---
title: Is a local MCP server safe? What local-only means
description: A local MCP server keeps the connection on your Mac, but the tool you connect still sends what it reads to its model provider. Here is what moves where.
date: 2026-10-11
tags: [mcp, privacy, security]
image: https://ik.imagekit.io/somanshu/HushNotes/shot-shelf-notes-lens.png
related: [mcp]
---

A local-only MCP server runs on your own computer and answers only programs on that computer, so
there is no cloud relay between your data and the tool reading it, and no API key or account for
the server itself. It does not mean your data never leaves the machine. The tool you connect, such
as Claude Code or Cursor, reads from the local server and then sends what it read to its model
provider as part of your conversation.

So "local-only" is a true promise about one hop, not the whole trip. This piece covers both hops,
how one local server is actually built, and what to ask of any server before you connect it.

## What does "local-only MCP" actually mean?

It means the MCP server, the program that holds your data and answers requests, runs on your
machine and accepts connections only from your machine.

The [Model Context Protocol specification](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports)
defines two standard transports, and both can be local:

- **stdio.** The client launches the server as a child process and they talk over standard input
  and output. Nothing listens on a network port. The
  [MCP architecture overview](https://modelcontextprotocol.io/docs/learn/architecture) uses Claude
  Desktop launching a filesystem server this way as its example of a "local" server.
- **Streamable HTTP.** The server is its own process that accepts HTTP POST requests at one
  endpoint. That endpoint can be on the internet, which people call a "remote" server, or it can
  listen only on `127.0.0.1`, the loopback address that never leaves your Mac.

"No cloud relay" means the request from the tool to the server stays on your machine instead of
passing through the server maker's infrastructure. "No API key" means you do not sign up with the
server's maker for a credential; a local HTTP server still needs a secret, but it is generated on
your machine. "No account" means the server has no login. The tool you connect almost certainly
does: Claude Code, Cursor and Codex all run under an account with their maker.

## Is a local MCP server safe?

A local MCP server is safe when only the programs you chose can reach it and it can do only what
you allowed. Being local is the start of that, not the whole of it.

The spec's [Streamable HTTP security section](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http)
says servers must validate the `Origin` header to prevent DNS rebinding, should bind only to
`127.0.0.1` rather than all network interfaces when running locally, and should implement proper
authentication. Without those, it warns, "attackers could use DNS rebinding to interact with local
MCP servers from remote websites." DNS rebinding lets a web page in your browser send requests to a
port on your own machine, so loopback alone does not keep a careless server private.

The spec's [security best practices](https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices)
add that local servers "may be accessible to other processes running on the user's machine", and
recommend stdio, which limits access to the client that launched the server, or, for HTTP, an
authorization token.

The other half of safety is what a tool can do once it is in. A server that can only read is a
smaller risk than one that can delete, and one that keeps private items out of reach entirely is
smaller still.

## What data moves where when Claude or Cursor reads your notes?

Two hops happen, and only the first is local.

**Hop one, tool to server.** You ask a question, the tool calls the server, for example a search,
and the server answers with matching notes. With a loopback server this happens entirely on your
Mac.

**Hop two, tool to model.** The tool hands that answer to the language model. The
[MCP architecture overview](https://modelcontextprotocol.io/docs/learn/architecture) says the client
routes the tool call to the server, executes it, "and returns the results back to the LLM as part
of the conversation flow." Unless the model runs on your machine, the text of the notes the tool
read goes over the internet to the model provider, with your prompt.

What happens next is set by the provider, not the MCP server. Each vendor's own docs say this:

- **Claude Code.** Anthropic's [data usage page](https://code.claude.com/docs/en/data-usage) says
  Claude Code "runs locally" and, to reach the model, sends data over the network, including "all
  user prompts and model outputs". On Free, Pro and Max plans that data is kept 30 days if you do
  not allow model improvement and five years if you do. Commercial accounts default to 30 days.
- **Claude Desktop and claude.ai.** Anthropic's
  [privacy article](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-personal-data)
  says a deleted conversation leaves back-end storage within 30 days, and that with model
  improvement on, data may be kept de-identified for up to five years.
- **Cursor.** Cursor's [data use page](https://cursor.com/data-use) says "even if you use your API
  key, your requests will still go through our backend", where it builds the final prompt. With
  Privacy Mode on, Cursor says it does not train on your data and has zero data retention
  agreements with its model providers.

