feat(http): make bind host configurable

[artgas1]

Summary

• add a HOST option for the Streamable HTTP listener
• preserve the existing 0.0.0.0 default for container/cloud deployments
• document and test HOST=127.0.0.1 for local-only daemons

Motivation

Local shared-daemon deployments need to restrict NetBird MCP to loopback. app.listen(port) currently binds all interfaces, which exposes the MCP endpoint to the LAN when direct-PAT auth is enabled.

QA

• npm test — 165 passed
• npm run typecheck
• npm run build
• live negative control: listener 127.0.0.1:39417; loopback /healthz 200; host LAN address refused with curl rc=7

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 119ca206-e5fc-4fdf-9eae-5b0cd4df8c7d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}