`mcp-server-fetch` follows redirects with no private-IP / metadata SSRF guard |

[tiagovilasboas]

Static review of public source at commit f46d9578190b. No traffic was sent to any MCP environment.

The Fetch MCP server retrieves arbitrary URLs with redirects enabled and no private/link-local/metadata IP checks:

src/fetch/src/mcp_server_fetch/server.py:

async with AsyncClient(proxy=proxy_url) as client:
    response = await client.get(
        url,
        follow_redirects=True,
        headers={"User-Agent": user_agent},
        timeout=30,
    )

The README already documents the risk (This server can access local/internal IP addresses…). Robots.txt handling is present; SSRF egress control is not. A model-controlled url (or a redirect hop) can therefore reach loopback, RFC1918, link-local, or cloud metadata endpoints from the host that runs the server.

Suggested change (defense-in-depth, opt-out for demos):

• Resolve hostname → IP(s) before connect; block private/special-purpose ranges and known metadata addresses by default (revalidate on each redirect hop).
• Add --allow-private-ips / env escape hatch and document it next to the existing CAUTION.
• Prefer the same posture pydantic-ai’s safe_download / similar libraries use (block-by-default, explicit allow_local).

Severity: medium as insecure default for an agent-facing fetch tool; README already discloses the class of risk. Not filed as a novel CVE claim. No proof-of-concept.

Happy to send a focused PR if useful.

[yinnho]

Implementation data point — we ended up building exactly this fence for the fetch/download tools of our MCP browser (aginxbrowser, Rust with reqwest underneath), and the detail that mattered most was where the check lives.

A resolve-then-connect pre-check (per the sketch above) still leaves a small TOCTOU: the classic rebinding trick hands the pre-check a public A record and the actual dial a private one. We put the check inside a custom Resolve impl handed to the client via dns_resolver(...), so the filter runs on the exact address list the dialer is about to use. That closes the rebinding window, and as a side effect redirect hops need no separate bookkeeping — every dial, first or fifth, passes the same gate. We still keep a cheap URL-level pre-check per hop (scheme allow-list, literal IP ranges, localhost spellings) so the common cases fail before any DNS happens.

Two ranges worth adding to the deny set that a first pass tends to miss: 100.64.0.0/10 CGNAT — Alibaba's metadata endpoint (100.100.200.x family) lives there, not in 169.254-land — and 0.0.0.0, which the OS happily routes to localhost. We also fail closed when any record of a multi-record answer is forbidden (mixed A-sets are where the bypass usually hides), and made the opt-out a host-side env/flag rather than a request parameter — the model calling the tool shouldn't be able to open the gate it's being fenced from. Only friction so far: local smoke tests need the env once at startup.

Happy to share the resolver shape if a PR lands here.