fix: prefix env vars and reject origins without hosts

Two defects found by testing the merge risk of this branch against a
live server rather than only through mocks.

--allowed-origins without --allowed-hosts enabled DNS-rebinding
protection with an empty host allowlist, which rejects *every* request
with 421 Misdirected Request. Measured on a running server: no
allowlist -> 200, origins-only -> 421, hosts set -> 200. Origins-only
is therefore never a usable configuration, and the README presented
both flags side by side, so reaching it took only using one of them.
The combination now fails at startup instead of serving an endpoint
that answers nothing.

The environment variables were unprefixed. A bare MCP_TRANSPORT
belongs to no particular server, so a value left over from an
unrelated one turned a stdio launch -- how every desktop MCP client
starts this server -- into an HTTP listener that never answers the
client's handshake; confirmed by launching with MCP_TRANSPORT=http and
watching uvicorn come up on a stdio invocation. They are now
COMMIT_CHECK_MCP_*, and a test pins that the unprefixed names are
ignored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U9zFxq8V4qxG4aMzJhGBFn

Author: claude

README.md

@@ -248,7 +248,10 @@ commit-check-mcp --transport http --host 0.0.0.0 --port 8080
 ```
 
 The same settings are available as environment variables for container
-images: `MCP_TRANSPORT=http`, `MCP_HOST`, and `MCP_PORT`.
+images: `COMMIT_CHECK_MCP_TRANSPORT=http`, `COMMIT_CHECK_MCP_HOST`, and
+`COMMIT_CHECK_MCP_PORT`. They are deliberately prefixed — an unprefixed
+`MCP_TRANSPORT` belongs to no particular server, and a stray value would
+turn a stdio launch into an HTTP listener that never answers its client.
 
 > [!IMPORTANT]
 > The server has no built-in authentication or TLS. The `0.0.0.0` bind is
@@ -263,7 +266,10 @@ images: `MCP_TRANSPORT=http`, `MCP_HOST`, and `MCP_PORT`.
 >   --allowed-origins https://app.example.com
 > ```
 >
-> (also available as `MCP_ALLOWED_HOSTS` / `MCP_ALLOWED_ORIGINS`)
+> (also available as `COMMIT_CHECK_MCP_ALLOWED_HOSTS` /
+> `COMMIT_CHECK_MCP_ALLOWED_ORIGINS`). `--allowed-origins` requires
+> `--allowed-hosts`: an empty host allowlist rejects every request with
+> 421, so the server refuses to start on that combination.
 
 Each request is self-contained — clients can `POST` a `tools/call` directly
 to `/mcp` without an `initialize` handshake or `Mcp-Session-Id` header:

src/commit_check_mcp/server.py

@@ -620,30 +620,35 @@ def main(argv: list[str] | None = None) -> None:
     """
     import argparse
 
+    # Environment variables carry the COMMIT_CHECK_MCP_ prefix on purpose. A
+    # bare MCP_TRANSPORT belongs to no particular server, so an unrelated
+    # value left in the environment would turn a stdio launch — how every
+    # desktop MCP client starts this server — into an HTTP listener that
+    # never answers the client's handshake.
     parser = argparse.ArgumentParser(prog="commit-check-mcp")
     parser.add_argument(
         "--transport",
         choices=["stdio", "http"],
-        default=os.environ.get("MCP_TRANSPORT", "stdio"),
+        default=os.environ.get("COMMIT_CHECK_MCP_TRANSPORT", "stdio"),
         help="stdio for local clients (default); http for a stateless remote server",
     )
     parser.add_argument(
         "--host",
-        default=os.environ.get("MCP_HOST", "127.0.0.1"),
+        default=os.environ.get("COMMIT_CHECK_MCP_HOST", "127.0.0.1"),
         help="bind address for --transport http (default 127.0.0.1; use 0.0.0.0 in containers)",
     )
     # A string default is converted through type=int only when --port is
-    # absent, so an invalid inherited MCP_PORT still fails loudly on its own
-    # but cannot veto an explicit, valid --port.
+    # absent, so an invalid inherited port still fails loudly on its own but
+    # cannot veto an explicit, valid --port.
     parser.add_argument(
         "--port",
         type=int,
-        default=os.environ.get("MCP_PORT", "8000"),
+        default=os.environ.get("COMMIT_CHECK_MCP_PORT", "8000"),
         help="port for --transport http (default 8000)",
     )
     parser.add_argument(
         "--allowed-hosts",
-        default=os.environ.get("MCP_ALLOWED_HOSTS", ""),
+        default=os.environ.get("COMMIT_CHECK_MCP_ALLOWED_HOSTS", ""),
         help=(
             "comma-separated Host header allowlist for --transport http"
             " (e.g. mcp.example.com,mcp.example.com:443); enables strict"
@@ -652,14 +657,17 @@ def main(argv: list[str] | None = None) -> None:
     )
     parser.add_argument(
         "--allowed-origins",
-        default=os.environ.get("MCP_ALLOWED_ORIGINS", ""),
-        help="comma-separated Origin header allowlist for --transport http",
+        default=os.environ.get("COMMIT_CHECK_MCP_ALLOWED_ORIGINS", ""),
+        help=(
+            "comma-separated Origin header allowlist for --transport http;"
+            " requires --allowed-hosts"
+        ),
     )
     args = parser.parse_args(argv)
 
     # argparse does not check `choices` against env-supplied defaults, and a
-    # typo in MCP_TRANSPORT must not silently fall back to stdio inside a
-    # container that expects an HTTP listener.
+    # typo in COMMIT_CHECK_MCP_TRANSPORT must not silently fall back to stdio
