "DEBUG"
     main()
 
@@ -1094,6 +1101,8 @@ def _run_http_server(transport: str, default_port: int = 8086) -> None:
     """
     from ha_mcp.settings_ui import register_settings_routes
 
+    # The DNS-rebinding guard is defaulted off in _create_server (reached here via
+    # _get_mcp below, before the app is built) -- see transport_security.
     host, port, path = _get_http_runtime(default_port)
     _warn_if_default_path_exposed(host, port, path)
     # SSE transport answers GET with 200 (the event stream), so a GET->405 there
@@ -1224,6 +1233,12 @@ async def _run_oauth_server(
     """
     from ha_mcp.auth import HomeAssistantOAuthProvider
     from ha_mcp.server import HomeAssistantSmartMCPServer
+    from ha_mcp.transport_security import ensure_host_origin_guard_default_off
+
+    # Browser OAuth clients (Claude.ai / ChatGPT) reach the discovery endpoints
+    # cross-origin, and users front this server with proxies/tunnels on arbitrary
+    # hosts; default fastmcp's DNS-rebinding guard off so it does not 403/421 them.
+    ensure_host_origin_guard_default_off()
 
     # Create OAuth provider
     auth_provider = HomeAssistantOAuthProvider(

ha_mcp_dev-7.9.0.dev768/src/ha_mcp/transport_security.py

@@ -0,0 +1,90 @@
+"""Transport-security defaults for ha-mcp's Streamable-HTTP servers.
+
+fastmcp >= 3.4.3 ships ``HostOriginGuardMiddleware`` (a DNS-rebinding guard) that
+is **on by default**. Inserted at the front of the Streamable-HTTP ASGI stack, it
+rejects any request whose ``Host`` header is not loopback / an explicitly-allowed
+host with ``421 Misdirected Request``, and any browser ``Origin`` that is not
+same-origin / loopback / explicitly allowed with ``403 Forbidden`` -- before the
+request reaches any route.
+
+That default is wrong for ha-mcp. We are *designed* to be reached through
+operator-chosen reverse proxies and tunnels (Cloudflare Tunnel, nginx, Traefik,
+Nabu Casa Remote UI) and via direct LAN IPs, whose ``Host`` values we cannot
+enumerate. Leaving the guard on would ``421`` the majority of real deployments --
+including the plain browser landing page, which is a no-``Origin`` navigation
+that still trips the ``Host`` check.
+
+Our security boundary is the high-entropy secret path (and, in OAuth mode, the
+per-user token), not the ``Host`` header. The loopback settings sidecar enforces
+its *own* Host/Origin allow-list (see ``stdio_settings_sidecar``), independent of
+this setting. So defaulting fastmcp's guard off on the main server restores
+exactly the pre-3.4.3 behaviour without giving up the protection that matters.
+
+Operators who front ha-mcp differently can re-enable the guard (and pin their
+own allow-lists) via ``FASTMCP_HTTP_HOST_ORIGIN_PROTECTION=true`` plus
+``FASTMCP_HTTP_ALLOWED_HOSTS`` / ``FASTMCP_HTTP_ALLOWED_ORIGINS``.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+
+logger = logging.getLogger(__name__)
+
+#: fastmcp's env var for the Host/Origin (DNS-rebinding) guard. Present as a
+#: field on fastmcp's Settings only from 3.4.3 onward.
+HOST_ORIGIN_PROTECTION_ENV = "FASTMCP_HTTP_HOST_ORIGIN_PROTECTION"
+
+#: fastmcp Settings attribute backing the env var above.
+_HOST_ORIGIN_PROTECTION_ATTR = "http_host_origin_protection"
+
+
+def ensure_host_origin_guard_default_off() -> None:
+    """Default fastmcp's Host/Origin guard off for ha-mcp's Streamable-HTTP servers.
+
+    Idempotent and safe to call from every server-creation path. Call before the
+    Streamable-HTTP app is built (``mcp.http_app()`` / ``mcp.run(transport="http")``
+    / ``mcp.run_async(...)``): ``http_app`` reads
+    ``fastmcp.settings.http_host_origin_protection`` at build time, so mutating
+    that singleton beforehand deterministically neutralises the guard.
+
+    Does nothing when the running fastmcp predates the guard (the setting field is
+    absent, i.e. < 3.4.3) or when the operator set the env var explicitly (their
+    choice wins). A failed mutation is logged at WARNING and left retryable -- it
+    is not recorded as done -- so a later reload re-attempts it.
+    """
+    try:
+        import fastmcp
+    except Exception:  # pragma: no cover - fastmcp is a hard dependency
+        return
+
+    settings = getattr(fastmcp, "settings", None)
+    if settings is None or not hasattr(settings, _HOST_ORIGIN_PROTECTION_ATTR):
+        # fastmcp < 3.4.3: no guard exists, nothing to disable.
+        return
+
+    if getattr(settings, _HOST_ORIGIN_PROTECTION_ATTR) is False:
+        # Already off -- a prior call, or the operator's own default. Idempotent.
+        return
+
+    if HOST_ORIGIN_PROTECTION_ENV in os.environ:
+        # Operator explicitly opted in (guard on); honour their choice.
+        return
+
+    try:
+        setattr(settings, _HOST_ORIGIN_PROTECTION_ATTR, False)
+    except Exception:
+        logger.warning(
+            "Could not disable fastmcp's Host/Origin (DNS-rebinding) guard; MCP "
+            "reached through a reverse proxy, tunnel, or LAN IP -- and the browser "
+            "landing page -- may fail with 421/403. Set %s=false, or pin "
+            "FASTMCP_HTTP_ALLOWED_HOSTS / FASTMCP_HTTP_ALLOWED_ORIGINS.",
+            HOST_ORIGIN_PROTECTION_ENV,
+            exc_info=True,
+        )
+        return
+
+    # Belt: honoured by any fresh ``Settings()`` read and by child processes. Set
+    # only after a confirmed mutation so a failed attempt stays retryable.
+    os.environ.setdefault(HOST_ORIGIN_PROTECTION_ENV, "false")

{ha_mcp_dev-7.9.0.dev767 → ha_mcp_dev-7.9.0.dev768/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 7.9.0.dev767
+Version: 7.9.0.dev768
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT

{ha_mcp_dev-7.9.0.dev767 → ha_mcp_dev-7.9.0.dev768}/src/ha_mcp_dev.egg-info/SOURCES.txt

@@ -14,6 +14,7 @@ src/ha_mcp/read_only.py
 src/ha_mcp/server.py
 src/ha_mcp/smoke_test.py
 src/ha_mcp/stdio_settings_sidecar.py
+src/ha_mcp/transport_security.py
 src/ha_mcp/update_check.py
 src/ha_mcp/auth/__init__.py
 src/ha_mcp/auth/consent_form.py