An argument of an MCP tool handler (@mcp.tool()) flows into an outbound HTTP request without validation, a server-side request forgery (SSRF, CWE-918).

Why this matters

Tool arguments are attacker-influenced: an LLM (or a malicious caller) can point the URL at internal services, cloud metadata (169.254.169.254), or localhost. BlueRock found ~36.7% of MCP servers SSRF-prone.

Validate the target before fetching: resolve and allow-list the host, reject private/link-local ranges, and disable redirects. Never pass a raw tool argument straight into httpx/requests.

import httpx


@mcp.tool()
def fetch_url(url: str) -> str:
    # ruleid: auth.py.mcp.tool-handler-ssrf
    return httpx.get(url).text

import httpx


@mcp.tool()
def health() -> str:
    # ok: auth.py.mcp.tool-handler-ssrf
    return httpx.get("https://api.internal/health").text

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.mcp.tool-handler-ssrf -- <reason>

References