diff --git a/MCPForUnity/Editor/Constants/EditorPrefKeys.cs b/MCPForUnity/Editor/Constants/EditorPrefKeys.cs
index 71a5be703..c5dab7c41 100644
--- a/MCPForUnity/Editor/Constants/EditorPrefKeys.cs
+++ b/MCPForUnity/Editor/Constants/EditorPrefKeys.cs
@@ -30,6 +30,8 @@ internal static class EditorPrefKeys
         internal const string GitUrlOverride = "MCPForUnity.GitUrlOverride";
         internal const string DevModeForceServerRefresh = "MCPForUnity.DevModeForceServerRefresh";
         internal const string ProjectScopedToolsLocalHttp = "MCPForUnity.ProjectScopedTools.LocalHttp";
+        internal const string AllowLanHttpBind = "MCPForUnity.Security.AllowLanHttpBind";
+        internal const string AllowInsecureRemoteHttp = "MCPForUnity.Security.AllowInsecureRemoteHttp";
 
         internal const string PackageDeploySourcePath = "MCPForUnity.PackageDeploy.SourcePath";
         internal const string PackageDeployLastBackupPath = "MCPForUnity.PackageDeploy.LastBackupPath";
diff --git a/MCPForUnity/Editor/Helpers/HttpEndpointUtility.cs b/MCPForUnity/Editor/Helpers/HttpEndpointUtility.cs
index 98fdb2d5a..4f8064612 100644
--- a/MCPForUnity/Editor/Helpers/HttpEndpointUtility.cs
+++ b/MCPForUnity/Editor/Helpers/HttpEndpointUtility.cs
@@ -1,4 +1,5 @@
 using System;
+using System.Net;
 using MCPForUnity.Editor.Constants;
 using MCPForUnity.Editor.Models;
 using MCPForUnity.Editor.Services;
@@ -51,7 +52,7 @@ public static void SaveBaseUrl(string userValue)
         public static string GetLocalBaseUrl()
         {
             string stored = EditorPrefs.GetString(LocalPrefKey, DefaultLocalBaseUrl);
-            return NormalizeBaseUrl(stored, DefaultLocalBaseUrl);
+            return NormalizeBaseUrl(stored, DefaultLocalBaseUrl, remoteScope: false);
         }
 
         /// <summary>
@@ -59,7 +60,7 @@ public static string GetLocalBaseUrl()
         /// </summary>
         public static void SaveLocalBaseUrl(string userValue)
         {
-            string normalized = NormalizeBaseUrl(userValue, DefaultLocalBaseUrl);
+            string normalized = NormalizeBaseUrl(userValue, DefaultLocalBaseUrl, remoteScope: false);
             EditorPrefs.SetString(LocalPrefKey, normalized);
         }
 
@@ -74,7 +75,7 @@ public static string GetRemoteBaseUrl()
             {
                 return DefaultRemoteBaseUrl;
             }
-            return NormalizeBaseUrl(stored, DefaultRemoteBaseUrl);
+            return NormalizeBaseUrl(stored, DefaultRemoteBaseUrl, remoteScope: true);
         }
 
         /// <summary>
@@ -87,7 +88,7 @@ public static void SaveRemoteBaseUrl(string userValue)
                 EditorPrefs.SetString(RemotePrefKey, DefaultRemoteBaseUrl);
                 return;
             }
-            string normalized = NormalizeBaseUrl(userValue, DefaultRemoteBaseUrl);
+            string normalized = NormalizeBaseUrl(userValue, DefaultRemoteBaseUrl, remoteScope: true);
             EditorPrefs.SetString(RemotePrefKey, normalized);
         }
 
@@ -146,10 +147,169 @@ public static ConfiguredTransport GetCurrentServerTransport()
             return IsRemoteScope() ? ConfiguredTransport.HttpRemote : ConfiguredTransport.Http;
         }
 
