OGX (Llama Stack) MCP Tool Definition SSRF via server_url

Technical Analysis

MCP tool definitions allow specifying a server_url plus custom headers and authorization values that the OGX server uses to make outbound requests when executing tool calls. Unlike other URL-accepting fields, server_url bypasses the existing validate_url_not_private() guard, so no check prevents targeting RFC1918 ranges, localhost, or the 169.254.169.254 cloud metadata endpoint. Because the default starter configuration runs unauthenticated, any remote party can submit a crafted MCP tool definition via POST /v1/responses, causing the server to act as an open proxy into the internal network and to forward attacker-controlled bearer tokens/headers to arbitrary destinations. This crosses the tool-layer/agent boundary: an external, untrusted actor manipulates what is meant to be a trusted internal tool-invocation pathway, turning the agent framework itself into an SSRF pivot capable of cloud credential theft and internal service reconnaissance.

Affected Systems

OGX (formerly Llama Stack); protocols: MCP

Detection Signatures

• Outbound requests from the OGX/Llama Stack host to 169.254.169.254 or other link-local/metadata addresses
• MCP tool definitions containing server_url values pointing to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16)
• Unexpected outbound HTTP requests from the /v1/responses endpoint immediately following tool-registration API calls
• Presence of custom authorization/header values in MCP tool definitions submitted by unauthenticated or unexpected clients
• Server logs showing validate_url_not_private() not invoked prior to server_url dereference

Remediation Steps

1. 1

   Patch/upgrade OGX

   Apply the vendor patch that extends validate_url_not_private() (or equivalent) validation to the server_url parameter in MCP tool definitions.

2. 2

   Enforce authentication

   Do not run the default starter configuration in production; require authentication on /v1/responses and all MCP tool-registration endpoints.

3. 3

   Network egress controls

   Block or restrict outbound traffic from the OGX host to private IP ranges and cloud metadata endpoints (169.254.169.254) at the network/firewall level, and disable IMDSv1 in favor of IMDSv2 with hop-limit protections.

4. 4

   Input validation allowlisting

   Apply strict allowlisting of permitted destination hosts/schemes for any server-side fetch triggered by user- or tool-supplied URLs.

5. 5

   Audit and monitor

   Add monitoring for outbound requests originating from tool-execution code paths to internal/metadata addresses, and alert on anomalous MCP tool_definition payloads.