fix: use localhost for MCP OAuth loopback redirect URIs

[rumbin]

Summary

• generate MCP OAuth redirect URIs with http://localhost:<port>/callback
• keep the local callback listener bound to 127.0.0.1
• add tests to lock in the new redirect URI behavior

Motivation

Some OAuth providers accept loopback redirect URIs only in the localhost form and reject the equivalent numeric loopback address 127.0.0.1.

That breaks first-time OAuth bootstrap during dynamic client registration even though the callback server is still strictly local.

This surfaced against the Superset MCP server at:

• https://XXXX.net/mcp

In that flow:

• http://localhost:<port>/callback was accepted
• http://127.0.0.1:<port>/callback was rejected

Implementation

In tools/mcp_oauth.py:

• keep the callback server bound to 127.0.0.1
• generate advertised redirect URIs with localhost
• update the SSH hint text accordingly
• centralize the distinction with separate bind/redirect host constants

In tests/tools/test_mcp_oauth.py:

• assert generated redirect URIs start with http://localhost:
• assert generated redirect URIs end with /callback

Why this is safe

This does not broaden callback exposure:

• the HTTP listener still binds to loopback only
• only the hostname used in the advertised redirect URI changes
• localhost still resolves to the local machine in the standard desktop/CLI OAuth loopback flow

So this is a compatibility fix, not a security relaxation.

Validation

• /home/philipp/.hermes/hermes-agent/venv/bin/python -m pytest tests/tools/test_mcp_oauth.py -q → 42 passed
• /home/philipp/.hermes/hermes-agent/venv/bin/python -m pytest tests/tools/test_mcp_oauth_integration.py -q → 5 passed
• /home/philipp/.hermes/hermes-agent/venv/bin/hermes mcp test superset → connected successfully, 112 tools discovered

Observed successful redirect URI:

• http://localhost:50611/callback

Note on overlap

There is already an open broader redirect-host plumbing PR (#21482). This PR is intentionally narrower: it fixes the concrete interoperability issue by switching generated loopback redirect URIs to localhost while preserving loopback-only binding on 127.0.0.1.