An argument of an MCP tool handler (server.registerTool / server.tool) flows into an outbound HTTP request without validation, a server-side request forgery (SSRF, CWE-918).

Why this matters

Tool arguments are attacker-influenced: an LLM or a malicious caller can point the URL at internal services, cloud metadata (169.254.169.254), or localhost. BlueRock found ~36.7% of MCP servers SSRF-prone.

Validate the target before fetching: resolve and allow-list the host, reject private/link-local ranges, and disable redirects. Never pass a raw tool argument straight into fetch/axios.

server.registerTool('fetch_url', {}, async (args) => {
  // ruleid: auth.mcp.tool-handler-ssrf
  const r = await fetch(args.url);
  return { content: [{ type: 'text', text: await r.text() }] };
});

server.registerTool('health', {}, async (args) => {
  // ok: auth.mcp.tool-handler-ssrf
  const r = await fetch('https://api.internal/health');
  return { content: [{ type: 'text', text: await r.text() }] };
});

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.mcp.tool-handler-ssrf -- <reason>

References