test: tidy the proxy conformance lane

.github/workflows/conformance.yml

@@ -124,7 +124,15 @@ jobs:
       - name: Build
         run: pnpm run build
       - name: Run proxy server conformance
-        run: node test/conformance/server.mjs --output-dir results/proxy-server
+        # Extra arguments are passed through to the conformance CLI.
+        run: |
+          ARGS=(--output-dir results/proxy-server)
+          if [ "${VERBOSE}" = "true" ]; then
+            ARGS+=(--verbose)
+          fi
+          node test/conformance/server.mjs "${ARGS[@]}"
+        env:
+          VERBOSE: ${{ inputs.verbose }}
       - name: Upload conformance results
         if: ${{ always() }}
         uses: actions/upload-artifact@v5

test/conformance/README.md

@@ -45,6 +45,7 @@ newly added scenarios.
 | `tools_call` | `tools-list`/`tools-get`/`tools-call` argument-parsing paths; `--task` is refused when the server has no `tasks` capability |
 | `auth/client-credentials-basic` | `login --grant client-credentials` with `client_secret_basic`, incl. RFC 9728 discovery of an authorization server on another origin |
 | `auth/client-credentials-jwt` | The same via `private_key_jwt` (`--client-key`), signed with ES256 |
+| `dns-rebinding-protection` | Server scenario, run through `mcpc connect --proxy` by `server.mjs` (see below): the proxy rejects non-loopback `Host`/`Origin` headers and accepts loopback ones |
 
 `sse-retry` is implemented but excluded from default runs: it surfaces a known
 mcpc SSE-reconnect timing issue. Run it explicitly with

test/conformance/server.mjs

@@ -46,8 +46,8 @@ function launch(command, args, options = {}) {
   return child;
 }
 
-async function run(command, args, timeoutMillis = 180000) {
-  const child = launch(command, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+async function run(command, args, { timeoutMillis = 180000, ...spawnOptions } = {}) {
+  const child = launch(command, args, { stdio: ['ignore', 'pipe', 'pipe'], ...spawnOptions });
   let output = '';
   for (const stream of [child.stdout, child.stderr]) {
     stream.on('data', (data) => {
@@ -78,7 +78,8 @@ async function run(command, args, timeoutMillis = 180000) {
   }
 }
 
-const mcpc = (args) => run(process.execPath, [join(root, 'bin/mcpc'), ...args], 30000);
+const mcpc = (args) =>
+  run(process.execPath, [join(root, 'bin/mcpc'), ...args], { timeoutMillis: 30000 });
 
 // Same reserve-then-release pattern used by test/e2e/lib/framework.sh.
 async function availablePort() {
@@ -154,16 +155,22 @@ try {
         throw new Error('CONFORMANCE_PACKAGE_VERSION must be a version number');
       }
       const pkg = '@modelcontextprotocol/conformance' + (version ? `@${version}` : '');
-      await run(process.platform === 'win32' ? 'npx.cmd' : 'npx', [
-        '-y',
-        pkg,
-        'server',
-        '--url',
-        `http://127.0.0.1:${proxyPort}/mcp`,
-        '--scenario',
-        'dns-rebinding-protection',
-        ...process.argv.slice(2),
-      ]);
+      // On Windows `npx` is a .cmd shim, which Node refuses to spawn without a
+      // shell (EINVAL). Every argument is local, so the shell adds no risk.
+      await run(
+        'npx',
+        [
+          '-y',
+          pkg,
+          'server',
+          '--url',
+          `http://127.0.0.1:${proxyPort}/mcp`,
+          '--scenario',
+          'dns-rebinding-protection',
+          ...process.argv.slice(2),
+        ],
+        { shell: process.platform === 'win32' }
+      );
       break;
     } catch (error) {
       if (