🐛 Bind MCP PluginBridge WebSocket to configured host

The plugin WebSocket bridge ignored PENPOT_MCP_SERVER_HOST and bound all interfaces, exposing unauthenticated task dispatch to the network in single-user mode. Pass mcpServer.host into WebSocketServer, mirroring the ReplServer fix, so the bridge binds localhost by default and 0.0.0.0 only on explicit opt-in. Closes #11603. AI-assisted-by: muse-spark-1.3-contributor
2026-09-11 13:20:03 -04:00 · 2026-09-10 08:51:36 +00:00
1 changed files with 1 additions and 1 deletions
@@ -94,7 +94,7 @@ export class PluginBridge {
        private readonly taskTimeoutSecs: number,
        private readonly redisBridge?: RedisBridge
    ) {
-        this.wsServer = new WebSocketServer({ port: port });
+        this.wsServer = new WebSocketServer({ port: port, host: mcpServer.host });
        this.setupWebSocketHandlers();
    }