The llama.cpp server is safe by default on loopback, and it gets riskier as you change a handful of options. The README says the host defaults to 127.0.0.1, the health route skips the API key check, CORS reflects any Origin by default, and the tool and MCP options hand the server real capabilities.
Settings that tighten
These are from the server README as fetched in October 2026. Check your own version's help output, because options change.
- Host. Defaults to 127.0.0.1. Leave it there unless you must listen elsewhere. It accepts a comma separated list of addresses or UNIX socket paths ending in .sock, and a socket is a good choice for a single local client.
- API key. There is a key option, and several keys can be given as a comma separated list. A file option reads keys from a file, one per line, which keeps secrets out of your shell history and process list.
- Metrics. The metrics endpoint is disabled by default and only available when you enable it.
llama-server -m model.gguf --host 127.0.0.1 --api-key-file keys.txt
Substitute your own model path. Run the command with the help flag to confirm option names in your build.
Settings that widen
- Listening on all interfaces. Setting the host to 0.0.0.0 exposes the port to your network. Pair it with an API key and a reverse proxy, as the README advises for public deployments.
- The health route. The README says GET /health is public and skips the key check. That is usually fine, but know that it answers anyone who can connect.
- CORS. The README says that by default the server reflects any Origin header back with credentials allowed. A web page in your browser could therefore talk to a loopback server. Restrict origins where the build lets you.
Options that grant capabilities
The README describes tool and agent options that expose file read and write over the API. In that case it says the CORS origins default to localhost.
It also describes options for configuring MCP servers, and marks them as not to be enabled in untrusted environments, noting that MCP child processes run with the server's privileges. In plain terms, a client that can reach the server could cause those processes to run as your user.
If you use those features:
- Run the server as a dedicated low privilege account or inside a container with limited mounts.
- Keep it on loopback.
- Review every MCP server you attach. See sandboxing local MCP servers.
Click through it at your own pace, or open it full screen.
A short review routine
Before you share a server, write down the command line, the host, whether a key is set, whether tools or MCP are enabled, and who can reach the port. Review that list when you upgrade. Safeguard's MCP Guardrail can enforce policy on MCP tool use in agent workflows, and its dependency scanning can check what the surrounding project pulls in.
Quick check
Is the llama.cpp server open to the network by default?
No. The README documents a default host of 127.0.0.1, which is loopback only. It becomes reachable when you change the host.
Does an API key protect every route?
Not necessarily. The README says the health route skips the key check. Treat the proxy as the real front door.
Sources
Last reviewed: 19 October 2026.
