fix(mcp): accept only direct local requests at /mcp

The /mcp route now applies the same proxy and sharing checks as Provider
Settings: requests carrying forwarding headers, or arriving while launcher
sharing is on, are refused. The Host must name the port the request reached
and a browser Origin must match that host exactly. The proxy and sharing
checks move into shared helpers in keySetupCore; Provider Settings behaves
as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

docs/CURRENT-STATE.md

@@ -21,7 +21,9 @@ and `gods-eye-view/tools/mcp` exposes a composed catalog over the Model Context
 Protocol. `npm run mcp` serves Core's tools over stdio to a local MCP client,
 reading from a running app's `/api` routes (default `http://localhost:4173`).
 The development and preview servers also serve the tools over HTTP at `/mcp`,
-accepting only local requests with loopback hosts and origins.
+accepting only direct local requests: a loopback host on the port reached,
+an `Origin` (when sent) from that same host, no proxy forwarding headers, and
+launcher sharing off.
 Queries cover earthquakes, active fires, recent launches, aircraft (in an
 area, by identifier, tracks, and type and route lookups), ships (in an area,
 by identifier, and tracks), satellites (next

docs/TOOLS.md

@@ -241,8 +241,10 @@ claude mcp add --transport http gods-eye-view http://localhost:4173/mcp
 ```
 
 The route accepts only requests from this machine that name a loopback host
-and, when a browser sends an `Origin`, come from a loopback origin. This is
-local transport safety, not authentication. The
+on the port they reached and, when a browser sends an `Origin`, come from
+that same host. It refuses requests a proxy forwarded and refuses all
+requests while launcher sharing is on. This is local transport safety, not
+authentication. The
 local server makes no requests other than to the app's `/api` routes and the
 public feeds the sources already use.