M server.py → server.py

@@ -10,6 +10,7 @@ from starlette.requests import Request
 from starlette.responses import JSONResponse, Response
 from mcp.server.fastmcp import FastMCP
 from mcp.server.auth.settings import AuthSettings, ClientRegistrationOptions, RevocationOptions
+from mcp.server.transport_security import TransportSecuritySettings
 
 import config
 import db
@@ -26,6 +27,11 @@ )
 log = logging.getLogger("news_mcp")
 
 _provider = oauth.NewsOAuthProvider() if config.ISSUER_URL else None
+
+# O servidor fica atrás do nginx e exige token/OAuth, então a proteção
+# anti-DNS-rebinding do SDK (que valida o Host) só atrapalha: sem isto o
+# Host público seria recusado com 421 Misdirected Request.
+_security = TransportSecuritySettings(enable_dns_rebinding_protection=False)
 
 
 if config.ISSUER_URL:
@@ -38,9 +44,10 @@ enabled=True, valid_scopes=["news"], default_scopes=["news"]
         ),
         revocation_options=RevocationOptions(enabled=True),
     )
-    mcp = FastMCP("news_mcp", auth_server_provider=_provider, auth=_auth_settings)
+    mcp = FastMCP("news_mcp", auth_server_provider=_provider, auth=_auth_settings,
+                  transport_security=_security)
 else:
-    mcp = FastMCP("news_mcp")
+    mcp = FastMCP("news_mcp", transport_security=_security)
 
 
 @mcp.tool(