Server validates the Origin header
Authored by Stanley Hong · AgentReserve (founder).
The MCP server returns HTTP 403 to a POST whose `Origin` header points at a host other than its own. This is the documented DNS-rebinding mitigation in the MCP 2025-11-25 security best practices: a server that processes cross-origin requests can be coerced via DNS rebinding into accepting tool calls from any page in the user's browser. Real CVEs in this class include CVE-2025-10625 (Neo4j Cypher MCP) and CVE-2026-23744 (MCPJam Inspector).
When this rule runs
Evaluated on every scan — observable from the URL, TLS handshake, or HTTP response headers, even when the MCP layer is auth-walled or unresponsive.
Why it matters
DNS rebinding lets an attacker's web page reach an MCP server bound to localhost or to an internal hostname — the browser-level same-origin policy doesn't help because the IP changes after the page loads. The Origin header is the server-side check that closes the loop. A server that doesn't validate Origin is reachable from any page the user visits while the MCP client is running.
Pass condition
The cross-origin POST probe returned HTTP 403 (the spec-compliant rejection).
Fail condition
The cross-origin POST probe returned a 2xx status, indicating the server processed the request without validating Origin.
Evidence examples
When the rule fails, the report records evidence in roughly this shape:
{"sentOrigin": "https://agentreserve-rebind-probe.invalid", "status": 200}
Remediation
Validate the `Origin` header on every MCP request. Maintain an allow-list of acceptable origins (typically the operator's own clients) and return HTTP 403 on any mismatch. Localhost-only servers should additionally reject requests whose `Host` header points at any name other than the loopback addresses they bound to.
Methodology
This rule belongs to the Transport security dimension. How the server is reached on the wire. Covers TLS and protocol-level confidentiality of probe traffic.
Read the full methodology for how rules are aggregated into a score, how verdicts are decided, and how hard-fail rules override the aggregate.