@sendinel/mcp-server 1.0.67 → 1.0.68

package/build/lib/ssrf-pinned-fetch.js

@@ -5,16 +5,23 @@
 // than a cross-package import — keep both in sync if the SSRF guard changes.
 import dns from 'node:dns/promises';
 import net from 'node:net';
-import { Agent } from 'undici';
+// #4049: fetch must come from the same undici as Agent. Node's global fetch bundles its own undici and
+// rejects a foreign dispatcher (UND_ERR_INVALID_ARG) before any request, so every pinned fetch failed.
+import { Agent, fetch as undiciFetch } from 'undici';
 export function createPinnedIpDispatcher(hostname, resolved) {
     const expectedHost = hostname.toLowerCase();
     return new Agent({
         connect: {
-            lookup(requestedHost, _options, callback) {
+            lookup(requestedHost, options, callback) {
                 if (String(requestedHost).toLowerCase() !== expectedHost) {
                     callback(new Error('Pinned fetch attempted to resolve an unexpected host'), []);
                     return;
                 }
+                // Node's connect asks for every address when options.all is set; answer in the shape it asked for.
+                if (options?.all) {
+                    callback(null, [{ address: resolved.address, family: resolved.family }]);
+                    return;
+                }
                 callback(null, resolved.address, resolved.family);
             },
         },
@@ -23,7 +30,7 @@ export function createPinnedIpDispatcher(hostname, resolved) {
 }
 export function fetchPinnedToResolvedIp(url, resolved, init = {}) {
     const dispatcher = createPinnedIpDispatcher(url.hostname, resolved);
-    return fetch(url, { ...init, dispatcher });
+    return undiciFetch(url, { ...init, dispatcher });
 }
 function isPrivateIp(address) {
     if (net.isIPv4(address)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.67",
+  "version": "1.0.68",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",