Change default listen address of MCP server in HTTP mode to localhost

The previous default 0.0.0.0 was a potential security hazard

docs/02-usage/020_running.md

@@ -147,6 +147,9 @@ you would run
 
 and then configure your client to connect to `http://localhost:9121/mcp`.
 
+By default, only connections from localhost are allowed; pass the `--host <listen_address>` option to configure
+the listen address and allow remote connections if needed (but be aware of the security implications of doing so).
+
 **When to use.** Note that Serena is a stateful MCP server, and only one coding project can be active at a time.
 Therefore, starting a single Serena instance and connecting it to multiple clients is only 
 appropriate if all clients will be working on the same project.  

src/serena/cli.py

@@ -188,7 +188,7 @@ class TopLevelCommands(AutoRegisteringGroup):
     @click.option(
         "--host",
         type=str,
-        default="0.0.0.0",
+        default="127.0.0.1",
         show_default=True,
         help="Listen address for the MCP server (when using corresponding transport).",
     )

src/serena/mcp.py

@@ -270,7 +270,7 @@ class SerenaMCPFactory:
 
     def create_mcp_server(
         self,
-        host: str = "0.0.0.0",
+        host: str = "127.0.0.1",
         port: int = 8000,
         modes: Sequence[str] = (),
         language_backend: LanguageBackend | None = None,