examples: safer local defaults (localhost bind + loopback CORS)

[TheodorNEngoy]

A number of runnable examples start HTTP servers using listen(port) (bind-all-interfaces) and some also enable demo-only permissive CORS.

This PR makes the safer defaults explicit:

• Bind example HTTP servers to localhost by default.
• Add MCP_HOST (default localhost) and pass it through to server binds.
• Restrict example CORS to loopback origins by default (and avoid credentialed wildcard CORS). Set MCP_CORS_ORIGIN_REGEX to explicitly allow additional UI origins if you intentionally expose a demo server remotely.
• Switch the incorrect listen(port, (error) => ...) pattern to proper server.on('error', ...) handling.
• Update README notes for the new env vars.

This reduces the risk of people running an example and accidentally exposing an insecure demo server on their LAN/public interface.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6b21e9f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1494

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1494

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1494

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1494

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1494

commit: 6b21e9f

[TheodorNEngoy]

Added one more hardening tweak: the SSE polling example now avoids cors() defaults and instead allows only loopback origins by default (localhost/127.0.0.1), while still permitting non-browser clients (no Origin header).

If someone needs broader CORS for a hosted inspector/app, they can set MCP_CORS_ORIGIN_REGEX explicitly.

[TheodorNEngoy]

One more small hardening tweak: the demo auth server example now sets an explicit JSON/urlencoded body size limit (100kb) for non-better-auth routes (avoids accidental large-body DoS).