Skip to main content

validateHttpEgress

@forge/monorepo

@forge/monorepo / backend/src / validateHttpEgress

Function: validateHttpEgress()

validateHttpEgress(policy, endpoint): URL

Defined in: backend/src/mcp/egress.ts:89

The HTTP half of the policy, on its own — #176.

Extracted because the check is about HTTP egress, not about MCP: an agent tool that fetches a URL needs exactly these rules, and the alternatives were both bad. Calling validateEndpoint(policy, "streamable-http", url) would be passing a transport the caller does not have, and writing the checks again in the tool would be a second SSRF defence that drifts from the first — and the one that drifts is the one nobody re-reads.

Everything here was already load-bearing for MCP. Stated again because it is now reachable from a tool the model chooses the argument for, which is a materially more hostile position than an operator-configured endpoint:

  • Credentials in userinfo are refused, not stripped.
  • Every IPv6 literal is denied by default, because ::ffff:169.254.169.254 slips a cloud metadata address past any v4-only check.
  • An explicit host allow-list is authoritative, so an operator can permit something they trust.
  • Absent an allow-list, private, loopback, link-local and .internal/.local targets are blocked.

Parameters​

policy​

EgressPolicy

endpoint​

string

Returns​

URL