OptionalallowedList of allowed hostnames for DNS rebinding protection.
If provided, host header validation will be applied using this list.
For IPv6, provide addresses with brackets (e.g., '[::1]').
This is useful when binding to '0.0.0.0' or '::' but still wanting
to restrict which hostnames are allowed.
OptionalhostThe hostname to bind to. Defaults to '127.0.0.1'.
When set to '127.0.0.1', 'localhost', or '::1', DNS rebinding protection is automatically enabled.
OptionaljsonControls the maximum request body size for the JSON body parser.
Passed directly to Express's express.json({ limit }) option.
Defaults to Express's built-in default of '100kb'.
Options for creating an MCP Express application.