fix: Python server dependency resolution and Docker host validation (#333)

* fix(say-server): add --index flag to uv run for PyPI resolution

The pocket-tts dependency wasn't resolving without explicit --index flag
when invoked via npm scripts.

* fix(qr-server): allow Docker bridge IP in transport security

Add 172.17.0.1:* to allowed_hosts to fix 421 Misdirected Request errors
when the server is accessed from Docker containers.

Author: ochafik

examples/qr-server/server.py

@@ -19,6 +19,7 @@
 import qrcode
 import uvicorn
 from mcp.server.fastmcp import FastMCP
+from mcp.server.transport_security import TransportSecuritySettings
 from mcp import types
 from starlette.middleware.cors import CORSMiddleware
 
@@ -161,7 +162,11 @@ def view() -> str:
         mcp.run(transport="stdio")
     else:
         # HTTP mode for basic-host (default) - with CORS
-        app = mcp.streamable_http_app(stateless_http=True)
+        # Allow Docker bridge IP for container-to-host communication
+        security = TransportSecuritySettings(
+            allowed_hosts=["127.0.0.1:*", "localhost:*", "[::1]:*", "172.17.0.1:*"]
+        )
+        app = mcp.streamable_http_app(stateless_http=True, transport_security=security)
         app.add_middleware(
             CORSMiddleware,
             allow_origins=["*"],

examples/say-server/package.json

@@ -10,8 +10,8 @@
   },
   "license": "MIT",
   "scripts": {
-    "start": "uv run server.py",
-    "dev": "uv run server.py",
+    "start": "uv run --index https://pypi.org/simple server.py",
+    "dev": "uv run --index https://pypi.org/simple server.py",
     "build": "echo 'No build step needed for Python server'"
   },
   "dependencies": {