fix(fetch): block SSRF to internal/metadata IPs by default

[olaservo]

Description

Adds SSRF protection to the fetch server. The fetch tool previously issued a server-side request to any caller-supplied URL with no validation of the destination host, and followed redirects without re-checking the target. Because the URL argument is model-produced and can be steered by untrusted content (indirect prompt injection from a fetched page), this could be used to reach loopback, private (RFC1918), link-local, and cloud-metadata endpoints (e.g. 169.254.169.254) and return their contents — including IMDS credentials — into the model context.

This change resolves the destination host and rejects non-public IP addresses, restricts schemes to http/https, and re-validates the destination on every redirect hop.

Server Details

• Server: fetch (Python, mcp-server-fetch)
• Changes to: tools (request handling / URL validation)

Motivation and Context

The fetch server accepts an arbitrary URL and performs a server-side GET. There was no allowlist/denylist for scheme, host, or IP range; no blocking of loopback / private / link-local / cloud-metadata addresses; and redirects were followed with follow_redirects=True without re-validating the target, so a public-looking URL that 302-redirects to an internal address bypassed any initial-host defense. The robots.txt pre-check used the same unguarded client.

What this PR does:

• Adds _validate_url_is_safe(): resolves the host (handling IP literals and DNS names, including IPv4-mapped IPv6) and rejects loopback, private, link-local (incl. metadata), multicast, reserved, and unspecified addresses. Restricts schemes to http/https.
• Follows redirects manually (_get_following_redirects) so each hop is re-validated. Applied to both the fetch path and the robots.txt pre-check.
• Blocking is on by default. A new --allow-internal-ips flag (threaded through serve() and the CLI) restores the previous behavior for operators who deliberately need to fetch internal hosts.

How Has This Been Tested?

• New unit tests cover blocked ranges (loopback, 169.254.169.254, RFC1918, 0.0.0.0, IPv6 loopback, IPv4-mapped IPv6), non-http schemes, a public IP literal (allowed), end-to-end rejection through fetch_url, and the --allow-internal-ips bypass.
• Existing tests updated to stay hermetic (host validation stubbed where the HTTP client is already mocked).
• uv run pytest (30 passed), uv run ruff check ., and uv run pyright (0 errors) all pass locally.
• Behavior exercised via the tool path with internal/metadata targets (blocked) and public URLs (allowed).

Breaking Changes

Yes — by default the server now refuses to fetch loopback/private/link-local/metadata addresses. Deployments that intentionally fetch internal hosts (e.g. localhost) must add --allow-internal-ips. This is called out in the README (CAUTION note + new "Customization - Internal IPs" section).

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Protocol Documentation
• My changes follows MCP security best practices
• I have updated the server's README accordingly
• I have tested this with an LLM client
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have documented all environment variables and configuration options

Additional context

Design note: the fetch server's README previously documented internal-IP access as an accepted risk. This PR flips the default to secure-by-default (block, with explicit opt-in) rather than opt-in hardening, since the most severe case (reading cloud instance-metadata / IAM credentials) warrants a safe default. DNS re-resolution between validation and connection leaves a narrow DNS-rebinding window; pinning the connection to the validated IP could be layered on later.

🤖 Generated with Claude Code

Prior art

This isn't the first attempt to harden fetch against SSRF — credit to earlier independent efforts on the same issue:

• fetch: harden against SSRF (private/loopback/metadata block, scheme block, redirect revalidation) #4205 (Jaeyoung Yun) — closed; a very similar approach: resolve the host and block if any resolved IP is loopback/link-local/RFC1918, http/https scheme lock, manual per-hop redirect re-validation, and an opt-in flag (--allow-private-networks).
• feat(fetch): add SSRF protection and comprehensive security test suite #3180 (@Tomo1912) — open; SSRF protection with private/IPv6 IP blocking and env-var configuration.

This PR was developed independently but lands on a similar design, defaulting to secure-by-default with an --allow-internal-ips opt-in.

