github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-09-23 20:36:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Bind MCP PluginBridge WebSocket to configured host (#11605)

Browse Source 
The plugin WebSocket bridge ignored PENPOT_MCP_SERVER_HOST and bound all interfaces, 
exposing unauthenticated task dispatch to the network in single-user mode. Pass mcpServer.host 
into WebSocketServer, mirroring the ReplServer fix, so the bridge binds localhost by default and 
0.0.0.0 only on explicit opt-in. 

Closes #11603. 

AI-assisted-by: muse-spark-1.3-contributor
This commit is contained in:
Andrey Antukh 2026-09-22 11:53:23 +02:00 committed by GitHub
parent 5c22f5bfb7
commit b5274a4476
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mcp/packages/server/src/PluginBridge.ts
View File

@ -94,7 +94,7 @@ export class PluginBridge {
private readonly taskTimeoutSecs: number,
private readonly redisBridge?: RedisBridge
) {
this.wsServer = new WebSocketServer({ port: port });
this.wsServer = new WebSocketServer({ port: port, host: mcpServer.host });
this.setupWebSocketHandlers();
}