SSRF in Awesome-MCP-Server wiki-summary tool via unvalidated URL parameter

Technical Analysis

The wiki-summary tool in mcp_wiki/server.py accepts a 'url' parameter from the calling agent or user and performs a server-side fetch without validating the target host, scheme, or restricting it to allow-listed domains. Because this is exposed as an MCP tool, any agent or LLM-driven client that can invoke this tool becomes a vector to trigger outbound requests from the MCP server's network context, effectively letting untrusted model output or user input control a network fetch primitive. An attacker can point 'url' at internal-only endpoints (e.g., cloud metadata services, internal admin panels, or loopback addresses) to perform reconnaissance, exfiltrate internal data, or pivot further into the network. This crosses the boundary between the agent's declared intent (summarizing a wiki page) and unintended network access, since the tool implicitly trusts any URL provided through the agent's tool-call interface.

Affected Systems

AIAnytime Awesome-MCP-Server, mcp-wiki; protocols: MCP

Detection Signatures

• Outbound requests from the MCP server host to internal IP ranges (e.g., 127.0.0.1, 169.254.169.254, RFC1918 addresses) triggered by the wiki-summary tool
• MCP tool-call logs showing 'url' parameter values pointing to non-wiki, internal, or unexpected hosts
• Unusual outbound HTTP requests correlated with agent tool invocations to mcp_wiki/server.py
• Repeated tool calls to wiki-summary with schemes other than https (e.g., file://, gopher://, http:// to internal hosts)

Remediation Steps

1. 1

   Validate and allow-list URLs

   Restrict the 'url' parameter in the wiki-summary tool to a strict allow-list of expected wiki domains and reject internal/loopback/link-local addresses and non-HTTP(S) schemes.

2. 2

   Implement egress filtering

   Apply network-level egress controls so the MCP server host cannot reach internal metadata services or private IP ranges regardless of application-layer validation.

3. 3

   Patch or fork the project

   Since the maintainer has not responded, apply a local patch or fork with input validation until an official fix is released; monitor the upstream repository for updates.

4. 4

   Sandbox MCP tool execution

   Run the MCP server in an isolated network segment or container with no access to sensitive internal services to limit SSRF blast radius.

5. 5

   Audit tool exposure

   Review all MCP tools that accept URLs or file paths as arguments across your deployed servers for similar unvalidated fetch patterns.