codex-plugin-doctor 1.50.0 → 1.52.0

package/dist/core/remote-network-policy.js

@@ -0,0 +1,125 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { BlockList, isIP, SocketAddress } from "node:net";
+export class RemoteNetworkPolicyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "RemoteNetworkPolicyError";
+    }
+}
+const blockedAddresses = new BlockList();
+const loopbackAddresses = new BlockList();
+const mappedIpv4Addresses = new BlockList();
+const ipv4CompatibleAddresses = new BlockList();
+function addIpv4Subnet(address, prefix) {
+    blockedAddresses.addSubnet(address, prefix, "ipv4");
+    blockedAddresses.addSubnet(`::ffff:${address}`, prefix + 96, "ipv6");
+}
+function addLoopbackSubnet(address, prefix) {
+    loopbackAddresses.addSubnet(address, prefix, "ipv4");
+    loopbackAddresses.addSubnet(`::ffff:${address}`, prefix + 96, "ipv6");
+}
+for (const [address, prefix] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["100.64.0.0", 10],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.0.0.0", 24],
+    ["192.0.2.0", 24],
+    ["192.88.99.0", 24],
+    ["192.168.0.0", 16],
+    ["198.18.0.0", 15],
+    ["198.51.100.0", 24],
+    ["203.0.113.0", 24],
+    ["224.0.0.0", 4],
+    ["240.0.0.0", 4]
+]) {
+    addIpv4Subnet(address, prefix);
+}
+addLoopbackSubnet("127.0.0.0", 8);
+blockedAddresses.addAddress("100.100.100.200", "ipv4");
+blockedAddresses.addAddress("100.100.100.100", "ipv4");
+for (const [address, prefix] of [
+    ["::", 128],
+    ["100::", 64],
+    ["2001::", 23],
+    ["2001:db8::", 32],
+    ["2002::", 16],
+    ["3fff::", 20],
+    ["5f00::", 16],
+    ["fc00::", 7],
+    ["fe80::", 10],
+    ["ff00::", 8]
+]) {
+    blockedAddresses.addSubnet(address, prefix, "ipv6");
+}
+loopbackAddresses.addAddress("::1", "ipv6");
+mappedIpv4Addresses.addSubnet("::ffff:0:0", 96, "ipv6");
+ipv4CompatibleAddresses.addSubnet("::", 96, "ipv6");
+for (const [address, prefix] of [
+    ["64:ff9b::", 96],
+    ["64:ff9b:1::", 48],
+    ["100:0:0:1::", 64]
+]) {
+    blockedAddresses.addSubnet(address, prefix, "ipv6");
+}
+function normalizeAddress(address, family) {
+    if ((family !== 4 && family !== 6) || isIP(address) !== family) {
+        throw new RemoteNetworkPolicyError("REMOTE_TARGET_INVALID_ADDRESS", "Remote target DNS resolution returned an invalid address.");
+    }
+    const normalized = new SocketAddress({
+        address,
+        port: 0,
+        family: family === 4 ? "ipv4" : "ipv6"
+    });
+    return { address: normalized.address, family };
+}
+function isListed(address, family, list) {
+    return list.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+export async function resolveRemoteTarget(url, options = {}) {
+    const hostname = url.hostname.startsWith("[") && url.hostname.endsWith("]")
+        ? url.hostname.slice(1, -1)
+        : url.hostname;
+    if ((url.protocol !== "http:" && url.protocol !== "https:") || !hostname || isIP(hostname) !== 0) {
+        throw new RemoteNetworkPolicyError("REMOTE_TARGET_URL_INVALID", "Remote target URL must use HTTP or HTTPS with a hostname, not an IP address literal.");
+    }
+    const lookup = options.lookup ?? (async (hostname, lookupOptions) => {
+        const answers = await dnsLookup(hostname, lookupOptions);
+        return answers.map((answer) => ({
+            address: answer.address,
+            family: answer.family
+        }));
+    });
+    let answers;
+    try {
+        answers = await lookup(hostname, { all: true, verbatim: true });
+    }
+    catch {
+        throw new RemoteNetworkPolicyError("REMOTE_TARGET_LOOKUP_FAILED", "Remote target DNS resolution failed.");
+    }
+    if (answers.length === 0) {
+        throw new RemoteNetworkPolicyError("REMOTE_TARGET_EMPTY", "Remote target DNS resolution returned no addresses.");
+    }
+    const normalizedAnswers = answers.map((answer) => normalizeAddress(answer.address, answer.family));
+    for (const answer of normalizedAnswers) {
+        const isLoopback = isListed(answer.address, answer.family, loopbackAddresses);
+        const isMappedIpv4 = answer.family === 6 && isListed(answer.address, answer.family, mappedIpv4Addresses);
+        const isIpv4Compatible = answer.family === 6 && isListed(answer.address, answer.family, ipv4CompatibleAddresses);
+        const isForbidden = isListed(answer.address, answer.family, blockedAddresses)
+            || isIpv4Compatible
+            || (isMappedIpv4 && !isLoopback);
+        if ((isForbidden && !isLoopback) || (isLoopback && !options.allowLocalNetwork)) {
+            throw new RemoteNetworkPolicyError("REMOTE_TARGET_FORBIDDEN", "Remote target resolved to a forbidden address.");
+        }
+    }
+    const selected = normalizedAnswers[0];
+    return {
+        hostname,
+        address: selected.address,
+        family: selected.family,
+        local: isListed(selected.address, selected.family, loopbackAddresses)
+    };
+}