+        /// <summary>
+        /// Returns true when advanced settings allow binding HTTP Local to all interfaces
+        /// (e.g. 0.0.0.0 / ::). Disabled by default.
+        /// </summary>
+        public static bool AllowLanHttpBind()
+        {
+            return EditorPrefs.GetBool(EditorPrefKeys.AllowLanHttpBind, false);
+        }
+
+        /// <summary>
+        /// Returns true when advanced settings allow insecure HTTP/WS for remote endpoints.
+        /// Disabled by default.
+        /// </summary>
+        public static bool AllowInsecureRemoteHttp()
+        {
+            return EditorPrefs.GetBool(EditorPrefKeys.AllowInsecureRemoteHttp, false);
+        }
+
+        /// <summary>
+        /// Returns true if the host is loopback-only.
+        /// </summary>
+        public static bool IsLoopbackHost(string host)
+        {
+            if (string.IsNullOrWhiteSpace(host))
+            {
+                return false;
+            }
+
+            string normalized = host.Trim().Trim('[', ']').ToLowerInvariant();
+            if (normalized == "localhost")
+            {
+                return true;
+            }
+
+            if (IPAddress.TryParse(normalized, out IPAddress parsedIp))
+            {
+                return IPAddress.IsLoopback(parsedIp);
+            }
+
+            return false;
+        }
+
+        /// <summary>
+        /// Returns true if the host is a bind-all-interfaces address.
+        /// </summary>
+        public static bool IsBindAllInterfacesHost(string host)
+        {
+            if (string.IsNullOrWhiteSpace(host))
+            {
+                return false;
+            }
+
+            string normalized = host.Trim().Trim('[', ']').ToLowerInvariant();
+            if (IPAddress.TryParse(normalized, out IPAddress parsedIp))
+            {
+                return parsedIp.Equals(IPAddress.Any) || parsedIp.Equals(IPAddress.IPv6Any);
+            }
+
+            return false;
+        }
+
+        /// <summary>
+        /// Returns true when the URL host is acceptable for HTTP Local launch.
+        /// Loopback is always allowed. Bind-all interfaces requires explicit opt-in.
+        /// </summary>
+        public static bool IsHttpLocalUrlAllowedForLaunch(string url, out string error)
+        {
+            error = null;
+            if (string.IsNullOrWhiteSpace(url))
+            {
+                error = "HTTP Local requires a loopback URL (localhost/127.0.0.1/::1).";
+                return false;
+            }
+
+            if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))
+            {
+                error = $"Invalid URL: {url}";
+                return false;
+            }
+
+            string host = uri.Host;
+            if (IsLoopbackHost(host))
+            {
+                return true;
+            }
+
+            if (IsBindAllInterfacesHost(host))
+            {
+                if (AllowLanHttpBind())
+                {
+                    return true;
+                }
+
+                error = "Binding to all interfaces (0.0.0.0/::) is disabled by default. " +
+                        "Enable \"Allow LAN bind for HTTP Local\" in Advanced Settings to opt in.";
+                return false;
+            }
+
+            error = "HTTP Local requires a loopback URL (localhost/127.0.0.1/::1).";
+            return false;
+        }
+
+        /// <summary>
+        /// Returns true when remote URL is allowed by current security policy.
+        /// HTTPS is required by default; HTTP needs explicit opt-in.
+        /// </summary>
+        public static bool IsRemoteUrlAllowed(string remoteBaseUrl, out string error)
+        {
+            error = null;
+            if (string.IsNullOrWhiteSpace(remoteBaseUrl))
+            {
+                error = "HTTP Remote requires a configured URL.";
+                return false;
+            }
+
+            if (!Uri.TryCreate(remoteBaseUrl, UriKind.Absolute, out var uri))
+            {
+                error = $"Invalid HTTP Remote URL: {remoteBaseUrl}";
+                return false;
+            }
+
+            if (uri.Scheme.Equals("https", StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+
+            if (uri.Scheme.Equals("http", StringComparison.OrdinalIgnoreCase))
+            {
+                if (AllowInsecureRemoteHttp())
+                {
+                    return true;
+                }
+
+                error = "HTTP Remote requires HTTPS by default. Enable \"Allow insecure HTTP for HTTP Remote\" in Advanced Settings to opt in.";
+                return false;
+            }
+
+            error = $"Unsupported URL scheme '{uri.Scheme}'. Use https:// (or http:// only with explicit insecure opt-in).";
+            return false;
+        }
+
+        /// <summary>
+        /// Returns true when the currently configured remote URL satisfies security policy.
+        /// </summary>
+        public static bool IsCurrentRemoteUrlAllowed(out string error)
+        {
+            return IsRemoteUrlAllowed(GetRemoteBaseUrl(), out error);
+        }
+
+        /// <summary>
+        /// Human-readable host requirement for HTTP Local based on current security settings.
+        /// </summary>
+        public static string GetHttpLocalHostRequirementText()
+        {
+            return AllowLanHttpBind()
+                ? "localhost/127.0.0.1/::1/0.0.0.0/::"
+                : "localhost/127.0.0.1/::1";
+        }
+
         /// <summary>
         /// Normalizes a URL so that we consistently store just the base (no trailing slash/path).
         /// </summary>
-        private static string NormalizeBaseUrl(string value, string defaultUrl)
+        private static string NormalizeBaseUrl(string value, string defaultUrl, bool remoteScope)
         {
             if (string.IsNullOrWhiteSpace(value))
             {
@@ -158,10 +318,13 @@ private static string NormalizeBaseUrl(string value, string defaultUrl)
 
             string trimmed = value.Trim();
 
-            // Ensure scheme exists; default to http:// if user omitted it.
+            // Ensure scheme exists.
+            // For HTTP Remote, default to https:// to avoid accidental plaintext transport.
+            // For HTTP Local, default to http:// for zero-friction local setup.
             if (!trimmed.Contains("://"))
             {
-                trimmed = $"http://{trimmed}";
+                string defaultScheme = remoteScope ? "https" : "http";
+                trimmed = $"{defaultScheme}://{trimmed}";
             }
 
             // Remove trailing slash segments.
diff --git a/MCPForUnity/Editor/Services/IServerManagementService.cs b/MCPForUnity/Editor/Services/IServerManagementService.cs
index 299fad511..2da66738f 100644
--- a/MCPForUnity/Editor/Services/IServerManagementService.cs
+++ b/MCPForUnity/Editor/Services/IServerManagementService.cs
@@ -58,7 +58,7 @@ public interface IServerManagementService
         /// <summary>
         /// Check if the local HTTP server can be started
         /// </summary>
-        /// <returns>True if HTTP transport is enabled and URL is local</returns>
+        /// <returns>True if HTTP transport is enabled and URL satisfies local launch security policy</returns>
         bool CanStartLocalServer();
     }
 }
diff --git a/MCPForUnity/Editor/Services/Server/ServerCommandBuilder.cs b/MCPForUnity/Editor/Services/Server/ServerCommandBuilder.cs
index 47b46755b..47ba7186d 100644
--- a/MCPForUnity/Editor/Services/Server/ServerCommandBuilder.cs
+++ b/MCPForUnity/Editor/Services/Server/ServerCommandBuilder.cs
@@ -31,9 +31,11 @@ public bool TryBuildCommand(out string fileName, out string arguments, out strin
             }
 
             string httpUrl = HttpEndpointUtility.GetLocalBaseUrl();
-            if (!IsLocalUrl(httpUrl))
+            if (!HttpEndpointUtility.IsHttpLocalUrlAllowedForLaunch(httpUrl, out string localUrlError))
             {
-                error = $"The configured URL ({httpUrl}) is not a local address. Local server launch only works for localhost.";
+                error = string.IsNullOrEmpty(localUrlError)
+                    ? $"The configured URL ({httpUrl}) is not allowed for HTTP Local launch."
+                    : $"{localUrlError} (configured URL: {httpUrl})";
                 return false;
             }
 
@@ -129,23 +131,5 @@ public string QuoteIfNeeded(string input)
             return input.IndexOf(' ') >= 0 ? $"\"{input}\"" : input;
         }
 
