NgTech-LTD/gns3-server
2
0 Fork 0
mirror of https://github.com/GNS3/gns3-server.git synced 2026-11-03 05:51:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add configurable MCP transport security settings via gns3_server.conf

Browse Source 
Add MCP transport security configuration to gns3_server.conf with permissive
defaults that align with GNS3's design philosophy and VM distribution requirements.

## Changes

### 1. Configuration Schema (gns3server/schemas/config.py)
- Added MCP transport security fields to ServerSettings class:
  - mcp_enable_dns_rebinding_protection (bool, default: True)
  - mcp_allowed_hosts (list[str], default: ["*"])
  - mcp_allowed_origins (list[str], default: ["*"])
- Added field validators to handle comma-separated string input

### 2. MCP Server Initialization (gns3server/api/routes/mcp/__init__.py)
- Import TransportSecuritySettings from mcp.server.transport_security
- Added _create_mcp_server() function to read configuration
- Updated FastMCP instantiation to use configured security settings

### 3. Configuration Sample (gns3server/config_samples/gns3_server.conf)
- Added MCP transport security settings section
- Documented default behavior and security options
- Provided examples for different use cases

## Design Philosophy

**Default: Allow All Hosts** (matches GNS3's 0.0.0.0 binding):
- VM distribution works out-of-the-box
- Users can access from any network location
- Security-conscious users can restrict when needed

**Security: Optional Restriction**:
Users can configure specific hosts for enhanced security:
``ini
mcp_allowed_hosts = 127.0.0.1:*,localhost:*,192.168.1.3:*
mcp_allowed_origins = http://127.0.0.1:*,http://localhost:*,http://192.168.1.3:*
```

## Benefits

- Flexible: Users can configure based on security requirements
- User-friendly: Default matches GNS3's 0.0.0.0 binding philosophy
- Maintainable: No code changes needed for different deployment scenarios
- Secure: DNS rebinding protection remains enabled with configurable hosts

## Related

- Issue #2771
- FastMCP DNS rebinding protection design
- Existing skills configuration in ServerSettings
This commit is contained in:
YueGuobin committed 2026-06-05 23:06:06 +08:00
1 parent 68f63597eb
commit bb39238f02
3 files changed
+51 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

gns3server/config_samples/gns3_server.conf
+14 -1
View File
@@ -183,4 +183,17 @@ memory = 2g
; CPU cores per container (e.g., 1.0, 2.0)
cpus = 1.0
; Process limit per container
pids_limit = 1000
pids_limit = 1000
; MCP (Model Context Protocol) transport security settings
; Enable DNS rebinding protection for MCP server
mcp_enable_dns_rebinding_protection = True
; Allowed hosts for MCP connections (comma-separated, use * for wildcard)
; Default: * (allow all hosts - recommended for GNS3 VM distribution)
; For enhanced security, restrict to specific hosts: 127.0.0.1:*,localhost:*,192.168.1.3:*
mcp_allowed_hosts = *
; Allowed origins for MCP connections (comma-separated)
; Default: * (allow all origins)
; For enhanced security: http://127.0.0.1:*,http://localhost:*,http://192.168.1.3:*
mcp_allowed_origins = *