MCP servers that need localhost access fail silently in sandboxed agent runtimes (SSRF protection)

The problem

Many MCP servers are designed to connect to locally-running services (databases, n8n, Home Assistant, Ollama, etc.) via localhost or 127.0.0.1. But modern agent runtimes like Claude Code enforce SSRF protection that blocks outbound HTTP to localhost in "strict mode."

Concrete example: n8n-mcp

n8n-mcp (npx -y n8n-mcp) configures N8N_API_URL=http://localhost:5678 and connects via HTTP to the local n8n instance. In Claude Code's sandbox:

{
  "success": false,
  "error": "SSRF protection: Localhost access is blocked in strict mode",
  "code": "REQUEST_ERROR"
}

The health check connects fine (diagnostics work), but every management operation (list workflows, execute, create) fails because those hit the HTTP API. The 7 documentation-only tools (node search, template search, validation) still work because they don't make HTTP calls.

What breaks vs. what works

Breaks (needs localhost HTTP):

• n8n-mcp management tools (workflow CRUD, execution)
• mcp-server-redis (connects to localhost:6379)
• Any MCP server that proxies a local database (Postgres, MySQL, MongoDB)
• Home Assistant MCP (connects to local HA instance)
• Ollama MCP (connects to localhost:11434)

Works fine (no localhost HTTP needed):

• Playwright MCP (launches its own Chromium, no HTTP)
• Filesystem MCP (direct file I/O, no HTTP)
• Git MCP (shells out to git, no HTTP)
• Calculator/encoding/utility MCPs (pure computation)
• Remote API MCPs (Slack, GitHub, etc. — connects to external URLs)

Questions for the community

1. Which other popular MCP servers hit this? Building a registry of "needs localhost" vs. "self-contained" would help agents pick the right tool.
2. Are there workarounds? Can you tunnel localhost via a Unix socket or named pipe that bypasses HTTP? Can the MCP server be configured to use a non-localhost URL?
3. Should tani surfaces have a `requires_localhost` constraint? This would let tani_resolve filter out servers that won't work in sandboxed runtimes.