SSRF via url Parameter in MasterGo Magic MCP Server's getComponentLink Tool

Technical Analysis

The vulnerability resides in src/tools/get-component-link.ts, where the mcp__getComponentLink tool accepts a url parameter validated only via a basic z.string() schema check with no scheme, host, or network-destination restrictions. Because this is exposed as an MCP tool callable by any connected agent or client, an attacker (or a compromised/malicious upstream LLM agent) can invoke the tool with a URL pointing at internal services, cloud metadata endpoints, or other restricted network resources, causing the MCP server to make the request on the attacker's behalf. This crosses the agent-to-tool trust boundary: the MCP server treats tool-call arguments from the LLM/agent layer as trusted input rather than untrusted external data, enabling SSRF that could lead to internal network reconnaissance, credential/metadata theft, or pivoting to other internal systems reachable by the MCP host.

Affected Systems

mastergo-magic-mcp; protocols: MCP

Detection Signatures

• Tool call logs showing mcp__getComponentLink invoked with url values pointing to internal IP ranges (127.0.0.1, 169.254.169.254, 10.x.x.x, 192.168.x.x) or non-standard schemes (file://, gopher://, ftp://)
• Outbound HTTP requests originating from the MCP server process to unexpected internal or cloud-metadata hosts
• Anomalous or repeated tool invocations with malformed/unexpected URL formats
• Absence of allow-list validation logic in get-component-link.ts around z.string() usage

Remediation Steps

1. 1

   Upgrade or patch the MCP server

   Monitor the mastergo-magic-mcp repository for a fix beyond 0.2.0; since the vendor has not responded, consider forking and patching locally if the tool is business-critical.

2. 2

   Implement strict URL validation

   Replace the bare z.string() check with a schema enforcing allowed schemes (https only), disallowing private/reserved IP ranges, localhost, and metadata service addresses (e.g., 169.254.169.254).

3. 3

   Network egress controls

   Restrict outbound network access from the MCP server host via firewall rules/allow-lists so it cannot reach internal services or cloud metadata endpoints.

4. 4

   Sandbox/isolate the MCP server

   Run the MCP server in a network-segmented or containerized environment with minimal network reachability to reduce SSRF blast radius.

5. 5

   Monitor and log tool invocations

   Add logging/alerting on the getComponentLink tool for suspicious URL parameters and unusual destination hosts.