mirror of
https://github.com/GNS3/gns3-server.git
synced 2026-08-28 13:00:15 +03:00
bb39238f02
Add MCP transport security configuration to gns3_server.conf with permissive defaults that align with GNS3's design philosophy and VM distribution requirements. ## Changes ### 1. Configuration Schema (gns3server/schemas/config.py) - Added MCP transport security fields to ServerSettings class: - mcp_enable_dns_rebinding_protection (bool, default: True) - mcp_allowed_hosts (list[str], default: ["*"]) - mcp_allowed_origins (list[str], default: ["*"]) - Added field validators to handle comma-separated string input ### 2. MCP Server Initialization (gns3server/api/routes/mcp/__init__.py) - Import TransportSecuritySettings from mcp.server.transport_security - Added _create_mcp_server() function to read configuration - Updated FastMCP instantiation to use configured security settings ### 3. Configuration Sample (gns3server/config_samples/gns3_server.conf) - Added MCP transport security settings section - Documented default behavior and security options - Provided examples for different use cases ## Design Philosophy **Default: Allow All Hosts** (matches GNS3's 0.0.0.0 binding): - VM distribution works out-of-the-box - Users can access from any network location - Security-conscious users can restrict when needed **Security: Optional Restriction**: Users can configure specific hosts for enhanced security: ``ini mcp_allowed_hosts = 127.0.0.1:*,localhost:*,192.168.1.3:* mcp_allowed_origins = http://127.0.0.1:*,http://localhost:*,http://192.168.1.3:* ``` ## Benefits - Flexible: Users can configure based on security requirements - User-friendly: Default matches GNS3's 0.0.0.0 binding philosophy - Maintainable: No code changes needed for different deployment scenarios - Secure: DNS rebinding protection remains enabled with configurable hosts ## Related - Issue #2771 - FastMCP DNS rebinding protection design - Existing skills configuration in ServerSettings