Skip to content

[pull] main from googleapis:main#133

Merged
pull[bot] merged 3 commits intoCrazyForks:mainfrom
googleapis:main
Jan 15, 2026
Merged

[pull] main from googleapis:main#133
pull[bot] merged 3 commits intoCrazyForks:mainfrom
googleapis:main

Conversation

@pull
Copy link

@pull pull bot commented Jan 15, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

Add remaining CLI flags for the server published on official mcp
registry.

ref: https://googleapis.github.io/genai-toolbox/reference/cli/

_note: mcp registry do not support shorthand flag (there are no options
to defined an alternate name). The only way is to define them as
separate named arguments but it may not work well since both would try
to set the same underlying value._
Update error code from 400 to 403 according to MCP
[updates](modelcontextprotocol/modelcontextprotocol#1439)
for invalid origin header.

Also updated hostCheck to only check host, not port.

To test, run Toolbox with the following (also work with port number e.g.
`--allowed-host=127.0.0.1:5000`):
```
go run . --allowed-hosts=127.0.0.1 
```

Test with the following:
```
// curl successfully
curl -H "Host: 127.0.0.1:5000" http://127.0.0.1:5000

// curl successfully
curl -H "Host: 127.0.0.1:3000" http://127.0.0.1:5000

// will show Invalid Host Header error
curl -H "Host: attacker:5000" http://127.0.0.1:5000
```
@pull pull bot locked and limited conversation to collaborators Jan 15, 2026
@pull pull bot added the ⤵️ pull label Jan 15, 2026
@pull pull bot merged commit d00b6fd into CrazyForks:main Jan 15, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant