marchon/verae-mcp-timestamping-server-go
Watch
1
0
Fork
You've already forked verae-mcp-timestamping-server-go
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: disable localhost Host protection behind Caddy

Browse source 
Public MCP requests arrive with Host mcp.verae.ai while the process binds
127.0.0.1; the go-sdk default rejected those with 403.
This commit is contained in:
George Lambert 2026-09-29 12:18:06 -04:00
commit 00f5d18364
1 changed files with 5 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
internal/server/server.go
View file

@ -67,11 +67,14 @@ func New(opts Options) (*Server, error) {
RequireBearer: opts.RequireBearer, RequireBearer: opts.RequireBearer,
} }
mcpServer := tools.NewServer(deps) mcpServer := tools.NewServer(deps)
// Behind Caddy (or any reverse proxy) the bind is loopback while Host is
// the public name (mcp.verae.ai). Disable the SDK's localhost Host check.
stream := mcp.NewStreamableHTTPHandler(func(*http.Request) *mcp.Server { stream := mcp.NewStreamableHTTPHandler(func(*http.Request) *mcp.Server {
return mcpServer return mcpServer
}, &mcp.StreamableHTTPOptions{ }, &mcp.StreamableHTTPOptions{
JSONResponse: opts.JSONResponse, JSONResponse: opts.JSONResponse,
Stateless: opts.Stateless, Stateless: opts.Stateless,
DisableLocalhostProtection: true,
}) })
mux := http.NewServeMux() mux := http.NewServeMux()