Can Mercurial be configured to bind hg serve to localhost by default?

Answer

No – Mercurial does not provide a configuration option (e.g., in [web] of hgrc) that changes the default bind address for hg serve. The server always binds to 0.0.0.0:8000 unless you explicitly give -a/--address (or --port) on the command line.

Why the default stays unchanged

The built‑in web server is designed as a quick, ad‑hoc sharing tool. Keeping the permissive 0.0.0.0 bind lets users share a repository on a LAN without extra flags. Changing the default to localhost‑only would break that common workflow, so the upstream project has left the address as an explicit flag.

Practical ways to make hg serve listen on localhost only

1. Shell alias (works in Bash, Zsh, fish, etc.):
   alias hgserve='hg serve -a 127.0.0.1'
2. Wrapper script (place somewhere in $PATH):
   

   #!/usr/bin/env sh
   hg serve -a 127.0.0.1 "$@"
   

3. Mercurial alias (limited): you can add [alias] in hgrc but it cannot override the built‑in serve command name; it only creates a new subcommand (e.g., hg localserve). Therefore a shell‑level alias or wrapper is the reliable method.

Verification

After starting the server with your alias or wrapper, check what address it is bound to:

# start the server (alias or wrapper)
hgserve &   # or ./hgserve-wrapper &
# find the PID and ports
ss -tlnp | grep :8000
# or netstat -tlnp | grep :8000

You should see a line showing 127.0.0.1:8000 (or [::1]:8000) and not 0.0.0.0:8000. To confirm it is not reachable from another host, try curl http://<other‑host>:8000 from a different machine; the connection should be refused or time‑out.