-        /// <summary>
-        /// Check if a URL is local (localhost, 127.0.0.1, 0.0.0.0, ::1)
-        /// </summary>
-        private static bool IsLocalUrl(string url)
-        {
-            if (string.IsNullOrEmpty(url)) return false;
-
-            try
-            {
-                var uri = new Uri(url);
-                string host = uri.Host.ToLower();
-                return host == "localhost" || host == "127.0.0.1" || host == "0.0.0.0" || host == "::1";
-            }
-            catch
-            {
-                return false;
-            }
-        }
     }
 }
diff --git a/MCPForUnity/Editor/Services/ServerManagementService.cs b/MCPForUnity/Editor/Services/ServerManagementService.cs
index ecd248da5..0b7799fad 100644
--- a/MCPForUnity/Editor/Services/ServerManagementService.cs
+++ b/MCPForUnity/Editor/Services/ServerManagementService.cs
@@ -654,13 +654,32 @@ private bool StopLocalHttpServerInternal(bool quiet, int? portOverride = null, b
                                 }
                                 return false;
                             }
-                            if (!quiet)
+
+                            // If the pidfile PID is no longer the active listener, treat handshake state as stale
+                            // and continue with guarded port-based heuristics below.
+                            if (!pidIsListener)
                             {
-                                McpLog.Warn(
-                                    $"Refusing to stop port {port}: pidfile PID {pidFromFile} failed validation " +
-                                    $"(listener={pidIsListener}, tokenMatch={tokenMatches}, tokenQueryOk={tokenQueryOk}).");
+                                if (!quiet)
+                                {
+                                    McpLog.Warn(
+                                        $"Stale pidfile for port {port}: pidfile PID {pidFromFile} is not the current listener " +
+                                        $"(tokenMatch={tokenMatches}, tokenQueryOk={tokenQueryOk}). Falling back to guarded port heuristics.");
+                                }
+                                try { DeletePidFile(pidFilePath); } catch { }
+                                ClearLocalServerPidTracking();
+                            }
+                            else
+                            {
+                                // PID still owns the listener, but identity validation failed.
+                                // Fail closed to avoid terminating unrelated processes.
+                                if (!quiet)
+                                {
+                                    McpLog.Warn(
+                                        $"Refusing to stop port {port}: pidfile PID {pidFromFile} failed validation " +
+                                        $"(listener={pidIsListener}, tokenMatch={tokenMatches}, tokenQueryOk={tokenQueryOk}).");
+                                }
+                                return false;
                             }
-                            return false;
                         }
                     }
                 }
@@ -875,7 +894,8 @@ public bool IsLocalUrl()
         }
 
         /// <summary>
-        /// Check if a URL is local (localhost, 127.0.0.1, 0.0.0.0)
+        /// Check if a URL is local or bind-all (localhost/loopback and 0.0.0.0/::).
+        /// This helper is intentionally broader than local-launch policy checks.
         /// </summary>
         private static bool IsLocalUrl(string url)
         {
@@ -884,8 +904,8 @@ private static bool IsLocalUrl(string url)
             try
             {
                 var uri = new Uri(url);
-                string host = uri.Host.ToLower();
-                return host == "localhost" || host == "127.0.0.1" || host == "0.0.0.0" || host == "::1";
+                string host = uri.Host;
+                return HttpEndpointUtility.IsLoopbackHost(host) || HttpEndpointUtility.IsBindAllInterfacesHost(host);
             }
             catch
             {
@@ -899,7 +919,13 @@ private static bool IsLocalUrl(string url)
         public bool CanStartLocalServer()
         {
             bool useHttpTransport = EditorConfigurationCache.Instance.UseHttpTransport;
-            return useHttpTransport && IsLocalUrl();
+            if (!useHttpTransport)
+            {
+                return false;
+            }
+
+            string httpUrl = HttpEndpointUtility.GetLocalBaseUrl();
+            return HttpEndpointUtility.IsHttpLocalUrlAllowedForLaunch(httpUrl, out _);
         }
 
         private System.Diagnostics.ProcessStartInfo CreateTerminalProcessStartInfo(string command)
diff --git a/MCPForUnity/Editor/Services/Transport/Transports/WebSocketTransportClient.cs b/MCPForUnity/Editor/Services/Transport/Transports/WebSocketTransportClient.cs
index 668c20ad2..8832b3227 100644
--- a/MCPForUnity/Editor/Services/Transport/Transports/WebSocketTransportClient.cs
+++ b/MCPForUnity/Editor/Services/Transport/Transports/WebSocketTransportClient.cs
@@ -86,6 +86,15 @@ public async Task<bool> StartAsync()
                 ? EditorPrefs.GetString(EditorPrefKeys.ApiKey, string.Empty)
                 : string.Empty;
 