package/dist/core/remote-oauth-readiness.d.ts

@@ -0,0 +1,12 @@
+import { type BoundedHttpRequestOptions, type BoundedHttpResponse } from "./bounded-http-client.js";
+import type { Finding } from "../domain/types.js";
+export type RemoteOAuthReadinessRequest = (rawUrl: string, options?: BoundedHttpRequestOptions) => Promise<BoundedHttpResponse>;
+export interface RemoteOAuthReadinessOptions {
+    request?: RemoteOAuthReadinessRequest;
+    requestOptions?: Pick<BoundedHttpRequestOptions, "allowLocalNetwork" | "lookup" | "timeoutMs">;
+}
+export interface RemoteOAuthReadinessResult {
+    status: "pass" | "fail";
+    findings: Finding[];
+}
+export declare function checkRemoteOAuthReadiness(resourceUrl: string, wwwAuthenticate: Array<string | string[]>, options?: RemoteOAuthReadinessOptions): Promise<RemoteOAuthReadinessResult>;

package/dist/core/remote-oauth-readiness.js

@@ -0,0 +1,295 @@
+import { isIP } from "node:net";
+import { requestBoundedHttp } from "./bounded-http-client.js";
+const MAX_DISCOVERY_CANDIDATES = 4;
+const MAX_DISCOVERY_TIMEOUT_MS = 3_000;
+function failure(id) {
+    return {
+        status: "fail",
+        findings: [{
+                id,
+                severity: "fail",
+                message: "The remote MCP server authorization metadata could not be validated.",
+                impact: "Protected MCP endpoints cannot be safely assessed without valid OAuth discovery metadata.",
+                suggestedFix: "Publish valid HTTPS protected-resource and authorization-server metadata without credentials, queries, or fragments."
+            }]
+    };
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mediaType(headers) {
+    const value = headers["content-type"];
+    const source = Array.isArray(value) ? value[0] : value;
+    return typeof source === "string" ? source.split(";", 1)[0]?.trim().toLowerCase() ?? null : null;
+}
+function parseJsonObject(body) {
+    try {
+        const parsed = JSON.parse(body.toString("utf8"));
+        return isPlainObject(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function safeHttpsUrl(value) {
+    if (typeof value !== "string")
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" ||
+            !url.hostname ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            url.hostname.startsWith("[") ||
+            isIP(url.hostname) !== 0) {
+            return null;
+        }
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+function insertWellKnown(resourceUrl, suffix) {
+    const url = new URL(resourceUrl);
+    const path = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+    return `${url.origin}/.well-known/${suffix}${path}`;
+}
+function oidcDiscoveryUrl(issuer) {
+    const url = new URL(issuer);
+    return `${url.origin}${url.pathname.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+function splitTopLevelCommas(value) {
+    const parts = [];
+    let start = 0;
+    let quoted = false;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index];
+        if (quoted && character === "\\") {
+            index += 1;
+            if (index >= value.length)
+                return null;
+            continue;
+        }
+        if (character === "\"") {
+            quoted = !quoted;
+            continue;
+        }
+        if (!quoted && character === ",") {
+            parts.push(value.slice(start, index));
+            start = index + 1;
+        }
+    }
+    return quoted ? null : [...parts, value.slice(start)];
+}
+function parseAuthParam(value) {
+    const match = /^([!#$%&'*+.^`|~\w-]+)[ \t]*=[ \t]*(.*)$/.exec(value);
+    if (match === null)
+        return null;
+    const name = match[1];
+    const rawValue = match[2].trim();
+    if (rawValue.length === 0)
+        return null;
+    if (!rawValue.startsWith("\"")) {
+        return /[\s"]/u.test(rawValue) ? null : { name, value: rawValue };
+    }
+    if (!rawValue.endsWith("\"") || rawValue.length === 1)
+        return null;
+    let decoded = "";
+    for (let index = 1; index < rawValue.length - 1; index += 1) {
+        const character = rawValue[index];
+        if (character === "\\") {
+            index += 1;
+            if (index >= rawValue.length - 1)
