Change default binding from 0.0.0.0 to 127.0.0.1 to align with security recommendations

[ciccolo-anthropic]

Change default server settings and all example code to bind to 127.0.0.1 rather than 0.0.0.0

Motivation and Context

The official docs note that

When running locally, servers SHOULD bind only to localhost (127.0.0.1) rather than all network interfaces (0.0.0.0)

This change attempts to make that behavior the default and reduce the chances of successful DNS rebinding attacks.

How Has This Been Tested?

Not tested.

Breaking Changes

This could be breaking in the scenario where users are relying on this default behavior to make the server accessible outside of localhost. An alternative would be to remove the change to src/mcp/server/fastmcp/server.py but keep the changes in example files and comments. That version would not be breaking.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[ihrpr]

Thank you!