Is the MAVLink WebSocket on TCP/56781 intended to be remotely writable?

I found that Mission Planner starts a WebSocket server on TCP port 56781 using non-loopback network interfaces. One of the exposed endpoints is "/websocket/raw". The endpoint does not require authentication, and data received is written directly to Mission Planner's active vehicle connection.

I was able to connect to this endpoint from another host on the network and send a MAVLink command to a connected ArduCopter SITL instance. For example, I was able to change the disarmed vehicle from STABILIZE to ALT_HOLD.

My main question is whether remote write access to "/websocket/raw" is intended. Looking at the code, it seems to hint towards an intention for read only and localhost only. The surrounding Mission Planner/ArduPilot usage I found appears to treat port 56781 as a localhost integration interface. However, I do not have clear proof for that.

Start by reviewing the code that creates the WebSocket server on TCP/56781 and handles /websocket/raw, then trace how received data reaches the active vehicle connection. Confirm whether remote unauthenticated writes are intended; done requires a documented decision and, if behavior changes, coverage for network exposure and write access.

Written by the indexing model from the issue text.