Topic · DiggingBeagle record
Localhost is not a trust boundary for agents
A loopback address restricts network reachability but does not, by itself, authenticate a caller or authorize a privileged action.
- Topic kind
- pattern
Definition & limits
Local placement is not a complete trust model. A service can be reachable only on a workstation and still receive requests from a browser, an agent-controlled tool or another local process that should not control it. The exact route depends on the browser, protocol, service and deployment; there is no need to assume a universal browser-origin bypass to identify the missing authorization decision.
Three questions
Who can connect? Which authenticated client or principal is represented? Which action is that client allowed to request? Origin and Host validation, authentication and action authorization answer different parts of those questions. Loopback binding remains useful, but it cannot replace all three.
Two cases, different chains
The deprecated MCP WebSocket helper lacked transport-level validation and requires explicit configuration after the patch. AutoJack combined local reachability with an authentication gap and executable parameters in a development control plane. Their shared category should not erase the additional prerequisites that made process execution possible in AutoJack.
Review method
Identify listeners and exposed transports, test admission from unauthorized contexts, and inspect whether a permitted caller can select executable configuration or another client’s pending work. Record the actual browser and server versions. A rejection at one entry point is evidence about that path, not a general certificate for the whole local environment.
Examples
- AutoJack's browsing-agent path into AutoGen Studio.
- Browser-reachable local MCP services with wildcard CORS.