diff --git a/backend-compliance/compliance/mcp/server.py b/backend-compliance/compliance/mcp/server.py
index 1087fcd4..1a3ee715 100644
--- a/backend-compliance/compliance/mcp/server.py
+++ b/backend-compliance/compliance/mcp/server.py
@@ -17,11 +17,22 @@ import os
 from typing import Optional
 
 from mcp.server.fastmcp import FastMCP
+from mcp.server.transport_security import TransportSecuritySettings
 
 from compliance.api.cra_annex_i_data import ANNEX_I_REQUIREMENTS
 from compliance.services.cra_finding_mapper import assess_findings_payload
 
-mcp = FastMCP("breakpilot-cra")
+# We are a server-to-server, Bearer-gated API behind nginx — not a browser target.
+# FastMCP's DNS-rebinding protection rejects unknown Host headers (HTTP 421); keep
+# it OFF unless MCP_ALLOWED_HOSTS pins an explicit allowlist (comma-separated).
+_ALLOWED = [h.strip() for h in (os.environ.get("MCP_ALLOWED_HOSTS") or "").split(",") if h.strip()]
+_SECURITY = TransportSecuritySettings(
+    enable_dns_rebinding_protection=bool(_ALLOWED),
+    allowed_hosts=_ALLOWED,
+    allowed_origins=_ALLOWED,
+)
+
+mcp = FastMCP("breakpilot-cra", transport_security=_SECURITY)
 
 
 @mcp.tool(
diff --git a/docker-compose.yml b/docker-compose.yml
index 973ec844..5335adae 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -156,13 +156,15 @@ services:
     container_name: bp-compliance-mcp
     platform: linux/arm64
     command: ["python", "-m", "compliance.mcp.server"]
+    # Internal-only on the breakpilot network; reached via nginx (follow-up) or by
+    # other containers. No host port (avoids host-port conflicts).
     expose:
       - "8099"
-    ports:
-      - "8099:8099"
     environment:
       MCP_PORT: 8099
       CRA_MCP_TOKEN: ${CRA_MCP_TOKEN:-}
+      # Optional: pin Host allowlist (comma-separated) to enable DNS-rebinding protection.
+      MCP_ALLOWED_HOSTS: ${MCP_ALLOWED_HOSTS:-}
     healthcheck:
       disable: true
     restart: unless-stopped