lighthouse-mcp 0.1.16 → 0.1.17

package/README.md

@@ -158,3 +158,7 @@ Claude will use the `get_performance_score` tool to analyze the website and retu
 Chrome runs with its sandbox enabled. Localhost, IPv4 loopback, and IPv6 loopback remain supported by default. Private, link-local, cloud metadata, and other non-public destinations are blocked, including requests made by redirects and page resources. Connections use validated IP addresses to prevent DNS rebinding. Because loopback access is intentional, audit only pages you trust to access services on your own machine. For hostile sites, use a separate environment with network isolation.
 
 Audits are limited to one at a time and time out after 120 seconds. Chrome and the audit proxy are cleaned up after success or failure.
+
+### Public-only audits
+
+Set `AUDIT_ALLOW_LOOPBACK=false` to reject loopback destinations as well as private and metadata addresses. Hosted workers must use this setting and infrastructure egress isolation. Local development keeps loopback access by default.

package/build/index.js

@@ -26,7 +26,7 @@ class LighthouseServer {
         this.auditRunning = false;
         this.server = new Server({
             name: 'lighthouse-mcp',
-            version: '0.1.16',
+            version: '0.1.17',
         }, {
             capabilities: {
                 tools: {},
@@ -122,7 +122,7 @@ class LighthouseServer {
         let proxy;
         let timer;
         try {
-            const allowLoopback = true;
+            const allowLoopback = process.env.AUDIT_ALLOW_LOOPBACK !== 'false';
             const url = parseUrl(args.url);
             await resolveTarget(url.hostname, allowLoopback);
             proxy = await createAuditProxy(allowLoopback);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lighthouse-mcp",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "MCP server for Google Lighthouse performance metrics",
   "type": "module",
   "main": "build/index.js",