unifi-network-mcp 0.5.0__py3-none-any.whl → 0.5.2__py3-none-any.whl

src/_version.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '0.5.0'
-__version_tuple__ = version_tuple = (0, 5, 0)
+__version__ = version = '0.5.2'
+__version_tuple__ = version_tuple = (0, 5, 2)
 
 __commit_id__ = commit_id = None

src/config/config.yaml

@@ -8,8 +8,8 @@ unifi:
   controller_type: ${oc.env:UNIFI_CONTROLLER_TYPE,auto}
 
 server:
-  host: 0.0.0.0
-  port: 3000
+  host: ${oc.env:UNIFI_MCP_HOST,0.0.0.0}
+  port: ${oc.env:UNIFI_MCP_PORT,3000}
   log_level: INFO
 
   # Tool registration mode

src/runtime.py

@@ -80,10 +80,22 @@ def get_server() -> FastMCP:
     allowed_hosts_str = os.getenv("UNIFI_MCP_ALLOWED_HOSTS", "localhost,127.0.0.1")
     allowed_hosts = [h.strip() for h in allowed_hosts_str.split(",") if h.strip()]
 
+    # Allow disabling DNS rebinding protection entirely (default: enabled)
+    # Set to "false" for Kubernetes/proxy deployments where allowed_hosts is insufficient
+    enable_dns_rebinding = (
+        os.getenv("UNIFI_MCP_ENABLE_DNS_REBINDING_PROTECTION", "true").lower() == "true"
+    )
+
     # Configure transport security settings
-    transport_security = TransportSecuritySettings(allowed_hosts=allowed_hosts)
+    transport_security = TransportSecuritySettings(
+        allowed_hosts=allowed_hosts,
+        enable_dns_rebinding_protection=enable_dns_rebinding,
+    )
 
-    logger.debug(f"Configuring FastMCP with allowed_hosts: {allowed_hosts}")
+    logger.debug(
+        f"Configuring FastMCP with allowed_hosts: {allowed_hosts}, "
+        f"dns_rebinding_protection: {enable_dns_rebinding}"
+    )
 
     server = FastMCP(
         name="unifi-network-mcp",

{unifi_network_mcp-0.5.0.dist-info → unifi_network_mcp-0.5.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: unifi-network-mcp
-Version: 0.5.0
+Version: 0.5.2
 Summary: Unifi Network MCP Server
 License-File: LICENSE
 Requires-Python: >=3.13
@@ -534,11 +534,14 @@ The server merges settings from **environment variables**, an optional `.env` fi
 | `UNIFI_VERIFY_SSL` | Set to `false` if using self-signed certs |
 | `UNIFI_CONTROLLER_TYPE` | Controller API path type: `auto` (detect), `proxy` (UniFi OS), `direct` (standalone). Default `auto` |
 | `UNIFI_MCP_HTTP_ENABLED` | Set `true` to enable optional HTTP SSE server (default `false`) |
+| `UNIFI_MCP_HOST` | HTTP SSE bind address (default `0.0.0.0`) |
+| `UNIFI_MCP_PORT` | HTTP SSE bind port (default `3000`) |
 | `UNIFI_AUTO_CONFIRM` | Set `true` to auto-confirm all mutating operations (skips preview step). Ideal for workflow automation (n8n, Make, Zapier). Default `false` |
 | `UNIFI_TOOL_REGISTRATION_MODE` | Tool loading mode: `lazy` (default), `eager`, or `meta_only`. See [Context Optimization](#context-optimization) |
 | `UNIFI_ENABLED_CATEGORIES` | Comma-separated list of tool categories to load (eager mode). See table below |
 | `UNIFI_ENABLED_TOOLS` | Comma-separated list of specific tool names to register (eager mode) |
 | `UNIFI_MCP_ALLOWED_HOSTS` | Comma-separated list of allowed hostnames for reverse proxy support. Required when running behind Nginx/Cloudflare/etc. Default `localhost,127.0.0.1` |
+| `UNIFI_MCP_ENABLE_DNS_REBINDING_PROTECTION` | Enable/disable DNS rebinding protection. Set to `false` for Kubernetes/proxy deployments where `UNIFI_MCP_ALLOWED_HOSTS` is insufficient. Default `true` |
 
 ### Tool Categories (for UNIFI_ENABLED_CATEGORIES)
 
@@ -810,7 +813,9 @@ See [docs/permissions.md](docs/permissions.md) for complete documentation includ
 * **Review permissions carefully** before enabling high-risk operations. Use environment variables for runtime control.
 * Create, update, and delete tools should be used with caution and only enabled when necessary.
 * Do not host outside of your network unless using a secure reverse proxy like Cloudflare Tunnel or Ngrok. Even then, an additional layer of authentication is recommended.
-* **Reverse Proxy Configuration:** When running behind a reverse proxy, set `UNIFI_MCP_ALLOWED_HOSTS` to include your external domain (e.g., `localhost,127.0.0.1,unifi-mcp.example.com`) to bypass FastMCP's DNS rebinding protection.
+* **Reverse Proxy Configuration:** When running behind a reverse proxy (Kubernetes ingress, Nginx, Cloudflare, etc.):
+  * First try: Set `UNIFI_MCP_ALLOWED_HOSTS` to include your external domain (e.g., `localhost,127.0.0.1,unifi-mcp.example.com`)
+  * If that's insufficient: Set `UNIFI_MCP_ENABLE_DNS_REBINDING_PROTECTION=false` to disable host validation entirely. Only use this in trusted network environments.
 
