helixgen 0.19.1__tar.gz

helixgen-0.19.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mike Shea
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

helixgen-0.19.1/PKG-INFO

@@ -0,0 +1,132 @@
+Metadata-Version: 2.4
+Name: helixgen
+Version: 0.19.1
+Summary: Generate Line 6 Helix Stadium .hsp / legacy .hlx preset files from JSON tone specs.
+Author: Mike Shea
+License: MIT
+Project-URL: Homepage, https://github.com/sheax0r/helixgen-core
+Project-URL: Repository, https://github.com/sheax0r/helixgen-core
+Project-URL: Issues, https://github.com/sheax0r/helixgen-core/issues
+Keywords: line6,helix,guitar,preset,tone,hsp,impulse-response
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Multimedia :: Sound/Audio
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: click>=8.1
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4; extra == "dev"
+Provides-Extra: mcp
+Requires-Dist: mcp<2.0,>=1.0; extra == "mcp"
+Provides-Extra: device
+Requires-Dist: pyzmq>=25; extra == "device"
+Requires-Dist: msgpack>=1; extra == "device"
+Requires-Dist: paramiko>=3.4; extra == "device"
+Dynamic: license-file
+
+# helixgen-core
+
+The core Python library + CLI behind **helixgen**: generate Line 6 Helix
+Stadium `.hsp` presets (and legacy `.hlx`) from JSON tone recipes, edit them
+surgically in place, manage impulse responses by Stadium-exact content hash,
+and control a Helix Stadium directly over the LAN (OSC-over-ZeroMQ — no
+editor app).
+
+> ⚠️ **Unofficial tool — use at your own risk.** Not affiliated with or
+> endorsed by Line 6 / Yamaha (see [Trademark notice](#trademark-notice)).
+> Loading any user-generated preset on your hardware carries risk — rejected
+> loads, corrupted preset slots, on-device crashes. Review what you import.
+> The MIT [LICENSE](LICENSE) disclaims all warranty.
+
+## Repo family
+
+| Repo | What it is |
+|---|---|
+| **helixgen-core** (this repo) | The `helixgen` Python package: libs, CLI, MCP server |
+| [helixgen](https://github.com/sheax0r/helixgen) | The Claude Code plugin — `/tone`, `/setup`, `/device` skills + marketplace |
+| [helixgen-tui](https://github.com/sheax0r/helixgen-tui) | Terminal UI for tones, setlists, and device control |
+
+Want natural-language preset generation inside Claude Code? Install the
+[plugin](https://github.com/sheax0r/helixgen) — you don't need this repo
+directly. This repo is for using the CLI/library standalone, or developing
+against it.
+
+## Install
+
+Requires **Python 3.11+**. Not yet published to PyPI (coming); install from
+source for now:
+
+```bash
+pip install 'helixgen[device] @ git+https://github.com/sheax0r/helixgen-core'
