fix(mcp): validate the Host header, not only Origin (#50)

[jrosskopf]

Closes nothing on its own — see the note at the bottom about #50.

The gap

PR #45 removed the wildcard Access-Control-Allow-Origin and added Origin validation, and that part works: Origin: https://evil.example is answered 403. The comment on #50 argues that Host must be validated too, and it is right. Measured against the released build:

POST /mcp  Host: rebind.evil.example:8192  Origin: http://rebind.evil.example:8192  → 200
POST /mcp  Host: rebind.evil.example:8192  (no Origin)                              → 200

Both are what DNS rebinding looks like once evil.example points rebind.evil.example at 127.0.0.1. The browser considers the call same-origin, so the first request passes ClassifyOrigin's same-origin rule — which proves nothing, because after rebinding the attacker owns both halves of that comparison — and the second passes the no-Origin rule. Behind the endpoint sit adt_write_source, adt_delete_object, adt_activate, adt_release_transport, bw_delete_object.

What this does

ClassifyHost classifies the Host header on its own, checked before Origin:

Host	Verdict
absent	NoHost — browsers always send one
localhost, 127.0.0.1, [::1]	Loopback
any IP literal (192.168.1.5, [fe80::1])	IpLiteral — an IP address has no DNS name to rebind
the address bound, or named by --allowed-hosts	Allowlisted
--allowed-hosts '*'	Wildcard
any other DNS name	Unrecognised

--allowed-hosts <list> on both mcp --http and catalog webui. The IpLiteral rule is what keeps --host 0.0.0.0 reachable at a LAN address with no configuration.

Warn-only by default

Passing --allowed-hosts is what turns refusal on. Without it an Unrecognised Host is still served, with one warning per distinct host on stderr (deduplicated, so a scripted attack cannot flood the log). A deployment reached through a DNS name or a reverse proxy therefore does not break on upgrade.

The trade-off to be explicit about: in the default configuration the rebinding path above is still open. That is why this PR does not close #50 — closing it would mean flipping the default to enforcing, which is a separate decision.

Verified live

== default (warn-only) ==                  == with --allowed-hosts mcp.internal.example ==
rebound Host + matching Origin   200       rebound Host + matching Origin   403
rebound Host, no Origin          200       rebound Host, no Origin          403
loopback                         200       loopback                         200
                                           LAN IP literal                   200
                                           the configured name              200

Plus: 1363 unit tests pass (13 new), and scripts/ci/webui_smoke.py passes — the embedded web UI is same-origin on loopback, so enforcement costs it nothing.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}