amal66 closes a dangerous back door in bring-your-own connectors

The fork makes it far harder for a normal account to turn a connector into a probe of the platform's private systems.

securityintegration

Connectors let an organisation link Mike to outside services, but the platform has to contact the address supplied by the user. amal66 has put a serious safety check around that step: requests to private networks, cloud credential services, databases and internal admin tools are refused before a connection opens.

The protection checks where an address actually leads, rather than trusting its name. It also blocks obscure address formats, refuses anything it cannot safely classify, prevents public links from redirecting into private systems, and closes a DNS trick that could swap a safe address for an internal one at connection time. The same controls now cover connector sign-in and token refresh steps.

So what Firms using shared legal-AI infrastructure should care because one tenant's connector should never become a route to everyone else's data.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

4 commits from amal66/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`22169c14`	security: SSRF guardrails for server-side connector fetches	Amalanand Muthukumaran	2026-07-25	↗ GitHub
commit body Port the fork's SSRF hardening for MCP connector egress into the upstream layout: - Extract private/reserved IP classification into lib/privateIp.ts and fix IPv6 gaps: fe80::/10 link-local matching (the /^fe[89ab]:/ regex only matched the hextet "fe8:" and let fe80::1 through), hex-form IPv4-mapped addresses (::ffff:a00:1), NAT64 (64:ff9b::/96) and 6to4 (2002::/16) embedded IPv4 ranges. - Strip brackets from IPv6 literals in validateRemoteMcpUrl so [::1] et al. are classified by the private-IP guard instead of falling through to DNS lookup. - Route all OAuth egress (metadata fetch, discovery probes, dynamic client registration, token refresh) through guardedFetch so every outbound MCP request gets the same HTTPS-only / blocked-host / private-IP / no-redirect checks; the discovery probes were previously raw, unvalidated fetches. - Add SSRF regression tests (run atop the test-harness PR) and exclude test files from the tsc production build. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CEguyEgXa9JjCciXCcVemC
`e639dbfc`	security: block IPv4-compatible IPv6 embeds in the private-IP guard	Amalanand Muthukumaran	2026-07-25	↗ GitHub
`f28d9d14`	security: pin MCP egress DNS at connect time (undici dispatcher)	Amalanand Muthukumaran	2026-07-25	↗ GitHub
commit body Restore the fork's pinnedGuardAgent verbatim: guardedFetch now routes through a per-request undici Agent whose connect-time DNS lookup runs the private-IP guard and returns only validated addresses, so the address we validate is the address we connect to - closing the DNS-rebinding/TOCTOU window between the pre-fetch validation lookup and the socket's own resolution. Adds the undici runtime dependency the fork ships for exactly this purpose ("undici": "^6.27.0"), and restores the dispatcher assertions in the SSRF test so it matches the fork's byte for byte. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CEguyEgXa9JjCciXCcVemC
`65cbf0ee`	security: harden SSRF IP guard and reuse dispatcher	willchen96	2026-08-03	↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1326.md from inside the repo you want the changes in.

⬇ Download capture-thread-1326.md