fix: Bind to 127.0.0.1 instead of 0.0.0.0 for stricter local isolation

server/src/main.rs

@@ -169,25 +169,25 @@ fn run_server(state: Arc<MemoryState>) -> Result<(), Box<dyn std::error::Error>>
 
         let mut retries = 0;
         let listener = loop {
-            match tokio::net::TcpListener::bind("0.0.0.0:3000").await {
+            match tokio::net::TcpListener::bind("127.0.0.1:3000").await {
                 Ok(l) => break l,
                 Err(e) => {
                     retries += 1;
                     if retries > 15 {
                         let log_path = dirs::home_dir().unwrap_or_default().join(".gemini/mcp_memory/daemon_fatal.log");
-                        let _ = std::fs::write(&log_path, format!("FATAL: Could not bind to 0.0.0.0:3000 after 15 seconds: {}\n", e));
+                        let _ = std::fs::write(&log_path, format!("FATAL: Could not bind to 127.0.0.1:3000 after 15 seconds: {}\n", e));
                         std::process::exit(1);
                     }
                     let log_path = dirs::home_dir().unwrap_or_default().join(".gemini/mcp_memory/daemon_error.log");
                     if let Ok(mut file) = std::fs::OpenOptions::new().create(true).append(true).open(&log_path) {
                         use std::io::Write;
-                        let _ = writeln!(file, "Failed to bind to 0.0.0.0:3000 (attempt {}): {}. Retrying in 1s...", retries, e);
+                        let _ = writeln!(file, "Failed to bind to 127.0.0.1:3000 (attempt {}): {}. Retrying in 1s...", retries, e);
                     }
                     tokio::time::sleep(std::time::Duration::from_secs(1)).await;
                 }
             }
         };
-        eprintln!("MCP Memory Server running on http://0.0.0.0:3000/sse");
+        eprintln!("MCP Memory Server running on http://127.0.0.1:3000/sse");
         if let Err(e) = axum::serve(listener, app).await {
             let log_path = dirs::home_dir().unwrap_or_default().join(".gemini/mcp_memory/daemon_error.log");
             let _ = std::fs::write(&log_path, format!("Server crashed: {}\n", e));
@@ -253,7 +253,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         use std::os::windows::process::CommandExt;
         if !cli.daemon {
             loop {
-                if let Err(_) = std::net::TcpListener::bind("0.0.0.0:3000") {
+                if let Err(_) = std::net::TcpListener::bind("127.0.0.1:3000") {
                     // Port in use, become a stub proxy!
                     let target_url = cli.target.as_deref().unwrap_or("http://127.0.0.1:3000");
                     match proxy::run_proxy(target_url) {