AgentArmorHQ
Sign in
Configuration

Enable DNS rebinding protection on local HTTP MCP servers

AgentArmorHQ team2 min read

You will check every local HTTP MCP server and confirm DNS rebinding protection is active. This matters because a malicious website can reach an unauthenticated localhost server through DNS rebinding ([GitHub advisory GHSA-w48q-cv73-mx4w](https://github.com/advisories/GHSA-w48q-cv73-mx4w)).

  1. Find HTTP MCP serversStdio servers are not affected
  2. Update to 1.24.0Fix is in this version
  3. Check Express setupDefault applies via createMcpExpressApp()
  4. Add host header validationUse hostHeaderValidation() for custom Express
  5. Restart and confirmYour own client should still connect

Why it matters

HTTP-based MCP servers that run on localhost without authentication could be reached by a malicious website through DNS rebinding when enableDnsRebindingProtection was not set (GitHub advisory GHSA-w48q-cv73-mx4w (opens external site)). An attacker in that position can invoke tools or access resources on your behalf. Stdio servers are not affected, so this change applies to HTTP transport only.

Steps

  1. List every local MCP server you run over HTTP. Stdio-only servers are not affected and need no change.
  2. Update the MCP SDK for each HTTP server to 1.24.0, the version that carries the fix (GitHub advisory GHSA-w48q-cv73-mx4w (opens external site)). Rebuild and restart the server afterward.
  3. If your server is created with createMcpExpressApp() and binds to localhost, the protection is enabled by default in 1.24.0 (GitHub advisory GHSA-w48q-cv73-mx4w (opens external site)). Confirm the version and the bind address.
  4. If you build your own Express setup, apply the hostHeaderValidation() middleware, which protects custom Express setups (GitHub advisory GHSA-w48q-cv73-mx4w (opens external site)). Add it before your MCP route handlers, and check your SDK's documentation for the exact import in your version.
  5. Search your configuration for enableDnsRebindingProtection and make sure it is not set to disable the protection, since its absence was the condition for exposure.
  6. Restart the server and confirm it still answers requests from your own client.
  7. If a server does not need HTTP access, move it to stdio transport. Stdio servers are not affected by this issue (GitHub advisory GHSA-w48q-cv73-mx4w (opens external site)).

Common mistakes

  • Upgrading the SDK but keeping a hand-written Express app that skips the middleware. The default only applies through createMcpExpressApp().
  • Assuming a server bound to a non-localhost address gets the same default. Check the bind address yourself.
  • Leaving unauthenticated HTTP servers running when you no longer use them. Stop them.
  • Treating this fix as the whole answer. Keep servers on localhost and limit the tools they expose.

Warnings

This change reduces risk from one attack path. It does not replace authentication or least-privilege tool design.

Checklist

0 of 8 done

Sources

  1. GitHub Advisory Database: GHSA-w48q-cv73-mx4w
Was this guide useful?