+            if (HttpEndpointUtility.IsRemoteScope()
+                && !HttpEndpointUtility.IsCurrentRemoteUrlAllowed(out string remoteUrlError))
+            {
+                string message = remoteUrlError ?? "HTTP Remote URL is not allowed by current security settings.";
+                _state = TransportState.Disconnected(TransportDisplayName, message);
+                McpLog.Error($"[WebSocket] {message}");
+                return false;
+            }
+
             // Get project root path (strip /Assets from dataPath) for focus nudging
             string dataPath = Application.dataPath;
             if (!string.IsNullOrEmpty(dataPath))
diff --git a/MCPForUnity/Editor/Windows/Components/Advanced/McpAdvancedSection.cs b/MCPForUnity/Editor/Windows/Components/Advanced/McpAdvancedSection.cs
index 386f8ac59..218e95e17 100644
--- a/MCPForUnity/Editor/Windows/Components/Advanced/McpAdvancedSection.cs
+++ b/MCPForUnity/Editor/Windows/Components/Advanced/McpAdvancedSection.cs
@@ -26,6 +26,8 @@ public class McpAdvancedSection
         private Button clearGitUrlButton;
         private Toggle debugLogsToggle;
         private Toggle devModeForceRefreshToggle;
+        private Toggle allowLanHttpBindToggle;
+        private Toggle allowInsecureRemoteHttpToggle;
         private TextField deploySourcePath;
         private Button browseDeploySourceButton;
         private Button clearDeploySourceButton;
@@ -64,6 +66,8 @@ private void CacheUIElements()
             clearGitUrlButton = Root.Q<Button>("clear-git-url-button");
             debugLogsToggle = Root.Q<Toggle>("debug-logs-toggle");
             devModeForceRefreshToggle = Root.Q<Toggle>("dev-mode-force-refresh-toggle");
+            allowLanHttpBindToggle = Root.Q<Toggle>("allow-lan-http-bind-toggle");
+            allowInsecureRemoteHttpToggle = Root.Q<Toggle>("allow-insecure-remote-http-toggle");
             deploySourcePath = Root.Q<TextField>("deploy-source-path");
             browseDeploySourceButton = Root.Q<Button>("browse-deploy-source-button");
             clearDeploySourceButton = Root.Q<Button>("clear-deploy-source-button");
@@ -98,6 +102,20 @@ private void InitializeUI()
                 if (forceRefreshLabel != null)
                     forceRefreshLabel.tooltip = devModeForceRefreshToggle.tooltip;
             }
+            if (allowLanHttpBindToggle != null)
+            {
+                allowLanHttpBindToggle.tooltip = "Allow HTTP Local to bind on all interfaces (0.0.0.0 / ::). Disabled by default because devices on your LAN may reach MCP tools.";
+                var lanBindLabel = allowLanHttpBindToggle?.parent?.Q<Label>();
+                if (lanBindLabel != null)
+                    lanBindLabel.tooltip = allowLanHttpBindToggle.tooltip;
+            }
+            if (allowInsecureRemoteHttpToggle != null)
+            {
+                allowInsecureRemoteHttpToggle.tooltip = "Allow HTTP Remote over plaintext http/ws. Disabled by default to require HTTPS/WSS.";
+                var insecureRemoteLabel = allowInsecureRemoteHttpToggle?.parent?.Q<Label>();
+                if (insecureRemoteLabel != null)
+                    insecureRemoteLabel.tooltip = allowInsecureRemoteHttpToggle.tooltip;
+            }
             if (testConnectionButton != null)
                 testConnectionButton.tooltip = "Test the connection between Unity and the MCP server.";
             if (deploySourcePath != null)
@@ -128,6 +146,14 @@ private void InitializeUI()
             McpLog.SetDebugLoggingEnabled(debugEnabled);
 
             devModeForceRefreshToggle.value = EditorPrefs.GetBool(EditorPrefKeys.DevModeForceServerRefresh, false);
+            if (allowLanHttpBindToggle != null)
+            {
+                allowLanHttpBindToggle.SetValueWithoutNotify(EditorPrefs.GetBool(EditorPrefKeys.AllowLanHttpBind, false));
+            }
+            if (allowInsecureRemoteHttpToggle != null)
+            {
+                allowInsecureRemoteHttpToggle.SetValueWithoutNotify(EditorPrefs.GetBool(EditorPrefKeys.AllowInsecureRemoteHttp, false));
+            }
             UpdatePathOverrides();
             UpdateDeploymentSection();
         }
@@ -178,6 +204,24 @@ private void RegisterCallbacks()
                 OnHttpServerCommandUpdateRequested?.Invoke();
             });
 
+            if (allowLanHttpBindToggle != null)
+            {
+                allowLanHttpBindToggle.RegisterValueChangedCallback(evt =>
+                {
+                    EditorPrefs.SetBool(EditorPrefKeys.AllowLanHttpBind, evt.newValue);
+                    OnHttpServerCommandUpdateRequested?.Invoke();
+                });
+            }
+
+            if (allowInsecureRemoteHttpToggle != null)
+            {
+                allowInsecureRemoteHttpToggle.RegisterValueChangedCallback(evt =>
+                {
+                    EditorPrefs.SetBool(EditorPrefKeys.AllowInsecureRemoteHttp, evt.newValue);
+                    OnHttpServerCommandUpdateRequested?.Invoke();
+                });
+            }
+
             deploySourcePath.RegisterValueChangedCallback(evt =>
             {
                 string path = evt.newValue?.Trim();
@@ -280,6 +324,14 @@ public void UpdatePathOverrides()
             gitUrlOverride.value = EditorPrefs.GetString(EditorPrefKeys.GitUrlOverride, "");
             debugLogsToggle.value = EditorPrefs.GetBool(EditorPrefKeys.DebugLogs, false);
             devModeForceRefreshToggle.value = EditorPrefs.GetBool(EditorPrefKeys.DevModeForceServerRefresh, false);
+            if (allowLanHttpBindToggle != null)
+            {
+                allowLanHttpBindToggle.value = EditorPrefs.GetBool(EditorPrefKeys.AllowLanHttpBind, false);
+            }
+            if (allowInsecureRemoteHttpToggle != null)
+            {
+                allowInsecureRemoteHttpToggle.value = EditorPrefs.GetBool(EditorPrefKeys.AllowInsecureRemoteHttp, false);
+            }
             UpdateDeploymentSection();
         }
 
diff --git a/MCPForUnity/Editor/Windows/Components/Advanced/McpAdvancedSection.uxml b/MCPForUnity/Editor/Windows/Components/Advanced/McpAdvancedSection.uxml
index 50b3412c0..673e062d2 100644
--- a/MCPForUnity/Editor/Windows/Components/Advanced/McpAdvancedSection.uxml
+++ b/MCPForUnity/Editor/Windows/Components/Advanced/McpAdvancedSection.uxml
@@ -41,6 +41,16 @@
                 <ui:Toggle name="dev-mode-force-refresh-toggle" class="setting-toggle" />
             </ui:VisualElement>
 
+            <ui:VisualElement class="setting-row">
+                <ui:Label text="Allow LAN Bind (HTTP Local):" class="setting-label" />
+                <ui:Toggle name="allow-lan-http-bind-toggle" class="setting-toggle" />
+            </ui:VisualElement>
+
+            <ui:VisualElement class="setting-row">
+                <ui:Label text="Allow Insecure Remote HTTP:" class="setting-label" />
+                <ui:Toggle name="allow-insecure-remote-http-toggle" class="setting-toggle" />
+            </ui:VisualElement>
+
             <ui:VisualElement class="override-row" style="margin-top: 8px;">
                 <ui:Label text="Package Source:" class="override-label" />
             </ui:VisualElement>
diff --git a/MCPForUnity/Editor/Windows/Components/Connection/McpConnectionSection.cs b/MCPForUnity/Editor/Windows/Components/Connection/McpConnectionSection.cs
index 7f1478169..557d832c2 100644
--- a/MCPForUnity/Editor/Windows/Components/Connection/McpConnectionSection.cs
+++ b/MCPForUnity/Editor/Windows/Components/Connection/McpConnectionSection.cs
@@ -393,14 +393,40 @@ public void UpdateConnectionStatus()
                     statusIndicator.AddToClassList("disconnected");
                     connectionToggleButton.text = "Start Session";
 
