SSRF Risks in MCP Servers

Server-side request forgery becomes relevant when an MCP tool accepts a URL and fetches it from a privileged server environment.

Why agents increase exposure

Models can generate URLs from untrusted content. A generic “fetch URL” tool may therefore be directed at internal network locations or cloud metadata services.

Defensive controls

• Prefer fixed upstream APIs over arbitrary URLs.
• Use hostname/domain allowlists where practical.
• Block private/link-local/metadata network ranges at egress.
• Revalidate redirect destinations.
• Use a restricted outbound proxy or network policy.
• Set timeouts and response-size limits.