diff --git a/backend/app/api/routes/messages.py b/backend/app/api/routes/messages.py
index b9a6ba2..a4e488a 100644
--- a/backend/app/api/routes/messages.py
+++ b/backend/app/api/routes/messages.py
@@ -87,9 +87,7 @@ async def publish_message(
         detail=body.source_detail,
     )
     try:
-        await run_in_threadpool(
-            controller.publish_message, name, body.value, source
-        )
+        await run_in_threadpool(controller.publish_message, name, body.value, source)
     except KeyError:
         raise HTTPException(
             status_code=404, detail=f"No flow declares a message named '{name}'"
diff --git a/backend/app/mcp/http.py b/backend/app/mcp/http.py
index 20d9800..cb61f19 100644
--- a/backend/app/mcp/http.py
+++ b/backend/app/mcp/http.py
@@ -66,7 +66,13 @@ def _transport_security() -> TransportSecuritySettings:
     allowed_origins = [f"https://{host}", f"http://{host}"]
     if settings.ENVIRONMENT == "local":
         # The test client and a direct uvicorn run do not go through Traefik.
-        allowed_hosts += ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "testserver"]
+        allowed_hosts += [
+            "localhost",
+            "localhost:*",
+            "127.0.0.1",
+            "127.0.0.1:*",
+            "testserver",
+        ]
         allowed_origins += ["http://localhost", "http://127.0.0.1"]
     return TransportSecuritySettings(
         enable_dns_rebinding_protection=True,
diff --git a/backend/tests/api/routes/test_flows.py b/backend/tests/api/routes/test_flows.py
index afeb2f3..eed6f74 100644
--- a/backend/tests/api/routes/test_flows.py
+++ b/backend/tests/api/routes/test_flows.py
@@ -118,9 +118,12 @@ def test_editing_does_not_deploy_until_published(
     ).json()
     assert saved["has_draft"] is True
     # Nothing is running yet, so the engine knows no nodes of this flow.
-    assert client.get(f"{PREFIX}/staged/state", headers=superuser_token_headers).json()[
-        "nodes"
-    ] == []
+    assert (
+        client.get(f"{PREFIX}/staged/state", headers=superuser_token_headers).json()[
+            "nodes"
+        ]
+        == []
+    )
 
     published = client.post(
         f"{PREFIX}/staged/publish",
diff --git a/backend/tests/api/routes/test_oauth.py b/backend/tests/api/routes/test_oauth.py
index 1ee34ef..9051576 100644
--- a/backend/tests/api/routes/test_oauth.py
+++ b/backend/tests/api/routes/test_oauth.py
@@ -103,7 +103,9 @@ def test_a_wrong_verifier_is_refused(
     _, challenge = pkce()
     code = approve(client, superuser_token_headers, registered["client_id"], challenge)
 
-    response = exchange(client, registered["client_id"], code, secrets.token_urlsafe(48))
+    response = exchange(
+        client, registered["client_id"], code, secrets.token_urlsafe(48)
+    )
     assert response.status_code == 400
     assert response.json()["error"] == "invalid_grant"
 
@@ -207,9 +209,7 @@ def test_approving_needs_a_signed_in_user(client: TestClient) -> None:
 
 
 def test_an_unsupported_grant_says_so(client: TestClient) -> None:
-    response = client.post(
-        f"{PREFIX}/token", data={"grant_type": "client_credentials"}
-    )
+    response = client.post(f"{PREFIX}/token", data={"grant_type": "client_credentials"})
     assert response.status_code == 400
     assert response.json()["error"] == "unsupported_grant_type"
 
@@ -219,9 +219,16 @@ def test_everything_is_refused_while_mcp_is_off(
 ) -> None:
     monkeypatch.setattr(settings, "MCP_ENABLED", False)
 
-    assert client.post(f"{PREFIX}/register", json={"redirect_uris": [REDIRECT]}).status_code == 403
     assert (
-        client.post(f"{PREFIX}/token", data={"grant_type": "authorization_code"}).status_code
+        client.post(
+            f"{PREFIX}/register", json={"redirect_uris": [REDIRECT]}
+        ).status_code
+        == 403
+    )
+    assert (
+        client.post(
+            f"{PREFIX}/token", data={"grant_type": "authorization_code"}
+        ).status_code
         == 403
     )