superlocalmemory 3.6.11 → 3.6.13

package/src/superlocalmemory/core/remote_mode.py

@@ -0,0 +1,197 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
+
+"""Distributed / LAN deployment mode — the single ``SLM_REMOTE`` switch.
+
+SuperLocalMemory historically assumes every dashboard browser, MCP client,
+and API caller lives on ``127.0.0.1``. That assumption breaks three things
+for users who deploy SLM on a server and reach it across a LAN (issue #39):
+
+  1. ``/internal/token`` refuses any non-loopback client → Brain page can't
+     fetch the install token → "Couldn't load Brain".
+  2. The MCP Streamable-HTTP transport is **stateful** — every call must
+     replay the ``Mcp-Session-Id`` from the ``initialize`` handshake. A
+     gateway/hub that forwards a tool call without replaying it gets
+     ``-32600 Session not found``.
+  3. Dashboard CSRF origin checks only accept loopback origins.
+
+``SLM_REMOTE=1`` flips all three assumptions at once, **default OFF** so the
+loopback-only security posture is unchanged for the 99% local case. LAN
+access is still gated by an explicit IP allowlist (``SLM_MCP_ALLOWED_HOSTS``)
+— remote mode alone does not throw the doors open.
+
+Granular overrides (each implied by ``SLM_REMOTE=1`` but usable alone):
+  * ``SLM_MCP_STATELESS=1`` — stateless MCP transport only (gateway fix),
+    without opening the dashboard token endpoint.
+
+Security note (WORSTCASE): stateless MCP drops per-session isolation, and
+serving the install token to a LAN host lets any allowlisted machine read
+the brain. Keep the allowlist specific (never blanket ``*`` unless the
+network is fully trusted) — see ``docs/distributed-deployment.md``.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import os
+
+_TRUTHY = frozenset({"1", "true", "yes", "on"})
+
+
+def _is_truthy(value: str | None) -> bool:
+    return bool(value) and value.strip().lower() in _TRUTHY
+
+
+def is_remote_mode() -> bool:
+    """True iff ``SLM_REMOTE`` opts this daemon into LAN/distributed mode."""
+    return _is_truthy(os.environ.get("SLM_REMOTE"))
+
+
+def mcp_stateless() -> bool:
+    """True iff the MCP transport should run stateless (no session id required).
+
+    Enabled by ``SLM_REMOTE=1`` (umbrella) or ``SLM_MCP_STATELESS=1`` (granular).
+    Stateless mode lets any gateway/hub forward ``tools/call`` without replaying
+    the ``Mcp-Session-Id`` handshake — the fix for issue #39 Issue 3.
+    """
+    return is_remote_mode() or _is_truthy(os.environ.get("SLM_MCP_STATELESS"))
+
+
+def _allowlist_entries() -> list[str]:
+    """Trusted-client allowlist, from ``SLM_MCP_ALLOWED_HOSTS``.
+
+    Reuses the existing LAN allowlist the user already sets for MCP DNS-rebinding
+    protection so there is ONE place to configure trusted hosts. Entries are
+    comma-separated and may be: ``*`` (any), an exact IP, a CIDR block
+    (``192.168.1.0/24``), or a prefix wildcard (``192.168.*``). A trailing
+    ``:port`` / ``:*`` (host-header style) is ignored for client-IP matching.
+    """
+    raw = os.environ.get("SLM_MCP_ALLOWED_HOSTS", "").strip()
+    return [e.strip() for e in raw.split(",") if e.strip()]
+
+
+def _strip_port(entry: str) -> str:
+    """Drop a trailing ``:port`` / ``:*`` host-header suffix.
+
+    Handles plain ``host[:port]`` and CIDR ``a.b.c.d/n[:port]`` (v3.6.12 lan-1:
+    a CIDR written with a host-header port suffix used to fail ip_network() and
+    silently deny ALL clients). Bracketless IPv6 literals (≥2 colons, no '/')
+    are left untouched.
+    """
+    e = entry.strip()
+    if "/" in e:
+        # CIDR — strip anything after the network prefix (a stray :port/:*)
+        return e.partition(":")[0]
+    if e.count(":") == 1:  # host:port or host:* (IPv4 / hostname)
+        return e.split(":", 1)[0]
+    return e
+
+
+def _host_matches(entry: str, client_host: str, client_ip) -> bool:
+    host = _strip_port(entry).strip()
+    if not host:
+        return False
+    if host == "*":
