Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
This is InfinityFree’s browser security system, not a ModSecurity or firewall rule on your account. It can’t be turned off or allowed per endpoint on free hosting.
The system requires JavaScript and cookies, which plugins, scripts and WordPress’s own self-checks can’t provide. Programmatic requests to your site, including REST API endpoints, usually get a “403 Forbidden” back. This article covers it:
For the Site Health message, “The REST API encountered an unexpected result” is a known warning on InfinityFree. It appears because WordPress can’t call its own site through the security system. It doesn’t mean the API is broken for real visitors. This article lists it:
So the Site Health warning can be ignored. But your MCP plugin connects from outside as an automated client, so it will most likely be blocked the same way. I don’t think it can work on free hosting. The article’s options are premium hosting, which doesn’t have this restriction, or a different setup that doesn’t need inbound API calls. I haven’t verified how your specific plugin connects, so that part is an inference from the article.
More detail on how the security system works is here: