fix(mcp): permit the pinned IP as a redirect target (initial + hops), block other private IPs

Consolidates the pinned-path redirect policy into one mechanism. followRedirectsGuarded
took validateInitialTarget to skip the initial private-IP check, but per-hop checks still
blocked a self-hosted MCP redirecting to its own pinned private IP (e.g. a trailing-slash
301 to http://10.0.0.5/mcp/). Replace it with allowRedirectToIp: the pinned fetch permits
exactly its own validated IP as a target — initial URL and any hop that stays on it — while
every OTHER private target (e.g. the 169.254.169.254 metadata IP) stays blocked. Tests cover
the same-IP hop (followed) and the metadata-IP escape (still refused).

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.server.ts

@@ -543,7 +543,7 @@ const MAX_GUARDED_REDIRECTS = 5
  * a 3xx to `http://169.254.169.254/` would otherwise connect directly. Hostname
  * targets are covered by {@link createSsrfGuardedLookup} at connect time.
  */
-function assertGuardedRedirectTarget(url: URL): void {
+function assertGuardedRedirectTarget(url: URL, allowedPinnedIp?: string): void {
   if (url.protocol !== 'http:' && url.protocol !== 'https:') {
     throw new Error(`Blocked by SSRF policy: redirect to unsupported protocol ${url.protocol}`)
   }
@@ -552,6 +552,16 @@ function assertGuardedRedirectTarget(url: URL): void {
       ? url.hostname.slice(1, -1)
       : url.hostname
   if (ipaddr.isValid(host) && isPrivateOrReservedIP(host)) {
+    // The pinned-private carve-out permits exactly its own validated IP as a target (a
+    // self-hosted MCP on a private IP, or a same-host redirect that stays on it) — but nothing
+    // else private (a redirect to e.g. the cloud metadata IP is still blocked).
+    if (
+      allowedPinnedIp &&
+      ipaddr.isValid(allowedPinnedIp) &&
+      ipaddr.process(host).toString() === ipaddr.process(allowedPinnedIp).toString()
+    ) {
+      return
+    }
     throw new Error('Blocked by SSRF policy: redirect to a private or reserved address')
   }
 }
@@ -568,15 +578,14 @@ export async function followRedirectsGuarded(
   rawFetch: (url: string, init: UndiciRequestInit) => Promise<Response>,
   input: string,
   init: UndiciRequestInit,
-  options?: { validateInitialTarget?: boolean }
+  options?: { allowRedirectToIp?: string }
 ): Promise<Response> {
   let currentUrl = new URL(input)
-  // The initial URL gets the same IP-literal check as redirect hops, so the exported
-  // guard is self-contained even when a caller skips its own up-front validation. The
-  // pinned-private MCP carve-out opts out (`validateInitialTarget: false`): its caller has
-  // already validated the URL and legitimately targets a private IP (a self-hosted server
-  // configured with an IP-literal URL). Redirect HOPS below are always validated regardless.
-  if (options?.validateInitialTarget !== false) assertGuardedRedirectTarget(currentUrl)
+  // The initial URL gets the same IP-literal check as redirect hops, so the exported guard is
+  // self-contained even when a caller skips its own up-front validation. `allowRedirectToIp`
+  // (the pinned-private MCP carve-out's validated IP) permits that one private target — both the
+  // initial URL and any hop that stays on it — while everything else private stays blocked.
+  assertGuardedRedirectTarget(currentUrl, options?.allowRedirectToIp)
   let method = (init.method ?? 'GET').toUpperCase()
   let body = init.body
   let headers = init.headers
@@ -604,7 +613,7 @@ export async function followRedirectsGuarded(
       throw new Error(`Blocked by SSRF policy: more than ${MAX_GUARDED_REDIRECTS} redirects`)
     }
     const nextUrl = new URL(location, currentUrl)
-    assertGuardedRedirectTarget(nextUrl)
+    assertGuardedRedirectTarget(nextUrl, options?.allowRedirectToIp)
     // Per the fetch spec: 303 (and 301/302 on POST) switch to a bodyless GET, dropping
     // the entity headers that described the removed body (a retained Content-Length /
     // Content-Type on a bodyless GET is malformed and undici rejects it).
@@ -1033,11 +1042,11 @@ export function createPinnedFetchWithDispatcher(
       }
       return response
     }
-    // The pinned fetch's caller has already validated the target (and the private carve-out
-    // legitimately pins to a private IP), so skip re-validating the initial URL — otherwise a
-    // self-hosted MCP configured with a private IP-literal URL would be blocked by its own
-    // transport. Redirect hops are still validated inside the follower.
-    return followRedirectsGuarded(rawFetch, target, undiciInit, { validateInitialTarget: false })
+    // Permit this pinned IP as a redirect/initial target even when it's private (the
+    // self-hosted MCP carve-out on a private/loopback IP, and same-host redirects that stay on
+    // it) — otherwise the guarded policy would block a self-hosted server reaching itself. Any
+    // OTHER private target (e.g. a redirect to the cloud metadata IP) is still blocked.
+    return followRedirectsGuarded(rawFetch, target, undiciInit, { allowRedirectToIp: resolvedIP })
   }
 
   return { fetch: pinned, dispatcher }

apps/sim/lib/core/security/pinned-fetch.server.test.ts

@@ -176,6 +176,34 @@ describe('createPinnedFetch', () => {
     expect(await response.text()).toBe('mcp')
   })
 
+  it('follows a redirect that stays on the pinned private IP (self-hosted MCP alias)', async () => {
+    mockUndiciRequest
+      .mockResolvedValueOnce(
+        undiciReply(301, { location: 'http://10.0.0.5:3000/mcp/' }, byteStream(''))
+      )
+      .mockResolvedValueOnce(undiciReply(200, {}, byteStream('mcp')))
+    const pinned = createPinnedFetch('10.0.0.5')
+
+    const response = await pinned('http://10.0.0.5:3000/mcp', { method: 'GET' })
+
+    expect(mockUndiciRequest).toHaveBeenCalledTimes(2)
+    expect(response.status).toBe(200)
+    expect(await response.text()).toBe('mcp')
+  })
+
+  it('STILL blocks a redirect to a different private IP (no metadata-IP escape)', async () => {
+    mockUndiciRequest.mockResolvedValueOnce(
+      undiciReply(302, { location: 'http://169.254.169.254/latest/meta-data/' }, byteStream(''))
+    )
+    const pinned = createPinnedFetch('10.0.0.5')
+
+    await expect(pinned('http://10.0.0.5:3000/mcp', { method: 'GET' })).rejects.toThrow(
+      /private or reserved/
+    )
+    // The initial request happened; the redirect to the metadata IP was refused.
+    expect(mockUndiciRequest).toHaveBeenCalledTimes(1)
+  })
+
   it('reuses one dispatcher across all calls of a single instance', async () => {
     const pinned = createPinnedFetch('203.0.113.10')
     await pinned('https://example.com/a')