+        return True
+    if "/" in host and client_ip is not None:
+        try:
+            return client_ip in ipaddress.ip_network(host, strict=False)
+        except ValueError:
+            return False
+    if host.endswith("*"):
+        # STRING prefix match (not CIDR). client_host is always the numeric
+        # socket peer IP (never a resolvable hostname), and a dotted prefix like
+        # "192.168." rejects "192.1680.x". Prefer CIDR (192.168.0.0/16) for
+        # unambiguous network matching; wildcards are a convenience.
+        return client_host.startswith(host[:-1])
+    return host == client_host
+
+
+def is_lan_client_allowed(client_host: str) -> bool:
+    """True iff remote mode is ON and ``client_host`` is in the trusted allowlist.
+
+    Loopback is handled separately by callers — this governs *non*-loopback LAN
+    clients only. Returns False whenever remote mode is off or the allowlist is
+    empty, so the default posture stays loopback-only.
+    """
+    if not is_remote_mode() or not client_host:
+        return False
+    entries = _allowlist_entries()
+    if not entries:
+        return False
+    try:
+        client_ip = ipaddress.ip_address(client_host)
+    except ValueError:
+        client_ip = None
+    return any(_host_matches(e, client_host, client_ip) for e in entries)
+
+
+def is_remote_origin_allowed(origin: str) -> bool:
+    """True iff remote mode is ON and ``origin``'s host is in the allowlist.
+
+    ``origin`` is a full URL (``http://192.168.50.144:8765``). Empty origin is
+    not this function's concern (loopback callers handle that). Used to relax
+    the dashboard CSRF origin guard for trusted LAN dashboards.
+    """
+    if not is_remote_mode() or not origin:
+        return False
+    # Extract host from scheme://host[:port]
+    rest = origin.split("://", 1)[-1]
+    host = rest.split("/", 1)[0]
+    # Strip a trailing :port (IPv4/hostname); leave bracketed IPv6 alone.
+    if host.startswith("["):
+        host = host.split("]", 1)[0].lstrip("[")
+    elif host.count(":") == 1:
+        host = host.split(":", 1)[0]
+    return is_lan_client_allowed(host)
+
+
+def _env_int(name: str, default: int) -> int:
+    """Read a positive int from env, falling back to ``default`` on any error."""
+    raw = os.environ.get(name, "").strip()
+    if not raw:
+        return default
+    try:
+        val = int(raw)
+    except ValueError:
+        return default
+    return val if val > 0 else default
+
+
+def rate_limit_config() -> tuple[int, int, int]:
+    """(write_max, read_max, window_seconds) for the dashboard rate limiter.
+
+    Issue #40 Issue 3: the limiter was hardcoded (30 writes / 120 reads per 60s)
+    with no way to raise it for distributed/LAN debugging, so a remote browser
+    that retried a failing Brain load hit ``429 Too Many Requests``. These are
+    now tunable via ``SLM_RATE_LIMIT_WRITE`` / ``SLM_RATE_LIMIT_READ`` /
+    ``SLM_RATE_LIMIT_WINDOW`` (defaults unchanged for the local case).
+    """
+    write_max = _env_int("SLM_RATE_LIMIT_WRITE", 30)
+    read_max = _env_int("SLM_RATE_LIMIT_READ", 120)
+    window = _env_int("SLM_RATE_LIMIT_WINDOW", 60)
+    return write_max, read_max, window
+
+
+def is_rate_limit_exempt(client_host: str) -> bool:
+    """True iff ``client_host`` should bypass the dashboard rate limiter.
+
+    Loopback is always exempt (the dashboard polls itself rapidly). In remote
+    mode, an allowlisted LAN client is the user's own remote browser doing the
+    same rapid reads, so it is exempt too — otherwise normal dashboard polling
+    trips the limiter (issue #40 Issue 3).
+    """
+    if client_host in ("127.0.0.1", "::1", "localhost"):
+        return True
+    return is_lan_client_allowed(client_host)
+
+
+__all__ = (
+    "is_remote_mode",
+    "mcp_stateless",
+    "is_lan_client_allowed",
+    "is_remote_origin_allowed",
+    "rate_limit_config",
+    "is_rate_limit_exempt",
+)

