Problem

HOST defaults to 0.0.0.0, binding the server to all network interfaces. This allows anyone on the same network to access the MCP server and your GITLAB_TOKEN.

Affected: src/config.ts

export const HOST = process.env.HOST ?? "0.0.0.0"; // should be "127.0.0.1"

Fix

Change the default to 127.0.0.1. Docker users can still set HOST=0.0.0.0 explicitly.

Files to change:

• src/config.ts: change default value
• tests/unit/config.test.ts: update expected value in test

Reference

This was already fixed in the upstream repo: zereight/gitlab-mcp#289