### The Claude Desktop connector nuance

Anthropic's article on
[custom connectors using remote MCP](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-MCP)
says that "Claude connects to your remote MCP server from Anthropic's cloud infrastructure, rather
than from your local device", in every Claude client including Claude Desktop, and that the server
must be reachable over the public internet.

So a connector request starts in Anthropic's cloud, not on your Mac, and a server that answers only
on `127.0.0.1` cannot be reached that way at all. The same article says local servers set up in
`claude_desktop_config.json` are a separate mechanism that does use your local network. If you use
Claude Desktop, check which of the two your setup is before you trust the word "local". The
[MCP setup guide](/mcp/#claude-desktop) and the
[Claude and Cursor walkthrough](/blog/read-mac-notes-from-claude-or-cursor-mcp/) show the
config-file route for HushNotes, tested in October 2026.

### The whole trip in one table

| Step | Where it happens | What crosses |
| --- | --- | --- |
| You send a prompt | Your Mac to model provider | Your prompt |
| The model asks for a tool call | Model provider to your Mac | The tool name and arguments |
| The tool calls the local server | Your Mac, over loopback | The request, and the notes or snippets that answer it |
| The tool returns the result | Your Mac to model provider | The text of those notes |
| The provider keeps the conversation | Provider's servers | As its retention policy says |

A local server controls the third row and shapes the fourth, by deciding what it hands over. It has
no say over the rest.

## How the HushNotes MCP server is built

HushNotes is a notes app for the Mac, and its MCP server is one we can describe from the code.

![The HushNotes Shelf with notes and a search lens](https://ik.imagekit.io/somanshu/HushNotes/shot-shelf-notes-lens.png?tr=w-1200,f-auto)

### Where it listens

- **Off by default.** Nothing listens until you turn on **Settings › Connections › Let external
  tools read your notes (MCP)**, and it stops when you quit HushNotes.
- **Loopback only.** The listener requires the loopback interface, so it answers on `127.0.0.1`
  and nowhere else. The default port is 48219; if that is taken it tries the next ports up, and
  **Status** in Settings shows the real one.
- **Streamable HTTP only.** Each request gets one JSON reply and the connection closes. There is no
  stdio command.
- **Origin and Host checks.** A request whose `Host` is not `localhost`, `127.0.0.1` or `::1`, or
  that carries an `Origin` from a web site, is refused with `403 Forbidden`.

### How it authenticates

- **A token made on your Mac.** HushNotes generates a random 24-character token and keeps it in
  your Keychain. It is the end of the URL Settings shows, `http://127.0.0.1:48219/mcp/<token>`, or
  a tool can send it as a Bearer header. A missing or wrong token gets `401 Unauthorized`.
- **Approval per tool.** The first time a tool connects, a card names it, such as "claude-code
  wants to read your notes", and holds the request until you answer. Allow remembers the tool by
  name. Deny, or no answer within 60 seconds, refuses it.

### What a tool can do

| Tool | What it does | Available at |
| --- | --- | --- |
| `search_notes` | Keyword search: id, title, short snippet, date | Read-only and Read & write |
| `list_notes` | Lists all, pinned or recent notes | Read-only and Read & write |
| `read_note` | One note's title, Markdown body and dates | Read-only and Read & write |
| `create_note` | Adds a new note | Read & write only |

- **Read-only is the default.** **Access** in Settings › Connections stays on **Read-only** until
  you choose **Read & write**. Until then `create_note` is not offered, and a call to it anyway is
  refused. A read-only tool that later tries to create a note brings the card back: "claude-code
  now wants to create notes too".
- **No edit, no delete.** No tool exists for either.
- **Locked notes are excluded.** Locked notes and notes in the Trash never appear in a search or a
  list, and `read_note` on one returns "note not found", the same answer as an id that never
  existed, so the error cannot reveal that a private note exists.
- **Pictures stay put.** A picture appears in the body only as a reference; the image is not sent.

### What it logs, and how to take it back

The MCP code writes no log line per request and never logs note text. It has three log lines,
and they concern the token and a one-time migration of approvals; none names a note. Approvals
are kept as a name, a level and a date.

Three controls sit in Settings › Connections:

1. **Revoke** next to a tool removes that tool. The others keep working.
2. **Regenerate token** changes the URL and clears every approval, so any tool you want back needs
   the new URL and a fresh Allow.
3. **Switching it off** stops the listener entirely.

