fix(mcp): keep self-hosted private-resolving hosts unguarded (old-pin parity)

A DNS alias resolving to loopback/private is only reachable on self-hosted,
where the policy explicitly permits it; the guarded lookup would filter the
address and strand the connect where the old pin connected. Both MCP gates
(transport + OAuth guard) now route private/loopback resolutions over the
unguarded path, same as the localhost carve-out. Test IPs moved off RFC-5737
TEST-NET (which is correctly classified reserved).

Author: waleedlatif1

apps/sim/lib/mcp/client.test.ts

@@ -276,7 +276,7 @@ describe('McpClient notification handler', () => {
     const client = new McpClient({
       config: createConfig(),
       securityPolicy: { requireConsent: false, auditLevel: 'basic' },
-      resolvedIP: '203.0.113.10',
+      resolvedIP: '93.184.216.34',
     })
 
     // A failed connect discards the client without a disconnect(), so the Agent
@@ -290,7 +290,7 @@ describe('McpClient notification handler', () => {
     const client = new McpClient({
       config: createConfig(),
       securityPolicy: { requireConsent: false, auditLevel: 'basic' },
-      resolvedIP: '203.0.113.10',
+      resolvedIP: '93.184.216.34',
     })
 
     await client.connect()
@@ -304,7 +304,7 @@ describe('McpClient notification handler', () => {
     const client = new McpClient({
       config: createConfig(),
       securityPolicy: { requireConsent: false, auditLevel: 'basic' },
-      resolvedIP: '203.0.113.10',
+      resolvedIP: '93.184.216.34',
     })
 
     await expect(client.connect()).rejects.toThrow()

apps/sim/lib/mcp/client.ts

@@ -11,6 +11,7 @@ import {
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
+import { isPrivateOrReservedIP } from '@/lib/core/security/input-validation.server'
 import { getMcpSafeErrorDiagnostics } from '@/lib/mcp/error-diagnostics'
 import { McpOauthRedirectRequired } from '@/lib/mcp/oauth'
 import { createGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
@@ -98,7 +99,11 @@ export class McpClient {
     const useOauth = this.config.authType === 'oauth'
     // `resolvedIP` non-null signals the SSRF policy is active for this server (it is null in
     // allowlist mode / localhost-on-self-hosted); the guard validates addresses per-connect.
-    const guarded = resolvedIP ? createGuardedMcpFetch() : undefined
+    // A private/loopback resolvedIP only reaches here on self-hosted (where the policy
+    // permits it) — the guarded lookup would filter it, so those connect unguarded like the
+    // localhost carve-out.
+    const guarded =
+      resolvedIP && !isPrivateOrReservedIP(resolvedIP) ? createGuardedMcpFetch() : undefined
     this.closeGuardedTransport = guarded?.close
     this.transport = new StreamableHTTPClientTransport(new URL(this.config.url), {
       authProvider: useOauth ? this.authProvider : undefined,

apps/sim/lib/mcp/oauth/revoke.test.ts

@@ -31,6 +31,8 @@ const {
 }))
 
 vi.mock('@/lib/core/security/input-validation.server', () => ({
+  isPrivateOrReservedIP: (ip: string) =>
+    ip.startsWith('127.') || ip.startsWith('10.') || ip === '::1',
   createSsrfGuardedFetchWithDispatcher: vi.fn(() => ({
     fetch: mockUndiciFetch,
     dispatcher: { destroy: vi.fn(() => Promise.resolve()) },

apps/sim/lib/mcp/pinned-fetch.test.ts

@@ -18,6 +18,8 @@ const {
 
 vi.mock('@/lib/core/security/input-validation.server', () => ({
   createSsrfGuardedFetchWithDispatcher: mockCreateGuardedFetchWithDispatcher,
+  isPrivateOrReservedIP: (ip: string) =>
+    ip.startsWith('127.') || ip.startsWith('10.') || ip === '::1',
 }))
 vi.mock('@/lib/mcp/domain-check', () => ({
   validateMcpServerSsrf: mockValidateMcpServerSsrf,
@@ -345,3 +347,22 @@ describe('createSsrfGuardedMcpFetch', () => {
     }
   })
 })
+
+describe('self-hosted private-resolution carve-out', () => {
+  it('routes a loopback-resolving host over global fetch (guarded lookup would filter it)', async () => {
+    // Self-hosted DNS alias -> 127.0.0.1: policy allows it, so the guard must not
+    // strand the connect. Falls back to global fetch, same as the allowlist path.
+    mockValidateMcpServerSsrf.mockResolvedValue('127.0.0.1')
+    const globalFetch = vi
+      .spyOn(globalThis, 'fetch')
+      .mockImplementation(async () => new Response('ok'))
+    try {
+      const fetchLike = createSsrfGuardedMcpFetch()
+      await fetchLike('https://my-local-alias/mcp')
+      expect(mockCreateGuardedFetchWithDispatcher).not.toHaveBeenCalled()
+      expect(globalFetch).toHaveBeenCalledTimes(1)
+    } finally {
+      globalFetch.mockRestore()
+    }
+  })
+})

apps/sim/lib/mcp/pinned-fetch.ts

@@ -1,7 +1,10 @@
 import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js'
 import { createLogger } from '@sim/logger'
 import type { Agent } from 'undici'
-import { createSsrfGuardedFetchWithDispatcher } from '@/lib/core/security/input-validation.server'
+import {
+  createSsrfGuardedFetchWithDispatcher,
+  isPrivateOrReservedIP,
+} from '@/lib/core/security/input-validation.server'
 import { validateMcpServerSsrf } from '@/lib/mcp/domain-check'
 import { McpError } from '@/lib/mcp/types'
 
@@ -216,7 +219,10 @@ export function createSsrfGuardedMcpFetch(timeoutMs: number = OAUTH_FETCH_TIMEOU
       const resolvedIP = await withDeadline(validateMcpServerSsrf(target), signal)
       logger.info('OAuth guarded fetch: requesting', { host, guarded: Boolean(resolvedIP) })
       let response: Response
-      if (resolvedIP) {
+      // A private/loopback resolvedIP only occurs on self-hosted where the policy permits
+      // it — the guarded lookup would filter it out, so those go over global fetch like the
+      // allowlist carve-out below.
+      if (resolvedIP && !isPrivateOrReservedIP(resolvedIP)) {
         const guarded = createSsrfGuardedFetchWithDispatcher({
           maxResponseSize: MAX_OAUTH_RESPONSE_BYTES,
         })