Added the possibility to block the MCP server from outside.

src/Managers/MCPServer.ToolsManager.pas

@@ -24,6 +24,8 @@   TMCPToolsManager = class(TInterfacedObject, IMCPCapabilityManager)
     FTools: TDictionary<string, IMCPTool>;
     procedure RegisterTool(const Tool: IMCPTool);
     procedure RegisterBuiltInTools;
+  strict protected
+    function InternalAllowTool(const ToolName: string): Boolean; virtual;
   public
     constructor Create;
     destructor Destroy; override;
@@ -86,10 +88,14 @@ procedure TMCPToolsManager.RegisterBuiltInTools;
   Tool: IMCPTool;
   ToolName: string;
 begin
+  FTools.Clear;
   for ToolName in TMCPRegistry.GetToolNames do
   begin
-    Tool := TMCPRegistry.CreateTool(ToolName);
-    RegisterTool(Tool);
+    if InternalAllowTool(ToolName) then
+    begin
+      Tool := TMCPRegistry.CreateTool(ToolName);
+      RegisterTool(Tool);
+    end;
   end;
 end;
 
@@ -250,9 +256,15 @@ function TMCPToolsManager.CallTool(const Params: System.JSON.TJSONObject): TValu
   Result := TValue.From<TJSONObject>(BuildToolCallResponse(ResultValue));
 end;
 
+function TMCPToolsManager.InternalAllowTool(const ToolName: string): Boolean;
+begin
+  Result := True;
+end;
+
 function TMCPToolsManager.ListTools: TValue;
 begin
   TLogger.Info('MCP ListTools called');
+  RegisterBuiltInTools;
   Result := TValue.From<TJSONObject>(BuildToolListResponse);
 end;
 

src/Server/MCPServer.IdHTTPServer.pas

@@ -44,6 +44,7 @@   TMCPIdHTTPServer = class(TComponent)
     FActive: Boolean;
     FSettings: TMCPSettings;
     FEventIDCounter: Int64;
+    FOnlyHost: Boolean;
     procedure ConfigureSSL;
     procedure HandleQuerySSLPort(APort: Word; var VUseSSL: Boolean);
     procedure HandleHTTPRequest(Context: TIdContext; RequestInfo: TIdHTTPRequestInfo; ResponseInfo: TIdHTTPResponseInfo);
@@ -56,6 +57,8 @@   TMCPIdHTTPServer = class(TComponent)
     function GetNextEventID: string;
     function AcceptsSSE(const AcceptHeader: string): Boolean;
     function IsRequestOnlyNotificationsOrResponses(JSONRequest: TJSONValue): Boolean;
+  strict protected
+    function InternalVerify(RequestInfo: TIdHTTPRequestInfo; ResponseInfo: TIdHTTPResponseInfo): Boolean; virtual;
   public
     constructor Create(Owner: TComponent); override;
     destructor Destroy; override;
@@ -66,11 +69,14 @@   TMCPIdHTTPServer = class(TComponent)
     property ManagerRegistry: IMCPManagerRegistry read FManagerRegistry write FManagerRegistry;
     property CoreManager: IMCPCapabilityManager read FCoreManager write FCoreManager;
     property Settings: TMCPSettings read FSettings write FSettings;
+    property OnlyHost: Boolean read FOnlyHost write FOnlyHost;
   end;
 
 implementation
 
 uses
+  IdSocketHandle,
+  IdStack,
   MCPServer.Resource.Server,
   MCPServer.CoreManager,
   MCPServer.Logger;
@@ -134,6 +140,8 @@ destructor TMCPIdHTTPServer.Destroy;
 end;
 
 procedure TMCPIdHTTPServer.Start;
+var
+  lBinding: TIdSocketHandle;
 begin
   if FActive then
     Exit;
@@ -153,6 +161,13 @@ procedure TMCPIdHTTPServer.Start;
   end;
 
   FHTTPServer.DefaultPort := FPort;
+  if FOnlyHost then
+  begin
+    FHTTPServer.Bindings.Clear;
+    lBinding := FHTTPServer.Bindings.Add;
+    lBinding.IP := GStack.ResolveHost(FSettings.Host, Id_IPv4);
+    lBinding.Port := FPort;
+  end;
   FHTTPServer.Active := True;
   FActive := True;
 
@@ -181,6 +196,9 @@ procedure TMCPIdHTTPServer.HandleHTTPRequest(Context: TIdContext;
     if not VerifyAndSetCORSHeaders(RequestInfo, ResponseInfo) then
       Exit; // CORS blocked the request
 
+    if not InternalVerify(RequestInfo, ResponseInfo) then
+      Exit;
+
     RequestPath := RequestInfo.Document;
 
     // Only handle requests to the configured MCP endpoint
@@ -555,4 +573,9 @@ procedure TMCPIdHTTPServer.HandlePostRequestJSON(RequestInfo: TIdHTTPRequestInfo
   TLogger.Info('Response: ' + ResponseBody);
 end;
 
+function TMCPIdHTTPServer.InternalVerify(RequestInfo: TIdHTTPRequestInfo; ResponseInfo: TIdHTTPResponseInfo): Boolean;
+begin
+  Result := True;
+end;
+
 end.