fix(fetch): block SSRF to internal/metadata IPs by default - #4497

Open

olaservo wants to merge 7 commits into

modelcontextprotocol:mainfrom

olaservo:fix/fetch-ssrf-guard

Commits on Jul 8, 2026

fix(fetch): block SSRF to internal/metadata IPs by default

olaservo
and
claude
committed
41f8a3a

Commits on Jul 10, 2026

fix(fetch): block carrier-grade NAT and IPv4-compatible IPv6 SSRF targets

olaservo
and
claude
committed
0e8f64c

Commits on Jul 14, 2026

fix(fetch): fail closed on unresolvable hosts; strip IPv6 zone ids

olaservo
and
claude
committed
afb9720

Commits on Jul 20, 2026

fix(fetch): keep scheme lock under --allow-internal-ips; INVALID_PARAMS

olaservo
and
claude
committed
07b2917

Commits on Aug 10, 2026

fix(fetch): block 6to4 and site-local IPv6 in the SSRF guard

olaservo
and
claude
committed
c41635a

Commits on Aug 13, 2026

Merge branch 'main' into fix/fetch-ssrf-guard
olaservo
authored
6710e7f
fix(fetch): warn that the SSRF guard cannot enforce through a proxy

olaservo
and
claude
committed
29cc021