+```
+
+Extras: `device` (network device control: pyzmq, msgpack, paramiko), `mcp`
+(the MCP server), `dev` (pytest).
+
+A standalone install starts with an empty block library — seed it first:
+
+```bash
+helixgen bootstrap
+```
+
+Computing IR hashes from WAVs (`register-irs <wav>`, `ir-scan`) additionally
+needs **libsndfile** (`brew install libsndfile` / `apt install libsndfile1`).
+
+## Quick tour
+
+```bash
+helixgen list-blocks --category amp        # browse the block library
+helixgen show-block "Brit Plexi Brt"       # exact param names/ranges
+helixgen generate recipe.json -o tone.hsp  # author a preset from a recipe
+helixgen set-param tone.hsp "Tape Echo Stereo" Mix 0.3   # surgical edit
+helixgen view tone.hsp                     # read a .hsp back as a recipe
+helixgen device list                       # talk to a Stadium on the LAN
+helixgen device sync my-setlist            # mirror a managed setlist onto it
+```
+
+Full references:
+
+- [`docs/CLI.md`](docs/CLI.md) — every verb, including the complete
+  `helixgen device` reference.
+- [`docs/recipe-reference.md`](docs/recipe-reference.md) — the exhaustive
+  recipe schema (paths, splits, snapshots, footswitches, expression, MIDI,
+  Command Center, IRs).
+- [`docs/ir-hash-algorithm.md`](docs/ir-hash-algorithm.md) — the
+  reverse-engineered Stadium IR hash, field-validated.
+- [`docs/helix-protocol.md`](docs/helix-protocol.md) — the network protocol.
+
+## Tests
+
+Run from a source checkout with the package on `PYTHONPATH`:
+
+```bash
+PYTHONPATH=$PWD/src python -m pytest
+```
+
+## Acknowledgments
+
+helixgen leans **heavily** on
+[**sensorium/phelix**](https://github.com/sensorium/phelix) — a
+community-maintained, hand-curated repository of Helix block JSON files. The
+`helixgen bootstrap` command clones phelix and ingests its `blocks/`
+directory; without that pre-extracted catalog the cold-start experience of
+this tool would be considerably worse.
+
+## Trademark notice
+
+helixgen is an unofficial community project. **Line 6**, **Helix**, **HX**,
+and related product names are trademarks of **Yamaha Guitar Group, Inc.**
+helixgen is not affiliated with, endorsed by, or sponsored by Line 6 or
+Yamaha. References in this project to Line 6 hardware, file formats (`.hlx`,
+`.hsp`), and model identifiers are descriptive — helixgen generates files
+intended to be compatible with Line 6 Helix devices but is not a Line 6
+product.
+
+If you are a representative of Line 6 / Yamaha and have concerns about this
+project's name or scope, please open an issue.