package/src/superlocalmemory/core/summarizer.py

@@ -124,8 +124,11 @@ class Summarizer:
         """
         import httpx
         model = getattr(self._config.llm, 'model', None) or "llama3.1:8b"
+        # v3.6.12 (modeb-2): honor the configured endpoint instead of hardcoding
+        # localhost:11434, so a remote/non-default Ollama host works in Mode B.
+        _base = (getattr(self._config.llm, 'api_base', '') or "http://localhost:11434").rstrip("/")
         with httpx.Client(timeout=httpx.Timeout(30.0)) as client:
-            resp = client.post("http://localhost:11434/api/generate", json={
+            resp = client.post(f"{_base}/api/generate", json={
                 "model": model,
                 "prompt": prompt,
                 "stream": False,

package/src/superlocalmemory/llm/backbone.py

@@ -138,7 +138,13 @@ class LLMBackbone:
             return False
         if self._provider == "ollama":
             return True
-        return bool(self._api_key)
+        # v3.6.12 (modeb-1): a custom local OpenAI-compatible endpoint
+        # (llama.cpp, LM Studio, vLLM) needs NO API key — _build_openai already
+        # omits the Authorization header when the key is empty. Treat a
+        # configured base_url as sufficient, otherwise Mode B silently falls
+        # back to Mode A extraction for keyless local endpoints.
+        _base = getattr(self, "_base_url", "") or getattr(self, "_api_base", "")
+        return bool(self._api_key) or bool(_base)
 
     @property
     def provider(self) -> str:

package/src/superlocalmemory/mcp/agent_context.py

@@ -15,8 +15,12 @@ import contextvars
 import os
 import re
 
+# v3.6.12 (parity-1): default is "" (the "no agent routed" sentinel), NOT the
+# user-visible "mcp_client". Sanitized agent ids are [A-Za-z0-9._-], so "" can
+# never collide — a client that explicitly routes to /mcp/mcp_client is now
+# distinguishable from a bare /mcp/ request with no agent segment.
 _current_agent_id: contextvars.ContextVar[str] = contextvars.ContextVar(
-    "slm_agent_id", default="mcp_client"
+    "slm_agent_id", default=""
 )
 
 # Agent ids arrive from an untrusted URL path segment. They are ATTRIBUTION
@@ -42,8 +46,8 @@ def get_current_agent_id(env_fallback: bool = True) -> str:
     fall through to the SLM_AGENT_ID env var instead.
     """
     ctx_id = _current_agent_id.get()
-    if ctx_id != "mcp_client":
-        return ctx_id
+    if ctx_id:
+        return ctx_id  # an explicitly-routed agent id (incl. "mcp_client")
     if env_fallback:
         return os.environ.get("SLM_AGENT_ID", "mcp_client")
     return "mcp_client"

package/src/superlocalmemory/mcp/tools_core.py

@@ -309,7 +309,10 @@ def register_core_tools(server, get_engine: Callable) -> None:
         try:
             engine = get_engine()
             pid = profile_id or engine.profile_id
-            facts = engine._db.get_all_facts(pid)[:limit]
+            # v3.6.12 (search-2): push the limit into the query — was loading the
+            # ENTIRE facts table (deserializing every 768-float embedding) just
+            # to return the top N. get_all_facts preserves created_at DESC order.
+            facts = engine._db.get_all_facts(pid, limit=limit)
             items = []
             for f in facts:
                 items.append({
@@ -401,6 +404,15 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 # Dashboard not installed — profile switch still works for MCP/CLI
                 logger.debug("Dashboard routes not available, profile set in engine only")
 
+            # v3.6.12 (search-3): recall/delete run in a separate worker
+            # subprocess that caches its engine (and profile_id) at init. Recycle
+            # it so the NEXT recall uses the new profile instead of the stale one.
+            try:
+                from superlocalmemory.core.worker_pool import WorkerPool
+                WorkerPool.shared().shutdown()
+            except Exception:
+                logger.debug("worker-pool recycle on profile switch skipped")
+
             return {
                 "success": True,
                 "previous_profile": old,

package/src/superlocalmemory/mcp/tools_mesh.py

@@ -76,7 +76,7 @@ def _mesh_request(method: str, path: str, body: dict | None = None) -> dict | No
 
 def _ensure_registered() -> None:
     """Register this session with the mesh broker if not already."""
-    global _REGISTERED, _PROJECT_PATH
+    global _REGISTERED, _PROJECT_PATH, _PEER_ID
     if _REGISTERED:
         return
 
