Change default binding from 0.0.0.0 to 127.0.0.1 to align with security recommendations (#738)

Author: ciccolo-anthropic

examples/servers/simple-prompt/mcp_simple_prompt/server.py

@@ -114,7 +114,7 @@ async def handle_sse(request):
 
         import uvicorn
 
-        uvicorn.run(starlette_app, host="0.0.0.0", port=port)
+        uvicorn.run(starlette_app, host="127.0.0.1", port=port)
     else:
         from mcp.server.stdio import stdio_server
 

examples/servers/simple-resource/mcp_simple_resource/server.py

@@ -72,7 +72,7 @@ async def handle_sse(request):
 
         import uvicorn
 
-        uvicorn.run(starlette_app, host="0.0.0.0", port=port)
+        uvicorn.run(starlette_app, host="127.0.0.1", port=port)
     else:
         from mcp.server.stdio import stdio_server
 

examples/servers/simple-streamablehttp-stateless/mcp_simple_streamablehttp_stateless/server.py

@@ -136,6 +136,6 @@ async def lifespan(app: Starlette) -> AsyncIterator[None]:
 
     import uvicorn
 
-    uvicorn.run(starlette_app, host="0.0.0.0", port=port)
+    uvicorn.run(starlette_app, host="127.0.0.1", port=port)
 
     return 0

examples/servers/simple-streamablehttp/mcp_simple_streamablehttp/server.py

@@ -164,6 +164,6 @@ async def lifespan(app: Starlette) -> AsyncIterator[None]:
 
     import uvicorn
 
-    uvicorn.run(starlette_app, host="0.0.0.0", port=port)
+    uvicorn.run(starlette_app, host="127.0.0.1", port=port)
 
     return 0

examples/servers/simple-tool/mcp_simple_tool/server.py

@@ -84,7 +84,7 @@ async def handle_sse(request):
 
         import uvicorn
 
-        uvicorn.run(starlette_app, host="0.0.0.0", port=port)
+        uvicorn.run(starlette_app, host="127.0.0.1", port=port)
     else:
         from mcp.server.stdio import stdio_server
 

src/mcp/server/fastmcp/server.py

@@ -87,7 +87,7 @@ class Settings(BaseSettings, Generic[LifespanResultT]):
     log_level: Literal["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"] = "INFO"
 
     # HTTP settings
-    host: str = "0.0.0.0"
+    host: str = "127.0.0.1"
     port: int = 8000
     mount_path: str = "/"  # Mount path (e.g. "/github", defaults to root path)
     sse_path: str = "/sse"

src/mcp/server/sse.py

@@ -27,7 +27,7 @@ async def handle_sse(request):
 
     # Create and run Starlette app
     starlette_app = Starlette(routes=routes)
-    uvicorn.run(starlette_app, host="0.0.0.0", port=port)
+    uvicorn.run(starlette_app, host="127.0.0.1", port=port)
 ```
 
 Note: The handle_sse function must return a Response to avoid a "TypeError: 'NoneType'