helixgen-0.19.1/README.md

@@ -0,0 +1,100 @@
+# helixgen-core
+
+The core Python library + CLI behind **helixgen**: generate Line 6 Helix
+Stadium `.hsp` presets (and legacy `.hlx`) from JSON tone recipes, edit them
+surgically in place, manage impulse responses by Stadium-exact content hash,
+and control a Helix Stadium directly over the LAN (OSC-over-ZeroMQ — no
+editor app).
+
+> ⚠️ **Unofficial tool — use at your own risk.** Not affiliated with or
+> endorsed by Line 6 / Yamaha (see [Trademark notice](#trademark-notice)).
+> Loading any user-generated preset on your hardware carries risk — rejected
+> loads, corrupted preset slots, on-device crashes. Review what you import.
+> The MIT [LICENSE](LICENSE) disclaims all warranty.
+
+## Repo family
+
+| Repo | What it is |
+|---|---|
+| **helixgen-core** (this repo) | The `helixgen` Python package: libs, CLI, MCP server |
+| [helixgen](https://github.com/sheax0r/helixgen) | The Claude Code plugin — `/tone`, `/setup`, `/device` skills + marketplace |
+| [helixgen-tui](https://github.com/sheax0r/helixgen-tui) | Terminal UI for tones, setlists, and device control |
+
+Want natural-language preset generation inside Claude Code? Install the
+[plugin](https://github.com/sheax0r/helixgen) — you don't need this repo
+directly. This repo is for using the CLI/library standalone, or developing
+against it.
+
+## Install
+
+Requires **Python 3.11+**. Not yet published to PyPI (coming); install from
+source for now:
+
+```bash
+pip install 'helixgen[device] @ git+https://github.com/sheax0r/helixgen-core'
+```
+
+Extras: `device` (network device control: pyzmq, msgpack, paramiko), `mcp`
+(the MCP server), `dev` (pytest).
+
+A standalone install starts with an empty block library — seed it first:
+
+```bash
+helixgen bootstrap
+```
+
+Computing IR hashes from WAVs (`register-irs <wav>`, `ir-scan`) additionally
+needs **libsndfile** (`brew install libsndfile` / `apt install libsndfile1`).
+
+## Quick tour
+
+```bash
+helixgen list-blocks --category amp        # browse the block library
+helixgen show-block "Brit Plexi Brt"       # exact param names/ranges
+helixgen generate recipe.json -o tone.hsp  # author a preset from a recipe
+helixgen set-param tone.hsp "Tape Echo Stereo" Mix 0.3   # surgical edit
+helixgen view tone.hsp                     # read a .hsp back as a recipe
+helixgen device list                       # talk to a Stadium on the LAN
+helixgen device sync my-setlist            # mirror a managed setlist onto it
+```
+
+Full references:
+
+- [`docs/CLI.md`](docs/CLI.md) — every verb, including the complete
+  `helixgen device` reference.
+- [`docs/recipe-reference.md`](docs/recipe-reference.md) — the exhaustive
+  recipe schema (paths, splits, snapshots, footswitches, expression, MIDI,
+  Command Center, IRs).
+- [`docs/ir-hash-algorithm.md`](docs/ir-hash-algorithm.md) — the
+  reverse-engineered Stadium IR hash, field-validated.
+- [`docs/helix-protocol.md`](docs/helix-protocol.md) — the network protocol.
+
+## Tests
+
+Run from a source checkout with the package on `PYTHONPATH`:
+
+```bash
+PYTHONPATH=$PWD/src python -m pytest
+```
+
+## Acknowledgments
+
+helixgen leans **heavily** on
+[**sensorium/phelix**](https://github.com/sensorium/phelix) — a
+community-maintained, hand-curated repository of Helix block JSON files. The
+`helixgen bootstrap` command clones phelix and ingests its `blocks/`
+directory; without that pre-extracted catalog the cold-start experience of
+this tool would be considerably worse.
+
+## Trademark notice
+
+helixgen is an unofficial community project. **Line 6**, **Helix**, **HX**,
+and related product names are trademarks of **Yamaha Guitar Group, Inc.**
+helixgen is not affiliated with, endorsed by, or sponsored by Line 6 or
+Yamaha. References in this project to Line 6 hardware, file formats (`.hlx`,
+`.hsp`), and model identifiers are descriptive — helixgen generates files
+intended to be compatible with Line 6 Helix devices but is not a Line 6
+product.
+
+If you are a representative of Line 6 / Yamaha and have concerns about this
+project's name or scope, please open an issue.