+                return null;
+            decoded += rawValue[index];
+            continue;
+        }
+        if (character === "\"")
+            return null;
+        decoded += character;
+    }
+    return { name, value: decoded };
+}
+function parseChallenge(value) {
+    const match = /^([!#$%&'*+.^`|~\w-]+)(?:[ \t]+(.*))?$/.exec(value);
+    if (match === null)
+        return null;
+    const scheme = match[1];
+    const credentials = match[2];
+    if (credentials === undefined || credentials.trim().length === 0)
+        return { scheme, parameter: null };
+    const parameter = parseAuthParam(credentials);
+    if (parameter !== null)
+        return { scheme, parameter };
+    return /^[A-Za-z0-9\-._~+/]+={0,}$/.test(credentials) ? { scheme, parameter: null } : null;
+}
+function parseBearerResourceMetadata(headers) {
+    const values = [];
+    let specified = false;
+    for (const header of headers.flatMap((value) => Array.isArray(value) ? value : [value])) {
+        const parts = splitTopLevelCommas(header);
+        if (parts === null)
+            return null;
+        let scheme = null;
+        for (const part of parts) {
+            const token = part.trim();
+            if (token.length === 0)
+                return null;
+            const parameter = parseAuthParam(token);
+            if (parameter !== null) {
+                if (scheme === null)
+                    return null;
+                if (scheme.toLowerCase() === "bearer" && parameter.name.toLowerCase() === "resource_metadata") {
+                    specified = true;
+                    values.push(parameter.value);
+                }
+                continue;
+            }
+            const challenge = parseChallenge(token);
+            if (challenge === null)
+                return null;
+            scheme = challenge.scheme;
+            if (scheme.toLowerCase() === "bearer" && challenge.parameter?.name.toLowerCase() === "resource_metadata") {
+                specified = true;
+                values.push(challenge.parameter.value);
+            }
+        }
+    }
+    return { specified, values };
+}
+async function fetchMetadata(url, request, requestOptions, deadline) {
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0)
+        return { kind: "unavailable" };
+    let timeout;
+    try {
+        const response = await Promise.race([
+            request(url, {
+                ...requestOptions,
+                timeoutMs: Math.max(1, Math.floor(remainingMs)),
+                method: "GET",
+                headers: { Accept: "application/json" }
+            }),
+            new Promise((_resolve, reject) => {
+                timeout = setTimeout(() => reject(new Error("OAuth discovery timed out.")), remainingMs);
+            })
+        ]);
+        if (response.statusCode === 404)
+            return { kind: "not-found" };
+        if (response.statusCode !== 200 || mediaType(response.headers) !== "application/json") {
+            return { kind: "unavailable" };
+        }
+        const metadata = parseJsonObject(response.body);
+        return metadata === null ? { kind: "invalid" } : { kind: "ok", metadata };
+    }
+    catch {
+        return { kind: "unavailable" };
+    }
+    finally {
+        if (timeout !== undefined)
+            clearTimeout(timeout);
+    }
+}
+function validProtectedResourceMetadata(metadata, resourceUrl) {
+    if (metadata.resource !== resourceUrl || !Array.isArray(metadata.authorization_servers) || metadata.authorization_servers.length === 0) {
+        return null;
+    }
+    const issuers = metadata.authorization_servers.map(safeHttpsUrl);
+    if (!issuers.every((issuer) => issuer !== null))
+        return null;
+    const uniqueIssuers = [...new Set(issuers)];
+    return uniqueIssuers.length <= MAX_DISCOVERY_CANDIDATES ? uniqueIssuers : null;
+}
+function validAuthorizationServerMetadata(metadata, issuer) {
+    return (metadata.issuer === issuer &&
+        safeHttpsUrl(metadata.authorization_endpoint) !== null &&
+        safeHttpsUrl(metadata.token_endpoint) !== null);
+}
+async function authorizationServerIsReady(issuer, request, requestOptions, deadline) {
