http-bind
Listens on loopback only
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain http-bind.
- pack
http- weight
- advisory · not scored
- scope
- environment (the machine the server runs on, when the configured URL is loopback; not examined when Sealmark started the server itself)
- decided by
- process
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
checks.http-bind.enabledchecks.http-bind.severityserver.commandserver.url
Probes
listener-tableread this machine's listening-socket table for the URL's port (netstat or ss); no packet is sent to any address
Settings and thresholds
Every check also takes checks.http-bind.enabled and checks.http-bind.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
server.command | none | not locked | Program that starts the MCP server. Alone it is a stdio server; with url, Sealmark starts it, waits for url to answer, tests it and stops it. |
server.url | none | not locked | URL of a Streamable HTTP server. Alone it must already be running; with command, Sealmark starts it and waits for this URL. |
How the verdict is established
- Scoring. advisory: reported with its verdict but not part of the score.
What to fix
Bind the listener to 127.0.0.1 (or ::1) unless the server is meant to be reached from other machines; if it is, put authentication and TLS in front of it. This check is advisory.
False positives
A server meant to be reached from other machines, reached here through localhost.
False negatives
Only the local machine's table is read, so a server in a container or on another host cannot be seen; a port forwarded by a proxy looks loopback-only. Not examined when Sealmark started the server itself (server.command with server.url), because how that start command binds is its own choice and a container binding 0.0.0.0 is normal there.