helixgen-0.19.1/helixgen.egg-info/PKG-INFO

@@ -0,0 +1,132 @@
+Metadata-Version: 2.4
+Name: helixgen
+Version: 0.19.1
+Summary: Generate Line 6 Helix Stadium .hsp / legacy .hlx preset files from JSON tone specs.
+Author: Mike Shea
+License: MIT
+Project-URL: Homepage, https://github.com/sheax0r/helixgen-core
+Project-URL: Repository, https://github.com/sheax0r/helixgen-core
+Project-URL: Issues, https://github.com/sheax0r/helixgen-core/issues
+Keywords: line6,helix,guitar,preset,tone,hsp,impulse-response
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Multimedia :: Sound/Audio
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: click>=8.1
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4; extra == "dev"
+Provides-Extra: mcp
+Requires-Dist: mcp<2.0,>=1.0; extra == "mcp"
+Provides-Extra: device
+Requires-Dist: pyzmq>=25; extra == "device"
+Requires-Dist: msgpack>=1; extra == "device"
+Requires-Dist: paramiko>=3.4; extra == "device"
+Dynamic: license-file
+
+# helixgen-core
+
+The core Python library + CLI behind **helixgen**: generate Line 6 Helix
+Stadium `.hsp` presets (and legacy `.hlx`) from JSON tone recipes, edit them
+surgically in place, manage impulse responses by Stadium-exact content hash,
+and control a Helix Stadium directly over the LAN (OSC-over-ZeroMQ — no
+editor app).
+
+> ⚠️ **Unofficial tool — use at your own risk.** Not affiliated with or
+> endorsed by Line 6 / Yamaha (see [Trademark notice](#trademark-notice)).
+> Loading any user-generated preset on your hardware carries risk — rejected
+> loads, corrupted preset slots, on-device crashes. Review what you import.
+> The MIT [LICENSE](LICENSE) disclaims all warranty.
+
+## Repo family
+
+| Repo | What it is |
+|---|---|
+| **helixgen-core** (this repo) | The `helixgen` Python package: libs, CLI, MCP server |
+| [helixgen](https://github.com/sheax0r/helixgen) | The Claude Code plugin — `/tone`, `/setup`, `/device` skills + marketplace |
+| [helixgen-tui](https://github.com/sheax0r/helixgen-tui) | Terminal UI for tones, setlists, and device control |
+
+Want natural-language preset generation inside Claude Code? Install the
+[plugin](https://github.com/sheax0r/helixgen) — you don't need this repo
+directly. This repo is for using the CLI/library standalone, or developing
+against it.
+
+## Install
+
+Requires **Python 3.11+**. Not yet published to PyPI (coming); install from
+source for now:
+
+```bash
+pip install 'helixgen[device] @ git+https://github.com/sheax0r/helixgen-core'
+```
+
+Extras: `device` (network device control: pyzmq, msgpack, paramiko), `mcp`
+(the MCP server), `dev` (pytest).
+
+A standalone install starts with an empty block library — seed it first:
+
+```bash
+helixgen bootstrap
+```
+
+Computing IR hashes from WAVs (`register-irs <wav>`, `ir-scan`) additionally
+needs **libsndfile** (`brew install libsndfile` / `apt install libsndfile1`).
+
+## Quick tour
+
+```bash
+helixgen list-blocks --category amp        # browse the block library
+helixgen show-block "Brit Plexi Brt"       # exact param names/ranges
+helixgen generate recipe.json -o tone.hsp  # author a preset from a recipe
+helixgen set-param tone.hsp "Tape Echo Stereo" Mix 0.3   # surgical edit
+helixgen view tone.hsp                     # read a .hsp back as a recipe
+helixgen device list                       # talk to a Stadium on the LAN
+helixgen device sync my-setlist            # mirror a managed setlist onto it
+```
+
+Full references:
+
+- [`docs/CLI.md`](docs/CLI.md) — every verb, including the complete
+  `helixgen device` reference.
+- [`docs/recipe-reference.md`](docs/recipe-reference.md) — the exhaustive
+  recipe schema (paths, splits, snapshots, footswitches, expression, MIDI,
+  Command Center, IRs).
+- [`docs/ir-hash-algorithm.md`](docs/ir-hash-algorithm.md) — the
+  reverse-engineered Stadium IR hash, field-validated.
+- [`docs/helix-protocol.md`](docs/helix-protocol.md) — the network protocol.
+
+## Tests
+
+Run from a source checkout with the package on `PYTHONPATH`:
+
+```bash
+PYTHONPATH=$PWD/src python -m pytest
+```
+
+## Acknowledgments
+
+helixgen leans **heavily** on
+[**sensorium/phelix**](https://github.com/sensorium/phelix) — a
+community-maintained, hand-curated repository of Helix block JSON files. The
+`helixgen bootstrap` command clones phelix and ingests its `blocks/`
+directory; without that pre-extracted catalog the cold-start experience of
+this tool would be considerably worse.
+
+## Trademark notice
+
+helixgen is an unofficial community project. **Line 6**, **Helix**, **HX**,
+and related product names are trademarks of **Yamaha Guitar Group, Inc.**
+helixgen is not affiliated with, endorsed by, or sponsored by Line 6 or
+Yamaha. References in this project to Line 6 hardware, file formats (`.hlx`,
+`.hsp`), and model identifiers are descriptive — helixgen generates files
+intended to be compatible with Line 6 Helix devices but is not a Line 6
+product.
+
+If you are a representative of Line 6 / Yamaha and have concerns about this
+project's name or scope, please open an issue.

