A local MCP server that speaks Streamable HTTP can be reached by a website you visit, through DNS rebinding, unless it validates the Origin header. The specification requires that validation. It also says to bind to localhost only and to authenticate every connection.
What DNS rebinding is
A browser lets a page talk to its own domain. An attacker controls a domain and first points it at a harmless address. Later the same name resolves to 127.0.0.1, and the page's scripts are now talking to a service on your machine, while the browser still thinks it is the attacker's site.
If your local MCP server answers anyone who reaches the port, that script can call its tools.
What the transport specification requires
The Streamable HTTP section of the MCP transport specification carries a security warning with three points:
- Servers must validate the
Originheader on all incoming connections to prevent DNS rebinding. - When running locally, servers should bind only to localhost (127.0.0.1) and not to all interfaces (0.0.0.0).
- Servers should implement proper authentication for all connections.
It adds that without these protections, attackers could use DNS rebinding to interact with local MCP servers from remote websites.
Why each control matters
The Origin check is the direct answer. A request that came from a rebound page carries the attacker's origin, so the server can refuse it.
Binding to 127.0.0.1 keeps the port off your network. A server bound to 0.0.0.0 is reachable by other machines on the same network too, which is a separate and broader exposure.
Authentication closes the gap when the first two fail. A token the page does not have means the call fails even if the request reaches the server.
A configuration checklist
- Confirm the listening address with a command like
lsof -i -Pand look for 127.0.0.1, not an asterisk. - Send a request with a forged Origin header and confirm a rejection.
- Require a token, or use a Unix domain socket with restricted permissions, as the specification suggests for local HTTP.
- Prefer stdio when the server only serves one local client.
Why a firewall does not cover this
A network firewall sees traffic from your own browser to your own machine, which looks normal. The page that triggered it lives on the public internet, but the connection to the local port starts from inside your device. That is why the check has to happen in the server, using the Origin header, and not at the network edge.
What to tell your team
Developers who run MCP servers on laptops are the most exposed group. Give them a one line rule: if the server speaks HTTP, it checks Origin, binds to 127.0.0.1 and wants a token. If it speaks stdio, there is no port to rebind to. Add the rule to your internal MCP server template so new servers start correct.
Where Safeguard fits
Safeguard includes an MCP Guardrail for governing which servers agents use. It is a policy layer, not a replacement for the three transport controls above.
Quick check
If the server only listens on localhost, is the Origin check still needed?
Yes. In DNS rebinding the request really does arrive on localhost, from the user's own browser. Binding to localhost does not tell you which website initiated it.
Sources
- MCP transports specification, Streamable HTTP security warning
- MCP security best practices, local server compromise
Last reviewed: 19 October 2026.