@@ -89,6 +89,11 @@ def _ensure_registered() -> None:
         "agent_type": os.environ.get("CLAUDE_AGENT_TYPE", "claude_code"),
     })
     if result:
+        # v3.6.12 (mesh-1): the broker mints its OWN peer_id (RegisterRequest has
+        # no peer_id field, so our body value is dropped by pydantic). Adopt the
+        # broker's id BEFORE starting the heartbeat, otherwise heartbeat/send/
+        # inbox all target a non-existent peer → 404s and the session is reaped.
+        _PEER_ID = result.get("peer_id", _PEER_ID)
         _REGISTERED = True
         _start_heartbeat()
         pending = result.get("pending_messages", 0)
@@ -191,7 +196,7 @@ def register_mesh_tools(server, get_engine: Callable) -> None:
             _mesh_request, "POST", "/send",
             {"from_peer": _PEER_ID, "to_peer": to, "content": message},
         )
-        return result or {"error": "Failed to send message"}
+        return result or {"ok": False, "error": "Failed to send message"}
 
     @server.tool()
     async def mesh_inbox() -> dict:
@@ -207,8 +212,11 @@ def register_mesh_tools(server, get_engine: Callable) -> None:
             _mesh_request, "GET", f"/inbox/{_PEER_ID}?project_path={project}",
         )
         msg_list = (messages or {}).get("messages", [])
-        # Auto-mark unread messages as read
-        unread_ids = [m["id"] for m in msg_list if not m.get("read")]
+        # Auto-mark unread messages as read. v3.6.12 (failopen-2): use .get("id")
+        # — a malformed broker message without an "id" key used to raise KeyError
+        # out to the agent, violating the never-raise contract.
+        unread_ids = [m["id"] for m in msg_list
+                      if not m.get("read") and m.get("id") is not None]
         if unread_ids:
             await asyncio.to_thread(
                 _mesh_request, "POST", f"/inbox/{_PEER_ID}/read",
@@ -239,7 +247,7 @@ def register_mesh_tools(server, get_engine: Callable) -> None:
                 _mesh_request, "POST", "/state",
                 {"key": key, "value": value, "set_by": _PEER_ID},
             )
-            return result or {"error": "Failed to set state"}
+            return result or {"ok": False, "error": "Failed to set state"}
 
         if key:
             result = await asyncio.to_thread(_mesh_request, "GET", f"/state/{key}")
@@ -266,7 +274,7 @@ def register_mesh_tools(server, get_engine: Callable) -> None:
             _mesh_request, "POST", "/lock",
             {"file_path": file_path, "action": action, "locked_by": _PEER_ID},
         )
-        return result or {"error": "Lock operation failed"}
+        return result or {"ok": False, "error": "Lock operation failed"}
 
     @server.tool(annotations=ToolAnnotations(readOnlyHint=True))
     async def mesh_events() -> dict:

package/src/superlocalmemory/mesh/broker.py

@@ -281,10 +281,13 @@ class MeshBroker:
         try:
             now = datetime.now(timezone.utc).isoformat()
             # Direct messages to this peer
+            # v3.6.12 (mesh-3): only UNREAD direct messages — was returning read
+            # ones too, so every poll re-listed already-read messages until the
+            # 24h cleanup (broadcast/project already filter unread via mesh_reads).
             direct = conn.execute(
                 "SELECT id, from_peer, to_peer, msg_type, content, read, created_at, "
                 "target_type, project_path FROM mesh_messages "
-                "WHERE to_peer=? AND target_type='peer' "
+                "WHERE to_peer=? AND target_type='peer' AND COALESCE(read, 0) = 0 "
                 "AND (expires_at IS NULL OR expires_at > ?) "
                 "ORDER BY created_at DESC LIMIT 100",
                 (peer_id, now),
@@ -411,10 +414,18 @@ class MeshBroker:
                 return {"ok": True, "action": "acquired"}
 
