Add configurable Host/Origin allowlist for the MCP endpoint#3736
Open
souvikghosh04 wants to merge 8 commits into
Open
Add configurable Host/Origin allowlist for the MCP endpoint#3736souvikghosh04 wants to merge 8 commits into
souvikghosh04 wants to merge 8 commits into
Conversation
Introduces runtime.mcp.allowed-hosts so operators can restrict which Host and Origin header values are accepted by the MCP Streamable HTTP endpoint. Loopback hosts are always trusted; a single '*' entry preserves prior behavior. Adds validation middleware, config plumbing, schema, and unit tests.
The new UserProvidedAllowedHosts helper flag is not serialized to the config file, mirroring UserProvidedPath. Ignore it in the Cli.Tests and Service.Tests Verify module initializers so snapshot tests remain stable.
souvikghosh04
marked this pull request as ready for review
July 24, 2026 12:01
souvikghosh04
requested review from
Alekhya-Polavarapu,
JerryNixon,
RubenCerna2079,
aaronburtle,
anushakolan,
rusamant,
sourabh1007,
stuartpa and
vadeveka
as code owners
July 24, 2026 12:01
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a defense-in-depth DNS rebinding mitigation for the browser-reachable MCP Streamable HTTP endpoint by introducing a configurable Host/Origin allowlist in runtime config, plus schema and test coverage.
Changes:
- Introduces
runtime.mcp.allowed-hostsand serializes it only when explicitly user-provided. - Adds
McpDnsRebindingProtectionMiddlewareand wires it into the Service middleware pipeline for requests targeting the MCP path. - Updates JSON schema and adds unit/serialization tests for the new behavior and config round-tripping.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/Service/Startup.cs | Inserts the MCP DNS rebinding protection middleware into the request pipeline. |
| src/Azure.DataApiBuilder.Mcp/Core/McpDnsRebindingProtectionMiddleware.cs | Implements Host/Origin validation (loopback trusted, "*" opt-out) for MCP path requests. |
| src/Config/ObjectModel/McpRuntimeOptions.cs | Adds AllowedHosts and a UserProvidedAllowedHosts flag for controlled serialization. |
| src/Config/Converters/McpRuntimeOptionsConverterFactory.cs | Deserializes/serializes allowed-hosts gated by the user-provided flag. |
| src/Service.Tests/Mcp/McpDnsRebindingProtectionMiddlewareTests.cs | Adds unit tests for trust decisions and middleware pipeline behavior. |
| src/Service.Tests/Configuration/McpRuntimeOptionsSerializationTests.cs | Adds serialization/deserialization coverage for allowed-hosts. |
| src/Service.Tests/ModuleInitializer.cs | Updates snapshot settings to ignore the new non-serialized flag. |
| src/Cli.Tests/ModuleInitializer.cs | Updates snapshot settings to ignore the new non-serialized flag. |
| schemas/dab.draft.schema.json | Adds schema support and documentation for runtime.mcp.allowed-hosts. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…re/data-api-builder into mcp-allowed-hosts-validation # Conflicts: # src/Config/Converters/McpRuntimeOptionsConverterFactory.cs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The MCP Streamable HTTP endpoint is reachable from browsers. Today it accepts requests regardless of the incoming
Host/Originheader, which is broader than necessary for a locally- or internally-hosted endpoint. This change adds defense-in-depth by letting operators constrain which hosts and origins may reach the MCP endpoint, with a safe default.What
runtime.mcp.allowed-hosts(array of host names).Hostheader — and theOriginheader when present — for requests targeting the configured MCP path.localhost,127.0.0.1,::1) are always trusted so local MCP clients keep working with no additional configuration."*"entry opts out of validation, preserving prior behavior for deployments that terminate host validation upstream.403 Forbiddenbefore reaching the MCP transport.Behavior change
Deployments that expose the MCP endpoint on a non-loopback host name must add that host name to
runtime.mcp.allowed-hosts(or set"*"to keep the previous behavior).Testing
allowed-hostsproperty.dotnet format --verify-no-changesis clean on the changed files.