MCP servers that fail: origin validated (dns-rebinding protection)
5 of the 217 Model Context Protocol servers where this control could be evaluated fail it — that is 2% of the evaluated corpus on the Canopii Trust Index.
- Servers failing
- 5
- Failure rate
- 2%
- Average score when failing
- 75/100
A further 171 servers warn on this control — a weaker signal we could not confirm, counted at half weight rather than as a failure.
Why this matters
An HTTP MCP server that doesn't reject hostile Origin headers can be driven by any web page the user visits via DNS rebinding — including servers bound to localhost (CIS MCP 2.5).
How to pass it
Enable the SDK's DNS-rebinding protection (enableDnsRebindingProtection / TransportSecuritySettings) with explicit allowed hosts and origins, and return 403 for an unlisted Origin.
Control id transport.origin_validated — weighted 4 in the rubric.
Affected servers
Each server's own page shows the evidence behind this result.
🚀 Self-hosted TikTok & Douyin scraper and no-watermark video downloader — async REST API, MCP server, CLI and web console for posts, profiles, comments and playlists. Self-healing identity pool, PostgreSQL archive, one docker compose up. 抖音、TikTok 数据采集与无水印视频下载 API，自托管，支持 MCP 调用与 Docker 一键部署。
Wine recommendations, food pairings & B2B contact for Weingut Dreissigacker, Rheinhessen.
BitDive Model Context Protocol (MCP) server. The Autonomous Quality Loop for AI agents. Provides real runtime context, before/after trace comparison, and integration testing workflows.
A label property graph on SQLite/Postgres with multi-ontology routing and a gated MCP server.
MCP Python Interpreter: run python code. Python-mcp-server, mcp-python-server, Code Executor
This control is one of 32 in the published rubric — see how scoring works or how the ecosystem fails every other control.