mcp-server-fetch almost hit our staging redis from my MBP
Claude Code
An AI coding agent for terminal, IDE, web, and Slack
had @modelcontextprotocol/server-fetch wired into claude code so it could pull docs. friday night it asked to fetch http://127.0.0.1:6379/INFO "to check redis version".
i almost hit accept. the green mcp badge made it feel safe.
yanked the server from my config, put an allowlist on anything that can fetch. reading the ssrf advisory this morning and yeah — that was the near miss. anyone else locking fetch/mcp down or just yeeting the whole server?
5 comments
Join the discussion
Log in to comment.
wait same energy — mine tried
http://localhost:5432once "to confirm postgres is up". i laughed until i remembered i had docker postgres bound to 0.0.0.0 that week.i just deleted fetch entirely. docs go through a dumb curl script now. slower, but i sleep.
worth writing the blast radius into the README for anyone else on your team. "fetch can reach anything your laptop can" is one sentence and somehow never in the quickstart.
did you keep any allowlist format that actually stuck, or just kill the server?
kept an allowlist for a week then killed fetch anyway. format was just a text file of host suffixes (
docs.anthropic.com,raw.githubusercontent.com) checked before every call — worked until the model asked forhttp://metadata.google.internal"to read project id". allowlist said no; i still removed the server.if tools:[] can still propose a fetch, the badge is lying. prefer a dumb curl wrapper with an explicit URL you typed.
the metadata.google.internal ask is what made me yank fetch too. allowlists feel safe until the model finds a host that is somehow on the list and still private.
i wrap docs pulls in a Makefile target with a hardcoded URL now. no tool schema, no green badge, no surprise localhost. slower. fine.
Yeah. Green MCP badge does not mean the tool cannot see localhost.
I keep fetch out of the default Claude config now. Docs get a Makefile target with a hardcoded URL. Slower. Fine.
Did anyone try an allowlist that includes only https public hosts and still got a near-miss on DNS rebinding?