+    const rfc8414 = await fetchMetadata(insertWellKnown(issuer, "oauth-authorization-server"), request, requestOptions, deadline);
+    if (rfc8414.kind === "ok")
+        return validAuthorizationServerMetadata(rfc8414.metadata, issuer) ? "pass" : "invalid";
+    if (rfc8414.kind === "unavailable")
+        return "unavailable";
+    const oidcUrls = [...new Set([
+            insertWellKnown(issuer, "openid-configuration"),
+            oidcDiscoveryUrl(issuer)
+        ])];
+    for (const oidcUrl of oidcUrls) {
+        const oidc = await fetchMetadata(oidcUrl, request, requestOptions, deadline);
+        if (oidc.kind === "ok")
+            return validAuthorizationServerMetadata(oidc.metadata, issuer) ? "pass" : "invalid";
+        if (oidc.kind === "unavailable")
+            return "unavailable";
+    }
+    return "invalid";
+}
+export async function checkRemoteOAuthReadiness(resourceUrl, wwwAuthenticate, options = {}) {
+    const request = options.request ?? requestBoundedHttp;
+    const explicit = parseBearerResourceMetadata(wwwAuthenticate);
+    if (explicit === null)
+        return failure("plugin.runtime.remote.authorization.metadata.invalid");
+    const metadataCandidates = explicit.specified
+        ? explicit.values.map(safeHttpsUrl)
+        : [
+            insertWellKnown(resourceUrl, "oauth-protected-resource"),
+            `${new URL(resourceUrl).origin}/.well-known/oauth-protected-resource`
+        ].map(safeHttpsUrl);
+    if (!metadataCandidates.every((url) => url !== null)) {
+        return failure("plugin.runtime.remote.authorization.metadata.invalid");
+    }
+    const metadataUrls = [...new Set(metadataCandidates)];
+    if (metadataUrls.length > MAX_DISCOVERY_CANDIDATES)
+        return failure("plugin.runtime.remote.authorization.metadata.invalid");
+    const suppliedTimeoutMs = options.requestOptions?.timeoutMs;
+    const timeoutMs = typeof suppliedTimeoutMs === "number" && Number.isFinite(suppliedTimeoutMs)
+        ? Math.max(0, Math.min(suppliedTimeoutMs, MAX_DISCOVERY_TIMEOUT_MS))
+        : MAX_DISCOVERY_TIMEOUT_MS;
+    const deadline = Date.now() + timeoutMs;
+    let issuers = null;
+    let protectedMetadataFetchedInvalid = false;
+    let protectedMetadataUnavailable = false;
+    for (const metadataUrl of metadataUrls) {
+        const reply = await fetchMetadata(metadataUrl, request, options.requestOptions, deadline);
+        if (reply.kind === "ok") {
+            const candidateIssuers = validProtectedResourceMetadata(reply.metadata, resourceUrl);
+            if (candidateIssuers !== null) {
+                issuers = candidateIssuers;
+                break;
+            }
+            protectedMetadataFetchedInvalid = true;
+            if (!explicit.specified)
+                return failure("plugin.runtime.remote.authorization.metadata.invalid");
+            continue;
+        }
+        if (reply.kind === "invalid") {
+            protectedMetadataFetchedInvalid = true;
+            if (!explicit.specified)
+                return failure("plugin.runtime.remote.authorization.metadata.invalid");
+            continue;
+        }
+        protectedMetadataUnavailable = true;
+        if (!explicit.specified && reply.kind === "unavailable") {
+            return failure("plugin.runtime.remote.authorization.metadata.unavailable");
+        }
+    }
+    if (issuers === null)
+        return failure(protectedMetadataFetchedInvalid
+            ? "plugin.runtime.remote.authorization.metadata.invalid"
+            : protectedMetadataUnavailable
+                ? "plugin.runtime.remote.authorization.metadata.unavailable"
+                : "plugin.runtime.remote.authorization.metadata.invalid");
+    let unavailable = false;
+    for (const issuer of issuers) {
+        const readiness = await authorizationServerIsReady(issuer, request, options.requestOptions, deadline);
+        if (readiness === "pass")
+            return { status: "pass", findings: [] };
+        unavailable ||= readiness === "unavailable";
+    }
+    return failure(unavailable
+        ? "plugin.runtime.remote.authorization.metadata.unavailable"
+        : "plugin.runtime.remote.authorization.metadata.invalid");
+}

