fix(security): constrain remote MCP/OpenAPI egress targets - #53

Draft

reprewindai-dev wants to merge 8 commits into

mainfrom

fix/mcp-outbound-ssrf-boundary

Commits on Aug 24, 2026

fix(security): add fail-closed outbound target validation
reprewindai-dev
committed
f1dc25e
test(security): cover outbound target SSRF controls
reprewindai-dev
committed
d89e041
fix(security): validate MCP registration targets and sanitize errors
reprewindai-dev
committed
39869cc
fix(security): validate OpenAPI outbound targets before fetch
reprewindai-dev
committed
57efbc5
fix(security): revalidate proxy destinations before outbound fetch
reprewindai-dev
committed
4edfd20
fix(security): validate remote SSE MCP destination before connect
reprewindai-dev
committed
cbf8c51
docs(security): define hosted MCP outbound egress contract
reprewindai-dev
committed
b09e340
fix(security): constrain proxy headers and preserve upstream base paths
reprewindai-dev
committed
c75017b