fix(mcp): don't block private IP-literal URLs on the pinned fetch path

Routing the pinned fetch through followRedirectsGuarded added an initial
assertGuardedRedirectTarget check the old undici.fetch path never ran, which
would block a self-hosted MCP configured with a private IP-literal URL
(e.g. http://10.0.0.5:3000/mcp) — its own transport. The pinned path's callers
already validate the target and the private carve-out intentionally pins to a
private IP, so skip the initial-target check (validateInitialTarget: false) while
still validating every redirect hop. Adds a regression test.

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.server.ts

@@ -567,12 +567,16 @@ function assertGuardedRedirectTarget(url: URL): void {
 export async function followRedirectsGuarded(
   rawFetch: (url: string, init: UndiciRequestInit) => Promise<Response>,
   input: string,
-  init: UndiciRequestInit
+  init: UndiciRequestInit,
+  options?: { validateInitialTarget?: boolean }
 ): Promise<Response> {
   let currentUrl = new URL(input)
   // The initial URL gets the same IP-literal check as redirect hops, so the exported
-  // guard is self-contained even when a caller skips its own up-front validation.
-  assertGuardedRedirectTarget(currentUrl)
+  // guard is self-contained even when a caller skips its own up-front validation. The
+  // pinned-private MCP carve-out opts out (`validateInitialTarget: false`): its caller has
+  // already validated the URL and legitimately targets a private IP (a self-hosted server
+  // configured with an IP-literal URL). Redirect HOPS below are always validated regardless.
+  if (options?.validateInitialTarget !== false) assertGuardedRedirectTarget(currentUrl)
   let method = (init.method ?? 'GET').toUpperCase()
   let body = init.body
   let headers = init.headers
@@ -1026,7 +1030,11 @@ export function createPinnedFetchWithDispatcher(
       }
       return response
     }
-    return followRedirectsGuarded(rawFetch, target, undiciInit)
+    // The pinned fetch's caller has already validated the target (and the private carve-out
+    // legitimately pins to a private IP), so skip re-validating the initial URL — otherwise a
+    // self-hosted MCP configured with a private IP-literal URL would be blocked by its own
+    // transport. Redirect hops are still validated inside the follower.
+    return followRedirectsGuarded(rawFetch, target, undiciInit, { validateInitialTarget: false })
   }
 
   return { fetch: pinned, dispatcher }

apps/sim/lib/core/security/pinned-fetch.server.test.ts

@@ -151,6 +151,19 @@ describe('createPinnedFetch', () => {
     expect(await response.text()).toBe('done')
   })
 
+  it('does NOT block a private IP-literal URL (self-hosted-private MCP carve-out)', async () => {
+    mockUndiciRequest.mockResolvedValueOnce(undiciReply(200, {}, byteStream('mcp')))
+    const pinned = createPinnedFetch('10.0.0.5')
+
+    // A self-hosted MCP configured with a private IP-literal URL must still connect — the old
+    // undici.fetch path never ran the SSRF initial-target check that would otherwise block it.
+    const response = await pinned('http://10.0.0.5:3000/mcp', { method: 'POST', body: '{}' })
+
+    expect(mockUndiciRequest).toHaveBeenCalledTimes(1)
+    expect(response.status).toBe(200)
+    expect(await response.text()).toBe('mcp')
+  })
+
   it('reuses one dispatcher across all calls of a single instance', async () => {
     const pinned = createPinnedFetch('203.0.113.10')
     await pinned('https://example.com/a')