From 7071a6c26a85236260e1359762f2da488498247d Mon Sep 17 00:00:00 2001
From: Simon <10131203+gaomeng1900@users.noreply.github.com>
Date: Sat, 4 Apr 2026 03:15:20 +0800
Subject: [PATCH] fix(mcp): bind HTTP+WS server to localhost only (#399)

---
 packages/mcp/src/hub-bridge.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/mcp/src/hub-bridge.js b/packages/mcp/src/hub-bridge.js
index 22716ed..e7a22e1 100644
--- a/packages/mcp/src/hub-bridge.js
+++ b/packages/mcp/src/hub-bridge.js
@@ -6,6 +6,7 @@ import { WebSocketServer } from 'ws'
 
 const EXT_ID = 'akldabonmimlicnjlflnapfeklbfemhj'
 const STORE_URL = `https://chromewebstore.google.com/detail/page-agent-ext/${EXT_ID}`
+const LOOPBACK_HOST = 'localhost'
 
 const launcherTemplate = readFileSync(
 	fileURLToPath(new URL('./launcher.html', import.meta.url)),
@@ -60,8 +61,8 @@ export class HubBridge {
 					reject(err)
 				}
 			})
-			this.#httpServer.listen(this.port, () => {
-				console.error(`[page-agent-mcp] HTTP + WS on http://localhost:${this.port}`)
+			this.#httpServer.listen(this.port, LOOPBACK_HOST, () => {
+				console.error(`[page-agent-mcp] HTTP + WS on http://${LOOPBACK_HOST}:${this.port}`)
 				resolve()
 			})
 		})