Update app.py

app.py

@@ -33,6 +33,7 @@ from starlette.applications import Starlette
 from starlette.responses import HTMLResponse, JSONResponse, PlainTextResponse
 from starlette.routing import Route
 
+from mcp.server.transport_security import TransportSecuritySettings
 from epanet_mcp.server import mcp
 
 # ---------------------------------------------------------------------------
@@ -49,6 +50,14 @@ AUTH_ENABLED = bool(API_KEY) or REQUIRE_AUTH
 # Keep session state so load_network -> get_summary -> run_sim share one registry.
 mcp.settings.stateless_http = False
 
+# HF Spaces sit behind a proxy, so the inbound Host header is the public
+# *.hf.space domain. FastMCP's DNS-rebinding protection allow-lists only
+# localhost by default and would reject every real request with 421
+# "Invalid Host header". Disable it (HF terminates TLS and controls Host).
+mcp.settings.transport_security = TransportSecuritySettings(
+    enable_dns_rebinding_protection=False,
+)
+
 streamable_app = mcp.streamable_http_app()  # serves /mcp  (+ owns session mgr lifespan)
 sse_app = mcp.sse_app()                      # serves /sse + /messages/