IsValidRemoteURL only blocks literal localhost/127.0.0.1 — misses [::1], 127.0.0.0/8, 0.0.0.0, and private/link-local addresses

Open Beginner friendly
#1,465 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
go
Domain
security

Research direction

Start in internal/validators/utils.go at IsValidRemoteURL and inspect the auth domain-verification dialer and validateRealmURL for existing address checks. Verify handling for loopback, unspecified, private, link-local, and IPv4-mapped addresses, then confirm that the listed local and internal URLs are rejected while existing public URLs remain valid.

Written by the indexing model from the issue text.

Description

IsValidRemoteURL (internal/validators/utils.go) is meant to reject remote URLs pointing at local/internal hosts ("stricter than packages - no localhost allowed"). The current host check is:

hostname := u.Hostname()
if hostname == "localhost" || hostname == "127.0.0.1" || strings.HasSuffix(hostname, ".localhost") {
return false
}
Because it compares string literals, it only catches localhost, 127.0.0.1, and *.localhost. These all currently pass validation:

IPv6 loopback: https://[::1]/
Rest of 127.0.0.0/8: https://127.0.0.2/
Unspecified: https://0.0.0.0/, https://[::]/
IPv4-mapped loopback: https://[::ffff:127.0.0.1]/
RFC1918 / link-local: https://10.0.0.1/, https://192.168.1.1/, https://169.254.169.254/
So a published server entry can register a remote URL pointing at loopback/internal addresses despite the intended restriction. This is also inconsistent with the codebase's own handling elsewhere (the auth domain-verification dialer already blocks these ranges, and validateRealmURL blocks 0.0.0.0/::).

Happy to send a PR that resolves the host with net.ParseIP and rejects loopback/unspecified/private/link-local addresses.

Dominant language
Go
Stars
7.3k
Forks
994
Avg merge
4d 12h
Merged PRs (30d)
19

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/registry

All issues in modelcontextprotocol/registry

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.