From fe2c5c767d7a7670f997a42cbe5d58ea2164d5ff Mon Sep 17 00:00:00 2001 From: Felix Weinberger Date: Thu, 19 Jun 2025 11:47:04 +0100 Subject: [PATCH] refactor: deduplicate URL generation and standardize on localhost MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Extract duplicated URL generation code into getClientUrl() helper function in start.js - Replace all 127.0.0.1 references with localhost for consistency across codebase - Update server to respect HOST environment variable for URL generation - Remove 127.0.0.1 from default allowed origins in CORS configuration - Update documentation to use localhost instead of 127.0.0.1 šŸ¤– Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- CONTRIBUTING.md | 2 +- README.md | 4 ++-- client/bin/client.js | 2 +- client/bin/start.js | 20 +++++++++++--------- server/src/index.ts | 13 ++++++------- 5 files changed, 21 insertions(+), 20 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1eeeb864..0129a9e3 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -7,7 +7,7 @@ Thanks for your interest in contributing! This guide explains how to get involve 1. Fork the repository and clone it locally 2. Install dependencies with `npm install` 3. Run `npm run dev` to start both client and server in development mode -4. Use the web UI at http://127.0.0.1:6274 to interact with the inspector +4. Use the web UI at http://localhost:6274 to interact with the inspector ## Development Process & Pull Requests diff --git a/README.md b/README.md index 1a5bffff..deec2a45 100644 --- a/README.md +++ b/README.md @@ -168,7 +168,7 @@ DANGEROUSLY_OMIT_AUTH=true npm start #### Local-only Binding -By default, both the MCP Inspector proxy server and client bind only to `127.0.0.1` (localhost) to prevent network access. This ensures they are not accessible from other devices on the network. If you need to bind to all interfaces for development purposes, you can override this with the `HOST` environment variable: +By default, both the MCP Inspector proxy server and client bind only to `localhost` to prevent network access. This ensures they are not accessible from other devices on the network. If you need to bind to all interfaces for development purposes, you can override this with the `HOST` environment variable: ```bash HOST=0.0.0.0 npm start @@ -181,7 +181,7 @@ HOST=0.0.0.0 npm start To prevent DNS rebinding attacks, the MCP Inspector validates the `Origin` header on incoming requests. By default, only requests from the client origin are allowed (respects `CLIENT_PORT` if set, defaulting to port 6274). You can configure additional allowed origins by setting the `ALLOWED_ORIGINS` environment variable (comma-separated list): ```bash -ALLOWED_ORIGINS=http://localhost:6274,http://127.0.0.1:6274,http://localhost:8000 npm start +ALLOWED_ORIGINS=http://localhost:6274,http://localhost:8000 npm start ``` ### Configuration diff --git a/client/bin/client.js b/client/bin/client.js index 45fc2421..7c35a131 100755 --- a/client/bin/client.js +++ b/client/bin/client.js @@ -40,7 +40,7 @@ const server = http.createServer((request, response) => { }); const port = process.env.PORT || 6274; -const host = process.env.HOST || "127.0.0.1"; +const host = process.env.HOST || "localhost"; server.on("listening", () => { console.log( `šŸ” MCP Inspector is up and running at http://${host}:${port} šŸš€`, diff --git a/client/bin/start.js b/client/bin/start.js index 54b125e9..51d3ef76 100755 --- a/client/bin/start.js +++ b/client/bin/start.js @@ -12,6 +12,14 @@ function delay(ms) { return new Promise((resolve) => setTimeout(resolve, ms, true)); } +function getClientUrl(port, authDisabled, sessionToken) { + const host = process.env.HOST || "localhost"; + const baseUrl = `http://${host}:${port}`; + return authDisabled + ? baseUrl + : `${baseUrl}/?MCP_PROXY_AUTH_TOKEN=${sessionToken}`; +} + async function startDevServer(serverOptions) { const { SERVER_PORT, CLIENT_PORT, sessionToken, envVars, abort } = serverOptions; @@ -102,7 +110,7 @@ async function startDevClient(clientOptions) { const { CLIENT_PORT, authDisabled, sessionToken, abort, cancelled } = clientOptions; const clientCommand = "npx"; - const host = process.env.HOST || "127.0.0.1"; + const host = process.env.HOST || "localhost"; const clientArgs = ["vite", "--port", CLIENT_PORT, "--host", host]; const client = spawn(clientCommand, clientArgs, { @@ -114,10 +122,7 @@ async function startDevClient(clientOptions) { // Auto-open browser after vite starts if (process.env.MCP_AUTO_OPEN_ENABLED !== "false") { - const clientHost = process.env.HOST || "127.0.0.1"; - const url = authDisabled - ? `http://${clientHost}:${CLIENT_PORT}` - : `http://${clientHost}:${CLIENT_PORT}/?MCP_PROXY_AUTH_TOKEN=${sessionToken}`; + const url = getClientUrl(CLIENT_PORT, authDisabled, sessionToken); // Give vite time to start before opening browser setTimeout(() => { @@ -153,10 +158,7 @@ async function startProdClient(clientOptions) { // Only auto-open browser if not cancelled if (process.env.MCP_AUTO_OPEN_ENABLED !== "false" && !cancelled) { - const clientHost = process.env.HOST || "127.0.0.1"; - const url = authDisabled - ? `http://${clientHost}:${CLIENT_PORT}` - : `http://${clientHost}:${CLIENT_PORT}/?MCP_PROXY_AUTH_TOKEN=${sessionToken}`; + const url = getClientUrl(CLIENT_PORT, authDisabled, sessionToken); open(url); } diff --git a/server/src/index.ts b/server/src/index.ts index 7653597a..a18fa566 100644 --- a/server/src/index.ts +++ b/server/src/index.ts @@ -104,12 +104,10 @@ const originValidationMiddleware = ( // Default origins based on CLIENT_PORT or use environment variable const clientPort = process.env.CLIENT_PORT || "6274"; - const defaultOrigins = [ - `http://localhost:${clientPort}`, - `http://127.0.0.1:${clientPort}`, + const defaultOrigin = `http://localhost:${clientPort}`; + const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [ + defaultOrigin, ]; - const allowedOrigins = - process.env.ALLOWED_ORIGINS?.split(",") || defaultOrigins; if (origin && !allowedOrigins.includes(origin)) { console.error(`Invalid origin: ${origin}`); @@ -531,7 +529,7 @@ app.get("/config", originValidationMiddleware, authMiddleware, (req, res) => { }); const PORT = parseInt(process.env.PORT || "6277", 10); -const HOST = process.env.HOST || "127.0.0.1"; +const HOST = process.env.HOST || "localhost"; const server = app.listen(PORT, HOST); server.on("listening", () => { @@ -544,7 +542,8 @@ server.on("listening", () => { // Display clickable URL with pre-filled token const clientPort = process.env.CLIENT_PORT || "6274"; - const clientUrl = `http://localhost:${clientPort}/?MCP_PROXY_AUTH_TOKEN=${sessionToken}`; + const clientHost = process.env.HOST || "localhost"; + const clientUrl = `http://${clientHost}:${clientPort}/?MCP_PROXY_AUTH_TOKEN=${sessionToken}`; console.log( `\nšŸ”— Open inspector with token pre-filled:\n ${clientUrl}\n`, );