Prior to v0.104.0, the desktop application would also open a network port so that it can offer access to ETAPI (REST API) or even use it as a web server (see Using the desktop application as a server).

In order to reduce the attack surface, Trilium now enables these services only for the local device (e.g. `localhost`) instead of serving them over the LAN.

To better understand what is affected, refer to the following table:

Feature | Network access OFF | Network access ON
--- | --- | ---
Web Clipper | 🔒️ `localhost` only (still accessible to the browser extension on the same device) | 🌐 `localhost` + LAN
ETAPI (REST API) | 🔒️ `localhost` only | 🌐 `localhost` + LAN
LLM MCP (only if enabled in settings) | 🔒️ `localhost` only (never LAN as a security measure) | 🔒️ `localhost` only (never LAN as a security measure)
Web app | ❌️ completely disabled (403), only the desktop app is usable. | 🌐 `localhost` + LAN
Sharing notes | ❌️ completely disabled (403), if you are using Synchronization this will still work as part of the server. | 🌐 `localhost` + LAN