feat: enforce SSRF protection for MCP config-directed traffic by ibetitsmike · Pull Request #28242 · coder/coder

ibetitsmike · 2026-08-18T07:43:10Z

Routes all MCP config-directed traffic from coderd and chatd through a shared SSRF-protected HTTP client, now that organization admins, not only deployment admins, control MCP server URLs (#27942 and its stack below).

Summary

Uses the coder/safedial library: it blocks private and special-purpose destinations at dial time (validating resolved addresses at connection time so DNS rebinding cannot bypass the check) and rejects cross-origin redirects.
Covers the complete traffic surface: OAuth2 discovery, dynamic client registration, code exchange, token refresh, revocation, and runtime MCP connections from chatd.
Deployments that intentionally host internal MCP servers opt in via the new --mcp-allowed-private-cidrs (CODER_MCP_ALLOWED_PRIVATE_CIDRS) option.
Includes the deployment configuration surface, generated docs, CLI goldens, TypeScript types, and regression coverage for each traffic path.

Merge window

This protection originally lived inside #27942 and was split out to keep that diff reviewable. Until this PR lands, the stack below ships with only main's existing discovery IP-range guard (CODER_MCP_OAUTH2_DISCOVERY_ALLOWED_IP_RANGES), while org admins can already point MCP configs at arbitrary URLs. This PR should merge promptly after the stack below it.

Top of the MCP org-separation stack (CODAGT-711 -> CODAGT-717 audit -> CODAGT-712 ACLs -> CODAGT-806 token RBAC -> CODAGT-714 org picker -> this PR).

Mux (AI agent) authored this PR on Mike's behalf.

linear-code · 2026-08-18T07:43:14Z

CODAGT-711

github-actions · 2026-08-18T07:43:19Z

Docs preview

Check off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here.

ibetitsmike · 2026-08-18T07:45:19Z

@codex review

chatgpt-codex-connector · 2026-08-18T07:49:28Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 2e5292cbdf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ibetitsmike · 2026-08-18T08:32:51Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85bb3af7bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ibetitsmike · 2026-08-18T09:16:03Z

@codex review

chatgpt-codex-connector · 2026-08-18T09:19:35Z

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 814375ab5e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ibetitsmike · 2026-08-18T10:20:14Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 78f219bc06

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ibetitsmike · 2026-08-18T10:53:10Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 573efd387b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ibetitsmike · 2026-08-18T11:47:37Z

@codex review

coderagents · 2026-08-18T11:47:38Z

Documentation Check

New Documentation Needed

docs/ai-coder/agents/platform-controls/mcp-servers.md - This page documents the admin-configured MCP server url field but not the new SSRF behavior this PR introduces. Document that MCP server destinations resolving to private or reserved IP ranges are now blocked by default (covering OAuth2 discovery, OAuth2 token and revocation exchanges, and runtime MCP connections), and how a deployment admin exempts specific internal networks via --mcp-allowed-private-cidrs (CODER_MCP_ALLOWED_PRIVATE_CIDRS). Without this, an admin who points an MCP server at an internal URL will hit a connection block with no in-product doc explaining why. The AI Gateway proxy page (docs/ai-coder/ai-gateway/ai-gateway-proxy/setup.md) already documents the analogous behavior and is a good model for wording.

Note

The generated reference docs (docs/admin/setup/configuration-reference.md, docs/reference/cli/server.md, docs/reference/api/*) are already updated by this PR and are auto-generated, so no manual edits are needed there.

Automated review via Coder Agents

chatgpt-codex-connector · 2026-08-18T11:52:22Z

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 65a3878ca2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ibetitsmike · 2026-08-18T12:18:48Z

@codex review

The MCP SSRF guard was extracted into github.com/coder/safedial so other services can share it. Beyond the extraction, safedial hardens the same policy: it panics instead of silently substituting a blank transport for unguardable bases, preserves cookie jars, decodes every RFC 6052 NAT64 layout, fails closed on invalid addresses, and bounds dials to 30s even without a caller deadline.

safedial panics when http.DefaultTransport has been globally replaced with a non-*http.Transport instead of silently guarding a blank transport, so the transport-isolation test must install its counting sentinel only after coderd's guarded MCP client is constructed.

