diff --git a/codex/mcp_server.py b/codex/mcp_server.py
index 666c433..1caf294 100644
--- a/codex/mcp_server.py
+++ b/codex/mcp_server.py
@@ -26,10 +26,16 @@ from __future__ import annotations
 import logging
 
 from mcp.server.fastmcp import FastMCP
+from mcp.server.transport_security import TransportSecuritySettings
 
 logger = logging.getLogger(__name__)
 
-mcp = FastMCP("codex")
+# DNS rebinding protection disabled: the server is guarded by Bearer token auth
+# (mcp_server.py _TokenAuth middleware) and UFW firewall (trusted LAN IPs only).
+mcp = FastMCP(
+    "codex",
+    transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False),
+)
 
 
 # ---------------------------------------------------------------------------