Add Forge Bandit source scan

.github/workflows/ci.yml

@@ -48,6 +48,10 @@ jobs:
           python -m pip install --upgrade "pip>=26.1"
           python -m pip install -e ".[dev]"
           python -m pip install pip-audit
+          python -m pip install bandit[toml]
 
       - name: Run pip-audit
         run: python -m pip_audit --progress-spinner off
+
+      - name: Run Bandit
+        run: python -m bandit -r forge_cli -q --severity-level medium

forge_cli/mcp_sse.py

@@ -22,7 +22,8 @@
 def main() -> None:
     serve_mcp_http(
         options_from_env(
-            default_host="0.0.0.0",
+            # Legacy private-network wrapper; see module docstring.
+            default_host="0.0.0.0",  # nosec B104
             default_port=8765,
             allow_remote=True,
             disable_dns_rebinding_protection=True,

tests/test_ci_workflow.py

@@ -18,6 +18,8 @@ def test_ci_workflow_has_dependency_security_gate() -> None:
     assert 'python -m pip install --upgrade "pip>=26.1"' in workflow
     assert "python -m pip install pip-audit" in workflow
     assert "python -m pip_audit --progress-spinner off" in workflow
+    assert "python -m pip install bandit[toml]" in workflow
+    assert "python -m bandit -r forge_cli -q --severity-level medium" in workflow
 
 
 def test_github_actions_are_pinned_to_commit_shas() -> None: