MCP conformance: DNS rebinding protection

[jlowin]

The MCP conformance test suite expects DNS rebinding protection for HTTP transports. This is listed as an expected failure in tests/conformance/expected-failures.yml.

When implemented, remove dns-rebinding-protection from the expected failures file and verify the conformance suite passes.

[zweice]

DNS rebinding is one of the higher-risk gaps in HTTP-transport MCP servers, especially ones listening on localhost. The attack path:

1. Attacker serves a page that makes requests to localhost:PORT
2. DNS TTL expires mid-session, attacker rotates DNS to point to their own server
3. Browser's same-origin policy is now satisfied — attacker's origin == localhost
4. The attacker can now call any MCP tool exposed on that port

The conformance test is checking for the Host header validation (reject requests where Host is not localhost or 127.0.0.1), which is the standard mitigation.

A few things worth noting when implementing:

• IPv6 loopback (::1) needs to be in the allowlist alongside IPv4
• Some implementations also check for the Origin header as a secondary gate
• The mitigation should apply even when --allow-origin=* is set (CORS and DNS rebinding protection are independent concerns)

We've seen this come up repeatedly when auditing MCP servers at audit.pyfio.com — it's usually absent because it's not in the spec as a MUST, just a SHOULD. Good to see it being added to the conformance suite.