diff --git a/server/age-os/ecosystem.config.js b/server/age-os/ecosystem.config.js
index e693a908..03a98d87 100644
--- a/server/age-os/ecosystem.config.js
+++ b/server/age-os/ecosystem.config.js
@@ -18,8 +18,10 @@ function loadEnvFile(envPath) {
         env[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);
       }
     }
-  } catch {
-    // .env.mcp 不存在时使用默认值
+  } catch (err) {
+    if (err.code !== 'ENOENT') {
+      console.error(`[PM2] .env.mcp 读取错误: ${err.message}`);
+    }
   }
   return env;
 }
diff --git a/server/age-os/mcp-server/cos.js b/server/age-os/mcp-server/cos.js
index 0b5972cd..0dd51990 100644
--- a/server/age-os/mcp-server/cos.js
+++ b/server/age-os/mcp-server/cos.js
@@ -75,6 +75,10 @@ function validatePersonaCosPath(personaId, key) {
   if (!personaId || typeof personaId !== 'string') {
     throw new Error('persona_id 不能为空');
   }
+  // 验证 persona_id 仅包含安全字符（字母、数字、下划线、连字符）
+  if (!/^[a-zA-Z0-9_-]+$/.test(personaId)) {
+    throw new Error('persona_id 包含非法字符，仅允许字母、数字、下划线、连字符');
+  }
   // 规范化：确保路径以 persona_id/ 开头
   const normalizedKey = key.startsWith('/') ? key.slice(1) : key;
   if (!normalizedKey.startsWith(`${personaId}/`)) {
diff --git a/server/age-os/mcp-server/server.js b/server/age-os/mcp-server/server.js
index bf7a071a..eb56f9ba 100644
--- a/server/age-os/mcp-server/server.js
+++ b/server/age-os/mcp-server/server.js
@@ -457,9 +457,9 @@ async function logToolCall(tool, caller, status, durationMs, errorMsg) {
 }
 
 // ─── 启动 ───
-// 监听 0.0.0.0 允许 Nginx 从外部反代访问
-// 鉴权由 apiKeyAuth 中间件保护
-const BIND_HOST = process.env.MCP_BIND_HOST || '0.0.0.0';
+// 默认监听 127.0.0.1（安全默认值）
+// Nginx 从本机反代访问，无需暴露到外部网络
+const BIND_HOST = process.env.MCP_BIND_HOST || '127.0.0.1';
 app.listen(PORT, BIND_HOST, () => {
   console.log(`[MCP] AGE OS MCP Server 启动 · ${BIND_HOST}:${PORT}`);
   console.log(`[MCP] 工具数量: ${Object.keys(TOOLS).length}`);