Local-scan guide: what the web cannot see

HomeShield MCP's web scan only sees public endpoints you declare. It cannot audit your LAN from the internet — no web tool can. This checklist covers your own machine and home network. Run it on the computer that hosts your AI server.

1. Find what's listening on your machine

On Linux/macOS, list every listening port and the process behind it:

ss -tlnp | head -40

On Windows (PowerShell):

Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess

For each port you don't recognize, find the process and decide whether it should be reachable at all.

2. Check your tunnels and port forwards

• Look for tunnel processes: ngrok, cloudflared, tailscale, localtunnel, bore. Each one is a potential public door — know what each exposes.
• Log in to your router and review port-forwarding / virtual-server rules. Delete any you didn't create deliberately.
• Check UPnP: many routers let devices open ports automatically. If you don't need it, turn UPnP off.

3. Verify your MCP server's bind address

If your server binds to 0.0.0.0, it accepts connections from every network interface. Prefer 127.0.0.1 (localhost only) and expose it deliberately through one authenticated path.

4. Put auth in front of anything public

• Simplest: a reverse proxy (Caddy, nginx) with basic auth in front of the MCP port.
• Better: don't expose it publicly at all — reach it over Tailscale or WireGuard instead.
• Confirm from your phone (mobile data, Wi-Fi off) that the endpoint is unreachable without credentials — then paste the URL into the web scan to confirm the outside view.

5. Audit the tool surface

List the tools your MCP server exposes and remove any with filesystem, shell, or network-dial capabilities you don't actively use. An exposed tool list is the highest-risk shape of MCP exposure.

Want this checked continuously?

Pro ($19/mo) saves your endpoints and re-scans them on a schedule, keeping a full report history. See plans.