Use protected HTTP wiring in examples and guides

[felixweinberger]

Examples served over HTTP used bare createServer(toNodeHandler(handler)).listen(port) wiring — binding all interfaces with no host or origin validation, while the framework factories (createMcpExpressApp, createMcpHonoApp, createMcpFastifyApp) apply localhost validation by default. Since examples are the wiring most deployments copy, they should demonstrate the protected path.

Motivation and Context

• 18 stories now mount createMcpHandler via createMcpHonoApp (host/origin validation armed by default; the HTTP wiring in these stories is boilerplate, not the lesson).
• The two stories where hand-wired node:http routing is load-bearing (elicitation's era-split routing, gateway's request-count instrumentation) keep it, composing the validation guards from @modelcontextprotocol/node in front of toNodeHandler and binding 127.0.0.1 explicitly.
• Already-factory-based stories gain explicit loopback binds (including examples/hono, which bound all interfaces while logging 127.0.0.1, and the shared demo authorization server).
• docs/serving/http.md, examples/README.md, and examples/CONTRIBUTING.md now show the factory path as the default recipe; bare wiring appears only together with the validation middleware.

How Has This Been Tested?

• Full examples e2e suite: 29 stories / 75 transport×era legs, all passing.
• Root check:all (typecheck, lint, docs build) and test:all pass.

Breaking Changes

None — examples and docs only. Example servers now bind loopback explicitly; stories remain runnable exactly as before via the examples runner.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

[changeset-bot]

🦋 Changeset detected

Latest commit: 588c873

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@modelcontextprotocol/node	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2445

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2445

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2445

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2445

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2445

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2445

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2445

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2445

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2445

commit: 588c873