diff --git a/cmd/github-mcp-server/main.go b/cmd/github-mcp-server/main.go
index 04ba68e226..32fe5d741b 100644
--- a/cmd/github-mcp-server/main.go
+++ b/cmd/github-mcp-server/main.go
@@ -269,7 +269,7 @@ func init() {
 
 	// HTTP-specific flags
 	httpCmd.Flags().Int("port", 8082, "HTTP server port")
-	httpCmd.Flags().String("listen-host", "", "Host the HTTP server binds to (e.g. 127.0.0.1). Empty binds to all interfaces.")
+	httpCmd.Flags().String("listen-host", "127.0.0.1", "Host the HTTP server binds to (use 0.0.0.0 to bind all interfaces).")
 	httpCmd.Flags().String("base-url", "", "Base URL where this server is publicly accessible (for OAuth resource metadata)")
 	httpCmd.Flags().String("base-path", "", "Externally visible base path for the HTTP server (for OAuth resource metadata)")
 	httpCmd.Flags().String("authorization-server", "", "Override the authorization server URL in OAuth resource metadata. Useful when deploying behind an OAuth proxy (e.g. for GHES). Env: GITHUB_AUTHORIZATION_SERVER")
diff --git a/cmd/github-mcp-server/main_test.go b/cmd/github-mcp-server/main_test.go
index 48d1367acf..e0dcd5abf0 100644
--- a/cmd/github-mcp-server/main_test.go
+++ b/cmd/github-mcp-server/main_test.go
@@ -57,6 +57,12 @@ func TestAuthorizationServerConfigurationIsHTTPOnly(t *testing.T) {
 	assert.Equal(t, "https://oauth-proxy.example.com", viper.GetString("authorization-server"))
 }
 
+func TestHTTPListenHostDefaultsToLoopback(t *testing.T) {
+	flag := httpCmd.Flags().Lookup("listen-host")
+	require.NotNil(t, flag)
+	assert.Equal(t, "127.0.0.1", flag.DefValue)
+}
+
 func TestWriteToolDocScopes(t *testing.T) {
 	tool := inventory.ServerTool{
 		Tool:        mcp.Tool{Name: "delete", Annotations: &mcp.ToolAnnotations{Title: "Delete"}},
diff --git a/docs/streamable-http.md b/docs/streamable-http.md
index d5fc8a5d0d..d0c1b042d2 100644
--- a/docs/streamable-http.md
+++ b/docs/streamable-http.md
@@ -36,7 +36,11 @@ Start the server on the default port (8082):
 github-mcp-server http
 ```
 
-The server will be available at `http://localhost:8082`.
+The server will be available at `http://127.0.0.1:8082` (also reachable as `http://localhost:8082`). The default bind address is loopback-only. To listen on all interfaces, for example in a container or behind a reverse proxy, opt in explicitly:
+
+```bash
+github-mcp-server http --listen-host 0.0.0.0
+```
 
 ### With Scope Challenge
 
diff --git a/pkg/http/server_test.go b/pkg/http/server_test.go
index 60b0df0da3..44a95936e2 100644
--- a/pkg/http/server_test.go
+++ b/pkg/http/server_test.go
@@ -492,6 +492,12 @@ func TestResolveListenAddress(t *testing.T) {
 			port: 9090,
 			want: "127.0.0.1:9090",
 		},
+		{
+			name: "all interfaces host is joined with port",
+			host: "0.0.0.0",
+			port: 8082,
+			want: "0.0.0.0:8082",
+		},
 		{
 			name: "ipv6 host is bracketed and joined with port",
 			host: "::1",