Python MCP server behind a proxy or custom domain rejects every request with 421 Invalid Host header

421 Misdirected Request with body Invalid Host header in the server log

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

The Python SDK's DNS rebinding protection checks the Host and Origin headers against an allowlist. Deployed behind a real hostname or proxy, the default rejects every request before any MCP handling runs.

Fix

Pass transport_security with allowed_hosts and allowed_origins for the names you serve, listing both the bare host and host:* for ports, or turn the check off when a reverse proxy already controls Host.

Apply

from mcp.server.transport_security import TransportSecuritySettings
security = TransportSecuritySettings(allowed_hosts=["mcp.example.com", "mcp.example.com:*"], allowed_origins=["https://app.example.com"])
# pass transport_security=security when creating the server

Affects: MCP Python SDK since DNS rebinding protection (PR 861), including v2, as of 2026-10

Sources

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp