Does same-origin redirect enforcement break MCP servers behind a reverse proxy?
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 64/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- nginx, python
- Domain
- documentation, networking
Research direction
Start with the v2.2.0 release notes and the HTTP client redirect enforcement described in the issue. Verify whether additional origins can be allowlisted and how HTTP-to-HTTPS or subpath redirects behave behind a reverse proxy. Update the migration notes with the confirmed escape hatch or deployment guidance for self-hosted MCP servers.
Written by the indexing model from the issue text.
Description
Reading the v2.2.0 release notes: the HTTP client now fails redirects with MCPError unless the target is same-origin. For self-hosted setups this seems like it could bite people running an MCP server behind something like Caddy or nginx — e.g. an HTTP→HTTPS redirect, or a redirect from a bare port to a subpath, which often lands on a different-looking origin even though it's the same server.
The changelog doesn't say whether there's a way to allowlist additional origins for these cases, or whether the guidance is simply "don't let your reverse proxy redirect, terminate TLS and proxy_pass directly." Is there a documented escape hatch, or is this an intentional hard stop meant to force removing redirects from self-hosted deployments entirely? A line in the migration notes about the reverse-proxy case would save people a confusing debugging session when their server that worked in 2.1.x suddenly throws on upgrade.
- Dominant language
- Python
- Stars
- 24.3k
- Forks
- 4k
- Avg merge
- 1d 19m
- Merged PRs (30d)
- 29
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/python-sdk
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
modelcontextprotocol/python-sdk#3546 · 5 comments ·
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
modelcontextprotocol/python-sdk#3545 · 1 comment ·
-
v1 v2
Difficulty 1/5 Under an hour Newbie friendliness 91/100
modelcontextprotocol/python-sdk#3508 · 2 comments ·
-
v1 v2
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
modelcontextprotocol/python-sdk#3492 · 1 comment ·
-
v1
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
modelcontextprotocol/python-sdk#3487 · 3 comments ·
All issues in modelcontextprotocol/python-sdk
Similar issues
-
Add: hunch Open
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
AbdelStark/awesome-typesafe#104 ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
DiamondLightSource/dodal#2211 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
openml/openml-python#1749 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sipyourdrink-ltd/bernstein#6191 ·