chore: warn about insecure httpHost usage - MCP-184 #541
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
blva
changed the title
There was a problem hiding this comment.
Pull Request Overview
This PR adds a security warning to alert users when they bind the MCP Server to 0.0.0.0, which exposes it to the entire local network and poses security risks.
- Adds a warning log when
httpHostis set to0.0.0.0 - Creates a new log ID for the security warning message
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/transports/streamableHttp.ts | Adds security warning logic after server startup when httpHost is "0.0.0.0" |
| src/common/logger.ts | Adds new log ID constant for the HTTP host security warning |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
src/transports/streamableHttp.ts
Outdated
| noRedaction: true, | ||
| }); | ||
|
|
||
| if (this.userConfig.httpHost === "0.0.0.0") { |
There was a problem hiding this comment.
The warning only checks for exact match of '0.0.0.0'. Consider also warning for other non-localhost bindings like '::' (IPv6 all interfaces) or specific external IP addresses that could expose the server to unauthorized access.
Co-authored-by: Copilot <[email protected]>
Pull Request Test Coverage Report for Build 17615294858Details
💛 - Coveralls |
himanshusinghs
approved these changes
Sep 10, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes
addresses
[REC7] Warn users when they try to change localhost bindings to 0.0.0.0 or other non-local network interfaces.[WARNING] 1006009 - streamableHttpTransport: Binding to 0.0.0.0 can expose the MCP Server to the entire local network, which allows other devices on the same network to potentially access the MCP Server. This is a security risk and could allow unauthorized access to your database context. (46537)Checklist