safeFetch (lib/safe-fetch.ts)

SSRF‑safe fetch that validates URLs, limits size, and follows redirects securely.

// Source: https://github.com/pascalorg/editor | License: MIT | Copyright 2026 Pascal Group Inc
// Provided via justclaw.it.com; keep this notice with the code.
import { isIPv4, isIPv6 } from 'node:net'
import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js'

/**
 * SSRF-safe fetch for user-supplied URLs (image URLs in vision tools).
 *
 * Blocks the usual server-side-request-forgery attack surface:
 * - loopback (127.0.0.0/8, ::1)
 * - link-local (169.254.0.0/16 — includes cloud metadata at 169.254.169.254)
 * - private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7)
 * - non-http(s) schemes
 * - manual-redirect with the same allowlist applied to each hop
 * - max body size (default 20 MB)
 * - request timeout (default 10 s)
 *
 * Optional allowlist via `PASC

... (truncated -- full source via MCP)