Bug: MCP SSE _check_auth allows empty Host header (loopback bypass)

[tcconnally]

Severity: 🟡 Medium (security; Host-header bypass)

mcp.py:364–378:

def _check_auth(handler) -> bool:
    host = handler.headers.get("Host", "")
    if host:
        hostname = host.split(":")[0]
        if hostname not in ("127.0.0.1", "localhost", "::1"):
            return False
    if not token:
        return True
    ...

If Host: header is empty/absent, the loopback check is skipped and auth proceeds. With no token configured, an HTTP/1.0 request without a Host: header bypasses loopback enforcement.

Same pattern in serve.py::_serve_authorized (lines ~2611–2618).

Suggested fix

host = handler.headers.get("Host", "")
hostname = host.split(":")[0] if host else ""
if hostname not in ("127.0.0.1", "localhost", "::1"):
    return False

Acceptance criteria

• Test: HTTP request with no Host: header → 401.
• Same regression for serve.py::_serve_authorized.

[tcconnally]

Fixed in stacked PR chain → #179 (integration PR targeting main).