Prior to v0.104.0, the desktop application would also open a network port so that it can offer access to ETAPI (REST API) or even use it as a web server (see Using the desktop application as a server).
In order to reduce the attack surface, Trilium now enables these services
only for the local device (e.g. localhost)
instead of serving them over the LAN.
To better understand what is affected, refer to the following table:
| Feature | Network access OFF | Network access ON |
|---|---|---|
| Web Clipper | 🔒️ localhost only (still accessible to
the browser extension on the same device) |
🌐 localhost + LAN |
| ETAPI (REST API) | 🔒️ localhost only |
🌐 localhost + LAN |
| LLM MCP (only if enabled in settings) | 🔒️ localhost only (never LAN as a security
measure) |
🔒️ localhost only (never LAN as a security
measure) |
| Web app | ❌️ completely disabled (403), only the desktop app is usable. | 🌐 localhost + LAN |
| Sharing notes | ❌️ completely disabled (403), if you are using Synchronization this will still work as part of the server. | 🌐 localhost + LAN |