unifi-network-mcp 0.5.1__py3-none-any.whl → 0.5.2__py3-none-any.whl

src/_version.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '0.5.1'
-__version_tuple__ = version_tuple = (0, 5, 1)
+__version__ = version = '0.5.2'
+__version_tuple__ = version_tuple = (0, 5, 2)
 
 __commit_id__ = commit_id = None

src/runtime.py

@@ -80,10 +80,22 @@ def get_server() -> FastMCP:
     allowed_hosts_str = os.getenv("UNIFI_MCP_ALLOWED_HOSTS", "localhost,127.0.0.1")
     allowed_hosts = [h.strip() for h in allowed_hosts_str.split(",") if h.strip()]
 
+    # Allow disabling DNS rebinding protection entirely (default: enabled)
+    # Set to "false" for Kubernetes/proxy deployments where allowed_hosts is insufficient
+    enable_dns_rebinding = (
+        os.getenv("UNIFI_MCP_ENABLE_DNS_REBINDING_PROTECTION", "true").lower() == "true"
+    )
+
     # Configure transport security settings
-    transport_security = TransportSecuritySettings(allowed_hosts=allowed_hosts)
+    transport_security = TransportSecuritySettings(
+        allowed_hosts=allowed_hosts,
+        enable_dns_rebinding_protection=enable_dns_rebinding,
+    )
 
-    logger.debug(f"Configuring FastMCP with allowed_hosts: {allowed_hosts}")
+    logger.debug(
+        f"Configuring FastMCP with allowed_hosts: {allowed_hosts}, "
+        f"dns_rebinding_protection: {enable_dns_rebinding}"
+    )
 
     server = FastMCP(
         name="unifi-network-mcp",

{unifi_network_mcp-0.5.1.dist-info → unifi_network_mcp-0.5.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: unifi-network-mcp
-Version: 0.5.1
+Version: 0.5.2
 Summary: Unifi Network MCP Server
 License-File: LICENSE
 Requires-Python: >=3.13
@@ -541,6 +541,7 @@ The server merges settings from **environment variables**, an optional `.env` fi
 | `UNIFI_ENABLED_CATEGORIES` | Comma-separated list of tool categories to load (eager mode). See table below |
 | `UNIFI_ENABLED_TOOLS` | Comma-separated list of specific tool names to register (eager mode) |
 | `UNIFI_MCP_ALLOWED_HOSTS` | Comma-separated list of allowed hostnames for reverse proxy support. Required when running behind Nginx/Cloudflare/etc. Default `localhost,127.0.0.1` |
+| `UNIFI_MCP_ENABLE_DNS_REBINDING_PROTECTION` | Enable/disable DNS rebinding protection. Set to `false` for Kubernetes/proxy deployments where `UNIFI_MCP_ALLOWED_HOSTS` is insufficient. Default `true` |
 
 ### Tool Categories (for UNIFI_ENABLED_CATEGORIES)
 
@@ -812,7 +813,9 @@ See [docs/permissions.md](docs/permissions.md) for complete documentation includ
 * **Review permissions carefully** before enabling high-risk operations. Use environment variables for runtime control.
 * Create, update, and delete tools should be used with caution and only enabled when necessary.
 * Do not host outside of your network unless using a secure reverse proxy like Cloudflare Tunnel or Ngrok. Even then, an additional layer of authentication is recommended.
-* **Reverse Proxy Configuration:** When running behind a reverse proxy, set `UNIFI_MCP_ALLOWED_HOSTS` to include your external domain (e.g., `localhost,127.0.0.1,unifi-mcp.example.com`) to bypass FastMCP's DNS rebinding protection.
+* **Reverse Proxy Configuration:** When running behind a reverse proxy (Kubernetes ingress, Nginx, Cloudflare, etc.):
+  * First try: Set `UNIFI_MCP_ALLOWED_HOSTS` to include your external domain (e.g., `localhost,127.0.0.1,unifi-mcp.example.com`)
+  * If that's insufficient: Set `UNIFI_MCP_ENABLE_DNS_REBINDING_PROTECTION=false` to disable host validation entirely. Only use this in trusted network environments.
 