helixgen-0.19.1/helixgen.egg-info/SOURCES.txt

@@ -0,0 +1,137 @@
+LICENSE
+README.md
+pyproject.toml
+helixgen.egg-info/PKG-INFO
+helixgen.egg-info/SOURCES.txt
+helixgen.egg-info/dependency_links.txt
+helixgen.egg-info/entry_points.txt
+helixgen.egg-info/requires.txt
+helixgen.egg-info/top_level.txt
+mcp_server/__init__.py
+mcp_server/__main__.py
+mcp_server/server.py
+mcp_server/tools.py
+mcp_server/data/__init__.py
+src/helixgen/__init__.py
+src/helixgen/bootstrap.py
+src/helixgen/chassis.py
+src/helixgen/cli.py
+src/helixgen/cli_device.py
+src/helixgen/controllers.py
+src/helixgen/flowparams.py
+src/helixgen/generate.py
+src/helixgen/hsp.py
+src/helixgen/ingest.py
+src/helixgen/ir.py
+src/helixgen/irhash_cache.py
+src/helixgen/library.py
+src/helixgen/mutate.py
+src/helixgen/preferences.py
+src/helixgen/recipe.py
+src/helixgen/spec.py
+src/helixgen/view.py
+src/helixgen/device/__init__.py
+src/helixgen/device/_defs_data.json
+src/helixgen/device/_modelmap.json
+src/helixgen/device/_settings_pages.json
+src/helixgen/device/backup.py
+src/helixgen/device/bridge.py
+src/helixgen/device/client.py
+src/helixgen/device/content.py
+src/helixgen/device/defs.py
+src/helixgen/device/globaleq.py
+src/helixgen/device/hss.py
+src/helixgen/device/ir_upload.py
+src/helixgen/device/irmd.py
+src/helixgen/device/maintenance.py
+src/helixgen/device/manifest.py
+src/helixgen/device/meters.py
+src/helixgen/device/modelmap.py
+src/helixgen/device/osc.py
+src/helixgen/device/reorder.py
+src/helixgen/device/setlist_sync.py
+src/helixgen/device/settings.py
+src/helixgen/device/sftp.py
+src/helixgen/device/subscribe.py
+src/helixgen/device/transcode.py
+src/helixgen/device/tuner.py
+tests/test_bootstrap.py
+tests/test_chassis.py
+tests/test_cli.py
+tests/test_cli_library.py
+tests/test_commands.py
+tests/test_controller_depth.py
+tests/test_controllers.py
+tests/test_decompile.py
+tests/test_decompile_acceptance.py
+tests/test_decompile_advanced.py
+tests/test_decompile_sonic_fidelity.py
+tests/test_device_backup.py
+tests/test_device_bridge.py
+tests/test_device_cli.py
+tests/test_device_client.py
+tests/test_device_content.py
+tests/test_device_defs.py
+tests/test_device_extra_import_surface.py
+tests/test_device_globaleq.py
+tests/test_device_irmd.py
+tests/test_device_live.py
+tests/test_device_liveops.py
+tests/test_device_maintenance.py
+tests/test_device_meters.py
+tests/test_device_modelmap.py
+tests/test_device_osc.py
+tests/test_device_reorder.py
+tests/test_device_settings.py
+tests/test_device_sftp.py
+tests/test_device_slots_cli.py
+tests/test_device_subscribe.py
+tests/test_device_tuner.py
+tests/test_flowparams.py
+tests/test_generate.py
+tests/test_generate_combined.py
+tests/test_generate_expression.py
+tests/test_generate_flow.py
+tests/test_generate_footswitches.py
+tests/test_generate_input.py
+tests/test_generate_snapshots.py
+tests/test_hsp.py
+tests/test_hss.py
+tests/test_hss_cli.py
+tests/test_ingest.py
+tests/test_input_reshape.py
+tests/test_ir_cache_cli.py
+tests/test_ir_cli.py
+tests/test_ir_generate.py
+tests/test_ir_ingest.py
+tests/test_ir_mapping.py
+tests/test_ir_preset.py
+tests/test_ir_spec.py
+tests/test_ir_upload.py
+tests/test_irhash_cache.py
+tests/test_library.py
+tests/test_manifest.py
+tests/test_manifest_ops.py
+tests/test_manifest_v2.py
+tests/test_midi_controllers.py
+tests/test_mutate.py
+tests/test_mutate_cli.py
+tests/test_mutate_flow.py
+tests/test_preferences.py
+tests/test_recipe.py
+tests/test_roundtrip.py
+tests/test_setlist_sync.py
+tests/test_setlist_sync_mirror.py
+tests/test_spec.py
+tests/test_spec_commands.py
+tests/test_spec_expression.py
+tests/test_spec_flow.py
+tests/test_spec_footswitches.py
+tests/test_spec_input.py
+tests/test_spec_midi.py
+tests/test_trails_fxloop.py
+tests/test_transcode.py
+tests/test_transcode_flow.py
+tests/test_view.py
+tests/test_view_cli.py
+tests/test_view_flow.py

