security: finish MCP incident remediation after #50 merged with failing CI

[reprewindai-dev]

Observed current state

PR #50 (8182ea67702aef224642e02735402b415bc4a262) merged as eb38524268cc3b4bcc767b4c8ce7794c91c777c9 even though exact-head cAPI CI run 32644995839 concluded failure.

The merged source directionally closes the reported unauthenticated MCP inventory/registration, production local-process execution, full-process-env inheritance, and direct-proxy authentication defects. This is source remediation only, not deployed/runtime verification.

Remaining security work

1. Audit authenticated remote-http, remote-sse, and OpenAPI registration for SSRF/egress abuse. Authentication alone must not authorize arbitrary internal/link-local/loopback/private-network destinations. Apply canonical URL parsing, scheme restrictions, DNS/IP resolution checks, redirect revalidation, and an explicit egress/host policy appropriate to cAPI.
2. Add negative tests for loopback, RFC1918/private, link-local/metadata, IPv6-local/private, hostname-to-private resolution, and redirect-to-private targets. Preserve intentional explicitly configured internal targets through a narrow allowlist/policy rather than a general bypass.
3. Re-run the fix(security): close unauthenticated MCP host execution and proxy bypass #50 incident regressions on the current default-branch head: unauthenticated GET/POST /api/mcp/servers; production local-process; direct proxy missing/wrong key; no internal/admin credential forwarding; spawned local-process environment contains no cAPI secrets.
4. Repair/execute cAPI CI so exact-head tests/lint/build/dependency/security checks actually pass. Do not classify fix(security): close unauthenticated MCP host execution and proxy bypass #50 as VERIFIED while its exact-head CI is red.
5. Independently verify the deployed runtime after restart: deployed SHA, HTTP health/protocol identity, actual listener 3003, and Traefik route must agree. Only then proceed to Gnomledger→cAPI registration verification.

Truth boundary

observed_current_responsibilities: cAPI remains canonical Interlink/integration layer; CAPPO remains consequence-bearing governance/execution authority.

reported_runtime_state: cAPI 3003.

verified_runtime_state: NOT_VERIFIED.

Do not commit credentials, internal keys, provider secrets, or concrete private infrastructure addresses.

[reprewindai-dev]

@jules Please implement the remaining MCP incident remediation on current cAPI main, preserving merged PR #50 exactly where it is correct. Keep this narrowly scoped to remote MCP/OpenAPI registration egress safety and incident regressions.

Required changes:

1. Add one canonical outbound-target validator used by remote-http, remote-sse, OpenAPI openapi_url, and OpenAPI base_url before any connection/fetch.
2. Permit only intended http:/https: schemes. Reject credentials-in-URL, fragments where inappropriate, malformed/ambiguous hosts, loopback, RFC1918/private, link-local/metadata, unspecified, multicast/reserved, and IPv6 local/private targets.
3. Resolve hostnames and reject if any usable resolution is non-public unless the destination is covered by a narrow explicit server-side allowlist/policy. Do not accept caller-controlled bypass flags.
4. Revalidate every redirect destination with the same policy; do not follow a redirect from a public host into private/link-local space.
5. Cover hostname→private DNS resolution and redirect→private negatives, plus direct IPv4/IPv6 private/local targets. Preserve intentional explicitly configured internal MCP destinations only through documented deployment policy, never a generic exception.
6. Re-run and retain all fix(security): close unauthenticated MCP host execution and proxy bypass #50 incident regressions: unauthenticated GET/POST /api/mcp/servers; production local-process; direct proxy missing/wrong key; internal/admin credentials not forwarded; spawned stdio environment contains no cAPI service secrets.
7. Add focused tests proving safe public remote MCP/OpenAPI registration still works after validation.
8. Do not commit secrets, internal addresses, or concrete production topology. Do not claim runtime verification from source/tests.

Keep cAPI as canonical Interlink; CAPPO remains consequence-bearing execution authority. Leave runtime NOT_VERIFIED until deployed SHA + HTTP/protocol identity + listener 3003 + Traefik route independently agree. Open a small draft PR from current main and keep it draft until exact-head test/lint/build/dependency/security checks actually execute and pass.

[reprewindai-dev]

Current main has also advanced to signed docs commit 8d6a692ecae8d239692f9b0bbb091854da6c3372 (docs: freeze hosted MCP security boundary). Preserve its useful source-vs-runtime truth language, but amend docs/MCP_SECURITY_BOUNDARY.md with the remote-transport egress invariant when implementing this issue: "remote MCP" is not intrinsically safe. Document the canonical URL/DNS/IP/redirect validation and narrow server-controlled allowlist policy so future work cannot read “Hosted cAPI should use remote MCP transports” as permission for arbitrary authenticated SSRF targets. This docs-only commit does not close any #52 source/runtime requirement.

[reprewindai-dev]

Fresh current-main audit on 8d6a692ecae8d239692f9b0bbb091854da6c3372 confirms #52 is still live and adds one adjacent incident-boundary requirement.

src/app/api/mcp/servers/route.ts still passes caller-selected remote-http / remote-sse descriptors directly to mcpOrchestrator.startServer() and passes caller-selected openapi_url / base_url directly to translateOpenApiToMcp() with no canonical outbound-target validation visible at the route boundary. Keep the URL/DNS/IP/redirect SSRF requirements from the earlier implementation instruction.

