From 4c875ba7363ddb19c0d71e247ea465cacea8904f Mon Sep 17 00:00:00 2001
From: Dominik Jain <dominik.jain@oraios-ai.de>
Date: Mon, 12 Jan 2026 20:20:57 +0100
Subject: [PATCH] Change default allowedHosts to [], allowing only local
 connections (as before)

---
 penpot-plugin/vite.config.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/penpot-plugin/vite.config.ts b/penpot-plugin/vite.config.ts
index 1807e12..92af45e 100644
--- a/penpot-plugin/vite.config.ts
+++ b/penpot-plugin/vite.config.ts
@@ -28,6 +28,6 @@ export default defineConfig({
         cors: true,
         allowedHosts: process.env.PENPOT_MCP_PLUGIN_SERVER_ALLOWED_HOSTS
             ? process.env.PENPOT_MCP_PLUGIN_SERVER_ALLOWED_HOSTS.split(",").map((h) => h.trim())
-            : ["localhost", "0.0.0.0"],
+            : [],
     },
 });