mirror of
https://github.com/coder/coder.git
synced 2026-08-31 01:03:45 +08:00
Michael Suchacz
d6b67e8e31
Routes all MCP config-directed traffic from coderd and chatd through a shared SSRF-protected HTTP client, now that organization admins, not only deployment admins, control MCP server URLs (#27942 and its stack below). ## Summary - Uses the [`coder/safedial`](https://github.com/coder/safedial) library: it blocks private and special-purpose destinations at dial time (validating resolved addresses at connection time so DNS rebinding cannot bypass the check) and rejects cross-origin redirects. - Covers the complete traffic surface: OAuth2 discovery, dynamic client registration, code exchange, token refresh, revocation, and runtime MCP connections from chatd. - Deployments that intentionally host internal MCP servers opt in via the new `--mcp-allowed-private-cidrs` (`CODER_MCP_ALLOWED_PRIVATE_CIDRS`) option. - Includes the deployment configuration surface, generated docs, CLI goldens, TypeScript types, and regression coverage for each traffic path. ## Merge window This protection originally lived inside #27942 and was split out to keep that diff reviewable. Until this PR lands, the stack below ships with only main's existing discovery IP-range guard (`CODER_MCP_OAUTH2_DISCOVERY_ALLOWED_IP_RANGES`), while org admins can already point MCP configs at arbitrary URLs. This PR should merge promptly after the stack below it. Top of the MCP org-separation stack (CODAGT-711 -> CODAGT-717 audit -> CODAGT-712 ACLs -> CODAGT-806 token RBAC -> CODAGT-714 org picker -> this PR). > Mux (AI agent) authored this PR on Mike's behalf. <!-- mux-attribution: model=claude-fable-5 thinking=high -->