v0.6.0

Highlights

This release is all about running the server in real-world network environments: behind reverse proxies, in Docker, and behind TLS-intercepting corporate proxies.

🌐 HTTP transports work behind proxies and Docker (#45, #52)

FastMCP's DNS-rebinding protection only accepts localhost Host/Origin headers by default, so sse/streamable-http behind a reverse proxy or in a container failed every request with 421 Misdirected Request. The protection is now configurable:

• --allowed-hosts / --allowed-origins (or DDG_ALLOWED_HOSTS / DDG_ALLOWED_ORIGINS, comma-separated) allow-list the hosts clients actually use, keeping the protection on. Values support host, host:port, and host:*.
• --disable-dns-rebinding-protection (DDG_DISABLE_DNS_REBINDING_PROTECTION=1) as a last-resort escape hatch.
• When nothing is configured, the secure localhost-only default is unchanged.

🔐 Custom CA bundles for TLS-intercepting proxies (#54, #58)

Outbound requests failed certificate verification behind proxies that re-sign HTTPS traffic with their own CA (httpx no longer reads SSL_CERT_FILE). Now configurable:

• --ca-certs PATH (DDG_CA_CERTS) points every outbound client — httpx and curl_cffi, for both search and fetch_content — at a PEM CA bundle.
• --no-ssl-verify (DDG_SSL_VERIFY=0) disables verification entirely; insecure, prefer --ca-certs.

🐳 Docker image accepts CLI flags (#59)

The Dockerfile now uses ENTRYPOINT with an empty default CMD, so flags pass straight through docker run:

docker run -p 8000:8000 ghcr.io/nickclyde/duckduckgo-mcp-server \
  --transport streamable-http --host 0.0.0.0 --port 8000 --allowed-hosts "myhost:*"

A bare docker run still starts the stdio transport as before. Thanks @purplepixie!

🧹 CI quality gate (#53)

CI now runs ruff check (blocking) and a non-blocking pip-audit dependency scan alongside the Python 3.10–3.14 test matrix.

Upgrade

uv pip install --upgrade duckduckgo-mcp-server
# or, to enable the search/fetch curl fallback:
uv pip install --upgrade "duckduckgo-mcp-server[browser]"

Full changelog: v0.5.0...v0.6.0