mcp-server-kubernetes/dist/utils/allowed-hosts.d.ts

MCP server for interacting with Kubernetes clusters via kubectl

/**
 * Shared construction of the allowedHosts list used by both HTTP transports
 * for DNS rebinding protection.
 */
/**
 * True when `host` is an all-interfaces bind address ("0.0.0.0", "::", and the
 * bracketed IPv6 spelling).
 */
export declare function isAllInterfacesHost(host: string): boolean;
/**
 * Build the default allowedHosts list for DNS rebinding protection.
 * Includes localhost variants with and without port.
 *
 * The configured HOST is added too, so that binding to a specific address also
 * accepts that address as a Host header — but only when it names an actual
 * interface. An all-interfaces bind ("0.0.0.0", "::") is deliberately excluded:
 * it is a bind directive, not an address a client resolves, so accepting it
 * would let any caller satisfy the allowlist by sending "Host: 0.0.0.0:<port>"
 * — a value that is public knowledge rather than a property of the deployment.
 * That would defeat the guard exactly where it matters most, since binding to
 * all interfaces is what makes the server reachable off-host in the first
 * place.
 *
 * Deployments that bind to all interfaces and need to accept a real hostname
 * (a Kubernetes Service DNS name, an ingress host) set
 * DNS_REBINDING_ALLOWED_HOST to that name; it replaces this list entirely.
 */
export declare function buildDefaultAllowedHosts(host: string, port: number): string[];