fix(mcp): désactiver DNS rebinding protection (auth Bearer suffisant)

backend/app/api/mcp_server.py

@@ -4,6 +4,7 @@ from datetime import datetime, timedelta, timezone, date as date_type
 from decimal import Decimal
 
 from mcp.server.fastmcp import FastMCP
+from mcp.server.transport_security import TransportSecuritySettings
 from sqlalchemy import select, and_, text, or_
 from sqlalchemy.orm import selectinload
 
@@ -15,7 +16,12 @@ from app.models.shopping import ShoppingList, ListItem, Product
 _VALID_STATUSES = {"pending", "done", "cancelled"}
 _VALID_PRIORITIES = {"low", "medium", "high"}
 
-mcp = FastMCP("HomeHub", stateless_http=True, streamable_http_path="/")
+mcp = FastMCP(
+    "HomeHub",
+    stateless_http=True,
+    streamable_http_path="/",
+    transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False),
+)
 
 
 def _serialize(obj):