Fix guides · check protocol.origin

Validate the Origin header on your MCP server

A local or intranet MCP server that accepts any Origin can be driven by a web page through DNS rebinding.

Why it matters

The spec requires Streamable HTTP servers to validate Origin. Without it, a malicious site the user visits can send requests to a server on localhost.

What to do

Reject requests whose Origin is present and not on your allowlist with 403; bind local servers to 127.0.0.1, not 0.0.0.0.

Check your server

Paste your endpoint at /check, or run it in CI:

pipx run glimind check https://your-server.example.com/mcp --min-grade B