Consul dev mode HTTP API listening on all interfaces

Operators running Consul in development mode often need to verify that the agent’s HTTP API and UI are not inadvertently reachable beyond the intended test host. The default behavior binds the API to 0.0.0.0:8500, which exposes the interface on every network interface unless explicitly overridden. Because development mode disables authentication and ACLs, any external host that can reach port 8500 can read or modify the Consul state, creating a security risk when the host has a public or shared IP address. Determining whether a running dev agent is safely limited to loopback requires checking the effective client_addr setting and observing the bound address in the agent’s output or logs.

What configuration option or command‑line flag can be used to alter the client_addr in dev mode to restrict the listener to 127.0.0.1? How can an operator confirm that the agent is bound only to the loopback interface after applying that setting? Are there automated checks that can flag a dev agent listening on 0.0.0.0 in staging or CI environments?