From b82c7b5fda23ca2e7d3776a605efe5bc8876842e Mon Sep 17 00:00:00 2001
From: "Peter.Morton" <peter.morton@verint.com>
Date: Sun, 12 Apr 2026 21:09:29 -0500
Subject: [PATCH] open app via No automatic DNS rebinding protection

---
 src/transports/http-server.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/transports/http-server.ts b/src/transports/http-server.ts
index e8f0b64..900bdd4 100644
--- a/src/transports/http-server.ts
+++ b/src/transports/http-server.ts
@@ -22,7 +22,7 @@ const HOST = process.env.HOST || '127.0.0.1';
  * Each client can send their own initialize request without server-side session tracking.
  */
 export async function createHTTPServer(mcpServer: any) {
-  const app = createMcpExpressApp();
+  const app = createMcpExpressApp({ host: '0.0.0.0' });
   const transports: Record<string, any> = {};
 
   // Apply CORS globally