Lock local agent servers to your own machine

How to do it

Servers that talk over standard input and output have no port, so they skip this rule. A web page in the user's browser can reach servers on the user's own machine, for example through DNS rebinding. The MCP specification requires servers to check Origin and answer 403 when it is invalid. Bind to 127.0.0.1, never 0.0.0.0. Make a random token at start-up and require it on every request. Keep the host closed as well, as Turn on a firewall on every host says.

Examples

JavaScript example

import { randomBytes, timingSafeEqual } from 'node:crypto';

const ALLOWED_ORIGINS = new Set(['http://127.0.0.1:3845', 'http://localhost:3845']);
const expected = Buffer.from(`Bearer ${randomBytes(32).toString('hex')}`);
const hasToken = header => { const given = Buffer.from(header ?? ''); return given.length === expected.length && timingSafeEqual(given, expected); };

app.use((req, res, next) => {
  const origin = req.get('origin');
  if (origin && !ALLOWED_ORIGINS.has(origin)) return res.sendStatus(403);
  if (!hasToken(req.get('authorization'))) return res.sendStatus(401);
  next();
});
app.listen(3845, '127.0.0.1');

Python example

ALLOWED_ORIGINS = {"http://127.0.0.1:3845", "http://localhost:3845"}
EXPECTED = f"Bearer {secrets.token_hex(32)}"

@app.middleware("http")
async def local_only(request, call_next):
    origin = request.headers.get("origin")
    if origin and origin not in ALLOWED_ORIGINS:
        return Response(status_code=403)
    if not hmac.compare_digest(request.headers.get("authorization", ""), EXPECTED):
        return Response(status_code=401)
    return await call_next(request)

uvicorn.run(app, host="127.0.0.1", port=3845)

How to check

While the server runs, ss -ltn shows its port bound to 127.0.0.1 only. A request with Origin: https://evil.example.net gets 403, and a request without the token gets 401.

Sources

• MCP specification on the Streamable HTTP transport

Related rules

• AGT-14 Reject MCP requests whose headers disagree with the body in Agents as users
• INF-47 Turn on a firewall on every host in Infrastructure and environments