SEC-004: A local HTTP server listens on loopback only

Severity	Applies to	Spec section
warn	both eras, http	2026-07-28/basic/transports/streamable-http#security--endpoint

When the server URL is on this machine (localhost, 127.0.0.1 or ::1), tries to open a TCP connection to the same port on this machine's network address. When running locally, servers SHOULD bind only to localhost (127.0.0.1) rather than all network interfaces (0.0.0.0); otherwise anything on the network can reach the server. Skipped for remote servers and on machines without a network address. Origin validation is CONF-007; a request without an Origin header is not flagged, because non-browser clients never send one. Runs once per server.

From the command line: mcpprobe checks explain SEC-004. To leave it out of a run, add "SEC-004" to [checks] disable in mcpprobe.toml; to change how much it counts, use severity_overrides.