MCP_FIX_NOTES.md

MCP deployment fix

Root causes addressed

1. FastMCP was created with its default host (127.0.0.1) even though the server is deployed behind the Hugging Face public proxy. Recent MCP SDK releases automatically apply DNS-rebinding host validation to localhost-bound servers, which can reject the public *.hf.space Host header.
2. The code comment claimed rebinding handling was configured, but no such configuration existed.
3. The combined app used the mounted sub-application's private lifespan API. This is version-fragile. It now starts the documented mcp.session_manager.run() context directly.
4. Browser MCP clients require CORS and exposure of Mcp-Session-Id.
5. mcp>=1.2 had no upper bound. The project uses the v1 API, while MCP v2 is a breaking release. It is now pinned to mcp>=1.25,<2.
6. json_response=True is enabled, which is the recommended mode with stateless Streamable HTTP.

Expected endpoint

https://razaali10-land-develop-mcp.hf.space/mcp

Basic verification

A plain browser GET is not a valid MCP handshake and may return 405/406. Test with an MCP client or send an MCP initialize POST with both application/json and text/event-stream accepted.