package/dist/core/remote-url-policy.d.ts

@@ -0,0 +1,7 @@
+export interface RemoteUrlInspection {
+    parsedUrl: URL | null;
+    sanitizedUrl: string | null;
+    isLoopbackHost: boolean;
+    issues: Array<"invalid" | "unsupported_scheme" | "credentials" | "query" | "fragment" | "ip_literal" | "insecure_non_loopback">;
+}
+export declare function inspectRemoteMcpUrl(rawUrl: string): RemoteUrlInspection;

package/dist/core/remote-url-policy.js

@@ -0,0 +1,49 @@
+function isIpLiteral(hostname) {
+    return (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(hostname) ||
+        /^\[[0-9a-f:.]+\]$/i.test(hostname));
+}
+export function inspectRemoteMcpUrl(rawUrl) {
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(rawUrl);
+    }
+    catch {
+        return {
+            parsedUrl: null,
+            sanitizedUrl: null,
+            isLoopbackHost: false,
+            issues: ["invalid"]
+        };
+    }
+    const issues = [];
+    const isSupportedScheme = parsedUrl.protocol === "http:" || parsedUrl.protocol === "https:";
+    const isAbsoluteHttpUrl = /^https?:\/\//i.test(rawUrl);
+    const isLoopbackHost = parsedUrl.hostname.toLowerCase() === "localhost";
+    if (!isSupportedScheme) {
+        issues.push("unsupported_scheme");
+    }
+    else if (!isAbsoluteHttpUrl || !parsedUrl.hostname) {
+        issues.push("invalid");
+    }
+    if (parsedUrl.username || parsedUrl.password) {
+        issues.push("credentials");
+    }
+    if (parsedUrl.search || rawUrl.includes("?")) {
+        issues.push("query");
+    }
+    if (parsedUrl.hash || rawUrl.includes("#")) {
+        issues.push("fragment");
+    }
+    if (isIpLiteral(parsedUrl.hostname)) {
+        issues.push("ip_literal");
+    }
+    if (parsedUrl.protocol === "http:" && !isLoopbackHost) {
+        issues.push("insecure_non_loopback");
+    }
+    return {
+        parsedUrl,
+        sanitizedUrl: `${parsedUrl.origin}${parsedUrl.pathname}`,
+        isLoopbackHost,
+        issues
+    };
+}