github-actions Bot assigned ibetitsmike Aug 18, 2026

ibetitsmike mentioned this pull request Aug 18, 2026

feat!: org-scope MCP server configs with RBAC #27942

Merged

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 2e5292c to 85bb3af Compare August 18, 2026 08:31

ibetitsmike requested a review from jdomeracki-coder August 18, 2026 08:34

chatgpt-codex-connector Bot reviewed Aug 18, 2026

View reviewed changes

Comment thread coderd/mcpssrf/client.go Outdated

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 85bb3af to 814375a Compare August 18, 2026 09:15

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 814375a to 78f219b Compare August 18, 2026 10:18

chatgpt-codex-connector Bot reviewed Aug 18, 2026

View reviewed changes

Comment thread coderd/mcpssrf/client.go Outdated

Comment thread coderd/mcpssrf/client.go Outdated

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 78f219b to 573efd3 Compare August 18, 2026 10:52

chatgpt-codex-connector Bot reviewed Aug 18, 2026

View reviewed changes

Comment thread coderd/mcpssrf/client.go Outdated

Comment thread coderd/mcpssrf/client.go Outdated

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 573efd3 to 65a3878 Compare August 18, 2026 11:45

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 65a3878 to 32e109c Compare August 18, 2026 12:18

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 50221da to 2cb04fe Compare August 19, 2026 18:50

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 2cb04fe to 6ffda35 Compare August 19, 2026 19:12

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 6ffda35 to ef77e94 Compare August 19, 2026 19:25

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from ef77e94 to b01077b Compare August 19, 2026 19:37

Base automatically changed from mike/codagt-714-mcp-org-picker to main August 19, 2026 19:46

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from b01077b to 6590af1 Compare August 19, 2026 19:54

ibetitsmike mentioned this pull request Aug 20, 2026

feat: add SSRF-hardened dialers and HTTP clients coder/safedial#1

Merged

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch 2 times, most recently from 63aae9e to 8486714 Compare August 27, 2026 07:22

ibetitsmike added 12 commits August 30, 2026 10:51

feat(coderd): enforce SSRF protection for MCP config-directed traffic

b13c977

fix(coderd): normalize mapped MCP allowed CIDRs

495ca3b

fix(coderd/mcpssrf): block deprecated IPv6 site-local range

0b9d3f5

fix(coderd/mcpssrf): bound per-address dial attempts

772c75a

fix(coderd/mcpssrf): classify NAT64 addresses by embedded IPv4

441e6e3

fix(coderd/mcpssrf): preserve IPv6 zones for validated literals

ff33c1c

test(coderd/mcpssrf): cover encoded IPv6 zone URLs

5d271f7

fix(coderd/mcpssrf): block legacy IPv4-embedding IPv6 prefixes

3877759

chore: bump coder/safedial to v0.1.0

2907eb4

chore: bump coder/safedial to v0.2.0

0676c6d

ibetitsmike force-pushed the mike/codagt-711-mcp-ssrf branch from 8486714 to 0676c6d Compare August 30, 2026 10:56

ThomasK33 approved these changes Aug 30, 2026

View reviewed changes

ibetitsmike merged commit d6b67e8 into main Aug 30, 2026
31 checks passed

ibetitsmike deleted the mike/codagt-711-mcp-ssrf branch August 30, 2026 11:09

github-actions Bot locked and limited conversation to collaborators Aug 30, 2026

Uh oh!

Conversation

ibetitsmike commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Merge window

Uh oh!

linear-code Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docs preview

Uh oh!

ibetitsmike commented Aug 18, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 18, 2026

Uh oh!

ibetitsmike commented Aug 18, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

ibetitsmike commented Aug 18, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 18, 2026

Uh oh!

ibetitsmike commented Aug 18, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ibetitsmike commented Aug 18, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ibetitsmike commented Aug 18, 2026

Uh oh!

coderagents Bot commented Aug 18, 2026

Documentation Check

New Documentation Needed

Uh oh!

chatgpt-codex-connector Bot commented Aug 18, 2026

Uh oh!

ibetitsmike commented Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ibetitsmike commented Aug 18, 2026 •

edited

Loading

github-actions Bot commented Aug 18, 2026 •

edited

Loading