feat: add DNS rebinding protection conformance tests

examples/servers/typescript/README.md

@@ -170,3 +170,21 @@ If you're implementing MCP in another language/SDK:
 5. **Handle Notifications Carefully**: Catch/ignore errors when no client is connected
 
 **Goal**: All SDK example servers provide the same interface, enabling a single test suite to verify conformance across all implementations.
+
+## Negative Test Cases
+
+### no-dns-rebinding-protection.ts
+
+A minimal MCP server that intentionally omits DNS rebinding protection. This is a **negative test case** that demonstrates what a vulnerable server looks like and is expected to **FAIL** the `dns-rebinding-protection` conformance scenario.
+
+```bash
+# Run the vulnerable server
+npx tsx no-dns-rebinding-protection.ts
+
+# This should FAIL the dns-rebinding-protection checks
+npx @modelcontextprotocol/conformance server \
+  --url http://localhost:3003/mcp \
+  --scenario dns-rebinding-protection
+```
+
+**DO NOT** use this pattern in production servers. Always use `createMcpExpressApp()` or the `localhostHostValidation()` middleware for localhost servers.

examples/servers/typescript/everything-server.ts

@@ -18,6 +18,7 @@ import {
   EventId,
   StreamId
 } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createMcpExpressApp } from '@modelcontextprotocol/sdk/server/express.js';
 import {
   ElicitResultSchema,
   ListToolsRequestSchema,
@@ -26,7 +27,6 @@ import {
 } from '@modelcontextprotocol/sdk/types.js';
 import { zodToJsonSchema } from 'zod-to-json-schema';
 import { z } from 'zod';
-import express from 'express';
 import cors from 'cors';
 import { randomUUID } from 'crypto';
 
@@ -1055,8 +1055,8 @@ function isInitializeRequest(body: any): boolean {
 
 // ===== EXPRESS APP =====
 
-const app = express();
-app.use(express.json());
+// Use createMcpExpressApp for DNS rebinding protection on localhost
+const app = createMcpExpressApp();
 
 // Configure CORS to expose Mcp-Session-Id header for browser-based clients
 app.use(