package/dist/core/runtime-plan.d.ts

@@ -4,6 +4,7 @@ import type { RuntimeExecutionEvidence, RuntimeSandboxMode } from "../domain/typ
 type RuntimePlanStatus = "pass" | "warn" | "fail";
 type RuntimePlanRiskLevel = "low" | "medium" | "high";
 type RuntimePlanTransport = "stdio" | "http";
+type RemoteNetworkClass = "public_https" | "loopback_http" | "loopback_https" | "invalid";
 export interface RuntimePlanServer {
     name: string;
     transport: RuntimePlanTransport;
@@ -11,7 +12,9 @@ export interface RuntimePlanServer {
     args: string[];
     cwd: string | null;
     url: string | null;
+    networkClass?: RemoteNetworkClass;
     probeMethods: string[];
+    approvalRequirements?: string[];
     riskLevel: RuntimePlanRiskLevel;
     riskReasons: string[];
 }

package/dist/core/runtime-plan.js

@@ -5,6 +5,7 @@ import { discoverPackage } from "./discover-package.js";
 import { readJsonFile } from "./read-json-file.js";
 import { buildSecurityAudit } from "../security/security-audit.js";
 import { DOCKER_RUNTIME_IMAGE } from "./runtime-sandbox.js";
+import { inspectRemoteMcpUrl } from "./remote-url-policy.js";
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -47,6 +48,26 @@ function buildRisk(serverName, serverConfig, findings) {
         riskReasons: [...new Set(riskReasons)]
     };
 }
+function remoteProbeMethods() {
+    return [
+        "POST initialize",
+        "POST notifications/initialized",
+        "GET OAuth protected-resource metadata (401 only)",
+        "GET OAuth authorization-server metadata (401 only)"
+    ];
+}
+function remoteNetworkClass(rawUrl) {
+    const inspection = inspectRemoteMcpUrl(rawUrl);
+    if (inspection.parsedUrl === null ||
+        (inspection.parsedUrl.protocol !== "http:" && inspection.parsedUrl.protocol !== "https:") ||
+        !inspection.parsedUrl.hostname) {
+        return "invalid";
+    }
+    if (inspection.isLoopbackHost) {
+        return inspection.parsedUrl.protocol === "http:" ? "loopback_http" : "loopback_https";
+    }
+    return "public_https";
+}
 function planDigestPayload(plan) {
     return {
         schemaVersion: plan.schemaVersion,
@@ -119,6 +140,8 @@ export async function buildDoctorRuntimePlan(targetPath, generatedAt = new Date(
         const command = typeof serverConfig.command === "string" ? serverConfig.command : null;
         const url = typeof serverConfig.url === "string" ? serverConfig.url : null;
         const { riskLevel, riskReasons } = buildRisk(serverName, serverConfig, security.findings);
+        const networkClass = url ? remoteNetworkClass(url) : undefined;
+        const sanitizedUrl = url ? inspectRemoteMcpUrl(url).sanitizedUrl : null;
         return {
             name: serverName,
             transport: command ? "stdio" : "http",
@@ -127,19 +150,28 @@ export async function buildDoctorRuntimePlan(targetPath, generatedAt = new Date(
                 ? serverConfig.args.filter((arg) => typeof arg === "string")
                 : [],
             cwd: command ? normalizeCwd(discoveredPackage.rootPath, serverConfig.cwd) : null,
-            url,
+            url: sanitizedUrl,
+            ...(networkClass ? { networkClass } : {}),
             probeMethods: command
                 ? [
                     "initialize",
                     "tools/list",
                     "tools/call:safe-only",
+                    "tasks/list:declared-2025-11-only",
                     "resources/list",
                     "resources/read:first-resource-only",
                     "resources/templates/list",
                     "prompts/list",
                     "prompts/get:first-prompt-only"
                 ]
-                : [],
+                : url ? remoteProbeMethods() : [],
+            ...(url
+                ? {
+                    approvalRequirements: networkClass === "loopback_http" || networkClass === "loopback_https"
+                        ? ["--runtime", "--allow-network", "--allow-local-network"]
+                        : ["--runtime", "--allow-network"]
+                }
+                : {}),
             riskLevel,
             riskReasons
         };
@@ -244,7 +276,9 @@ export function renderDoctorRuntimePlanMarkdown(plan) {
         "## Execution Boundary",
         "",
         "- This plan is non-executing.",
+        "- Probe methods explicitly exclude task create, get, result, and cancel operations, plus sampling and elicitation requests.",
         "- Runtime probes require explicit operator approval before local MCP servers are started.",
+        "- Any remote target whose DNS resolves to loopback requires `--allow-local-network`, even if its URL looks public.",
         "- The approval digest changes when command, args, cwd, probe methods, risk reasons, or findings change.",
         "- Runtime approval is a review gate, not an OS, VM, or container sandbox.",
         "",

