Describe the bug
The ready-to-run Server and the primary Python Client do not enforce the network safety policy already used by the Agent integrations and documented in the configuration guide.
Two unsafe configurations are accepted:
- ServerSettings accepts a non-loopback bind such as 0.0.0.0 while bearer authentication remains disabled.
- ClientSettings and PowerContextClient accept a non-loopback http URL and send a bearer token over that plaintext connection.
The Codex, Claude Code, and Pi integrations already reject non-loopback plaintext HTTP, so the same deployment currently has different security behavior depending on which client surface is used.
Steps to reproduce
At commit a6e0dfe:
Server probe
Construct:
settings = ServerSettings(
http={"host": "0.0.0.0"},
auth={"enabled": False},
mcp={"enabled": False},
dashboard={"enabled": False},
)Create the app and request /v1/capabilities without Authorization.
Observed:
host=0.0.0.0
auth_enabled=False
capabilities_without_authorization=200
server/cli.py passes this host directly to uvicorn.run.
Client probe
Construct ClientSettings(server_url="http://memory.example"), then create PowerContextClient with token="probe-token" and a MockTransport.
Observed:
accepted_url=http://memory.example
request_url=http://memory.example/health/live
authorization=Bearer probe-token
Relevant paths:
- src/powercontext/server/settings.py:40-44 and 129-153
- src/powercontext/server/cli.py:50-80
- src/powercontext/client/settings.py:38-49
- src/powercontext/client/client.py:181-194
- integrations/claude-code/plugins/powercontext/claude_code_settings.py:144-149
- integrations/pi/plugins/powercontext/src/config.ts:71-88
- docs/en/docs/reference/configuration.md:57-59
Expected behavior
- Plain HTTP clients should be accepted only for 127.0.0.1, localhost, and ::1.
- A non-loopback Server bind should not silently start with authentication disabled.
- Deployments that intentionally use TLS termination or a controlled private network should require an explicit, clearly named opt-in rather than inheriting the unsafe combination by default.
- The Python Client, CLI, and Agent integrations should share one transport-policy contract and matching tests.
Actual behavior
The Server accepts an unauthenticated public bind, and the Python Client sends bearer credentials to non-loopback HTTP URLs. Documentation warns against these configurations, but the primary runtime surfaces do not reject them.
Environment
- PowerContext: 0.0.3.dev11+ga6e0dfe8b.d20260823
- Commit: a6e0dfe
- Python: 3.14.3
- OS: Windows 11
- External network access was not required; both probes used in-process transports.
Are you willing to submit a PR to fix this bug?
Describe the bug
The ready-to-run Server and the primary Python Client do not enforce the network safety policy already used by the Agent integrations and documented in the configuration guide.
Two unsafe configurations are accepted:
The Codex, Claude Code, and Pi integrations already reject non-loopback plaintext HTTP, so the same deployment currently has different security behavior depending on which client surface is used.
Steps to reproduce
At commit a6e0dfe:
Server probe
Construct:
Create the app and request /v1/capabilities without Authorization.
Observed:
server/cli.py passes this host directly to uvicorn.run.
Client probe
Construct ClientSettings(server_url="http://memory.example"), then create PowerContextClient with token="probe-token" and a MockTransport.
Observed:
Relevant paths:
Expected behavior
Actual behavior
The Server accepts an unauthenticated public bind, and the Python Client sends bearer credentials to non-loopback HTTP URLs. Documentation warns against these configurations, but the primary runtime surfaces do not reject them.
Environment
Are you willing to submit a PR to fix this bug?