inspector/server
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Felix Weinberger e8e990987c
fix: bind to localhost by default to prevent DNS rebinding attacks
- Change default binding from 0.0.0.0 (all interfaces) to 127.0.0.1 (localhost only)
- Add HOST environment variable to override binding address when needed
- Update console output to show actual binding address
- Document security change in README with warnings about binding to all interfaces

This prevents remote attackers from accessing the MCP Inspector proxy server,
which has the ability to execute local processes. The proxy should only be
accessible from the local machine unless explicitly configured otherwise.
2025-06-10 18:16:24 +01:00
..
src fix: bind to localhost by default to prevent DNS rebinding attacks 2025-06-10 18:16:24 +01:00
package.json Bump Inspector packages to 0.14.0, and sdk to 1.12.1 2025-06-04 16:13:35 -04:00
tsconfig.json init server 2024-10-07 16:27:49 -07:00