reject

The browser-facing half of the safety model, and the whole reason nothing here answers with a status:

A cross-origin fetch cannot read our status or body, but it CAN tell a resolved promise from a rejected one — so ANY reply, 403 included, is the one bit a page needs to fingerprint this port. Writing nothing makes us indistinguishable from a closed port. Nobody legitimate lands here: a real client is a POST that sets no Origin (browsers always do, cross-origin) and spells hostAuthorities exactly, which is what turns a rebinding attack away — it arrives carrying the attacker's own domain in Host.

127.0.0.1:<port>, LOCALHOST:<port> and /mcp are refused with the rest, deliberately: one blessed spelling, matched as literal bytes, with no normalization to reason about.