Three of five MCP server setups we tested listened on every network interface by default and answered a request sent to the machine's Wi-Fi address.
Run lsof -nP -iTCP -sTCP:LISTEN and treat an address starting with * or [::] as exposed; set the host to 127.0.0.1 to fix it.
CVE-2026-81735 and CVE-2026-9680 both trace to MCP servers that listened on all interfaces by default.