fix: default listening host to 0.0.0.0 for container compatibility

When running inside a container, binding to localhost only accepts
connections from within the container itself. Traffic from Docker
port forwarding arrives via the bridge network interface, not
loopback, causing connection resets. Defaulting to 0.0.0.0 ensures
the server is reachable from outside the container without requiring
an explicit override.

Author: tembleking

README.md

@@ -212,7 +212,7 @@ You can also set the following variables to override the default configuration:
 - `SYSDIG_MCP_MOUNT_PATH`:  The URL prefix for the streamable-http/sse deployment. Defaults to: `/sysdig-mcp-server`
 - `SYSDIG_MCP_LOGLEVEL`: Log Level of the application (`DEBUG`, `INFO`, `WARNING`, `ERROR`). Defaults to: `INFO`
 - `SYSDIG_MCP_LISTENING_PORT`: The port for the server when it is deployed using remote protocols (`streamable-http`, `sse`). Defaults to: `8080`
-- `SYSDIG_MCP_LISTENING_HOST`: The host for the server when it is deployed using remote protocols (`streamable-http`, `sse`). Defaults to: `localhost`
+- `SYSDIG_MCP_LISTENING_HOST`: The host for the server when it is deployed using remote protocols (`streamable-http`, `sse`). Defaults to: `0.0.0.0`
 
 You can find your API token in the Sysdig Secure UI under **Settings > Sysdig Secure API**. Make sure to copy the token as it will not be shown again.
 
@@ -242,7 +242,7 @@ SYSDIG_MCP_TRANSPORT=streamable-http
 # SYSDIG_MCP_API_HOST=https://us2.app.sysdig.com
 # SYSDIG_MCP_API_TOKEN=your-api-token-here
 SYSDIG_MCP_LISTENING_PORT=8080
-SYSDIG_MCP_LISTENING_HOST=localhost
+SYSDIG_MCP_LISTENING_HOST=0.0.0.0
 SYSDIG_MCP_MOUNT_PATH=/sysdig-mcp-server
 ```
 
@@ -354,8 +354,6 @@ spec:
         env:
           - name: SYSDIG_MCP_TRANSPORT
             value: "streamable-http"
-          - name: SYSDIG_MCP_LISTENING_HOST
-            value: "0.0.0.0"
         envFrom:
         - secretRef:
             name: mcp-server-secrets

internal/config/config.go

@@ -34,7 +34,7 @@ func Load() (*Config, error) {
 		APIToken:            getEnv("SYSDIG_MCP_API_TOKEN", ""),
 		SkipTLSVerification: getEnv("SYSDIG_MCP_API_SKIP_TLS_VERIFICATION", false),
 		Transport:           getEnv("SYSDIG_MCP_TRANSPORT", "stdio"),
-		ListeningHost:       getEnv("SYSDIG_MCP_LISTENING_HOST", "localhost"),
+		ListeningHost:       getEnv("SYSDIG_MCP_LISTENING_HOST", "0.0.0.0"),
 		ListeningPort:       getEnv("SYSDIG_MCP_LISTENING_PORT", "8080"),
 		MountPath:           getEnv("SYSDIG_MCP_MOUNT_PATH", "/sysdig-mcp-server"),
 		LogLevel:            getEnv("SYSDIG_MCP_LOGLEVEL", "INFO"),

internal/config/config_test.go

@@ -78,7 +78,7 @@ var _ = Describe("Config", func() {
 				cfg, err := config.Load()
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cfg.Transport).To(Equal("stdio"))
-				Expect(cfg.ListeningHost).To(Equal("localhost"))
+				Expect(cfg.ListeningHost).To(Equal("0.0.0.0"))
 				Expect(cfg.ListeningPort).To(Equal("8080"))
 				Expect(cfg.MountPath).To(Equal("/sysdig-mcp-server"))
 				Expect(cfg.LogLevel).To(Equal("INFO"))
@@ -96,7 +96,7 @@ var _ = Describe("Config", func() {
 				cfg, err := config.Load()
 				Expect(err).NotTo(HaveOccurred())
 				Expect(cfg.Transport).To(Equal("streamable-http"))
-				Expect(cfg.ListeningHost).To(Equal("localhost"))
+				Expect(cfg.ListeningHost).To(Equal("0.0.0.0"))
 				Expect(cfg.ListeningPort).To(Equal("8080"))
 				Expect(cfg.MountPath).To(Equal("/sysdig-mcp-server"))
 				Expect(cfg.LogLevel).To(Equal("INFO"))

package.nix

@@ -1,7 +1,7 @@
 { buildGo126Module, versionCheckHook }:
 buildGo126Module (finalAttrs: {
   pname = "sysdig-mcp-server";
-  version = "1.0.2";
+  version = "1.0.3";
   src = ./.;
   # This hash is automatically re-calculated with `just rehash-package-nix`. This is automatically called as well by `just update`.
   vendorHash = "sha256-7UtPcgvKrpSIUGEgIOTH/BBG9PacBeVtSEsrfBtgWxs=";