@urbicon-ui/mcp-server 6.48.0 → 6.49.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@urbicon-ui/mcp-server",
-  "version": "6.48.0",
+  "version": "6.49.0",
   "description": "Model Context Protocol server exposing the Urbicon UI component catalog, recipes and design intelligence to LLM agents",
   "license": "MIT",
   "repository": {
@@ -39,8 +39,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@urbicon-ui/design-content": "6.48.0",
-    "@urbicon-ui/design-engine": "6.48.0",
+    "@urbicon-ui/design-content": "6.49.0",
+    "@urbicon-ui/design-engine": "6.49.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
@@ -48,4 +48,4 @@
     "@types/node": "^26.1.2",
     "vitest": "^4.1.9"
   }
-}
+}

package/src/index.ts

@@ -8,13 +8,20 @@ import { startStdioTransport } from './transports/stdio.js';
 interface CliArgs {
   transport: 'stdio' | 'http';
   port: number;
+  host: string;
   contentDir?: string;
 }
 
 function parseArgs(args: string[]): CliArgs {
   const result: CliArgs = {
     transport: 'stdio',
-    port: 3001
+    port: 3001,
+    // Loopback by default: this server has no authentication of its own and is
+    // meant to sit behind a reverse proxy. Binding every interface was the old
+    // behaviour — the deploy host set `HOST=127.0.0.1` for years and nothing
+    // read it, so the listener answered on `0.0.0.0` and only the firewall kept
+    // it private. Widening this is now a deliberate `--host 0.0.0.0`.
+    host: process.env.HOST ?? '127.0.0.1'
   };
 
   for (let i = 0; i < args.length; i++) {
@@ -29,6 +36,9 @@ function parseArgs(args: string[]): CliArgs {
     } else if (arg === '--port' && next) {
       result.port = parseInt(next, 10);
       i++;
+    } else if (arg === '--host' && next) {
+      result.host = next;
+      i++;
     } else if (arg === '--content-dir' && next) {
       result.contentDir = next;
       i++;
@@ -53,7 +63,7 @@ async function main(): Promise<void> {
   }
 
   if (args.transport === 'http') {
-    await startHttpTransport(args.port);
+    await startHttpTransport(args.port, args.host);
   } else {
     const server = createServer();
     await startStdioTransport(server);

package/src/transports/http.ts

@@ -26,11 +26,16 @@ function respondError(res: ServerResponse, status: number, code: number, message
  * server that offers no sessions. Any non-`/mcp` path returns a plain-text
  * banner (a lightweight liveness ping).
  *
- * @param port - TCP port to listen on (binds `http://localhost:<port>/mcp`).
+ * @param port - TCP port to listen on (binds `http://<host>:<port>/mcp`).
+ * @param host - Interface to bind. Defaults to loopback: the server has no auth
+ *   of its own and belongs behind a reverse proxy. Pass `0.0.0.0` to widen it.
  * @returns A stop handle; `index.ts` ignores it and runs until the process
  *   exits, the transport test uses it to shut the listener down.
  */
-export async function startHttpTransport(port: number): Promise<{ close: () => Promise<void> }> {
+export async function startHttpTransport(
+  port: number,
+  host = '127.0.0.1'
+): Promise<{ close: () => Promise<void> }> {
   const httpServer = createHttpServer(async (req, res) => {
     const url = new URL(req.url || '/', `http://localhost:${port}`);
 
@@ -74,8 +79,8 @@ export async function startHttpTransport(port: number): Promise<{ close: () => P
   });
 
   await new Promise<void>((resolve) => {
-    httpServer.listen(port, () => {
-      console.error(`Urbicon UI MCP Server listening on http://localhost:${port}/mcp`);
+    httpServer.listen(port, host, () => {
+      console.error(`Urbicon UI MCP Server listening on http://${host}:${port}/mcp`);
       resolve();
     });
   });