fix: add SSRF redirect protection to httpx client factory - #2180

Closed

dgenio wants to merge 5 commits into

modelcontextprotocol:mainfrom

dgenio:feat/ssrf-redirect-protection

Commits on Feb 28, 2026

fix: add SSRF redirect protection to httpx client factory
dgenio
committed
5423962
fix: use Location header for redirect validation instead of next_request
dgenio
committed
1f1efbd
fix: remove redirect_policy from McpHttpClientFactory Protocol
dgenio
committed
6fc1bc7
docs: document SSRF redirect protection gap for user-provided clients
dgenio
committed
06d1f1e
test: fix coverage gaps for relative redirect and unreachable mock branch
dgenio
committed
75a4e45