A website can read your local MCP server 🚨 But don’t worry, we’ll tell you how to stop it.
When you add a local MCP server to your app, it’s easy to assume it’s only accessible from your machine. But your browser is running there too, which means a website can potentially reach that server.
We built a demo where a public page uses DNS rebinding to reach a real FastMCP server, list its tools, and read its config. Chrome and Firefox now block this with Local Network Access, but Safari doesn’t yet.
Watch the video and check 🧵 for the full write-up on how to fix it on our blog 👇