Secure MCP endpoint for LAN clients

README.md

@@ -35,7 +35,7 @@ npm run check
 npm run service:install
 ```
 
-The service endpoint is:
+The service defaults to a same-Mac endpoint:
 
 ```text
 http://127.0.0.1:7331/mcp
@@ -71,6 +71,21 @@ Service logs are stored in `.logs/`.
 For a harness that supports Streamable HTTP, configure the local MCP URL as
 `http://127.0.0.1:7331/mcp`.
 
+For a trusted local-network harness such as a Raspberry Pi, set
+`MACMINI_MCP_HOST` in `.env` to the Mac's LAN IP and set a strong
+`MACMINI_MCP_TOKEN`. Then configure the remote MCP client with:
+
+```text
+URL: http://<mac-lan-ip>:7331/mcp
+Authorization: Bearer <MACMINI_MCP_TOKEN>
+```
+
+Restart after changing `.env`:
+
+```sh
+npm run service:restart
+```
+
 For a harness that launches stdio servers, use:
 
 ```json
@@ -90,11 +105,11 @@ On first use of a Notes, Calendar, or Reminders tool, macOS may ask for
 Automation access for Node. Permit only the applications you want the server
 to control under **System Settings > Privacy & Security > Automation**.
 
-The HTTP service binds to `127.0.0.1` by default. To require bearer
-authentication even locally, create `.env` from `.env.example` and set
-`MACMINI_MCP_TOKEN`; clients must then send `Authorization: Bearer <token>`.
-Do not bind to a non-loopback address without enabling authentication and
-reviewing the tools first.
+The HTTP service binds to `127.0.0.1` by default. When configured to bind to a
+LAN address, it refuses to start without `MACMINI_MCP_TOKEN`; clients must send
+`Authorization: Bearer <token>`. This is HTTP bearer authentication on your
+local network, not encrypted transport. Use it only on a trusted LAN or put it
+behind a private encrypted network such as a VPN.
 
 ## Development