[Copilot]

Pull request overview

This PR hardens the mcp-server-fetch MCP server against SSRF by validating URL schemes, resolving and blocking non-public destination IPs, and re-validating destinations on each redirect hop, with an opt-out flag for operators.

Changes:

• Added SSRF guard that blocks loopback/private/link-local/metadata and other non-public IP ranges by default (http/https only).
• Replaced automatic redirect following with manual redirect handling to re-validate each hop.
• Added CLI/server flag --allow-internal-ips to explicitly disable SSRF protection, plus documentation and test updates.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/fetch/src/mcp_server_fetch/server.py	Implements IP-based SSRF validation and manual redirect following with per-hop validation and an allowlist bypass flag.
src/fetch/tests/test_server.py	Stubs SSRF validation for existing hermetic tests and adds new SSRF guard unit tests.
src/fetch/src/mcp_server_fetch/init.py	Adds --allow-internal-ips CLI flag and threads it into serve().
src/fetch/README.md	Updates security warning and documents internal-IP opt-in configuration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/fetch/src/mcp_server_fetch/server.py:156

• Similarly, failing closed when getaddrinfo() returns only unparsable addresses should be reported as INVALID_PARAMS rather than INTERNAL_ERROR, since it’s still an invalid/unsupported destination supplied by the caller.

    # Fail closed: if resolution produced no address we could parse and
    # classify, refuse rather than fall through to an empty (allow-all) check.
    if not ips:
        raise McpError(ErrorData(
            code=INTERNAL_ERROR,
            message=f"Failed to resolve host {host} to a usable IP address.",
        ))

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

src/fetch/src/mcp_server_fetch/server.py:126

• On supported Python 3.10–3.12 runtimes, ipaddress.is_private has known false negatives for special-purpose, non-global ranges. For example, 192.0.0.8 is outside the older 192.0.0.0/29 table, and none of the other predicates here block it, so this guard permits a non-public destination despite the documented policy. Please backport the corrected special-purpose ranges (including the .9/.10 global exceptions) into explicit constants and add a regression test rather than relying on the runtime's version-dependent classification.

        or ip.is_private

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

src/fetch/src/mcp_server_fetch/server.py:203

• Malformed user or redirect URLs can raise ValueError here instead of McpError: urlparse rejects malformed IPv6 authorities, and parsed.port rejects non-numeric or out-of-range ports. These exceptions are not caught by fetch_url, and the prompt path passes an unvalidated string, so one malformed URL escapes the MCP error handling. Parse the URL and extract its port inside a ValueError handler that reports INVALID_PARAMS.

    parsed = urlparse(url)

src/fetch/src/mcp_server_fetch/server.py:272

• The robots.txt path is also security-sensitive, but every existing robots test disables _validate_url_is_safe via the new autouse fixture, and the added redirect test covers only fetch_url. Add a robots-path regression test showing that an internal robots URL (and preferably a public robots URL redirecting internally) is rejected before the client requests the blocked hop.

            response = await _get_following_redirects(

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/fetch/src/mcp_server_fetch/server.py:276

• URL.join() can raise httpx.InvalidURL when a server returns a malformed Location header. InvalidURL is not an HTTPError, so the callers' existing except HTTPError blocks do not catch it; a remote response can therefore escape the tool as an unhandled exception. Mirror HTTPX's automatic redirect handling by catching InvalidURL here and converting it to a handled McpError (or RemoteProtocolError).

        current_url = str(URL(current_url).join(location))

src/fetch/src/mcp_server_fetch/server.py:221

• urlparse() and access to hostname/port can raise ValueError for malformed authorities (for example, an unmatched IPv6 bracket or a non-numeric port). That exception is not caught by fetch_url or the prompt handler, so a malformed direct URL or redirect target escapes as an unhandled server error instead of INVALID_PARAMS. Parse these components together and convert parser failures to McpError.

This issue also appears on line 276 of the same file.

    parsed = urlparse(url)