fix(mcp): allow the server's own port-less host in the transport allowlist

When BASE_URL carries a non-default port, the netloc and :* wildcard entries
match only a Host/Origin that includes a port. Hosted MCP gateways (e.g.
Databricks) send a port-less Host/Origin for the server's own host, which was
rejected with "invalid Host header" unless the host was re-listed in
TG_MCP_EXTRA_ALLOWED_HOSTS. Add the bare base_host and origin to the
BASE_URL-derived allowlist so the server accepts its own host regardless of port.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aarthy-dk

testgen/mcp/server.py

@@ -93,15 +93,20 @@ def _build_transport_security() -> TransportSecuritySettings:
     netloc = parsed.netloc
     scheme = parsed.scheme or "http"
 
+    # base_host (bare) is allowed alongside netloc: when BASE_URL carries a non-default
+    # port, netloc and the :* wildcard only match a host that includes a port, but some
+    # clients (e.g. hosted MCP gateways) send a port-less Host/Origin for their own host.
     allowed_hosts: set[str] = {
         netloc,
+        base_host,
         f"{base_host}:*",
         "127.0.0.1:*",
         "localhost:*",
         "[::1]:*",
     }
     allowed_origins: set[str] = {
         f"{scheme}://{netloc}",
+        f"{scheme}://{base_host}",
         "http://127.0.0.1:*", "https://127.0.0.1:*",
         "http://localhost:*", "https://localhost:*",
         "http://[::1]:*", "https://[::1]:*",

tests/unit/mcp/test_transport_security.py

@@ -30,6 +30,20 @@ def test_loopback_and_base_url_always_present():
     assert "https://localhost:*" in settings.allowed_origins
 
 
+def test_ported_base_url_also_allows_bare_host_and_origin():
+    """A BASE_URL with a non-default port also allows the bare (port-less) host and origin.
+
+    Clients such as hosted MCP gateways may send a port-less Host/Origin for the server's
+    own host; the `:*` wildcard requires a port, so the bare forms must be present too.
+    """
+    settings = _build_with("https://tg.example.com:8530")
+
+    assert "tg.example.com:8530" in settings.allowed_hosts
+    assert "tg.example.com" in settings.allowed_hosts
+    assert "https://tg.example.com:8530" in settings.allowed_origins
+    assert "https://tg.example.com" in settings.allowed_origins
+
+
 def test_extra_host_without_port_gets_wildcard_and_bare():
     """An extras entry without `:` is allowed both with a `:*` port wildcard and bare.