fix(mcp): pass bind host to streamable_http_app and close caller-owned http client

- runtime.py: pass host=server_config.host to streamable_http_app(). Without
  it the v2 SDK defaults host to 127.0.0.1 and auto-applies a localhost-only
  DNS rebinding allowlist when transport_security is None, causing HTTP 421 on
  every non-localhost request for servers bound to 0.0.0.0.
- client.py: enter the caller-provided httpx.AsyncClient into the exit stack.
  The v2 SDK does not close a caller-provided client, so it leaked on every
  connection attempt. Entered before the transport so LIFO teardown fires the
  terminate_on_close DELETE while the client is still open.
- test_runtime_coverage.py: set _transport_security on object.__new__ servers
  that bypass __init__, now required after dropping the getattr fallback.

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>

Author: araujof

cpex/framework/external/mcp/client.py

@@ -376,6 +376,11 @@ def _tls_httpx_client_factory(
         for attempt in range(max_retries):
             try:
                 http_client = _tls_httpx_client_factory()
+                # The v2 SDK does not close a caller-provided http_client, so we own its
+                # lifecycle. Enter it into the exit stack first (before the transport) so
+                # LIFO teardown closes the transport — firing the terminate_on_close DELETE
+                # while the client is still open — and then closes the client itself.
+                await self._exit_stack.enter_async_context(http_client)
                 streamable_client = streamable_http_client(
                     uri, http_client=http_client, terminate_on_close=True
                 )

cpex/framework/external/mcp/server/runtime.py

@@ -387,7 +387,10 @@ async def run_streamable_http_async(self) -> None:
             >>> server.server_config.port
             9000
         """
-        starlette_app = self.streamable_http_app(transport_security=self._transport_security)
+        starlette_app = self.streamable_http_app(
+            transport_security=self._transport_security,
+            host=self.server_config.host,
+        )
 
         # Add health check endpoint to main app
         # Third-Party

tests/unit/cpex/framework/external/mcp/server/test_runtime_coverage.py

@@ -117,6 +117,7 @@ async def test_with_uds(self, tmp_path, monkeypatch):
         server = object.__new__(runtime.SSLCapableMCPServer)
         server.server_config = config
         server.settings = SimpleNamespace(host="127.0.0.1", port=8000, log_level="info")
+        server._transport_security = None
         server.streamable_http_app = lambda **kwargs: SimpleNamespace(routes=[])
 
         monkeypatch.setattr(runtime.SSLCapableMCPServer, "_get_ssl_config", lambda self: {})
@@ -154,6 +155,7 @@ async def test_no_ssl(self, monkeypatch):
         server = object.__new__(runtime.SSLCapableMCPServer)
         server.server_config = config
         server.settings = SimpleNamespace(host="127.0.0.1", port=8000, log_level="info")
+        server._transport_security = None
         server.streamable_http_app = lambda **kwargs: SimpleNamespace(routes=[])
 
         monkeypatch.setattr(runtime.SSLCapableMCPServer, "_get_ssl_config", lambda self: {})
@@ -183,6 +185,7 @@ async def test_metrics_disabled(self, monkeypatch):
 
         routes_added = []
         app = SimpleNamespace(routes=routes_added)
+        server._transport_security = None
         server.streamable_http_app = lambda **kwargs: app
 
         monkeypatch.setattr(runtime.SSLCapableMCPServer, "_get_ssl_config", lambda self: {})
@@ -284,6 +287,7 @@ async def test_metrics_enabled_executes_routes(self, monkeypatch):
         server = object.__new__(runtime.SSLCapableMCPServer)
         server.server_config = config
         server.settings = SimpleNamespace(host="127.0.0.1", port=8000, log_level="INFO")
+        server._transport_security = None
         server.streamable_http_app = lambda **kwargs: SimpleNamespace(routes=[])
 
         monkeypatch.setenv("ENABLE_METRICS", "true")
@@ -315,6 +319,7 @@ async def test_metrics_disabled_executes_route(self, monkeypatch):
         server = object.__new__(runtime.SSLCapableMCPServer)
         server.server_config = config
         server.settings = SimpleNamespace(host="127.0.0.1", port=8000, log_level="INFO")
+        server._transport_security = None
         server.streamable_http_app = lambda **kwargs: SimpleNamespace(routes=[])
 
         monkeypatch.setenv("ENABLE_METRICS", "false")