* Add secure default for DNS rebinding, use in examples
* Update README examples to use createMcpExpressApp, bump to 1.23.0
- Update all server examples to use createMcpExpressApp() for secure defaults
- Rewrite DNS Rebinding Protection section to document new middleware approach
- Bump version from 1.23.0-beta.0 to 1.23.0
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add IPv6 support, allowedHosts option, and warning for unprotected servers
- Use native URL API to parse Host headers (handles IPv6 correctly)
- Add [::1] (IPv6 localhost) to localhostHostValidation
- Add ::1 to list of localhost hosts that get automatic protection
- Add allowedHosts option to createMcpExpressApp for custom host validation
- Warn when binding to 0.0.0.0 or :: without allowedHosts configured
- Add tests for IPv6 and allowedHosts functionality
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Update remaining examples to use createMcpExpressApp and add DNS rebinding docs
- Update simpleTaskInteractive.ts, ssePollingExample.ts, and elicitationUrlExample.ts
to use createMcpExpressApp() instead of express() + express.json()
- Add DNS rebinding protection section to docs/server.md explaining how to use
createMcpExpressApp() and hostHeaderValidation middleware
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Updated StreamableHTTPServerTransport to support both sync and async callbacks:
- Changed callback types to return void | Promise<void>
- Used await Promise.resolve() to handle both sync and async callbacks
- Added comprehensive tests for async callback functionality
- Errors in callbacks now properly propagate to HTTP responses
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Renamed ondelete callback to onsessionclosed for better clarity
- Moved callback from public property to private field following options pattern
- Added comprehensive JSDoc documentation explaining the callback's purpose
- Updated DELETE request handler to use the new callback structure
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Adds optional ondelete callback that fires when DELETE request is received, providing the sessionId for cleanup handling.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
