From 43f1f61019902a5eeea9822e0996f6a8f4d21bf9 Mon Sep 17 00:00:00 2001
From: guro <guro@anthropic.com>
Date: Tue, 20 Jan 2026 18:50:45 +0000
Subject: [PATCH] fix: enable trust proxy for correct rate limiting behind
 reverse proxy

Without this, rate limiting uses the proxy's IP instead of actual client IPs,
causing all requests through Cloudflare to be rate limited together.
---
 src/index.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/index.ts b/src/index.ts
index 8866406..f37ed02 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -44,6 +44,10 @@ async function main() {
 
   const app = express();
 
+  // Trust proxy headers (X-Forwarded-For, etc.) when behind reverse proxy (Cloudflare, etc.)
+  // This is required for rate limiting to work correctly with real client IPs
+  app.set('trust proxy', true);
+
   // Basic middleware
   // Intentionally permissive CORS for public MCP reference server
   // This allows any MCP client to test against this reference implementation