fix: default listening host to all interfaces for container compatibility

When running inside a container, binding to localhost only accepts
connections from within the container itself. Traffic from port
forwarding arrives via the bridge network interface, not loopback,
causing connection resets. Defaulting to all interfaces ensures
the server is reachable without requiring an explicit override.

Author: tembleking

README.md

@@ -212,7 +212,7 @@ You can also set the following variables to override the default configuration:
 - `SYSDIG_MCP_MOUNT_PATH`:  The URL prefix for the streamable-http/sse deployment. Defaults to: `/sysdig-mcp-server`
 - `SYSDIG_MCP_LOGLEVEL`: Log Level of the application (`DEBUG`, `INFO`, `WARNING`, `ERROR`). Defaults to: `INFO`
 - `SYSDIG_MCP_LISTENING_PORT`: The port for the server when it is deployed using remote protocols (`streamable-http`, `sse`). Defaults to: `8080`
-- `SYSDIG_MCP_LISTENING_HOST`: The host for the server when it is deployed using remote protocols (`streamable-http`, `sse`). Defaults to: `localhost`
+- `SYSDIG_MCP_LISTENING_HOST`: The host for the server when it is deployed using remote protocols (`streamable-http`, `sse`). Defaults to all interfaces (`:port`). Set to `127.0.0.1` for local-only access.
 
 You can find your API token in the Sysdig Secure UI under **Settings > Sysdig Secure API**. Make sure to copy the token as it will not be shown again.
 
@@ -242,7 +242,7 @@ SYSDIG_MCP_TRANSPORT=streamable-http
 # SYSDIG_MCP_API_HOST=https://us2.app.sysdig.com
 # SYSDIG_MCP_API_TOKEN=your-api-token-here
 SYSDIG_MCP_LISTENING_PORT=8080
-SYSDIG_MCP_LISTENING_HOST=localhost
+SYSDIG_MCP_LISTENING_HOST=
 SYSDIG_MCP_MOUNT_PATH=/sysdig-mcp-server
 ```
 
@@ -354,8 +354,6 @@ spec:
         env:
           - name: SYSDIG_MCP_TRANSPORT
             value: "streamable-http"
-          - name: SYSDIG_MCP_LISTENING_HOST
-            value: "0.0.0.0"
         envFrom:
         - secretRef:
             name: mcp-server-secrets

internal/config/config.go

@@ -34,7 +34,7 @@ func Load() (*Config, error) {
 		APIToken:            getEnv("SYSDIG_MCP_API_TOKEN", ""),
 		SkipTLSVerification: getEnv("SYSDIG_MCP_API_SKIP_TLS_VERIFICATION", false),
 		Transport:           getEnv("SYSDIG_MCP_TRANSPORT", "stdio"),
-		ListeningHost:       getEnv("SYSDIG_MCP_LISTENING_HOST", "localhost"),
+		ListeningHost:       getEnv("SYSDIG_MCP_LISTENING_HOST", ""),
 		ListeningPort:       getEnv("SYSDIG_MCP_LISTENING_PORT", "8080"),
 		MountPath:           getEnv("SYSDIG_MCP_MOUNT_PATH", "/sysdig-mcp-server"),
 		LogLevel:            getEnv("SYSDIG_MCP_LOGLEVEL", "INFO"),

internal/config/config_test.go

@@ -78,7 +78,7 @@ var _ = Describe("Config", func() {
 				cfg, err := config.Load()
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cfg.Transport).To(Equal("stdio"))
-				Expect(cfg.ListeningHost).To(Equal("localhost"))
+				Expect(cfg.ListeningHost).To(BeEmpty())
 				Expect(cfg.ListeningPort).To(Equal("8080"))
 				Expect(cfg.MountPath).To(Equal("/sysdig-mcp-server"))
 				Expect(cfg.LogLevel).To(Equal("INFO"))
@@ -96,7 +96,7 @@ var _ = Describe("Config", func() {
 				cfg, err := config.Load()
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cfg.Transport).To(Equal("streamable-http"))
-				Expect(cfg.ListeningHost).To(Equal("localhost"))
+				Expect(cfg.ListeningHost).To(BeEmpty())
 				Expect(cfg.ListeningPort).To(Equal("8080"))
 				Expect(cfg.MountPath).To(Equal("/sysdig-mcp-server"))
 				Expect(cfg.LogLevel).To(Equal("INFO"))

package.nix

@@ -1,10 +1,10 @@
 { buildGo126Module, versionCheckHook }:
 buildGo126Module (finalAttrs: {
   pname = "sysdig-mcp-server";
-  version = "1.0.2";
+  version = "1.0.3";
   src = ./.;
   # This hash is automatically re-calculated with `just rehash-package-nix`. This is automatically called as well by `just update`.
-  vendorHash = "sha256-7UtPcgvKrpSIUGEgIOTH/BBG9PacBeVtSEsrfBtgWxs=";
+  vendorHash = "sha256-IjVs+Mm9kV9pXoEOE3En2u+/jd/ITXZi0kp2+L92Mso=";
 
   subPackages = [
     "cmd/server"