SSRF in mcp-google-search MCP Server via read_webpage URL Parameter

Technical Analysis

The read_webpage function in src/index.ts of the mcp-google-search MCP server accepts a URL parameter without adequate validation or allow-listing, enabling an attacker (or a compromised upstream LLM/agent feeding it crafted input) to redirect the server's outbound HTTP requests to internal or unintended endpoints. This is a classic SSRF pattern applied to the MCP tool-layer: an agent's tool call becomes a proxy for attacker-controlled network requests. Because MCP tools often run with server-side network access and trust from the calling LLM/agent, an attacker who can influence the tool's arguments (via prompt injection, malicious tool chaining, or a compromised planner) could pivot to internal services, cloud metadata endpoints, or bypass network segmentation. The attack vector is marked local, meaning the attacker needs some form of local execution access to the MCP host or a co-located trust boundary, which reduces but does not eliminate risk in agent pipelines that ingest external, untrusted content and pass it downstream to this tool.

Affected Systems

mcp-google-search; protocols: MCP

Detection Signatures

• Outbound requests from MCP server process to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 127.0.0.1) triggered by read_webpage calls
• Log entries showing url parameter values pointing to internal hostnames, non-HTTP(S) schemes, or IP-literal addresses
• Unexpected DNS resolution requests originating from the MCP server host correlating with tool invocation timestamps
• Tool call arguments containing redirect chains or URL-encoded internal addresses

Remediation Steps

1. 1

   Apply the vendor patch

   Update mcp-google-search to the patched version containing commit f071d491b685011ca04e8ab8d586fc65f86bcee1 or later.

2. 2

   Validate and allow-list URLs

   Implement strict URL validation in read_webpage, restricting schemes to http/https, rejecting internal/private IP ranges, and using an allow-list of permitted domains.

3. 3

   Isolate MCP server network access

   Run the MCP server in a network-restricted environment (e.g., egress filtering, no access to cloud metadata endpoints) to limit SSRF blast radius.

4. 4

   Sanitize agent-supplied tool arguments

   Ensure any URL passed from an LLM/agent to this tool is validated independently of the model's output, treating model-generated arguments as untrusted.