mcp-use Inspector SSRF via Unvalidated Proxy Target

Technical Analysis

The vulnerable function, mountMcpProxy, read a destination URL from the X-Target-URL header or the __mcp_target parameter and issued a proxied HTTP request to it without checking the resolved IP against private, loopback, or link-local ranges. Because validation was only applied to the initial target and not reapplied after following a redirect, an attacker could also supply a public URL that redirects to an internal address, bypassing naive allowlist checks. This lets a remote caller pivot through the MCP inspector server to reach internal network services (cloud metadata endpoints, internal admin panels, other MCP servers) that are otherwise unreachable from outside the host, and exfiltrate response data through the proxy channel. The entry point is any client capable of sending HTTP requests to the inspector's proxy endpoint, crossing the trust boundary between external callers and the host's internal network.

Affected Systems

mcp-use (inspector package, libraries/typescript/packages/inspector); protocols: MCP

Detection Signatures

• Requests to the proxy endpoint containing X-Target-URL or __mcp_target parameters pointing to 127.0.0.1, localhost, 169.254.169.254, RFC1918 ranges (10.x, 172.16-31.x, 192.168.x), or hostnames resolving to these ranges
• HTTP responses from the proxy containing cloud metadata content or internal service banners
• Outbound proxy requests followed by 3xx redirects to internal/private addresses
• Repeated proxy calls probing sequential internal IPs or common internal ports (SSRF scanning pattern)

Remediation Steps

1. 1

   Upgrade mcp-use inspector

   Update to the patched version that calls isSafeProxyTarget to validate resolved addresses against private, loopback, and link-local ranges before proxying.

2. 2

   Validate on every redirect hop

   Ensure proxy logic re-validates the resolved address after each redirect rather than only at the initial request, and cap the number of redirects followed.

3. 3

   Restrict proxy target sources

   Do not trust caller-supplied headers or parameters (X-Target-URL, __mcp_target) as sole authorization for outbound requests; enforce an allowlist of permitted destination hosts where possible.

4. 4

   Network segmentation

   Run the inspector/proxy component with restricted network egress so it cannot reach internal management interfaces or cloud metadata services even if SSRF validation is bypassed.

5. 5

   Monitor and alert on internal-target proxy attempts

   Add logging and alerting for proxy requests targeting private, loopback, or link-local addresses to detect exploitation attempts.