+    # inside a container that expects an HTTP listener.
     if args.transport not in ("stdio", "http"):
         parser.error(
             f"argument --transport: invalid choice: {args.transport!r}"
@@ -677,7 +685,16 @@ def main(argv: list[str] | None = None) -> None:
         allowed_origins = [
             o.strip() for o in args.allowed_origins.split(",") if o.strip()
         ]
-        if allowed_hosts or allowed_origins:
+        # Turning on DNS-rebinding protection with an empty host allowlist
+        # rejects *every* request with 421, so origins-only is never a usable
+        # configuration — fail at startup instead of serving a server that
+        # answers nothing.
+        if allowed_origins and not allowed_hosts:
+            parser.error(
+                "--allowed-origins requires --allowed-hosts: an empty host"
+                " allowlist rejects every request with 421 Misdirected Request"
+            )
+        if allowed_hosts:
             from mcp.server.transport_security import TransportSecuritySettings
 
             http_kwargs["transport_security"] = TransportSecuritySettings(

tests/test_server.py

@@ -909,11 +909,11 @@ def fake_run(**kwargs: object) -> None:
         }
 
     def test_transport_from_environment(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        """MCP_TRANSPORT/MCP_HOST/MCP_PORT configure containers without argv."""
+        """COMMIT_CHECK_MCP_TRANSPORT/_HOST/_PORT configure containers without argv."""
         captured: dict[str, object] = {}
-        monkeypatch.setenv("MCP_TRANSPORT", "http")
-        monkeypatch.setenv("MCP_HOST", "0.0.0.0")
-        monkeypatch.setenv("MCP_PORT", "8080")
+        monkeypatch.setenv("COMMIT_CHECK_MCP_TRANSPORT", "http")
+        monkeypatch.setenv("COMMIT_CHECK_MCP_HOST", "0.0.0.0")
+        monkeypatch.setenv("COMMIT_CHECK_MCP_PORT", "8080")
         monkeypatch.setattr(server.mcp, "run", lambda **kw: captured.update(kw))
         server.main([])
         assert captured["transport"] == "streamable-http"
@@ -929,9 +929,9 @@ def test_rejects_unknown_transport_from_environment(
         self, monkeypatch: pytest.MonkeyPatch
     ) -> None:
         """argparse skips `choices` for env-supplied defaults; a typo in
-        MCP_TRANSPORT must fail loudly, not silently serve stdio in a
+        COMMIT_CHECK_MCP_TRANSPORT must fail loudly, not silently serve stdio in a
         container that expects an HTTP listener."""
-        monkeypatch.setenv("MCP_TRANSPORT", "htpp")
+        monkeypatch.setenv("COMMIT_CHECK_MCP_TRANSPORT", "htpp")
         monkeypatch.setattr(
             server.mcp, "run", lambda **kw: pytest.fail("server must not start")
         )
@@ -941,16 +941,16 @@ def test_rejects_unknown_transport_from_environment(
     def test_rejects_non_integer_port_from_environment(
         self, monkeypatch: pytest.MonkeyPatch
     ) -> None:
-        monkeypatch.setenv("MCP_PORT", "eight thousand")
+        monkeypatch.setenv("COMMIT_CHECK_MCP_PORT", "eight thousand")
         with pytest.raises(SystemExit):
             server.main([])
 
     def test_cli_port_overrides_invalid_environment_port(
         self, monkeypatch: pytest.MonkeyPatch
     ) -> None:
-        """An invalid inherited MCP_PORT must not veto an explicit --port."""
+        """An invalid inherited COMMIT_CHECK_MCP_PORT must not veto an explicit --port."""
         captured: dict[str, object] = {}
-        monkeypatch.setenv("MCP_PORT", "eight thousand")
+        monkeypatch.setenv("COMMIT_CHECK_MCP_PORT", "eight thousand")
         monkeypatch.setattr(server.mcp, "run", lambda **kw: captured.update(kw))
         server.main(["--transport", "http", "--port", "9000"])
         assert captured["port"] == 9000
@@ -985,3 +985,31 @@ def test_no_transport_security_by_default(
         monkeypatch.setattr(server.mcp, "run", lambda **kw: captured.update(kw))
         server.main(["--transport", "http"])
         assert "transport_security" not in captured
+
+    def test_origins_without_hosts_is_rejected(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """Origins-only would enable rebinding protection with an empty host
+        allowlist, which answers every request with 421 — verified against a
+        live server. Refuse to start rather than serve a dead endpoint."""
+        monkeypatch.setattr(
+            server.mcp, "run", lambda **kw: pytest.fail("server must not start")
+        )
+        with pytest.raises(SystemExit):
+            server.main(
+                ["--transport", "http", "--allowed-origins", "https://app.example.com"]
+            )
+
+    def test_unprefixed_env_vars_are_ignored(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """A bare MCP_TRANSPORT belongs to no particular server. Honouring it
+        would turn a stdio launch into an HTTP listener that never answers the
+        client's handshake."""
+        captured: dict[str, object] = {}
+        monkeypatch.setenv("MCP_TRANSPORT", "http")
+        monkeypatch.setenv("MCP_PORT", "9999")
+        monkeypatch.delenv("COMMIT_CHECK_MCP_TRANSPORT", raising=False)
+        monkeypatch.setattr(server.mcp, "run", lambda **kw: captured.update(kw))
+        server.main([])
+        assert captured == {"transport": "stdio"}