diff --git a/agent/internal/httpapi/alarms.go b/agent/internal/httpapi/alarms.go
index 46486b8..8d772f5 100644
--- a/agent/internal/httpapi/alarms.go
+++ b/agent/internal/httpapi/alarms.go
@@ -41,7 +41,8 @@ func (s *Server) handleAlarmReport(w http.ResponseWriter, r *http.Request) {
 		errorJSON(w, http.StatusMethodNotAllowed, "method not allowed")
 		return
 	}
-	if !s.authorize(r, true) {
+	// Allow localhost requests without token (media-server alarm callback)
+	if !isLocalhost(r) && !s.authorize(r, true) {
 		errorJSON(w, http.StatusUnauthorized, "unauthorized")
 		return
 	}
@@ -181,3 +182,8 @@ func randomHex(n int) string {
 	rand.Read(b)
 	return hex.EncodeToString(b)[:n]
 }
+
+func isLocalhost(r *http.Request) bool {
+	ip := remoteIP(r)
+	return ip == "127.0.0.1" || ip == "::1" || ip == "localhost"
+}
diff --git a/agent/rk3588-agent_linux_arm64 b/agent/rk3588-agent_linux_arm64
index 872d184..8cae8c7 100755
Binary files a/agent/rk3588-agent_linux_arm64 and b/agent/rk3588-agent_linux_arm64 differ