### Where it is weaker than it sounds

- **The name on the card is the name the tool gives itself.** HushNotes ties each approval to that
  name and signs it with the token, but a program that already has the token could connect under
  an approved tool's name. The token is the real key.
- **Your tool's config file holds the token.** Cursor, Codex and Claude Desktop keep the URL,
  token included, in files such as `~/.cursor/mcp.json`, `~/.codex/config.toml` and
  `claude_desktop_config.json`, and Claude Code keeps it in its own settings. Anything that can read those files can read your unlocked notes while HushNotes is
  running. If you suspect that, click Regenerate token.

## Threat model: what local-only protects against, and what it does not

| Threat | Protected? | Why |
| --- | --- | --- |
| Someone on your Wi-Fi or office network | Yes | The listener requires loopback |
| A web page probing local ports | Yes | A foreign `Origin` or `Host` gets `403`, and the token is still required |
| A local program without the token | Yes | It gets `401` |
| A tool you never approved | Yes | It gets nothing until you click Allow |
| A connected tool deleting or rewriting notes | Yes | No edit or delete tool exists |
| A connected tool reading locked notes | Yes | Excluded at the query layer, with no telltale error |
| A program that reads your tool's config file | No | That file holds the token |
| Malware running as your user account | No | It can do what you can do |
| Your model provider seeing notes the tool read | No | That is hop two, under the provider's policy |
| A note's text steering the tool | No | The tool must handle that; read-only and no delete limit the damage |

## What to ask of any MCP server before you connect it

If the answer is not in the docs or settings, treat that as an answer.

1. **Where does it run?** On your machine, or on the maker's servers?
2. **What does it listen on?** A stdio process, or HTTP bound to `127.0.0.1`? One bound to all
   interfaces is reachable from your network.
3. **What stops another program using it?** A token, plus an `Origin` check if it speaks HTTP.
4. **Does it ask before a new tool connects?** And can you revoke one tool without the others?
5. **What can it change?** Read-only by default is the safe shape. Can it edit, delete, send or run
   anything, and is that a switch you turn on?
6. **What does it refuse to hand over?** Private items should be out of reach, not just unlisted.
7. **What does it log?** A server that logs full requests keeps a second copy of your data.
8. **How do you turn it off,** and invalidate every credential at once?
9. **What does your tool do with the results?** That is the provider's policy. Read it once.

## What HushNotes does and does not do

HushNotes lets Claude Code, Cursor, Codex, Claude Desktop through a bridge, and other MCP clients
that can reach a local HTTP server search, list and read your unlocked notes, and, if you choose Read & write, add new ones. It never
edits or deletes a note, never exposes a locked one, and answers only on your Mac while the app
runs. It cannot decide what your tool's provider does with what it reads, and it cannot protect the
token from a program that can read your files.

The [MCP setup guide](/mcp/) has the steps per tool, and
[reading your Mac notes from Claude or Cursor](/blog/read-mac-notes-from-claude-or-cursor-mcp/)
covers using it day to day. For where any notes app keeps your words, see
[note apps that do not need an account](/blog/note-apps-that-dont-need-an-account/).

**How we checked (October 2026):** HushNotes behaviour comes from the app's source code, protocol
details from the MCP specification, and data handling from the Anthropic and Cursor pages linked
above. On 11 October 2026, on macOS 26, we connected Claude Code 2.1, Claude Desktop (through
mcp-remote 0.14) and Cursor to a development build of HushNotes. A connection to the Mac's network
address, even from the same Mac, was refused; a wrong token got `401`; a foreign `Host` got `403`.

## FAQ

### Is MCP safe to use?

MCP is a protocol, so safety depends on the server and the tool. A local server that requires a
token, asks before each tool connects and cannot delete anything is a small risk; an unknown server
that can run commands is a large one.

### Can I run an MCP server without an API key?

Yes. A local server needs no key from its maker. A local HTTP server should still use a secret made
on your machine, like the token in the HushNotes URL, so other programs cannot use it.

### Does a local MCP server keep my notes off the internet?

It keeps the tool-to-server connection on your machine. What the tool reads is then sent to its
model provider as part of the conversation, unless the model runs locally.

### How do I cut off a tool that can read my HushNotes notes?

Open Settings › Connections and click Revoke next to the tool. To cut off every tool at once, click
Regenerate token, or switch the connection off.