Uses mcp 2.2.0 (FastMCP is MCPServer there) with stateless streamable HTTP.
The SDK's DNS-rebinding protection checks the Host header, so the in-cluster
name Bifrost dials is an explicit allow-list entry (MCP_ALLOWED_HOSTS) —
otherwise every proxied call returns 421 and looks like an mdmem bug.
Agent edits to active notes become inbox revisions; no delete tool exists.