Also sanitize MCP registry errors before returning them. Current POST/GET responses expose instance.error, and the catch path returns err.message verbatim. Connection/DNS/transport exceptions can disclose internal hostnames, paths, ports, or other topology even to an authenticated registry caller. Return a stable public error code/message and keep detailed transport diagnostics server-side only.

Add focused regressions proving private/loopback/link-local/metadata/IPv6-local/DNS-to-private/redirect-to-private targets are denied without leaking the rejected/internal destination, while an allowed public remote MCP/OpenAPI target still works. Preserve #50's authentication, hosted-local-process ban, proxy auth, credential stripping, and sanitized stdio environment.

This is source-observed only. cAPI 3003 remains NOT_VERIFIED until deployed SHA + HTTP/protocol identity + listener + Traefik agree.

[reprewindai-dev]

Fresh current-main reconciliation on 8d6a692ecae8d239692f9b0bbb091854da6c3372: #52 must cover execution-time egress, not only registry-time URL validation.

Confirmed source paths:

• /api/mcp/servers accepts authenticated remote-sse descriptor.serverUrl and OpenAPI openapi_url / base_url without a shared outbound-target policy.
• McpDriver.connect() constructs SSEClientTransport(new URL(descriptor.serverUrl)) directly.
• translateOpenApiToMcp() performs fetch(openapiUrl) with normal redirect behavior and persists base_url for later proxy use.
• /api/proxy/[serverId]/... later builds targetUrl from that stored base_url and calls fetch(targetUrl) directly, again without DNS/IP/redirect revalidation. A one-time registration check alone is therefore insufficient against DNS changes/rebinding or redirect-to-private execution.
• The proxy also returns raw non-timeout exception text as Proxy error: ${message}, creating a second internal host/port/topology leakage path in addition to registry instance.error / caught error leakage.

Implementation requirement: one shared server-side outbound policy must be applied at registration and immediately before every outbound OpenAPI/proxy/MCP connection, with canonical scheme/credential/host validation, server-controlled allowlisting, DNS resolution and private/loopback/link-local/metadata/IPv6-local rejection, and redirect-hop revalidation or redirects disabled. Public responses must use stable sanitized error codes/messages; detailed transport diagnostics stay server-side. Also reconcile the current contract mismatch where the registry accepts remote-http but McpDriver only implements remote-sse: either implement the governed transport safely or reject remote-http explicitly instead of accepting a descriptor that can only become an error instance.

Keep this source remediation separate from runtime verification: cAPI 3003 remains NOT_VERIFIED until deployed SHA + protocol identity + listener + Traefik agree.

[reprewindai-dev]

Current-main implementation progress: draft PR #53 (fix/mcp-outbound-ssrf-boundary, exact head b09e340cb5d7537155e11fb2d047ddd350184e56) now adds shared URL/DNS/IP/allowlist validation, rejects unsupported remote-http, validates OpenAPI spec/base destinations, disables redirects on cAPI-controlled OpenAPI/proxy fetches, revalidates the stored proxy target immediately before execution, sanitizes registry/proxy errors, validates initial remote-SSE targets, updates the hosted MCP security contract, and adds focused SSRF tests. Keep #52 OPEN: SDK-managed remote-SSE redirect-hop behavior is still not proven fail-closed, and DNS validation still requires exact-head security review for rebinding/connection-time guarantees. cAPI CI run 32685877506 is queued, not passing. Runtime 3003 remains NOT_VERIFIED.

[reprewindai-dev]

Fresh exact-head review of draft #53 (b09e340cb5d7537155e11fb2d047ddd350184e56) confirms the post-#50 incident is still NOT_VERIFIED and identifies four remaining source blockers that now belong to this canonical issue:

1. DNS/IP validation is not connection-bound: the validator approves one resolution, then fetch() / SSEClientTransport can resolve the hostname again. Require a resolver/dispatcher/connection path pinned to the validated address set (preserving Host/TLS SNI) and a public-at-validation/private-at-connect rebinding regression.
2. Remote SSE still relies on SDK-managed networking without a policy-enforcing fetch, so redirects/reconnects/POST message requests are not proven to revalidate targets. Disable/constrain hosted remote-sse unless every request path can apply the outbound policy and reject redirects.
3. Direct proxy still forwards credential-bearing headers such as Authorization, Proxy-Authorization, and Cookie. Move to a safe outbound header allowlist and test that credentials/internal/hop-by-hop headers never reach the registered remote target.
4. Direct proxy URL construction can discard a configured server.base_url path prefix (for example /v1) when the requested path begins with /. Preserve the stored base pathname before revalidation/fetch.

PR #53 remains draft. Do not close this issue or promote the incident to VERIFIED until these blockers are fixed, exact-head tests/typecheck/build/security/dependency checks actually execute and pass, and deployed cAPI is independently proven by SHA + HTTP/protocol identity + listener 3003 + Traefik target.