feat: add quiet option to suppress DNS rebinding warning

[LikiosSedo]

Summary

• Add quiet option to createMcpExpressApp and createMcpHonoApp
• When true, suppresses the console.warn about missing DNS rebinding protection when binding to 0.0.0.0 or ::
• Useful for servers behind a reverse proxy or in containerized environments where the warning is not meaningful

Test plan

• Added tests for both express and hono middleware confirming no warning when quiet: true
• All existing tests continue to pass (warning still fires by default)

Closes #1515

[changeset-bot]

🦋 Changeset detected

Latest commit: fcc39c8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@modelcontextprotocol/express	Patch
@modelcontextprotocol/hono	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1751

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1751

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1751

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1751

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1751

commit: fcc39c8

[felixweinberger]

Thanks for the PR! Per the discussion on #1515, setting allowedHosts already silences this warning while keeping DNS rebinding protection, so we're going to hold off on adding a separate suppression option. See #1515 for the userland fix.

The warning is part of the CVE-2025-66414 mitigation, so we'd want to understand a case allowedHosts can't handle before adding a bypass. Happy to revisit if one surfaces.