amal66 tries to lock down Mike's connector back door
The proposed change would stop user-supplied AI connectors from turning Mike's server into a route into its own private network.
MCP connectors let Mike reach outside services, but their web addresses can be chosen by users. amal66's closed proposal tackles the uncomfortable consequence: a malicious address could try to make the platform contact internal systems or cloud credential services that an ordinary user cannot reach.
The safeguard would have:
- blocked private, reserved and hard-to-spot IPv6 network addresses;
- applied the same checks to connector sign-in and token renewal, not just the first connection;
- verified the address at the moment of connection, limiting a trick where a domain changes from public to private after an initial check;
- refused unsafe redirects and unrecognised addresses by default.
It was closed without merging, so this is a useful security direction rather than a shipped protection.
So what Teams exposing connectors to user-selected services should care because this is the boundary between a helpful integration and an attacker borrowing the platform's network access.
Spotted something wrong? Or know the PR text has fresher detail than the writeup above?