improvement(mcp): negotiate HTTP/2 for MCP transport

MCP servers are commonly behind HTTP/2 fronts (CDNs, cloud LBs), but the
SSRF-pinned undici Agent is HTTP/1.1-only unless it opts into h2 via ALPN. Add
an allowH2 option to createPinnedFetch (default false, so LLM-provider callers
are unchanged) and centralize the MCP h2 decision in one createPinnedMcpFetch
routed through the transport, OAuth probe, and SSRF-guarded fetch. Pinning is
unaffected: the pinned lookup forces every connection to the resolved IP.

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.server.ts

@@ -433,9 +433,21 @@ export function createPinnedLookup(resolvedIP: string): LookupFunction {
  *
  * The `Agent` is captured for the lifetime of the returned function, so repeated
  * calls (e.g. a provider tool loop) reuse its keep-alive connections.
+ *
+ * `allowH2` opts the pinned Agent into HTTP/2 (ALPN-negotiated, h1.1 fallback).
+ * It defaults to `false` to leave existing consumers unchanged. Enabling it does
+ * not weaken pinning: the pinned `connect.lookup` forces every connection on the
+ * Agent to `resolvedIP` regardless of authority, so h2 connection coalescing can
+ * never reach an address other than the validated one.
  */
-export function createPinnedFetch(resolvedIP: string): typeof fetch {
-  const dispatcher = new Agent({ connect: { lookup: createPinnedLookup(resolvedIP) } })
+export function createPinnedFetch(
+  resolvedIP: string,
+  options?: { allowH2?: boolean }
+): typeof fetch {
+  const dispatcher = new Agent({
+    allowH2: options?.allowH2 ?? false,
+    connect: { lookup: createPinnedLookup(resolvedIP) },
+  })
 
   const pinned = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
     // double-cast-allowed: DOM RequestInfo/URL and undici fetch input types differ but are structurally compatible at runtime (Node's global fetch IS undici)

apps/sim/lib/core/security/pinned-fetch.server.test.ts

@@ -55,6 +55,18 @@ describe('createPinnedFetch', () => {
     expect(resolved).toEqual({ address: '203.0.113.10', family: 4 })
   })
 
+  it('defaults allowH2 to false so existing consumers are unchanged', () => {
+    createPinnedFetch('203.0.113.10')
+    const opts = capturedAgentOptions[0] as { allowH2?: boolean }
+    expect(opts.allowH2).toBe(false)
+  })
+
+  it('opts the Agent into HTTP/2 when allowH2 is requested', () => {
+    createPinnedFetch('203.0.113.10', { allowH2: true })
+    const opts = capturedAgentOptions[0] as { allowH2?: boolean }
+    expect(opts.allowH2).toBe(true)
+  })
+
   it('uses IPv6 family when the validated IP is IPv6', async () => {
     createPinnedFetch('2606:4700:4700::1111')
     const { connect } = capturedAgentOptions[0] as { connect: { lookup: PinnedLookup } }

apps/sim/lib/mcp/oauth/probe.test.ts

@@ -15,10 +15,8 @@ const { mockCreatePinnedFetch, mockCreateSsrfGuardedMcpFetch, mockPinnedFetch, m
     }
   })
 
-vi.mock('@/lib/core/security/input-validation.server', () => ({
-  createPinnedFetch: mockCreatePinnedFetch,
-}))
 vi.mock('@/lib/mcp/pinned-fetch', () => ({
+  createPinnedMcpFetch: mockCreatePinnedFetch,
   createSsrfGuardedMcpFetch: mockCreateSsrfGuardedMcpFetch,
 }))
 

apps/sim/lib/mcp/oauth/probe.ts

@@ -1,9 +1,8 @@
 import { extractWWWAuthenticateParams } from '@modelcontextprotocol/sdk/client/auth.js'
 import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { createLogger } from '@sim/logger'
-import { createPinnedFetch } from '@/lib/core/security/input-validation.server'
 import { isLoopbackHostname } from '@/lib/core/utils/urls'
-import { createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
+import { createPinnedMcpFetch, createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
 import type { McpAuthType } from '@/lib/mcp/types'
 
 const logger = createLogger('McpOauthProbe')
@@ -34,7 +33,7 @@ export async function detectMcpAuthType(
   }
 
   const probeFetch: FetchLike = resolvedIP
-    ? createPinnedFetch(resolvedIP)
+    ? createPinnedMcpFetch(resolvedIP)
     : createSsrfGuardedMcpFetch()
 
   const controller = new AbortController()

apps/sim/lib/mcp/pinned-fetch.test.ts

@@ -31,7 +31,7 @@ describe('createSsrfGuardedMcpFetch', () => {
     await fetchLike('https://attacker.example/revoke', { method: 'POST' })
 
     expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith('https://attacker.example/revoke')
-    expect(mockCreatePinnedFetch).toHaveBeenCalledWith('203.0.113.10')
+    expect(mockCreatePinnedFetch).toHaveBeenCalledWith('203.0.113.10', { allowH2: true })
     expect(sentinelFetch).toHaveBeenCalledWith('https://attacker.example/revoke', {
       method: 'POST',
     })
@@ -54,7 +54,7 @@ describe('createSsrfGuardedMcpFetch', () => {
     await fetchLike(new URL('https://attacker.example/discover'))
 
     expect(mockValidateMcpServerSsrf).toHaveBeenCalledWith('https://attacker.example/discover')
-    expect(mockCreatePinnedFetch).toHaveBeenCalledWith('203.0.113.10')
+    expect(mockCreatePinnedFetch).toHaveBeenCalledWith('203.0.113.10', { allowH2: true })
   })
 
   it('falls back to global fetch when validation returns no IP', async () => {

apps/sim/lib/mcp/pinned-fetch.ts

@@ -2,6 +2,18 @@ import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { createPinnedFetch } from '@/lib/core/security/input-validation.server'
 import { validateMcpServerSsrf } from '@/lib/mcp/domain-check'
 
+/**
+ * Pinned fetch for all MCP traffic. MCP servers are commonly deployed behind
+ * HTTP/2 fronts (CDNs, cloud LBs), and undici's Agent is h1.1-only unless opted
+ * into h2 via ALPN — so every MCP connection enables it. This is the single
+ * source of the "MCP implies h2" decision; the base `createPinnedFetch` keeps
+ * its h1.1 default for non-MCP consumers. Pinning is unaffected: the pinned
+ * lookup forces the socket to `resolvedIP` regardless of negotiated protocol.
+ */
+export function createPinnedMcpFetch(resolvedIP: string): typeof fetch {
+  return createPinnedFetch(resolvedIP, { allowH2: true })
+}
+
 /**
  * Builds a `FetchLike` that validates every outbound request URL against the
  * MCP SSRF policy before issuing it, then pins the connection to the resolved
@@ -25,7 +37,7 @@ export function createSsrfGuardedMcpFetch(): FetchLike {
   return (async (url, init) => {
     const target = typeof url === 'string' ? url : url.href
     const resolvedIP = await validateMcpServerSsrf(target)
-    const pinnedFetch: FetchLike = resolvedIP ? createPinnedFetch(resolvedIP) : globalThis.fetch
+    const pinnedFetch: FetchLike = resolvedIP ? createPinnedMcpFetch(resolvedIP) : globalThis.fetch
     return pinnedFetch(url, init)
   }) satisfies FetchLike
 }