 ---
 

{unifi_network_mcp-0.5.1.dist-info → unifi_network_mcp-0.5.2.dist-info}/RECORD

@@ -1,8 +1,8 @@
-src/_version.py,sha256=cYMOhuaBHd0MIZmumuccsEQ-AxM8LIJy9dsBAWgOpqE,704
+src/_version.py,sha256=LGYtjQ6cyPZC_N0AovMIeSYYDK21050nm3HYgDanQBM,704
 src/bootstrap.py,sha256=mqkDDfn5xKRzun07TS8xPLZm_WnfLt3xTguxxFnfRV0,7572
 src/jobs.py,sha256=3IUO8ChpeRUjyJTWeFlyIwtkQLv-_KvfzuA5Ra4PmDI,5984
 src/main.py,sha256=gmOt3jlpWv5r9dlIpva7YCkZ8Yw45jQR3k9o7hBQhw4,15830
-src/runtime.py,sha256=Johuv7cVP0SFD9zDgjJt52E-DvwtcLZpH8FlzP1caFQ,7236
+src/runtime.py,sha256=VGk5c18ebDMP1n54DDGwBmIQZGx8mCS5Hn1UH0K1zak,7679
 src/schemas.py,sha256=Y9fglAAgRGh8zxwO0J5zpj5BsRMLDDwevwXY_6kj5VU,33725
 src/tool_index.py,sha256=aUPFqES4i_cq9ZsfAoiWuhKwoEEJ8NEAOafQ2h1g1NE,5492
 src/validator_registry.py,sha256=dboNY36ZQphCr7tDQuVQtNvXu4X1FBkgqoLb-sGNwJQ,3005
@@ -45,9 +45,9 @@ src/utils/permissions.py,sha256=dILy7uSb7WJsCfpYKr18VpEts3HfUQhNhNGoRV9IExU,4080
 src/utils/tool_loader.py,sha256=QpfHOxyZ_bzPJM0SItB7UM8uW_p7vl2Sm25rfgfwsAY,4147
 src/tools_manifest.json,sha256=FX4_TrE4gs8Ao_4B40yinipifyE256fzbwhia9W4-Zs,43100
 src/config/config.yaml,sha256=KiYwuDyq5L_6QZL-xG1N1gvO7W3Tck1JYZ-fv1YOi8U,4170
-unifi_network_mcp-0.5.1.data/data/share/unifi-network-mcp/.well-known/mcp-server.json,sha256=Ru2oF_SdOzkathJVTQ6R0bRB-NTmiXLlNVvsp7GqmPs,1427
-unifi_network_mcp-0.5.1.dist-info/METADATA,sha256=cRkmeIzNQMJPwgqped05WGevxLsF2Iz59oCyGu5dhTI,38820
-unifi_network_mcp-0.5.1.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
-unifi_network_mcp-0.5.1.dist-info/entry_points.txt,sha256=iDs5JXOBoUROpkuTXoxr-1WSrz1FLEgI0TO4pFsZ8u0,52
-unifi_network_mcp-0.5.1.dist-info/licenses/LICENSE,sha256=1tMHOACX4Nse1DzgSKufrvTGztT8kS71LE8l29IAvto,1068
-unifi_network_mcp-0.5.1.dist-info/RECORD,,
+unifi_network_mcp-0.5.2.data/data/share/unifi-network-mcp/.well-known/mcp-server.json,sha256=Ru2oF_SdOzkathJVTQ6R0bRB-NTmiXLlNVvsp7GqmPs,1427
+unifi_network_mcp-0.5.2.dist-info/METADATA,sha256=LG8NJDxnc-i5N037642piPX_eGrxvMEm3wI255c6IWg,39204
+unifi_network_mcp-0.5.2.dist-info/WHEEL,sha256=WLgqFyCfm_KASv4WHyYy0P3pM_m7J5L9k2skdKLirC8,87
+unifi_network_mcp-0.5.2.dist-info/entry_points.txt,sha256=iDs5JXOBoUROpkuTXoxr-1WSrz1FLEgI0TO4pFsZ8u0,52
+unifi_network_mcp-0.5.2.dist-info/licenses/LICENSE,sha256=1tMHOACX4Nse1DzgSKufrvTGztT8kS71LE8l29IAvto,1068
+unifi_network_mcp-0.5.2.dist-info/RECORD,,