agent safety Step 1: mcp_hardening

[jac9191]

What do you want, and why?

The first step of the agent safety plan. Added some fixes and verified. https://github.com/jac9191/dimos_jac/pull/2 @leshy

[jac9191]

The dimos MCP server previously might have several exposure issues:

Issue	Before	Impact
CORS wide open	allow_origins=["*"]	Any web page could call the endpoint cross-origin
No caller authentication	No identity check in tools/call	Anyone on the LAN could invoke robot skills
Unprotected listen address	Non-loopback listen_host possible	Endpoint exposed to the local network
agent_send unprotected	Callable by anyone	Attackers could inject text into /human_input, impersonating a user to the agent
No body size limit	Unbounded request.body()	Memory DoS surface

Fix (L0 hardening, fail-closed)

Implemented on branch l0-hardening of my fork (see linked PR jac9191#2):

1. Bearer auth middleware — non-loopback callers must present DIMOS_MCP_AUTH_TOKEN; missing and wrong tokens return identical 401 bodies, compared with hmac.compare_digest (timing-safe). Loopback stays token-free.
2. CORS lockdown — default empty allowlist denies all browser cross-origin requests; opt-in via DIMOS_MCP_ALLOWED_ORIGINS (comma-separated env).
3. Fail-closed startup guard — binding a non-loopback listen_host without a token refuses to start with a clear error.
4. agent_send loopback-only — refused for non-loopback callers even with a valid token.
5. 1 MB request body limit — larger payloads get 413.

Client side (mcp_client.py) reads the same GlobalConfig and attaches the token automatically when the server URL is non-loopback.

Verification

• New test_mcp_security.py covers all invariants (loopback unchanged, non-loopback 401 with/without/wrong token, startup guard, SSE same rules, agent_send restriction, body limit, CORS default-deny).
• pytest dimos/agents/mcp/test_mcp_security.py dimos/agents/mcp/test_mcp_server.py -q -- all passed (existing suite unaffected).
• Also verified live (no mocks) with uvicorn bound to 0.0.0.0 and curl from a remote host: 401 without token, 200 with token, SSE 401, CORS preflight denied.
• mypy --strict clean on touched files; only stdlib additions (hmac, ipaddress).

Very happy to open a PR against upstream if you'd like this contributed ! !