             elif action == "release":
-                conn.execute("DELETE FROM mesh_locks WHERE file_path=? AND locked_by=?",
-                             (file_path, locked_by))
+                # v3.6.12 (mesh-2): report whether we actually released. The
+                # DELETE is correctly owner-scoped, but it previously returned
+                # released=ok:true even when a NON-owner released nothing.
+                cur = conn.execute(
+                    "DELETE FROM mesh_locks WHERE file_path=? AND locked_by=?",
+                    (file_path, locked_by),
+                )
                 conn.commit()
-                return {"ok": True, "action": "released"}
+                if cur.rowcount and cur.rowcount > 0:
+                    return {"ok": True, "action": "released"}
+                return {"ok": False, "action": "not_released",
+                        "error": "no lock held by this peer for that file"}
 
             elif action == "query":
                 row = conn.execute(

package/src/superlocalmemory/optimize/compress/router.py

@@ -317,11 +317,16 @@ class CompressRouter:
 
     @staticmethod
     def _normalize_whitespace(text: str) -> str:
-        """Layer 1 lossless: collapse excess blank lines, strip trailing spaces per line."""
+        """Layer 1 safe: collapse runs of 3+ blank lines to a single blank line.
+
+        v3.6.12 (normalize-1): no longer rstrips trailing spaces per line — that
+        is LOSSY for Markdown hard breaks (two trailing spaces) and padded string
+        literals, which broke the 'lossless/safe' guarantee that callers (incl.
+        slm_compress mode=normalize) rely on. Only collapsing excess blank lines
+        remains, which is semantically safe.
+        """
         import re
-        text = re.sub(r"\n{3,}", "\n\n", text)
-        lines = [line.rstrip() for line in text.split("\n")]
-        return "\n".join(lines)
+        return re.sub(r"\n{3,}", "\n\n", text)
 
     # ── Lazy loaders ─────────────────────────────────────────────────────
 

package/src/superlocalmemory/optimize/storage/db.py

@@ -14,7 +14,12 @@ REUSE: DatabaseManager from superlocalmemory/src/superlocalmemory/storage/databa
 ENCRYPTION (resolves SEC-C-01 / CWE-312, NEW-M-01, NEW-M-02):
   - All value BLOBs (llmcache_entries.value_blob) are AES-256-GCM encrypted.
   - CCR original_blob is ALSO AES-256-GCM encrypted.
-  - Key derivation: PBKDF2-HMAC-SHA256(password=machine_id, salt=_per_db_salt, iter=100_000)
+  - Key storage: a single MACHINE-WIDE key file (~/.superlocalmemory/opt-key.bin,
+    0o600) is generated once and reused for all cache DBs on the machine. (The
+    per-DB salt below is persisted for provenance but does NOT make the AES key
+    per-DB — a single install has one llmcache.db, so a machine-wide key is the
+    intended model. A tampered/rotated key now degrades to a cache MISS, not a
+    crash — see _decrypt fail-open, v3.6.12 cache-1.)
   - Salt: os.urandom(32) generated ONCE at DB creation, stored in
     llmcache_schema_version.description='salt:<hex>'. NO hardcoded salt.
   - Nonce (12 bytes random) prepended to each ciphertext.
@@ -43,6 +48,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
+from cryptography.exceptions import InvalidTag
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
 from cryptography.hazmat.primitives import hashes
@@ -368,7 +374,15 @@ class CacheDB:
         nonce = blob[:_AES_NONCE_BYTES]
         ciphertext = blob[_AES_NONCE_BYTES:]
         aesgcm = AESGCM(self._aes_key)
-        return aesgcm.decrypt(nonce, ciphertext, associated_data=None)
+        # v3.6.12 (cache-1): AES-GCM raises cryptography.exceptions.InvalidTag
+        # (NOT a ValueError subclass) on a tampered/wrong-key blob. Every caller
+        # catches ValueError to fail-open; convert InvalidTag -> ValueError here
+        # at the single chokepoint so a corrupt/rotated-key cache entry degrades
+        # to a miss instead of raising out of get()/get_value()/ccr_get().
+        try:
+            return aesgcm.decrypt(nonce, ciphertext, associated_data=None)
+        except InvalidTag as exc:
+            raise ValueError(f"AES-GCM authentication failed: {exc}") from exc
 
