MCP client does not validate server URLs against SSRF

[Carlys17]

Summary

MCP SSE and Streamable HTTP transports (src/agentos/mcp/sse.py, src/agentos/mcp/streamable_http.py) connect to MCPServerConfig.url via httpx with no SSRF validation. Every other URL-fetching path (web_fetch, http_request, skill-hub) calls validate_http_url_for_fetch() before connecting — the MCP transport skips this entirely.

Impact

Cloud metadata endpoints (169.254.169.254), private ranges, and unsupported schemes are reachable through MCP server config. An attacker who controls or injects the MCP server URL can exfiltrate instance credentials or redirect agent traffic to internal hosts.

Suggested fix

Call validate_http_url_for_fetch(self.config.url) in both MCPSSEClient.connect() and StreamableHttpTransport.connect() before creating the httpx client. This is the same guard used by web_fetch and http_request.

Suggested labels: type: security, type: bug, area: mcp

[andreapn]

Accepted — confirmed on main (5b740f3).

MCPSSEClient.connect() (src/agentos/mcp/sse.py:71-73) and StreamableHttpTransport.connect() (src/agentos/mcp/streamable_http.py:145) build the httpx client from config.url with no validation at all. Every other outbound-URL path in the tree calls into agentos.tools.ssrf first (web_fetch.py:60, browser.py:204,259, media.py:287, skills/hub/deps.py:131, browser_eval_policy.py:179). MCP is the one gap.

Important correction to the suggested fix: do not call validate_http_url_for_fetch() here. That guard rejects loopback, private, link-local and reserved ranges (src/agentos/tools/ssrf.py:195-204), and http://localhost:PORT/mcp / LAN-hosted MCP servers are the normal, intended configuration. Using it would break the majority of real MCP setups.

The correct guard is assert_not_metadata_endpoint() — the same floor http_request uses for exactly this reason, documented at src/agentos/tools/ssrf.py:110-122: it blocks the instance-credential endpoints (169.254.169.254 and friends) while leaving private addresses reachable. Add a scheme check (http/https only) alongside it.

Marked type: security / p2 / ready. PRs #663 and #667 will be reviewed against the assert_not_metadata_endpoint approach, not the one in the issue body.