helixgen-0.19.1/helixgen.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

helixgen-0.19.1/helixgen.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+helixgen = helixgen.cli:cli

helixgen-0.19.1/helixgen.egg-info/requires.txt

@@ -0,0 +1,12 @@
+click>=8.1
+
+[dev]
+pytest>=7.4
+
+[device]
+pyzmq>=25
+msgpack>=1
+paramiko>=3.4
+
+[mcp]
+mcp<2.0,>=1.0

helixgen-0.19.1/helixgen.egg-info/top_level.txt

@@ -0,0 +1,2 @@
+helixgen
+mcp_server

helixgen-0.19.1/mcp_server/__init__.py

@@ -0,0 +1,9 @@
+"""helixgen MCP server — drives the helixgen library from an MCP client."""
+
+# Track the helixgen library version rather than carrying a separate number
+# that drifts out of date. The plugin/pip environments always have helixgen
+# importable; the fallback only matters in a stripped-down context.
+try:
+    from helixgen import __version__
+except Exception:  # pragma: no cover - helixgen not importable
+    __version__ = "0.0.0"

helixgen-0.19.1/mcp_server/__main__.py

@@ -0,0 +1,66 @@
+"""Entry point for `python -m mcp_server`.
+
+Two transports, picked by the MCP_TRANSPORT env var:
+
+- `stdio` (Claude Code spawning the server as a subprocess) — no host/port,
+  no allow-list config. The harness pipes JSON-RPC over stdin/stdout. This is
+  what the shipped plugin uses.
+- `streamable-http` (default; the Render deploy) — binds MCP_HOST:$PORT. The
+  bind host defaults to the loopback `127.0.0.1`; a deploy that must accept
+  external connections (e.g. Render) opts in explicitly with MCP_HOST=0.0.0.0.
+  DNS-rebinding protection (TransportSecuritySettings) is installed
+  unconditionally and is fail-closed: with no MCP_ALLOWED_HOSTS set it defaults
+  to loopback Host headers only, so the default 127.0.0.1 bind works out of the
+  box while a stray public Host header is rejected. A public deploy
+  (MCP_HOST=0.0.0.0) must therefore also set MCP_ALLOWED_HOSTS (CSV, e.g. its
+  external hostname); MCP_ALLOWED_ORIGINS (CSV) further restricts Origins.
+
+In mcp 1.27.2 the host/port live on app.settings (not on app.run()), so we
+mutate the settings before run().
+"""
+from __future__ import annotations
+
+import os
+
+from mcp.server.transport_security import TransportSecuritySettings
+
+from mcp_server.server import app
+
+
+def _csv_env(name: str) -> list[str]:
+    raw = os.environ.get(name, "")
+    return [s.strip() for s in raw.split(",") if s.strip()]
+
+
+def main() -> None:
+    transport = os.environ.get("MCP_TRANSPORT", "streamable-http")
+
+    if transport == "stdio":
+        app.run(transport="stdio")
+        return
+
+    # Default to loopback; opt in to a public bind with MCP_HOST=0.0.0.0.
+    app.settings.host = os.environ.get("MCP_HOST", "127.0.0.1")
+    app.settings.port = int(os.environ.get("PORT", "10000"))
+
+    # Always install DNS-rebinding protection (enable_dns_rebinding_protection
+    # defaults to True). The middleware is fail-closed: an empty allowed_hosts
+    # rejects *every* Host header, so we supply a loopback default that keeps
+    # the default 127.0.0.1 bind working. A public deploy must set
+    # MCP_ALLOWED_HOSTS to its external hostname.
+    allowed_hosts = _csv_env("MCP_ALLOWED_HOSTS") or [
+        "127.0.0.1",
+        "127.0.0.1:*",
+        "localhost",
+        "localhost:*",
+    ]
+    app.settings.transport_security = TransportSecuritySettings(
+        allowed_hosts=allowed_hosts,
+        allowed_origins=_csv_env("MCP_ALLOWED_ORIGINS"),
+    )
+
+    app.run(transport="streamable-http")
+
+
+if __name__ == "__main__":
+    main()