fix: Migrate rmcp 0.8 → 2.1 to resolve RUSTSEC-2026-0189 (MCP DNS rebinding).

API migration for rmcp 2.x: Content → ContentBlock, non-exhaustive model
structs built via constructors instead of literals.

rmcp now validates the Host header against a loopback-only allowlist by
default — the actual DNS-rebinding defense. New --mcp-allowed-hosts flag
extends the allowlist for the documented LAN use case (docs/mcp.md updated).

Smoke-tested live: initialize handshake OK on loopback and on an allowed
LAN host; unlisted Host rejected with 403.

cargo audit is now clean, unblocking the weekly image publish.

Closes #8
Closes #7

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: heskew

Cargo.lock

@@ -189,7 +189,7 @@ dirs = "5.0"
 # - server: MCP server implementation
 # - macros: #[tool] and #[tool_router] derive macros
 # - transport-streamable-http-server: HTTP transport with SSE streaming
-rmcp = { version = "0.8", features = ["server", "macros", "transport-streamable-http-server"] }
+rmcp = { version = "2", features = ["server", "macros", "transport-streamable-http-server"] }
 
 # schemars: JSON Schema generation. Used by rmcp for tool parameter schemas.
 schemars = "1.0"

Cargo.toml

@@ -96,6 +96,14 @@ pub enum Commands {
         /// Example: --mcp-port 3001
         #[arg(long)]
         mcp_port: Option<u16>,
+
+        /// Additional Host header values the MCP server accepts (comma-separated)
+        ///
+        /// The MCP server only accepts loopback hosts by default to block DNS
+        /// rebinding attacks. For LAN access, list the hostnames or host:port
+        /// authorities clients will use. Example: --mcp-allowed-hosts pi-hostname
+        #[arg(long, value_delimiter = ',')]
+        mcp_allowed_hosts: Vec<String>,
     },
 
     /// Show dashboard summary

crates/hone-cli/src/cli.rs

@@ -14,6 +14,7 @@ pub async fn cmd_serve(
     no_encrypt: bool,
     static_dir: Option<&Path>,
     mcp_port: Option<u16>,
+    mcp_allowed_hosts: Vec<String>,
 ) -> Result<()> {
     println!("🚀 Starting Hone web server...");
     println!("   Database: {}", db_path.display());
@@ -121,8 +122,11 @@ pub async fn cmd_serve(
     if let Some(mcp) = mcp_port {
         let mcp_db = db.clone();
         let mcp_host = host.to_string();
+        let mcp_hosts = mcp_allowed_hosts.clone();
         tokio::spawn(async move {
-            if let Err(e) = hone_server::mcp::start_mcp_server(mcp_db, &mcp_host, mcp).await {
+            if let Err(e) =
+                hone_server::mcp::start_mcp_server(mcp_db, &mcp_host, mcp, &mcp_hosts).await
+            {
                 eprintln!("MCP server error: {}", e);
             }
         });

crates/hone-cli/src/commands/serve.rs

@@ -64,6 +64,7 @@ async fn main() -> Result<()> {
             no_auth,
             static_dir,
             mcp_port,
+            mcp_allowed_hosts,
         } => {
             commands::cmd_serve(
                 &cli.db,
@@ -73,6 +74,7 @@ async fn main() -> Result<()> {
                 cli.no_encrypt,
                 static_dir.as_deref(),
                 mcp_port,
+                mcp_allowed_hosts,
             )
             .await
         }