Open-sourcing an MCP fetch server with bulletproof SSRF defense
Alarmed_Offer_3213 · reddit · 2026-08-12
Noting that existing MCP fetch servers lack robust SSRF (Server-Side Request Forgery) defenses, a developer has released safe-fetch-mcp-server. The project focuses entirely on secure fetching with the following core mechanisms:
- IP Validation & Pinning: Instead of failure-prone string checks, it validates the resolved IP against explicit ranges and pins the connection to that exact IP, completely closing DNS rebinding holes.
- Cloud Metadata Blocking: Unconditionally blocks access to cloud metadata endpoints (169.254.169.254) to prevent instance credential leakage.
The author also shared production debugging insights: despite 62 mocked tests passing, real HTTPS requests crashed due to Node.js's Happy Eyeballs mechanism. The project ultimately passed an independent 276-rule security scanner with only 2 low-severity findings.
More from coding & agent
- Discussion: What Actually Broke When You Ran AI Agents in Production? — Diegokernel · 2026-08-12
- Dev Humor: Vibe-Coded GPU Temp Monitor Feels Like Forgetting to Close the Garage — generativist · 2026-08-12
- Testing 4 Hosted Memory Tools: Top Tool Boosts Claude Code Agent Accuracy by 43% — Major-Shirt-8227 · 2026-08-12
- Running a Food Company on AI Agents: The Real Risk is Write Access — Positive-Emu-8379 · 2026-08-12
- AI Code-Testing Startup Blacksmith Raises $45M Series B, Valuation Jumps 10x to $550M — ycombinator · 2026-08-12
- Detecting Agent Skill Read-to-Mutate Changes via Behavioral Contracts — VLombar · 2026-08-12