 ---
 

{unifi_network_mcp-0.5.0.dist-info → unifi_network_mcp-0.5.2.dist-info}/RECORD

@@ -1,8 +1,8 @@
-src/_version.py,sha256=fvHpBU3KZKRinkriKdtAt3crenOyysELF-M9y3ozg3U,704
+src/_version.py,sha256=LGYtjQ6cyPZC_N0AovMIeSYYDK21050nm3HYgDanQBM,704
 src/bootstrap.py,sha256=mqkDDfn5xKRzun07TS8xPLZm_WnfLt3xTguxxFnfRV0,7572
 src/jobs.py,sha256=3IUO8ChpeRUjyJTWeFlyIwtkQLv-_KvfzuA5Ra4PmDI,5984
 src/main.py,sha256=gmOt3jlpWv5r9dlIpva7YCkZ8Yw45jQR3k9o7hBQhw4,15830
-src/runtime.py,sha256=Johuv7cVP0SFD9zDgjJt52E-DvwtcLZpH8FlzP1caFQ,7236
+src/runtime.py,sha256=VGk5c18ebDMP1n54DDGwBmIQZGx8mCS5Hn1UH0K1zak,7679
 src/schemas.py,sha256=Y9fglAAgRGh8zxwO0J5zpj5BsRMLDDwevwXY_6kj5VU,33725
 src/tool_index.py,sha256=aUPFqES4i_cq9ZsfAoiWuhKwoEEJ8NEAOafQ2h1g1NE,5492
 src/validator_registry.py,sha256=dboNY36ZQphCr7tDQuVQtNvXu4X1FBkgqoLb-sGNwJQ,3005
@@ -44,10 +44,10 @@ src/utils/meta_tools.py,sha256=XlLkzFEvrZsDEiXxMq_Lz22ZGZ8mMzbjx6krYJS-JD4,13172
 src/utils/permissions.py,sha256=dILy7uSb7WJsCfpYKr18VpEts3HfUQhNhNGoRV9IExU,4080
 src/utils/tool_loader.py,sha256=QpfHOxyZ_bzPJM0SItB7UM8uW_p7vl2Sm25rfgfwsAY,4147
 src/tools_manifest.json,sha256=FX4_TrE4gs8Ao_4B40yinipifyE256fzbwhia9W4-Zs,43100
-src/config/config.yaml,sha256=4qKXtIqhBStHF-djDRpRgXuYDyfh_95DTPC8v-vRJHU,4120
-unifi_network_mcp-0.5.0.data/data/share/unifi-network-mcp/.well-known/mcp-server.json,sha256=Ru2oF_SdOzkathJVTQ6R0bRB-NTmiXLlNVvsp7GqmPs,1427
-unifi_network_mcp-0.5.0.dist-info/METADATA,sha256=I8Y_maiyIqw2LLURZ3xP_O-lgYiMte0RsWJGEXrb7D4,38696
-unifi_network_mcp-0.5.0.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
-unifi_network_mcp-0.5.0.dist-info/entry_points.txt,sha256=iDs5JXOBoUROpkuTXoxr-1WSrz1FLEgI0TO4pFsZ8u0,52
-unifi_network_mcp-0.5.0.dist-info/licenses/LICENSE,sha256=1tMHOACX4Nse1DzgSKufrvTGztT8kS71LE8l29IAvto,1068
-unifi_network_mcp-0.5.0.dist-info/RECORD,,
+src/config/config.yaml,sha256=KiYwuDyq5L_6QZL-xG1N1gvO7W3Tck1JYZ-fv1YOi8U,4170
+unifi_network_mcp-0.5.2.data/data/share/unifi-network-mcp/.well-known/mcp-server.json,sha256=Ru2oF_SdOzkathJVTQ6R0bRB-NTmiXLlNVvsp7GqmPs,1427
+unifi_network_mcp-0.5.2.dist-info/METADATA,sha256=LG8NJDxnc-i5N037642piPX_eGrxvMEm3wI255c6IWg,39204
+unifi_network_mcp-0.5.2.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
+unifi_network_mcp-0.5.2.dist-info/entry_points.txt,sha256=iDs5JXOBoUROpkuTXoxr-1WSrz1FLEgI0TO4pFsZ8u0,52
+unifi_network_mcp-0.5.2.dist-info/licenses/LICENSE,sha256=1tMHOACX4Nse1DzgSKufrvTGztT8kS71LE8l29IAvto,1068
+unifi_network_mcp-0.5.2.dist-info/RECORD,,