-                    // Disable Start Session for HTTP Remote when no API key is set
-                    bool httpRemoteNeedsKey = transportDropdown != null
-                        && (TransportProtocol)transportDropdown.value == TransportProtocol.HTTPRemote
+                    bool httpRemoteSelected = transportDropdown != null
+                        && (TransportProtocol)transportDropdown.value == TransportProtocol.HTTPRemote;
+                    bool httpRemoteNeedsKey = httpRemoteSelected
                         && string.IsNullOrEmpty(EditorPrefs.GetString(EditorPrefKeys.ApiKey, string.Empty));
-                    connectionToggleButton.SetEnabled(!httpRemoteNeedsKey);
-                    connectionToggleButton.tooltip = httpRemoteNeedsKey
-                        ? "An API key is required for HTTP Remote. Enter one above."
-                        : string.Empty;
+                    string remoteUrlError = null;
+                    bool remoteUrlAllowed = !httpRemoteSelected
+                        || HttpEndpointUtility.IsCurrentRemoteUrlAllowed(out remoteUrlError);
+
+                    bool httpLocalSelected = IsHttpLocalSelected();
+                    string localUrlError = null;
+                    bool localUrlAllowed = !httpLocalSelected
+                        || TryGetLocalHttpLaunchPolicy(out _, out localUrlError);
+
+                    bool blockedByRemoteUrlPolicy = httpRemoteSelected && !remoteUrlAllowed;
+                    bool blockedByLocalUrlPolicy = httpLocalSelected && !localUrlAllowed;
+                    bool canStartSession = !httpRemoteNeedsKey && !blockedByRemoteUrlPolicy && !blockedByLocalUrlPolicy;
+                    connectionToggleButton.SetEnabled(canStartSession);
+
+                    if (httpRemoteNeedsKey)
+                    {
+                        connectionToggleButton.tooltip = "An API key is required for HTTP Remote. Enter one above.";
+                    }
+                    else if (blockedByRemoteUrlPolicy)
+                    {
+                        connectionToggleButton.tooltip = remoteUrlError ?? "HTTP Remote URL is blocked by current security settings.";
+                    }
+                    else if (blockedByLocalUrlPolicy)
+                    {
+                        connectionToggleButton.tooltip = localUrlError ?? "HTTP Local URL is blocked by current security settings.";
+                    }
+                    else
+                    {
+                        connectionToggleButton.tooltip = string.Empty;
+                    }
                 }
 
                 unityPortField.SetEnabled(!isStdioResuming);
@@ -425,7 +451,7 @@ public void UpdateHttpServerCommandDisplay()
 
             bool useHttp = transportDropdown != null && (TransportProtocol)transportDropdown.value != TransportProtocol.Stdio;
             bool httpLocalSelected = IsHttpLocalSelected();
-            bool isLocalHttpUrl = MCPServiceLocator.Server.IsLocalUrl();
+            bool isLocalHttpUrlAllowed = TryGetLocalHttpLaunchPolicy(out _, out string localUrlError);
 
             // Only show the local-server helper UI when HTTP Local is selected.
             if (!useHttp || !httpLocalSelected)
@@ -447,7 +473,7 @@ public void UpdateHttpServerCommandDisplay()
 
             httpServerCommandSection.style.display = DisplayStyle.Flex;
 
-            if (!isLocalHttpUrl)
+            if (!isLocalHttpUrlAllowed)
             {
                 httpServerCommandField.value = string.Empty;
                 httpServerCommandField.tooltip = string.Empty;
@@ -455,7 +481,8 @@ public void UpdateHttpServerCommandDisplay()
                 httpServerCommandSection.EnableInClassList("http-local-invalid-url", true);
                 if (httpServerCommandHint != null)
                 {
-                    httpServerCommandHint.text = "⚠ HTTP Local requires a localhost URL (localhost/127.0.0.1/0.0.0.0/::1).";
+                    string requirements = HttpEndpointUtility.GetHttpLocalHostRequirementText();
+                    httpServerCommandHint.text = $"⚠ {localUrlError ?? $"HTTP Local requires a loopback URL ({requirements})."}";
                     httpServerCommandHint.AddToClassList("http-local-url-error");
                 }
                 copyHttpServerCommandButton?.SetEnabled(false);
@@ -521,6 +548,12 @@ private bool IsHttpLocalSelected()
             return transportDropdown != null && (TransportProtocol)transportDropdown.value == TransportProtocol.HTTPLocal;
         }
 
+        private bool TryGetLocalHttpLaunchPolicy(out string localBaseUrl, out string localUrlError)
+        {
+            localBaseUrl = HttpEndpointUtility.GetLocalBaseUrl();
+            return HttpEndpointUtility.IsHttpLocalUrlAllowedForLaunch(localBaseUrl, out localUrlError);
+        }
+
         private void SyncUrlFieldToScope()
         {
             if (httpUrlField == null) return;
@@ -542,7 +575,8 @@ private void UpdateStartHttpButtonState()
             }
 
             bool httpLocalSelected = IsHttpLocalSelected();
-            bool canStartLocalServer = httpLocalSelected && MCPServiceLocator.Server.IsLocalUrl();
+            bool localUrlAllowedForLaunch = TryGetLocalHttpLaunchPolicy(out _, out string localUrlError);
+            bool canStartLocalServer = httpLocalSelected && localUrlAllowedForLaunch;
             bool localServerRunning = false;
 
             // Avoid running expensive port/PID checks every UI tick; use a fast socket probe for UI state.
@@ -567,7 +601,9 @@ private void UpdateStartHttpButtonState()
             startHttpServerButton.SetEnabled(
                 !httpServerToggleInProgress && (shouldShowStop || canStartLocalServer));
             startHttpServerButton.tooltip = httpLocalSelected
-                ? (canStartLocalServer ? string.Empty : "HTTP Local requires a localhost URL (localhost/127.0.0.1/0.0.0.0/::1).")
+                ? (canStartLocalServer
+                    ? string.Empty
+                    : localUrlError ?? $"HTTP Local requires a loopback URL ({HttpEndpointUtility.GetHttpLocalHostRequirementText()}).")
                 : string.Empty;
         }
 
