examples: bind local servers to localhost by default

[TheodorNEngoy]

A number of runnable examples start HTTP servers using listen(port) (bind-all-interfaces) and some also enable demo-only permissive CORS.

This PR makes the safer default explicit:

• Bind example HTTP servers to localhost by default.
• Add MCP_HOST (default localhost) and pass it through to server binds.
• Switch the incorrect listen(port, (error) => ...) pattern to proper server.on('error', ...) handling.
• Update README notes for the new env var.

This reduces the risk of people running an example and accidentally exposing an insecure demo server on their LAN/public interface.

[changeset-bot]

⚠️ No Changeset found

Latest commit: db9089b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1494

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1494

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1494

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1494

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1494

commit: db9089b

[TheodorNEngoy]

Added one more hardening tweak: the SSE polling example now avoids cors() defaults and instead allows only loopback origins by default (localhost/127.0.0.1), while still permitting non-browser clients (no Origin header).

If someone needs broader CORS for a hosted inspector/app, they can set MCP_CORS_ORIGIN_REGEX explicitly.

[TheodorNEngoy]

One more small hardening tweak: the demo auth server example now sets an explicit JSON/urlencoded body size limit (100kb) for non-better-auth routes (avoids accidental large-body DoS).