examples/servers/typescript/no-dns-rebinding-protection.ts

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+
+/**
+ * MCP Server WITHOUT DNS Rebinding Protection - Negative Test Case
+ *
+ * This server intentionally omits DNS rebinding protection to demonstrate
+ * what a vulnerable server looks like. DO NOT use this pattern in production.
+ *
+ * This is a negative test case for the conformance suite - it should FAIL
+ * the dns-rebinding-protection scenario.
+ */
+
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import {
+  StreamableHTTPServerTransport,
+  EventStore,
+  EventId,
+  StreamId
+} from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import express from 'express';
+import { randomUUID } from 'crypto';
+
+// In-memory event store for SSE
+function createEventStore(): EventStore {
+  const events = new Map<StreamId, Map<EventId, string>>();
+
+  return {
+    async storeEvent(
+      streamId: StreamId,
+      eventId: EventId,
+      message: string
+    ): Promise<void> {
+      if (!events.has(streamId)) {
+        events.set(streamId, new Map());
+      }
+      events.get(streamId)!.set(eventId, message);
+    },
+    async replayEventsAfter(
+      streamId: StreamId,
+      lastEventId: EventId
+    ): Promise<string[]> {
+      const streamEvents = events.get(streamId);
+      if (!streamEvents) {
+        return [];
+      }
+      const entries = Array.from(streamEvents.entries()).sort(
+        ([a], [b]) => Number(a) - Number(b)
+      );
+      const startIdx = entries.findIndex(([id]) => id === lastEventId);
+      if (startIdx === -1) {
+        return entries.map(([, msg]) => msg);
+      }
+      return entries.slice(startIdx + 1).map(([, msg]) => msg);
+    }
+  };
+}
+
+// Create MCP server with minimal functionality
+function createMcpServer(): McpServer {
+  const server = new McpServer({
+    name: 'no-dns-rebinding-protection-server',
+    version: '1.0.0'
+  });
+
+  // Add a simple tool
+  server.tool(
+    'echo',
+    'Echo the input back',
+    { message: { type: 'string', description: 'Message to echo' } },
+    async ({ message }) => {
+      return {
+        content: [{ type: 'text', text: `Echo: ${message}` }]
+      };
+    }
+  );
+
+  return server;
+}
+
+// Track active transports and servers
+const transports: Record<string, StreamableHTTPServerTransport> = {};
+const servers: Record<string, McpServer> = {};
+
+function isInitializeRequest(body: any): boolean {
+  return body?.method === 'initialize';
+}
+
+// === VULNERABLE EXPRESS APP ===
+// This intentionally does NOT use createMcpExpressApp() or localhostHostValidation()
+// to demonstrate a server without DNS rebinding protection.
+
+const app = express();
+app.use(express.json());
+
+// NO DNS rebinding protection middleware here!
+// This is intentionally vulnerable for testing purposes.
+
+app.post('/mcp', async (req, res) => {
+  const sessionId = req.headers['mcp-session-id'] as string | undefined;
+
+  try {
+    let transport: StreamableHTTPServerTransport;
+
+    if (sessionId && transports[sessionId]) {
+      transport = transports[sessionId];
+    } else if (!sessionId && isInitializeRequest(req.body)) {
+      const mcpServer = createMcpServer();
+
+      transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => randomUUID(),
+        eventStore: createEventStore(),
+        onsessioninitialized: (newSessionId) => {
+          transports[newSessionId] = transport;
+          servers[newSessionId] = mcpServer;
+        }
+      });
+
+      transport.onclose = () => {
+        const sid = transport.sessionId;
+        if (sid && transports[sid]) {
+          delete transports[sid];
+          if (servers[sid]) {
+            delete servers[sid];
+          }
+        }
+      };
+
+      await mcpServer.connect(transport);
+    } else {
+      res.status(400).json({
+        jsonrpc: '2.0',
+        error: { code: -32000, message: 'Bad Request: No valid session' },
+        id: null
+      });
+      return;
+    }
+
+    await transport.handleRequest(req, res, req.body);
+  } catch (error) {
+    console.error('Error handling request:', error);
+    if (!res.headersSent) {
+      res.status(500).json({
+        jsonrpc: '2.0',
+        error: { code: -32603, message: 'Internal error' },
+        id: null
+      });
+    }
+  }
+});
+
+// Start server
+const PORT = parseInt(process.env.PORT || '3003', 10);
+app.listen(PORT, '127.0.0.1', () => {
+  console.log(`Vulnerable server running on http://localhost:${PORT}`);
+  console.log(`  - MCP endpoint: http://localhost:${PORT}/mcp`);
+  console.log(`  - WARNING: No DNS rebinding protection enabled!`);
+});

package.json

@@ -50,6 +50,7 @@
     "eventsource-parser": "^3.0.6",
     "express": "^5.1.0",
     "jose": "^6.1.2",
+    "undici": "^7.19.0",
     "yaml": "^2.8.2",
     "zod": "^3.25.76"
   }

src/scenarios/index.ts

@@ -51,6 +51,8 @@ import {
   PromptsGetWithImageScenario
 } from './server/prompts';
 
+import { DNSRebindingProtectionScenario } from './server/dns-rebinding';
+
 import { authScenariosList } from './client/auth/index';
 import { listMetadataScenarios } from './client/auth/discovery-metadata';
 
@@ -123,7 +125,10 @@ const allClientScenariosList: ClientScenario[] = [
   new PromptsGetSimpleScenario(),
   new PromptsGetWithArgsScenario(),
   new PromptsGetEmbeddedResourceScenario(),
-  new PromptsGetWithImageScenario()
+  new PromptsGetWithImageScenario(),
+
+  // Security scenarios
+  new DNSRebindingProtectionScenario()
 ];
 
 // Active client scenarios (excludes pending)