feat(mcp): replace bind-host guard with auth-posture interlock

[gbrlcustodio]

Closes #379.

What

Replaces the bind-interface guard _assert_safe_http_bind with an auth-posture interlock, realizing the safety interlock scoped in #300 and retiring the legacy guard it was meant to supersede.

Why the old guard was wrong

The old guard refused any non-loopback HTTP bind. It checked the wrong axis. The property worth protecting is "an unauthenticated profile must not be served to untrusted callers," but bind interface is a poor proxy:

• In a container everything binds 0.0.0.0 and is still private (network namespace, no published port), so the guard false-positived on the entire hosted profile.
• Behind a proxy the server must bind non-loopback, and the remote profile is safe there because it has inbound auth (resource-server validation, per-request bearer). Every firing against remote was a false positive.

It also lived in run_server, not the app factory, so it protected nothing for callers that build the ASGI app directly via streamable_http_app(). That bypass was the intended off-loopback path today, which trains callers to route around the control and has already led a downstream repo to vendor a guard-less copy.

The interlock

Keyed on auth posture, not bind host, and expressed as a cross-field validator at the settings boundary (McpSettings._enforce_bind_safety), so no serving path can route around it: build_pipefy_mcp_server and any direct-ASGI-app caller both take a resolved Settings.

• No-inbound-auth posture (profile == "local"): refuses a non-loopback HTTP bind unless the escape hatch PIPEFY_MCP_ALLOW_INSECURE_HTTP_BIND is set. This is the real footgun (the full tool surface, no inbound bearer, reachable off the local machine).
• Resource-server posture (profile == "remote"): bind host is irrelevant and is not checked. The operator binds 0.0.0.0 legitimately. remote always carries inbound auth or fails fast in McpRuntime.for_profile, so keying on profile == "local" is a faithful proxy for posture at the settings layer.

Loopback detection moves to a new pipefy_infra.security.is_loopback_host, a generic security primitive that uses ipaddress(...).is_loopback to cover all of 127.0.0.0/8 and ::1, not the three string literals the old _LOOPBACK_HOSTS frozenset hardcoded.

Acceptance criteria

• _assert_safe_http_bind (the bind-interface check) is removed.
• The remote / resource-server profile serves on a non-loopback host with no bind-host guard and no bypass.
• The no-auth profile refuses non-loopback HTTP unless the escape hatch is set, exercised by a test.
• No supported serving path requires calling internal factory methods to route around a guard.

Testing

• uv run python -m pytest packages/infra/tests/test_security.py packages/mcp/tests/test_settings.py packages/mcp/tests/test_server.py packages/mcp/tests/test_main.py: 145 passed.
• Full non-integration packages/infra/tests packages/mcp/tests: 1607 passed, 5 skipped.
• cd packages/mcp && uv run lint-imports: contract kept.
• uv run ruff check packages/infra packages/mcp: clean.

Not in scope

• The configurable transport host / Origin allowlist for DNS-rebinding protection (Configurable transport host allowlist #303) stays open and is unaffected.
• Follow-up worth doing: the "auth posture" axis is re-derived from profile == "remote"/"local" at several sites (settings, server, runtime); a single named posture property on McpSettings would consolidate it. Deferred to keep this change focused.

[adriannoes]

Summary

Looks good to merge.

• Local checkout+tests on 9c818451 (ruff, targeted 145, full infra+mcp 1607, lint-imports kept) and CI lint/test are green.
• The auth-posture interlock at McpSettings._enforce_bind_safety matches #379: local+http refuses non-loopback without the hatch, remote can bind off-loopback, and the old run-path _assert_safe_http_bind is gone.

What worked well

• Moving the control to the settings boundary closes the ASGI/streamable_http_app bypass of the old run_server-only guard.
• Keying on auth posture (local vs remote) fixes the false positives on container 0.0.0.0 and authenticated hosted binds.
• is_loopback_host via ipaddress.is_loopback, with clear escape-hatch docs and tests.

Also noted

• Merge-order heads-up with the open #373 stack (PR #376 / feat/373-request-log-middleware): server.py conflicts where this PR removes _assert_safe_http_bind and that branch inserts _serve_streamable_http, and both rewrite the tail of run_server. The new test test_run_server_remote_serves_off_loopback_without_a_bind_guard asserts fake_app.run("streamable-http"), which that serve path replaces with anyio.run(_serve_streamable_http, ...), so whoever lands second needs to retarget that assertion. The settings-boundary interlock still covers that custom uvicorn path, which is exactly the coverage argument here.