docs+test(http-security): clarify portless-Host rationale; deterministic 403 Host

Addresses PR #172 review:
- Copilot: reword defaultAllowedHosts comment + CONFIGURATION.md to state
  bare hostnames are always kept (match a portless Host), not port-80-only.
- Copilot: set an explicit disallowed Host in the mismatched-Host 403 test
  so it no longer relies on supertest's implicit ephemeral-port Host.
- Codacy: reword the SECURITY.md rebinding bullet from an imperative 'must'
  to a descriptive match statement.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ihor-sokoliuk

CONFIGURATION.md

@@ -183,7 +183,7 @@ Opt-in security layer for when you expose the HTTP transport on a network. Defau
 | `MCP_HTTP_ALLOW_PRIVATE_URLS` | No | `false` | Allow `web_url_read` to fetch internal/private URLs, including hostnames that DNS-resolve to private/internal addresses. Private URL reads are blocked by default in all modes. |
 | `MCP_HTTP_EXPOSE_FULL_CONFIG` | No | `false` | Expose full config details in `/health` response (for debugging) |
 
-`MCP_HTTP_ALLOWED_HOSTS` is compared against the raw `Host` header, which includes the port. The default already covers loopback access on the configured `MCP_HTTP_PORT` (`127.0.0.1:PORT`, `localhost:PORT`, `[::1]:PORT`) plus the bare hostnames for the port-80/443 case. When you set it explicitly, list the exact `Host` the client (or your reverse proxy) sends — e.g. `app.example.com` if the proxy forwards `Host: app.example.com` on 443, or `app.example.com:8443` if it forwards a port.
+`MCP_HTTP_ALLOWED_HOSTS` is compared against the raw `Host` header, which includes the port. The default already covers loopback access on the configured `MCP_HTTP_PORT` (`127.0.0.1:PORT`, `localhost:PORT`, `[::1]:PORT`) plus the bare hostnames, which match a portless `Host` — a client or reverse proxy that omits the port (as on ports 80/443). When you set it explicitly, list the exact `Host` the client (or your reverse proxy) sends — e.g. `app.example.com` if the proxy forwards `Host: app.example.com` on 443, or `app.example.com:8443` if it forwards a port.
 
 ## URL Reader Security
 

SECURITY.md

@@ -70,7 +70,7 @@ Hardened mode enforces:
 
 - **Bearer token authentication** on every request (`Authorization: Bearer <token>`)
 - **CORS origin allowlist** — requests from unlisted origins are rejected
-- **DNS rebinding protection** — the `Host` header is validated against `MCP_HTTP_ALLOWED_HOSTS`. The default allows loopback access on the configured port (`127.0.0.1`, `localhost`, `[::1]` and their `:PORT` forms). A custom list is matched exactly against `Host`, so each entry must include the port if the client or proxy sends one (e.g. `app.example.com:8443`).
+- **DNS rebinding protection** — the `Host` header is validated against `MCP_HTTP_ALLOWED_HOSTS`. The default allows loopback access on the configured port (`127.0.0.1`, `localhost`, `[::1]` and their `:PORT` forms). A custom list is matched exactly against `Host`: an entry matches only when it carries the same port the client or proxy sends (e.g. `app.example.com:8443`).
 
 `MCP_HTTP_HARDEN=true` will fail to start if `MCP_HTTP_AUTH_TOKEN` or `MCP_HTTP_ALLOWED_ORIGINS` are missing.
 

__tests__/integration/http-server.test.ts

@@ -361,11 +361,12 @@ async function runTests() {
     envManager.set('MCP_HTTP_HARDEN', 'true');
     envManager.set('MCP_HTTP_AUTH_TOKEN', 'secret-token');
     envManager.set('MCP_HTTP_ALLOWED_ORIGINS', 'https://app.example.com');
-    envManager.set('MCP_HTTP_ALLOWED_HOSTS', 'allowed.example.com'); // supertest sends 127.0.0.1:<ephemeral>, which will not match
+    envManager.set('MCP_HTTP_ALLOWED_HOSTS', 'allowed.example.com');
 
     const app = await createHttpServer(() => createTestMcpServer(), 3000);
     const res = await request(app)
       .post('/mcp')
+      .set('Host', 'evil.example.com') // explicit disallowed Host so the 403 is deterministic across supertest/node versions
       .set('Origin', 'https://app.example.com')
       .set('Authorization', 'Bearer secret-token')
       .set('Content-Type', 'application/json')

src/http-security.ts

@@ -41,8 +41,9 @@ function parseTrustProxy(value: string | undefined): boolean | number | string {
 // Default DNS-rebinding allowlist when MCP_HTTP_ALLOWED_HOSTS is unset. The SDK
 // transport matches the raw Host header (port included) with exact Array.includes,
 // so the bind port must be baked into the loopback defaults or hardened mode 403s
-// every request on any non-80 port (BUG-012). Bare hostnames are kept for the
-// port-80/default-port case; [::1] mirrors the SDK's own localhost default.
+// every request on any non-80 port (BUG-012). The bare hostnames are always kept
+// too: they match a portless Host — a client or reverse proxy that omits the port
+// (as on default ports 80/443). [::1] mirrors the SDK's own localhost default.
 function defaultAllowedHosts(port?: number): string[] {
   const hosts = ["127.0.0.1", "localhost", "[::1]"];
   if (port !== undefined) {