Remote MCP endpoint returns "Forbidden: Invalid Host header" for all requests

[josucafd]

The remote MCP endpoint at https://rubyui.com/mcp — the one documented at /docs/mcp and installed via claude mcp add --transport http ruby-ui https://rubyui.com/mcp — currently rejects every request with a JSON-RPC error, so no MCP client can connect.

What happens

A client (Claude Code) fails on connect with:

SDK auth failed: HTTP 404: Invalid OAuth error response:
SyntaxError: Unrecognized token '<'

That surface error is misleading (the client falls back to OAuth discovery and gets the site's HTML 404 page). The real cause is visible with a direct request.

Reproduction

$ curl -sS -X POST \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}' \
    https://www.rubyui.com/mcp

{"jsonrpc":"2.0","id":null,"error":{"code":-32600,"message":"Forbidden: Invalid Host header"}}

Every request returns -32600 Forbidden: Invalid Host header, for both rubyui.com and www.rubyui.com hosts (HTTP 403).

Two separate problems

1. Invalid Host header rejects the public hostname. This looks like the MCP server's DNS-rebinding protection (allowed-hosts check) not including the public host it's actually served on (behind Cloudflare → Render). The client can't override this — it's a server-side config issue.
2. rubyui.com/mcp → 301 redirect to www.rubyui.com/mcp. The docs and the claude mcp add command use the bare (non-www) domain, but it 301s to www. A redirect mid-handshake also trips some MCP clients. The docs/command and the server should agree on a single canonical host.

Environment

• Client: Claude Code (--transport http)
• Endpoint: https://rubyui.com/mcp (per official docs)

Happy to provide more detail or test a fix. Thanks for RubyUI!