@@ -611,6 +647,14 @@ private async void OnHttpServerToggleClicked()
                     // Start Server: launch the local HTTP server.
                     // When WE start the server, auto-start our session (we clearly want to use it).
                     // This differs from detecting an already-running server, where we require manual session start.
+                    if (!TryGetLocalHttpLaunchPolicy(out _, out string localPolicyError))
+                    {
+                        string errorMsg = localPolicyError ?? "HTTP Local URL is blocked by current security settings.";
+                        EditorUtility.DisplayDialog("Cannot Start HTTP Server", errorMsg, "OK");
+                        McpLog.Warn($"Start server blocked by local URL security policy: {errorMsg}");
+                        return;
+                    }
+
                     bool serverStarted = MCPServiceLocator.Server.StartLocalHttpServer();
                     if (serverStarted)
                     {
@@ -745,6 +789,27 @@ private async void OnConnectionToggleClicked()
                 }
                 else
                 {
+                    bool httpRemoteSelected = transportDropdown != null
+                        && (TransportProtocol)transportDropdown.value == TransportProtocol.HTTPRemote;
+                    if (httpRemoteSelected
+                        && !HttpEndpointUtility.IsCurrentRemoteUrlAllowed(out string remotePolicyError))
+                    {
+                        string errorMsg = remotePolicyError ?? "HTTP Remote URL is blocked by current security settings.";
+                        EditorUtility.DisplayDialog("Connection Blocked", errorMsg, "OK");
+                        McpLog.Warn($"Connection blocked by remote URL security policy: {errorMsg}");
+                        return;
+                    }
+
+                    bool httpLocalSelected = IsHttpLocalSelected();
+                    if (httpLocalSelected
+                        && !TryGetLocalHttpLaunchPolicy(out _, out string localPolicyError))
+                    {
+                        string errorMsg = localPolicyError ?? "HTTP Local URL is blocked by current security settings.";
+                        EditorUtility.DisplayDialog("Connection Blocked", errorMsg, "OK");
+                        McpLog.Warn($"Connection blocked by local URL security policy: {errorMsg}");
+                        return;
+                    }
+
                     bool started = await bridgeService.StartAsync();
                     if (started)
                     {
diff --git a/MCPForUnity/Editor/Windows/EditorPrefs/EditorPrefsWindow.cs b/MCPForUnity/Editor/Windows/EditorPrefs/EditorPrefsWindow.cs
index 17369bb1f..b683a21a5 100644
--- a/MCPForUnity/Editor/Windows/EditorPrefs/EditorPrefsWindow.cs
+++ b/MCPForUnity/Editor/Windows/EditorPrefs/EditorPrefsWindow.cs
@@ -43,6 +43,8 @@ public class EditorPrefsWindow : EditorWindow
             { EditorPrefKeys.TelemetryDisabled, EditorPrefType.Bool },
             { EditorPrefKeys.DevModeForceServerRefresh, EditorPrefType.Bool },
             { EditorPrefKeys.ProjectScopedToolsLocalHttp, EditorPrefType.Bool },
+            { EditorPrefKeys.AllowLanHttpBind, EditorPrefType.Bool },
+            { EditorPrefKeys.AllowInsecureRemoteHttp, EditorPrefType.Bool },
             
             // Integer prefs
             { EditorPrefKeys.UnitySocketPort, EditorPrefType.Int },
diff --git a/MCPForUnity/Editor/Windows/MCPForUnityEditorWindow.cs b/MCPForUnity/Editor/Windows/MCPForUnityEditorWindow.cs
index 2e6f4bc52..c7a0e8355 100644
--- a/MCPForUnity/Editor/Windows/MCPForUnityEditorWindow.cs
+++ b/MCPForUnity/Editor/Windows/MCPForUnityEditorWindow.cs
@@ -258,16 +258,19 @@ public void CreateGUI()
                 advancedContainer.Add(advancedRoot);
                 advancedSection = new McpAdvancedSection(advancedRoot);
 
-                // Wire up events from Advanced section
-                advancedSection.OnGitUrlChanged += () =>
-                    clientConfigSection?.UpdateManualConfiguration();
-                advancedSection.OnHttpServerCommandUpdateRequested += () =>
-                    connectionSection?.UpdateHttpServerCommandDisplay();
-                advancedSection.OnTestConnectionRequested += async () =>
-                {
-                    if (connectionSection != null)
-                        await connectionSection.VerifyBridgeConnectionAsync();
-                };
+                // Wire up events from Advanced section
+                advancedSection.OnGitUrlChanged += () =>
+                    clientConfigSection?.UpdateManualConfiguration();
+                advancedSection.OnHttpServerCommandUpdateRequested += () =>
+                {
+                    connectionSection?.UpdateHttpServerCommandDisplay();
+                    connectionSection?.UpdateConnectionStatus();
+                };
+                advancedSection.OnTestConnectionRequested += async () =>
+                {
+                    if (connectionSection != null)
+                        await connectionSection.VerifyBridgeConnectionAsync();
+                };
                 // Wire up health status updates from Connection to Advanced
                 connectionSection?.SetHealthStatusUpdateCallback((isHealthy, statusText) =>
                     advancedSection?.UpdateHealthStatus(isHealthy, statusText));
diff --git a/README.md b/README.md
index 6a33bee89..4a56c7a06 100644
--- a/README.md
+++ b/README.md
@@ -202,6 +202,16 @@ See [README-DEV.md](docs/development/README-DEV.md) for development setup. For c
 Anonymous, privacy-focused telemetry (no code, no project names, no personal data). Opt out with `DISABLE_TELEMETRY=true`. See [TELEMETRY.md](docs/reference/TELEMETRY.md).
 </details>
 