package/dist/core/runtime-policy.js

@@ -38,7 +38,8 @@ function strongestDecision(decisions) {
     return "allow";
 }
 function buildRecommendation(plan, decision, reasons) {
-    if (plan.summary.executableServerCount === 0) {
+    const hasRemoteServer = plan.servers.some((server) => server.transport === "http");
+    if (plan.summary.executableServerCount === 0 && !hasRemoteServer) {
         return {
             decision: "allow",
             reason: "No executable local MCP runtime servers were found.",
@@ -78,6 +79,9 @@ function buildRecommendation(plan, decision, reasons) {
             actions: [
                 "Review command, args, cwd, URL, probe methods, and risk reasons before execution.",
                 "Approve the exact plan digest with `check --runtime --require-runtime-approval --runtime-approval-digest <digest>`.",
+                ...(hasRemoteServer
+                    ? ["Remote MCP probing also requires `--runtime --allow-network`; any target that DNS resolves to loopback additionally requires `--allow-local-network`."]
+                    : []),
                 "Use `doctor runtime-plan --markdown` when the approval needs to be preserved with release evidence."
             ]
         };

package/dist/core/runtime-probe.d.ts

@@ -1,6 +1,15 @@
 import type { DiscoveredPackage, RuntimeProbeResult, RuntimeSandboxMode } from "../domain/types.js";
-export declare function probeRuntime(discoveredPackage: DiscoveredPackage, options?: {
+import { type RemoteMcpRequest } from "./remote-mcp-probe.js";
+import type { RemoteLookup } from "./remote-network-policy.js";
+export declare function probeRuntime(discoveredPackage: DiscoveredPackage, options?: RuntimeProbeOptions): Promise<RuntimeProbeResult>;
+export interface RuntimeProbeOptions {
     startupTimeoutMs?: number;
     sandbox?: RuntimeSandboxMode;
     transcript?: (line: string) => void;
-}): Promise<RuntimeProbeResult>;
+    allowNetwork?: boolean;
+    allowLocalNetwork?: boolean;
+    remoteRequestTimeoutMs?: number;
+    remoteLookup?: RemoteLookup;
+    remoteRequest?: RemoteMcpRequest;
+}
+export declare function probeRuntimeConfig(rootPath: string, mcpConfigPath: string, options?: RuntimeProbeOptions): Promise<RuntimeProbeResult>;