windsurf-llama-cpp-mcp-bridge

The primary FastAPI server binds to localhost (127.0.0.1) by default, limiting network exposure. The 'server_stdio.py' component, if run directly as an HTTP server, would bind to all network interfaces (0.0.0.0), potentially exposing it; however, it appears intended for subprocess management via stdio. Both servers make HTTP requests to a configurable LLAMA_COMPLETION_URL; ensuring this URL points to a trusted local llama.cpp instance is crucial to prevent data leakage or external compromise. No 'eval', obfuscation, or hardcoded secrets were found. Basic input validation for numeric parameters is present.