+<details>
+<summary><strong>Security</strong></summary>
+
+Network defaults are intentionally fail-closed:
+* **HTTP Local** allows loopback-only hosts by default (`127.0.0.1`, `localhost`, `::1`).
+* Bind-all interfaces (`0.0.0.0`, `::`) require explicit opt-in in **Advanced Settings** via **Allow LAN Bind (HTTP Local)**.
+* **HTTP Remote** requires `https://` by default.
+* Plaintext `http://` for remote endpoints requires explicit opt-in via **Allow Insecure Remote HTTP**.
+</details>
+
 ---
 
 **License:** MIT — See [LICENSE](LICENSE) | **Need help?** [Discord](https://discord.gg/y4p8KfzrN4) | [Issues](https://github.com/CoplayDev/unity-mcp/issues)
diff --git a/TestProjects/UnityMCPTests/Assets/Tests/EditMode/Services/Characterization/ServerManagementServiceCharacterizationTests.cs b/TestProjects/UnityMCPTests/Assets/Tests/EditMode/Services/Characterization/ServerManagementServiceCharacterizationTests.cs
index 6fea180e8..0bdf20124 100644
--- a/TestProjects/UnityMCPTests/Assets/Tests/EditMode/Services/Characterization/ServerManagementServiceCharacterizationTests.cs
+++ b/TestProjects/UnityMCPTests/Assets/Tests/EditMode/Services/Characterization/ServerManagementServiceCharacterizationTests.cs
@@ -5,6 +5,7 @@
 using NUnit.Framework;
 using MCPForUnity.Editor.Services;
 using MCPForUnity.Editor.Constants;
+using MCPForUnity.Editor.Helpers;
 using UnityEditor;
 using UnityEngine;
 using UnityEngine.TestTools;
@@ -22,6 +23,10 @@ public class ServerManagementServiceCharacterizationTests
         private ServerManagementService _service;
         private bool _savedUseHttpTransport;
         private string _savedHttpUrl;
+        private string _savedHttpRemoteUrl;
+        private string _savedHttpTransportScope;
+        private bool _savedAllowLanHttpBind;
+        private bool _savedAllowInsecureRemoteHttp;
 
         [SetUp]
         public void SetUp()
@@ -30,6 +35,10 @@ public void SetUp()
             // Save current settings
             _savedUseHttpTransport = EditorPrefs.GetBool(EditorPrefKeys.UseHttpTransport, true);
             _savedHttpUrl = EditorPrefs.GetString(EditorPrefKeys.HttpBaseUrl, string.Empty);
+            _savedHttpRemoteUrl = EditorPrefs.GetString(EditorPrefKeys.HttpRemoteBaseUrl, string.Empty);
+            _savedHttpTransportScope = EditorPrefs.GetString(EditorPrefKeys.HttpTransportScope, string.Empty);
+            _savedAllowLanHttpBind = EditorPrefs.GetBool(EditorPrefKeys.AllowLanHttpBind, false);
+            _savedAllowInsecureRemoteHttp = EditorPrefs.GetBool(EditorPrefKeys.AllowInsecureRemoteHttp, false);
         }
 
         [TearDown]
@@ -45,6 +54,24 @@ public void TearDown()
             {
                 EditorPrefs.DeleteKey(EditorPrefKeys.HttpBaseUrl);
             }
+            if (!string.IsNullOrEmpty(_savedHttpRemoteUrl))
+            {
+                EditorPrefs.SetString(EditorPrefKeys.HttpRemoteBaseUrl, _savedHttpRemoteUrl);
+            }
+            else
+            {
+                EditorPrefs.DeleteKey(EditorPrefKeys.HttpRemoteBaseUrl);
+            }
+            if (!string.IsNullOrEmpty(_savedHttpTransportScope))
+            {
+                EditorPrefs.SetString(EditorPrefKeys.HttpTransportScope, _savedHttpTransportScope);
+            }
+            else
+            {
+                EditorPrefs.DeleteKey(EditorPrefKeys.HttpTransportScope);
+            }
+            EditorPrefs.SetBool(EditorPrefKeys.AllowLanHttpBind, _savedAllowLanHttpBind);
+            EditorPrefs.SetBool(EditorPrefKeys.AllowInsecureRemoteHttp, _savedAllowInsecureRemoteHttp);
             // Refresh cache to reflect restored values
             EditorConfigurationCache.Instance.Refresh();
         }
@@ -79,6 +106,20 @@ public void IsLocalUrl_127001_ReturnsTrue()
             Assert.IsTrue(result, "127.0.0.1 should be recognized as local URL");
         }
 
+        [Test]
+        public void IsLocalUrl_127002_ReturnsTrue()
+        {
+            // Arrange
+            EditorPrefs.SetString(EditorPrefKeys.HttpBaseUrl, "http://127.0.0.2:8080");
+            _service = new ServerManagementService();
+
+            // Act
+            bool result = _service.IsLocalUrl();
+
+            // Assert
+            Assert.IsTrue(result, "127.0.0.2 should be recognized as loopback local URL");
+        }
+
         [Test]
         public void IsLocalUrl_0000_ReturnsTrue()
         {
@@ -94,7 +135,7 @@ public void IsLocalUrl_0000_ReturnsTrue()
         }
 
         [Test]
-        public void IsLocalUrl_IPv6Loopback_ReturnsFalse_KnownLimitation()
+        public void IsLocalUrl_IPv6Loopback_ReturnsTrue()
         {
             // Arrange
             EditorPrefs.SetString(EditorPrefKeys.HttpBaseUrl, "http://[::1]:8080");
@@ -103,8 +144,22 @@ public void IsLocalUrl_IPv6Loopback_ReturnsFalse_KnownLimitation()
             // Act
             bool result = _service.IsLocalUrl();
 
-            // Assert - Known limitation: IPv6 loopback is not currently recognized as local
-            Assert.IsFalse(result, "::1 (IPv6 loopback) is not currently recognized as local (known limitation)");
+            // Assert
+            Assert.IsTrue(result, "::1 (IPv6 loopback) should be recognized as local URL");
+        }
+
+        [Test]
+        public void IsLocalUrl_IPv6LoopbackLongForm_ReturnsTrue()
+        {
+            // Arrange
+            EditorPrefs.SetString(EditorPrefKeys.HttpBaseUrl, "http://[0:0:0:0:0:0:0:1]:8080");
+            _service = new ServerManagementService();
+
+            // Act
+            bool result = _service.IsLocalUrl();
+
+            // Assert
+            Assert.IsTrue(result, "0:0:0:0:0:0:0:1 (IPv6 loopback long-form) should be recognized as local URL");
         }
 
