mirror/nanobot
1
0
Fork 0
mirror of https://github.com/HKUDS/nanobot.git synced 2026-08-06 17:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow local mcp urls with pinned dns

Browse Source
This commit is contained in:
hamb1y 2026-07-02 22:54:52 +05:30 committed by Xubin Ren
parent 73bf299a59
commit 4353f4680b
3 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nanobot/agent/tools/mcp.py
View File

@ -180,7 +180,7 @@ async def _probe_http_url(url: str, timeout: float = 3.0) -> bool:
port = parsed.port port = parsed.port
if not port: if not port:
port = 443 if parsed.scheme == "https" else 80 port = 443 if parsed.scheme == "https" else 80
ok, _, resolved_ips = resolve_url_target(url) ok, _, resolved_ips = resolve_url_target(url, allow_loopback=True)
if not ok: if not ok:
return False return False
try: try:
@ -218,7 +218,7 @@ def _redact_url(url: str) -> str:
async def _validate_mcp_request_url(request: httpx.Request) -> None: async def _validate_mcp_request_url(request: httpx.Request) -> None:
"""Validate each outgoing MCP HTTP request, including redirect targets.""" """Validate each outgoing MCP HTTP request, including redirect targets."""
ok, error = validate_url_target(str(request.url)) ok, error = validate_url_target(str(request.url), allow_loopback=True)
if not ok: if not ok:
raise httpx.RequestError( raise httpx.RequestError(
f"Blocked unsafe MCP URL {_redact_url(str(request.url))} ({error})", f"Blocked unsafe MCP URL {_redact_url(str(request.url))} ({error})",
@ -885,7 +885,7 @@ async def connect_mcp_servers(
follow_redirects=True, follow_redirects=True,
timeout=timeout, timeout=timeout,
auth=auth, auth=auth,
transport=PinnedDNSAsyncTransport(), transport=PinnedDNSAsyncTransport(allow_loopback=True),
) )
read, write = await server_stack.enter_async_context( read, write = await server_stack.enter_async_context(
@ -903,7 +903,7 @@ async def connect_mcp_servers(
event_hooks={"request": [_validate_mcp_request_url]}, event_hooks={"request": [_validate_mcp_request_url]},
follow_redirects=True, follow_redirects=True,
timeout=httpx.Timeout(30.0, connect=10.0), timeout=httpx.Timeout(30.0, connect=10.0),
transport=PinnedDNSAsyncTransport(), transport=PinnedDNSAsyncTransport(allow_loopback=True),
) )
) )
read, write, _ = await server_stack.enter_async_context( read, write, _ = await server_stack.enter_async_context(

5
nanobot/security/network.py
View File

@ -149,12 +149,13 @@ def pin_resolved_url_dns(url: str, resolved_ips: tuple[str, ...]):
class PinnedDNSAsyncTransport(httpx.AsyncBaseTransport): class PinnedDNSAsyncTransport(httpx.AsyncBaseTransport):
"""HTTPX transport that pins each request to the IPs validated for its URL.""" """HTTPX transport that pins each request to the IPs validated for its URL."""
def __init__(self) -> None: def __init__(self, *, allow_loopback: bool = False) -> None:
self._allow_loopback = allow_loopback
self._inner = httpx.AsyncHTTPTransport() self._inner = httpx.AsyncHTTPTransport()
async def handle_async_request(self, request: httpx.Request) -> httpx.Response: async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
url = str(request.url) url = str(request.url)
ok, error, resolved_ips = resolve_url_target(url) ok, error, resolved_ips = resolve_url_target(url, allow_loopback=self._allow_loopback)
if not ok: if not ok:
raise httpx.RequestError(error, request=request) raise httpx.RequestError(error, request=request)
with pin_resolved_url_dns(url, resolved_ips): with pin_resolved_url_dns(url, resolved_ips):

12
tests/tools/test_mcp_tool.py
View File

@ -712,8 +712,8 @@ async def test_connect_mcp_servers_logs_stdio_pollution_hint(
@pytest.mark.parametrize( @pytest.mark.parametrize(
"config", "config",
[ [
MCPServerConfig(url="http://127.0.0.1:9/sse"), MCPServerConfig(url="http://169.254.169.254/sse"),
MCPServerConfig(type="streamableHttp", url="http://127.0.0.1:9/mcp"), MCPServerConfig(type="streamableHttp", url="http://169.254.169.254/mcp"),
], ],
) )
async def test_connect_mcp_servers_rejects_unsafe_http_urls_before_probe( async def test_connect_mcp_servers_rejects_unsafe_http_urls_before_probe(
@ -762,7 +762,7 @@ async def test_connect_mcp_servers_http_clients_reject_unsafe_redirect_targets(
sent_urls: list[str] = [] sent_urls: list[str] = []
used_transports: list[str] = [] used_transports: list[str] = []
def _validate(url: str) -> tuple[bool, str]: def _validate(url: str, **_kwargs: object) -> tuple[bool, str]:
checked_urls.append(url) checked_urls.append(url)
if url == "http://127.0.0.1/private": if url == "http://127.0.0.1/private":
return False, "loopback blocked" return False, "loopback blocked"
@ -804,7 +804,11 @@ async def test_connect_mcp_servers_http_clients_reject_unsafe_redirect_targets(
monkeypatch.setattr(mcp_mod, "validate_url_target", _validate) monkeypatch.setattr(mcp_mod, "validate_url_target", _validate)
monkeypatch.setattr(mcp_mod, "_probe_http_url", _reachable) monkeypatch.setattr(mcp_mod, "_probe_http_url", _reachable)
monkeypatch.setattr(mcp_mod, "PinnedDNSAsyncTransport", lambda: httpx.MockTransport(_handler)) monkeypatch.setattr(
mcp_mod,
"PinnedDNSAsyncTransport",
lambda **_kwargs: httpx.MockTransport(_handler),
)
monkeypatch.setattr(mcp_mod.httpx, "AsyncClient", _async_client_with_mock_transport) monkeypatch.setattr(mcp_mod.httpx, "AsyncClient", _async_client_with_mock_transport)
monkeypatch.setattr(sys.modules["mcp.client.sse"], "sse_client", _fake_sse_client) monkeypatch.setattr(sys.modules["mcp.client.sse"], "sse_client", _fake_sse_client)
monkeypatch.setattr( monkeypatch.setattr(