MCP_FIX_NOTES.md

# MCP deployment fix

## Root causes addressed

1. `FastMCP` was created with its default host (`127.0.0.1`) even though the server is deployed behind the Hugging Face public proxy. Recent MCP SDK releases automatically apply DNS-rebinding host validation to localhost-bound servers, which can reject the public `*.hf.space` Host header.
2. The code comment claimed rebinding handling was configured, but no such configuration existed.
3. The combined app used the mounted sub-application's private lifespan API. This is version-fragile. It now starts the documented `mcp.session_manager.run()` context directly.
4. Browser MCP clients require CORS and exposure of `Mcp-Session-Id`.
5. `mcp>=1.2` had no upper bound. The project uses the v1 API, while MCP v2 is a breaking release. It is now pinned to `mcp>=1.25,<2`.
6. `json_response=True` is enabled, which is the recommended mode with stateless Streamable HTTP.

## Expected endpoint

`https://razaali10-land-develop-mcp.hf.space/mcp`

## Basic verification

A plain browser GET is not a valid MCP handshake and may return 405/406. Test with an MCP client or send an MCP initialize POST with both `application/json` and `text/event-stream` accepted.