How do I protect a local MCP server from DNS rebinding?

What should I check, step by step?

1. Prefer the stdio transport for servers that only your own MCP client launches; the MCP security best practices say to use stdio to limit access to just the MCP client, and the TypeScript SDK advisory notes stdio servers are not affected.

2. Bind HTTP servers to 127.0.0.1 or ::1, never 0.0.0.0 or ::, unless other machines genuinely need access (and then put real authentication and TLS in front).
3. Validate Origin on every request: if an Origin header is present and is not an origin you expect, return HTTP 403 Forbidden. Requests from non-browser clients usually send no Origin, so Origin checks alone are not authentication.
4. Validate Host against an allowlist (for example localhost:PORT, 127.0.0.1:PORT, [::1]:PORT). After a rebind the browser still sends the attacker's domain as Host, so a strict Host check stops the request.
5. Require a token on every request: generate a random secret at startup, hand it to the client out of band (config file, environment variable) and reject requests without it. The best-practices page lists an authorization token or a unix domain socket as the ways to restrict a local HTTP server.
6. TypeScript SDK: upgrade @modelcontextprotocol/sdk to 1.24.0 or later and build the app with createMcpExpressApp(); with a custom Express app, add the exported hostHeaderValidation() middleware. If you must bind 0.0.0.0, pass allowedHosts.
7. Test it: send a request with Host: attacker.example and one with Origin: https://attacker.example and confirm both are refused before any tool runs.
8. Don't leave dev servers, inspectors or debugging proxies listening after you're done; an idle localhost port is what a rebinding page looks for.

How the attack works

The same-origin policy is based on domain names, not IP addresses. An attacker serves a page from a domain they control, then changes that domain's DNS record to 127.0.0.1. The page's scripts can now send requests to a server on your machine while the browser still treats them as same-origin with the attacker's site.

• The MCP Streamable HTTP security warning says that without Origin validation, localhost binding and authentication, attackers could use DNS rebinding to interact with local MCP servers from remote websites. The MCP security best practices list an insecure local server left running on localhost as one of the ways local servers are compromised.

What does the specification require?

MCP specification 2025-11-25, Transports, Streamable HTTP: servers MUST validate the Origin header on all incoming connections to prevent DNS rebinding; if Origin is present and invalid they MUST respond with HTTP 403 Forbidden; when running locally they SHOULD bind only to localhost (127.0.0.1) rather than all interfaces (0.0.0.0); and they SHOULD implement proper authentication for all connections.

• MCP Security Best Practices, Local MCP Server Compromise: servers intended to run locally SHOULD prevent unauthorized use by malicious processes by using stdio, or, over HTTP, by requiring an authorization token or using unix domain sockets or other restricted IPC.

The TypeScript SDK fix (CVE-2025-66414)

GitHub advisory GHSA-w48q-cv73-mx4w (published December 2, 2025, severity high): @modelcontextprotocol/sdk before 1.24.0 did not enable DNS rebinding protection by default, so an unauthenticated localhost server using StreamableHTTPServerTransport or SSEServerTransport without enableDnsRebindingProtection could be called by a malicious website.

• In the current SDK, createMcpExpressApp() defaults to host 127.0.0.1 and applies Host validation for 127.0.0.1, localhost and ::1, plus Origin validation that rejects a present non-localhost Origin with 403 before the request body is read. Binding to 0.0.0.0 or :: only logs a warning unless you pass allowedHosts.