From b00ae292ac2d49947506886f44eb1cad7b7d7cd1 Mon Sep 17 00:00:00 2001 From: Dominik Jain Date: Sun, 29 Mar 2026 12:09:40 +0200 Subject: [PATCH] Change default listen address of MCP server in HTTP mode to localhost The previous default 0.0.0.0 was a potential security hazard --- docs/02-usage/020_running.md | 3 +++ src/serena/cli.py | 2 +- src/serena/mcp.py | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/02-usage/020_running.md b/docs/02-usage/020_running.md index 3b82a73b..5766a987 100644 --- a/docs/02-usage/020_running.md +++ b/docs/02-usage/020_running.md @@ -147,6 +147,9 @@ you would run and then configure your client to connect to `http://localhost:9121/mcp`. +By default, only connections from localhost are allowed; pass the `--host ` option to configure +the listen address and allow remote connections if needed (but be aware of the security implications of doing so). + **When to use.** Note that Serena is a stateful MCP server, and only one coding project can be active at a time. Therefore, starting a single Serena instance and connecting it to multiple clients is only appropriate if all clients will be working on the same project. diff --git a/src/serena/cli.py b/src/serena/cli.py index 7ee83a1f..ab84994d 100644 --- a/src/serena/cli.py +++ b/src/serena/cli.py @@ -188,7 +188,7 @@ class TopLevelCommands(AutoRegisteringGroup): @click.option( "--host", type=str, - default="0.0.0.0", + default="127.0.0.1", show_default=True, help="Listen address for the MCP server (when using corresponding transport).", ) diff --git a/src/serena/mcp.py b/src/serena/mcp.py index c83dadc7..f9374030 100644 --- a/src/serena/mcp.py +++ b/src/serena/mcp.py @@ -270,7 +270,7 @@ class SerenaMCPFactory: def create_mcp_server( self, - host: str = "0.0.0.0", + host: str = "127.0.0.1", port: int = 8000, modes: Sequence[str] = (), language_backend: LanguageBackend | None = None,