Skip to content

Comments

fix: add allowed hosts configuration to SDK templates#21

Merged
IBJunior merged 3 commits intomainfrom
fix/allowed-hosts
Feb 21, 2026
Merged

fix: add allowed hosts configuration to SDK templates#21
IBJunior merged 3 commits intomainfrom
fix/allowed-hosts

Conversation

@IBJunior
Copy link
Member

Summary

  • Add allowedHosts to createMcpExpressApp() in SDK stateless and stateful templates to support DNS rebinding protection
  • Default allowed hosts: localhost, 127.0.0.1, [::1]
  • Users can extend via ALLOWED_HOSTS env var (comma-separated)
  • Fix missing import 'dotenv/config' in stateful template (non-OAuth path)
  • Update SDK README templates to document ALLOWED_HOSTS

Test plan

  • All 144 tests passing
  • Build succeeds
  • Generated SDK project includes allowedHosts in createMcpExpressApp()

@IBJunior IBJunior merged commit 2ccf7f9 into main Feb 21, 2026
2 checks passed
@IBJunior IBJunior deleted the fix/allowed-hosts branch February 21, 2026 01:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant