[FEATURE] Let VERYFRONT_HOST_ALLOWED_INTERNAL_PROVIDER_ORIGINS (or a sibling) cover mcpServers on private addresses #5193

Activity

1. kwakayama commented on Oct 16, 2026

   

   kwakayama

   on Oct 16, 2026 – with Claude

   Contributor

   More actions

   This was generated by AI during triage.

   Agent Brief

   Category: enhancement

   Summary:
   Let a host operator allow exact private or loopback origins for remote MCP (mcpServers) transports without disabling the egress guard for all outbound calls.

   Current behavior:

   • Remote MCP tool sources fetch through guardedOutboundFetch (src/tool/remote-mcp.ts). A transport.url that resolves to a private address is refused, which matches the logged "Outbound network egress blocked" warning from the remote tool definition fetch in src/agent/runtime/tool-helpers.ts.
   • VERYFRONT_HOST_ALLOWED_INTERNAL_PROVIDER_ORIGINS (src/security/http/outbound-fetch.ts) is host-owned, exact-origin, and rejects paths, credentials, query strings and fragments. It applies only to origin-bound provider transports configured for the same origin. Project environment overlays cannot add origins.
   • The only switch that admits a private MCP origin today is VERYFRONT_HOST_ALLOW_INTERNAL_EGRESS=1, which disables the private-network check for all host fetches.
   • docs/guides/providers.md and src/security/README.md describe the provider exception only. Neither the mcpServers docs nor the self-hosting guide mention that MCP cannot use it.
   • No duplicate issue found. Closed Guarded egress: pooled sockets skip the pinned address lookup #3350 concerns pooled-socket address pinning, not this request.

   Desired behavior:

   • A host-owned allowlist of exact origins admits private or loopback destinations for remote MCP transports only. Either extend the existing variable's scope to MCP, or add a sibling such as VERYFRONT_HOST_ALLOWED_INTERNAL_MCP_ORIGINS. The maintainer decision between the two is open (see below).
   • Same semantics as the provider list: exact origin (scheme, host, port), the same parse validation and error messages, and no project-environment grant.
   • The exception is origin-bound. Redirects stay rejected, and every other internal destination stays blocked.
   • A provider-only origin must not silently become reachable by MCP (or the reverse) unless the chosen design says so explicitly.
   • Document the variable beside mcpServers and in the self-hosting guide and src/security/README.md. Update .env.example if a new variable is added.

   Key interfaces:

   • Remote MCP tool source transport (mcpServers transport.url) and its outbound fetch.
   • Host-owned internal-origin allowlist and the egress guard's origin-bound exception.
   • Project environment overlay boundary (must not grant the allowlist).

   Acceptance criteria:

   • A remote MCP source whose transport.url origin is on the host allowlist reaches a private or loopback server.
   • An MCP origin not on the list, and an origin allowed only for providers (if a sibling variable is chosen), is still refused.
   • Setting the variable through project environment overlays has no effect.
   • Invalid entries (paths, credentials, non-HTTP schemes) fail with the same validation as the provider list.
   • Redirects from an allowed MCP origin are still rejected.
   • Regression tests cover the above, and docs describe the behavior.
   • Relevant formatting, lint, typecheck, and CI checks pass
   • Existing behavior outside this issue remains unchanged

   Out of scope:

   • Unrelated refactors
   • Changes to VERYFRONT_HOST_ALLOW_INTERNAL_EGRESS semantics
   • OpenAPI, OAuth, or remote-module egress policy
   • New dependencies

   Verification plan:

   • deno task test:file src/tool/remote-mcp.test.ts
   • deno task test:file src/security/http/outbound-fetch.test.ts
   • deno fmt --check, deno task lint:ci, deno task typecheck
   • CI jobs in .github/workflows/cicd.yml covering unit tests, lint, and typecheck. Run deno task docs on the pinned Deno version if generated references change.

   Open decision for maintainers: extend the existing variable or add a sibling. A sibling keeps provider and MCP trust separate and matches the reporter's least-privilege goal. Note that the existing provider variable is already reused for non-provider origins (application auth, eval), so there is precedent for both.

   Handoff: ready for agent

   Thanks @dberesford. I reviewed the report against the current Veryfront Code implementation and reduced it to the Agent Brief above. The remaining work is bounded by the acceptance criteria and verification plan.

   ---

   Generated by Claude Code
2. kwakayama

   added

   enhancementNew feature or requestNew feature or request

   securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

   mediumMedium priorityMedium priority

   on Oct 16, 2026
3. dberesford commented on Oct 16, 2026

   

   dberesford

   on Oct 16, 2026

   Author

   More actions

   Correction from the author, after further testing on the same setup (veryfront 0.1.1276):

   • VERYFRONT_WORKER_ALLOWED_INTERNAL_HOSTS already does what this issue asks for. The host-side guarded fetch reads it when no allowedInternalHosts option is passed, so a comma-separated list of DNS names lets exactly those names resolve to internal addresses for mcpServers too. With the gateway's hostname on that list and nothing else, the in-cluster MCP calls went through. I had missed it because the providers guide and the mcpServers documentation only mention VERYFRONT_HOST_ALLOWED_INTERNAL_PROVIDER_ORIGINS.
   • "turns the guard off for every outbound call" overstated VERYFRONT_HOST_ALLOW_INTERNAL_EGRESS=1: it skips the private-address rejections for all requests through the guarded fetch, while the scheme check, the refusal of URL credentials, redirect authorisation and address pinning stay.

   What remains of this issue is documentation: mention VERYFRONT_WORKER_ALLOWED_INTERNAL_HOSTS beside mcpServers and in the self-hosting guide, and say that the provider origins list does not cover MCP transports. Feel free to retitle or close as a docs request.