Make MCP server listen address configurable, using localhost by default

Author: opcode81

README.md

@@ -197,13 +197,14 @@ options use the `PENPOT_MCP_` prefix for consistency.
 
 ### Server Configuration
 
-| Environment Variable        | Description                                                                | Default |
-|-----------------------------|----------------------------------------------------------------------------|---------|
-| `PENPOT_MCP_SERVER_PORT`    | Port for the HTTP/SSE server                                               | `4401` |
-| `PENPOT_MCP_WEBSOCKET_PORT` | Port for the WebSocket server (plugin connection)                          | `4402` |
-| `PENPOT_MCP_REPL_PORT`      | Port for the REPL server (development/debugging)                           | `4403` |
-| `PENPOT_MCP_SERVER_ADDRESS` | Hostname or IP address where the MCP server can be reached                 | `localhost` |
-| `PENPOT_MCP_REMOTE_MODE`    | Enable remote mode (disables file system access). Set to `true` to enable. | `false` |
+| Environment Variable               | Description                                                                | Default      |
+|------------------------------------|----------------------------------------------------------------------------|--------------|
+| `PENPOT_MCP_SERVER_LISTEN_ADDRESS` | Address on which the MCP server listens (binds to)                         | `localhost`  |
+| `PENPOT_MCP_SERVER_PORT`           | Port for the HTTP/SSE server                                               | `4401`       |
+| `PENPOT_MCP_WEBSOCKET_PORT`        | Port for the WebSocket server (plugin connection)                          | `4402`       |
+| `PENPOT_MCP_REPL_PORT`             | Port for the REPL server (development/debugging)                           | `4403`       |
+| `PENPOT_MCP_SERVER_ADDRESS`        | Hostname or IP address via which clients can reach the MCP server          | `localhost`  |
+| `PENPOT_MCP_REMOTE_MODE`           | Enable remote mode (disables file system access). Set to `true` to enable. | `false`      |
 
 ### Logging Configuration
 
@@ -230,6 +231,9 @@ you may set the following environment variables to configure the two servers
 (MCP server & plugin server) appropriately:
  * `PENPOT_MCP_REMOTE_MODE=true`: This ensures that the MCP server is operating
    in remote mode, with local file system access disabled.
+ * `PENPOT_MCP_SERVER_LISTEN_ADDRESS=<address>`: Set this to the address on which
+   the MCP server listens (binds to). To accept connections from any address, use
+   `0.0.0.0` (use caution in untrusted networks).
  * `PENPOT_MCP_SERVER_ADDRESS=<your-address>`: This sets the hostname or IP address
    where the MCP server can be reached. The Penpot MCP Plugin uses this to construct
    the WebSocket URL as `ws://<your-address>:<port>` (default port: `4402`).

mcp-server/src/PenpotMcpServer.ts

@@ -44,13 +44,18 @@ export class PenpotMcpServer {
     private readonly port: number;
     private readonly webSocketPort: number;
     private readonly replPort: number;
+    private readonly listenAddress: string;
+    /**
+     * the address (domain name or IP address) via which clients can reach the MCP server
+     */
     public readonly serverAddress: string;
 
     constructor(private isMultiUser: boolean = false) {
         // read port configuration from environment variables
         this.port = parseInt(process.env.PENPOT_MCP_SERVER_PORT ?? "4401", 10);
         this.webSocketPort = parseInt(process.env.PENPOT_MCP_WEBSOCKET_PORT ?? "4402", 10);
         this.replPort = parseInt(process.env.PENPOT_MCP_REPL_PORT ?? "4403", 10);
+        this.listenAddress = process.env.PENPOT_MCP_SERVER_LISTEN_ADDRESS ?? "localhost";
         this.serverAddress = process.env.PENPOT_MCP_SERVER_ADDRESS ?? "localhost";
 
         this.configLoader = new ConfigurationLoader();
@@ -229,7 +234,7 @@ export class PenpotMcpServer {
         this.setupHttpEndpoints();
 
         return new Promise((resolve) => {
-            this.app.listen(this.port, async () => {
+            this.app.listen(this.port, this.listenAddress, async () => {
                 this.logger.info(`Multi-user mode: ${this.isMultiUserMode()}`);
                 this.logger.info(`Remote mode: ${this.isRemoteMode()}`);
                 this.logger.info(`Modern Streamable HTTP endpoint: http://${this.serverAddress}:${this.port}/mcp`);