fix: bind to localhost by default to prevent DNS rebinding attacks

- Change default binding from 0.0.0.0 (all interfaces) to 127.0.0.1 (localhost only)
- Add HOST environment variable to override binding address when needed
- Update console output to show actual binding address
- Document security change in README with warnings about binding to all interfaces

This prevents remote attackers from accessing the MCP Inspector proxy server,
which has the ability to execute local processes. The proxy should only be
accessible from the local machine unless explicitly configured otherwise.

server/src/index.ts

@@ -415,11 +415,12 @@ app.get("/config", (req, res) => {
   }
 });
 
-const PORT = process.env.PORT || 6277;
+const PORT = parseInt(process.env.PORT || '6277', 10);
+const HOST = process.env.HOST || '127.0.0.1';
 
-const server = app.listen(PORT);
+const server = app.listen(PORT, HOST);
 server.on("listening", () => {
-  console.log(`⚙️ Proxy server listening on port ${PORT}`);
+  console.log(`⚙️ Proxy server listening on ${HOST}:${PORT}`);
 });
 server.on("error", (err) => {
   if (err.message.includes(`EADDRINUSE`)) {