     # ---- assertion ----
 

package/src/superlocalmemory/server/api.py

@@ -108,12 +108,20 @@ def create_app() -> FastAPI:
     # Rate limiting (graceful)
     try:
         from superlocalmemory.infra.rate_limiter import RateLimiter
-        _write_limiter = RateLimiter(max_requests=30, window_seconds=60)
-        _read_limiter = RateLimiter(max_requests=120, window_seconds=60)
+        from superlocalmemory.core.remote_mode import (
+            rate_limit_config,
+            is_rate_limit_exempt,
+        )
+        # v3.6.12 (issue #40): env-tunable thresholds (defaults unchanged).
+        _rl_write, _rl_read, _rl_window = rate_limit_config()
+        _write_limiter = RateLimiter(max_requests=_rl_write, window_seconds=_rl_window)
+        _read_limiter = RateLimiter(max_requests=_rl_read, window_seconds=_rl_window)
 
         @application.middleware("http")
         async def rate_limit_middleware(request, call_next):
             client_ip = request.client.host if request.client else "unknown"
+            if is_rate_limit_exempt(client_ip):
+                return await call_next(request)
             is_write = request.method in ("POST", "PUT", "DELETE", "PATCH")
             limiter = _write_limiter if is_write else _read_limiter
             allowed, remaining = limiter.is_allowed(client_ip)
@@ -122,7 +130,7 @@ def create_app() -> FastAPI:
                 return JSONResponse(
                     status_code=429,
                     content={"error": "Too many requests."},
-                    headers={"Retry-After": str(limiter.window_seconds)},
+                    headers={"Retry-After": str(limiter.window)},
                 )
             response = await call_next(request)
             response.headers["X-RateLimit-Remaining"] = str(remaining)

package/src/superlocalmemory/server/routes/mesh.py

@@ -77,6 +77,19 @@ def _get_broker(request: Request):
     config = getattr(request.app.state, 'config', None)
     if config and not getattr(config, 'mesh_enabled', True):
         raise HTTPException(503, detail="Mesh disabled in config")
+    # v3.6.12 (mesh-1 security): SLM_MESH_SHARED_SECRET was read by the broker but
+    # never verified on inbound mesh HTTP calls. When a secret is configured,
+    # require it (constant-time) from NON-loopback callers via X-Mesh-Secret.
+    # The local MCP client always calls over loopback and is exempt, so this is
+    # zero-change for single-machine use and closes the LAN mesh auth bypass.
+    secret = getattr(broker, "_shared_secret", None)
+    if secret:
+        client_host = request.client.host if request.client else ""
+        if client_host not in ("127.0.0.1", "::1", "localhost"):
+            import hmac
+            presented = request.headers.get("x-mesh-secret", "")
+            if not hmac.compare_digest(presented, secret):
+                raise HTTPException(401, detail="invalid or missing mesh secret")
     return broker
 
 

package/src/superlocalmemory/server/routes/token.py

@@ -33,8 +33,11 @@ router = APIRouter(tags=["internal"])
 
 _ALLOWED_ORIGIN_PREFIXES = (
     "http://127.0.0.1",
+    "https://127.0.0.1",
     "http://localhost",
+    "https://localhost",
     "http://[::1]",
+    "https://[::1]",
 )
 
 
@@ -57,13 +60,22 @@ async def get_token(request: Request) -> JSONResponse:
         logger.debug("token: primitives unimportable: %s", exc)
         return JSONResponse({"error": "server_error"}, status_code=500)
 
+    # v3.6.12 (issue #39): in SLM_REMOTE mode, also serve the token to
+    # explicitly-allowlisted LAN clients so a remote-browser dashboard can load
+    # the Brain page. Default stays loopback-only — remote_mode helpers return
+    # False unless SLM_REMOTE=1 AND the client IP is in SLM_MCP_ALLOWED_HOSTS.
+    from superlocalmemory.core.remote_mode import (
+        is_lan_client_allowed,
+        is_remote_origin_allowed,
+    )
+
     client_host = request.client.host if request.client else ""
-    if not is_loopback(client_host):
+    if not is_loopback(client_host) and not is_lan_client_allowed(client_host):
         return JSONResponse({"error": "loopback only"}, status_code=403)
 
     headers = {k.lower(): v for k, v in request.headers.items()}
     origin = headers.get("origin", "")
-    if not _origin_is_loopback(origin):
+    if not _origin_is_loopback(origin) and not is_remote_origin_allowed(origin):
         return JSONResponse(
             {"error": "origin not allowed"}, status_code=403,
         )