fix(mcp): validate HTTP origins and hosts

[fahreddinozcan]

Summary

Fixes the MCP HTTP Origin validation / permissive CORS finding reported as Cobalt PT38659_23.

• rejects foreign, null, malformed, and explicitly empty Origin values before JSON parsing or MCP dispatch on loopback servers
• validates Host values on loopback servers to prevent DNS rebinding
• echoes approved loopback origins with complete Vary headers
• preserves wildcard CORS on non-loopback deployments because hosted authentication is header-only and browser MCP clients must remain compatible
• binds local HTTP to 127.0.0.1 by default and documents the exact client URL instead of relying on platform-dependent localhost resolution
• keeps the production container reachable with an explicit 0.0.0.0 bind
• scopes bind-host validation to HTTP mode, so CONTEXT7_MCP_HOST cannot break stdio startup
• adds focused unit and end-to-end regression coverage

Linear: CTX7-2533

Validation

• MCP suite: 110 passed
• CLI suite: 361 passed
• Pi integration suite: 4 passed
• repository-wide format, typecheck, lint, and build passed
• latest-base merge check found no conflicts
• git diff --check passed

[linear-code]

CTX7-2533

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
context7	🟢 Ready	View Preview	Aug 27, 2026, 9:08 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[context7]

Docs7 for context7.com

Result	Status	Action
Deployment	✅ Ready	Open preview
Content review	✅ Passed. No problems found.	View findings

Commit 34a007c · Updated 2026-09-04 08:08 UTC · View build details

[enesgules]

The loopback logic is correct and well tested: IPv6 brackets, 127.1 canonicalization, userinfo/path rejection, null origin rejection, rejection before express.json, Vary headers, getOptionValueSource. Two blocking items on scope and compatibility, plus a few minor ones inline.

Blocking

1. Hosted mode breaks browser MCP clients. The public server at mcp.context7.com has no cookies and no ambient credentials; auth is header-only. For that server Access-Control-Allow-Origin: * is not a vulnerability. The comment this PR removes from index.ts shows the team deliberately added those headers so browser clients pass preflight. After this change MCP Inspector, web IDEs, and the Cloudflare playground get 403 from the hosted server. The Cobalt finding is the local server + DNS rebinding, and that stays fixed if the strict Origin allowlist applies only when isLocal is true. See inline comment.

2. localhost clients can get ECONNREFUSED. The default bind is now 127.0.0.1 only. On macOS with Node 24, localhost resolves to ::1 first (verified locally: a Node client with autoSelectFamily: false against a 127.0.0.1-only listener fails; autoSelectFamily: true succeeds). Every doc and MCP config example says http://localhost:3000/mcp. Either bind both 127.0.0.1 and ::1 for a loopback host, or change the docs/README examples to http://127.0.0.1:PORT/mcp. See inline comment.

[enesgules]

All four threads are addressed in 34a007c and verified locally: hosted mode keeps wildcard CORS, strict Origin/Host checks are loopback-only, bind-host normalization runs only in the HTTP branch, docs use 127.0.0.1, and Dockerfile/Smithery keep 0.0.0.0. Typecheck, lint, build, and 94 tests pass.