         [Test]
@@ -188,6 +243,116 @@ public void CanStartLocalServer_HttpEnabledRemoteUrl_ReturnsFalse()
             Assert.IsFalse(result, "Cannot start local server when URL is remote");
         }
 
+        [Test]
+        public void CanStartLocalServer_HttpEnabledZeroBind_DisallowedByDefault_ReturnsFalse()
+        {
+            // Arrange
+            EditorPrefs.SetBool(EditorPrefKeys.UseHttpTransport, true);
+            EditorPrefs.SetBool(EditorPrefKeys.AllowLanHttpBind, false);
+            EditorPrefs.SetString(EditorPrefKeys.HttpBaseUrl, "http://0.0.0.0:8080");
+            EditorConfigurationCache.Instance.Refresh();
+            _service = new ServerManagementService();
+
+            // Act
+            bool result = _service.CanStartLocalServer();
+
+            // Assert
+            Assert.IsFalse(result, "Cannot start local server on 0.0.0.0 unless LAN bind opt-in is enabled");
+        }
+
+        [Test]
+        public void CanStartLocalServer_HttpEnabledZeroBind_WithOptIn_ReturnsTrue()
+        {
+            // Arrange
+            EditorPrefs.SetBool(EditorPrefKeys.UseHttpTransport, true);
+            EditorPrefs.SetBool(EditorPrefKeys.AllowLanHttpBind, true);
+            EditorPrefs.SetString(EditorPrefKeys.HttpBaseUrl, "http://0.0.0.0:8080");
+            EditorConfigurationCache.Instance.Refresh();
+            _service = new ServerManagementService();
+
+            // Act
+            bool result = _service.CanStartLocalServer();
+
+            // Assert
+            Assert.IsTrue(result, "Can start local server on 0.0.0.0 when LAN bind opt-in is enabled");
+        }
+
+        #endregion
+
+        #region HttpEndpointUtility Security Policy Tests
+
+        [Test]
+        public void SaveRemoteBaseUrl_WithoutScheme_DefaultsToHttps()
+        {
+            // Arrange
+            EditorConfigurationCache.Instance.SetHttpTransportScope("remote");
+
+            // Act
+            HttpEndpointUtility.SaveRemoteBaseUrl("example.com:9000");
+            string normalized = HttpEndpointUtility.GetRemoteBaseUrl();
+
+            // Assert
+            Assert.AreEqual("https://example.com:9000", normalized);
+        }
+
+        [Test]
+        public void IsRemoteUrlAllowed_Http_DisallowedByDefault()
+        {
+            // Arrange
+            EditorPrefs.SetBool(EditorPrefKeys.AllowInsecureRemoteHttp, false);
+
+            // Act
+            bool allowed = HttpEndpointUtility.IsRemoteUrlAllowed("http://example.com:8080", out string error);
+
+            // Assert
+            Assert.IsFalse(allowed);
+            Assert.IsNotNull(error);
+            Assert.That(error, Does.Contain("HTTPS").IgnoreCase);
+        }
+
+        [Test]
+        public void IsRemoteUrlAllowed_Http_AllowedWithOptIn()
+        {
+            // Arrange
+            EditorPrefs.SetBool(EditorPrefKeys.AllowInsecureRemoteHttp, true);
+
+            // Act
+            bool allowed = HttpEndpointUtility.IsRemoteUrlAllowed("http://example.com:8080", out string error);
+
+            // Assert
+            Assert.IsTrue(allowed);
+            Assert.IsNull(error);
+        }
+
+        [Test]
+        public void IsHttpLocalUrlAllowedForLaunch_ZeroBind_DisallowedByDefault()
+        {
+            // Arrange
+            EditorPrefs.SetBool(EditorPrefKeys.AllowLanHttpBind, false);
+
+            // Act
+            bool allowed = HttpEndpointUtility.IsHttpLocalUrlAllowedForLaunch("http://0.0.0.0:8080", out string error);
+
+            // Assert
+            Assert.IsFalse(allowed);
+            Assert.IsNotNull(error);
+            Assert.That(error, Does.Contain("disabled by default").IgnoreCase);
+        }
+
+        [Test]
+        public void IsHttpLocalUrlAllowedForLaunch_ZeroBind_AllowedWithOptIn()
+        {
+            // Arrange
+            EditorPrefs.SetBool(EditorPrefKeys.AllowLanHttpBind, true);
+
+            // Act
+            bool allowed = HttpEndpointUtility.IsHttpLocalUrlAllowedForLaunch("http://0.0.0.0:8080", out string error);
+
+            // Assert
+            Assert.IsTrue(allowed);
+            Assert.IsNull(error);
+        }
+
         #endregion
 
         #region TryGetLocalHttpServerCommand Tests
@@ -480,7 +645,7 @@ public void IsLocalUrl_Static_MatchesPublicBehavior_ViaReflection()
             Assert.IsTrue((bool)method.Invoke(null, new object[] { "http://localhost:8080" }), "localhost should be local");
             Assert.IsTrue((bool)method.Invoke(null, new object[] { "http://127.0.0.1:8080" }), "127.0.0.1 should be local");
             Assert.IsTrue((bool)method.Invoke(null, new object[] { "http://0.0.0.0:8080" }), "0.0.0.0 should be local");
-            Assert.IsFalse((bool)method.Invoke(null, new object[] { "http://[::1]:8080" }), "::1 is not recognized as local (known limitation)");
+            Assert.IsTrue((bool)method.Invoke(null, new object[] { "http://[::1]:8080" }), "::1 should be recognized as local");
             Assert.IsFalse((bool)method.Invoke(null, new object[] { "http://example.com:8080" }), "example.com should not be local");
             Assert.IsFalse((bool)method.Invoke(null, new object[] { "" }), "empty string should not be local");
             Assert.IsFalse((bool)method.Invoke(null, new object[] { null }), "null should not be local");