prodlint 0.9.5 → 0.10.2

package/dist/index.js

@@ -516,6 +516,33 @@ async function collectWorkspaceDependencies(root, patterns) {
   }
   return deps;
 }
+async function collectNestedPackageDependencies(root) {
+  const deps = /* @__PURE__ */ new Set();
+  try {
+    const pkgFiles = await fg(["**/package.json"], {
+      cwd: root,
+      absolute: false,
+      ignore: ["**/node_modules/**", "package.json"]
+    });
+    for (const pkgFile of pkgFiles) {
+      try {
+        const raw = await readFile(resolve(root, pkgFile), "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name) deps.add(pkg.name);
+        for (const key of ["dependencies", "devDependencies", "peerDependencies"]) {
+          if (pkg[key] && typeof pkg[key] === "object") {
+            for (const dep of Object.keys(pkg[key])) {
+              deps.add(dep);
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
 async function buildProjectContext(root, files) {
   let packageJson = null;
   let declaredDependencies = /* @__PURE__ */ new Set();
@@ -543,6 +570,10 @@ async function buildProjectContext(root, files) {
       declaredDependencies.add(dep);
     }
   }
+  const nestedDeps = await collectNestedPackageDependencies(root);
+  for (const dep of nestedDeps) {
+    declaredDependencies.add(dep);
+  }
   for (const dep of declaredDependencies) {
     const framework = DEPENDENCY_TO_FRAMEWORK[dep];
     if (framework) {
@@ -4709,6 +4740,14 @@ var STATUS_ICONS = {
   info: pc.blue
 };
 
+// src/web-scanner/index.ts
+import { lookup as dnsLookup } from "dns";
+import { lookup as dnsLookupAll } from "dns/promises";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
+
 // src/web-scanner/checks.ts
 function make(id, name, description, maxPoints, severity, status, details) {
   return {
@@ -4848,76 +4887,153 @@ function getDomain(url) {
     return url;
   }
 }
-var PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "metadata.google.internal"]);
-function isPrivateHost(hostname) {
-  if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
-  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (ipv4) {
-    const [, a, b] = ipv4.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    if (a === 100 && b >= 64 && b <= 127) return true;
-    if (a === 198 && (b === 18 || b === 19)) return true;
-  }
-  return false;
+var PRIVATE_RANGES = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["224.0.0.0", 3]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+  ["::", 96],
+  ["64:ff9b:1::", 48],
+  ["2001::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv6");
+function ipv6Groups(address) {
+  const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
+  const [head, tail] = hex.split("::");
+  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse2(head);
+  const back = parse2(tail);
+  return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
 }
-function validateRedirectUrl(responseUrl) {
-  try {
-    const parsed = new URL(responseUrl);
-    return !isPrivateHost(parsed.hostname);
-  } catch {
-    return false;
-  }
+function embeddedIPv4(address) {
+  const g = ipv6Groups(address);
+  const quad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+  const zero = (from, to) => g.slice(from, to).every((x) => x === 0);
+  if (zero(0, 5) && g[5] === 65535) return quad(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zero(2, 6)) return quad(g[6], g[7]);
+  if (g[0] === 8194) return quad(g[1], g[2]);
+  return null;
 }
-async function fetchText(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return null;
-    return r.ok ? await r.text() : null;
-  } catch {
-    return null;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  const family = isIP(ip);
+  if (family === 4) return PRIVATE_RANGES.check(ip, "ipv4");
+  if (family !== 6) return false;
+  const v4 = embeddedIPv4(ip);
+  return v4 !== null && PRIVATE_RANGES.check(v4, "ipv4") || PRIVATE_RANGES.check(ip, "ipv6");
+}
+function isPrivateHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal")) return true;
+  return isPrivateAddress(host);
+}
+var guardedLookup = (hostname, options, callback) => {
+  dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) return callback(err, "");
+    const blocked = addresses.find((a) => isPrivateAddress(a.address));
+    if (blocked) {
+      return callback(Object.assign(new Error(`${hostname} resolves to private address ${blocked.address}`), { code: "EPRIVATEADDR" }), "");
+    }
+    if (options.all) return callback(null, addresses);
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+};
+var USER_AGENT = "Prodlint-WebScanner/1.0";
+var MAX_REDIRECTS = 5;
+var MAX_BODY_BYTES = 5 * 1024 * 1024;
+function flattenHeaders(res) {
+  const headers = {};
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value !== void 0) headers[key] = Array.isArray(value) ? value.join(", ") : value;
   }
+  return headers;
 }
-async function fetchHeaders(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return {};
-    const h = {};
-    r.headers.forEach((v, k) => {
-      h[k.toLowerCase()] = v;
+function readBody(res) {
+  const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+  const decoder = encoding === "gzip" || encoding === "x-gzip" ? createGunzip() : encoding === "deflate" ? createInflate() : encoding === "br" ? createBrotliDecompress() : null;
+  const stream = decoder ? res.pipe(decoder) : res;
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    let size = 0;
+    const done = () => resolve4(Buffer.concat(chunks).toString("utf8"));
+    stream.on("data", (chunk) => {
+      if (size >= MAX_BODY_BYTES) return;
+      chunks.push(chunk.subarray(0, MAX_BODY_BYTES - size));
+      size += chunk.length;
+      if (size >= MAX_BODY_BYTES) {
+        done();
+        res.destroy();
+        decoder?.destroy();
+      }
     });
-    return h;
-  } catch {
-    return {};
-  }
+    stream.on("end", done);
+    stream.on("error", reject);
+    res.on("error", reject);
+  });
 }
-async function fetchWithTiming(url, timeout = 15e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const start = Date.now();
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    const html = await r.text();
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
-    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
-  } catch {
-    return { html: null, loadTimeMs: null };
-  }
+function guardedGet(url, timeoutMs, lookup = guardedLookup) {
+  return new Promise((resolve4) => {
+    let current;
+    const finish = (result) => {
+      clearTimeout(timer);
+      current?.destroy();
+      resolve4(result);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const attempt = (target, redirectsLeft) => {
+      if (target.protocol !== "http:" && target.protocol !== "https:" || isPrivateHost(target.hostname)) return finish(null);
+      const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+      current = send(target, { agent: false, lookup, headers: { "User-Agent": USER_AGENT, "Accept-Encoding": "gzip, deflate, br" } }, (res) => {
+        const status = res.statusCode ?? 0;
+        const location = res.headers.location;
+        if (status >= 300 && status < 400 && location) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(location, target);
+          } catch {
+            return finish(null);
+          }
+          return redirectsLeft > 0 ? attempt(next, redirectsLeft - 1) : finish(null);
+        }
+        readBody(res).then((body) => finish({ status, headers: flattenHeaders(res), body }), () => finish(null));
+      });
+      current.on("error", () => finish(null));
+      current.end();
+    };
+    try {
+      attempt(new URL(url), MAX_REDIRECTS);
+    } catch {
+      finish(null);
+    }
+  });
+}
+async function fetchText(url, timeout = 8e3) {
+  const r = await guardedGet(url, timeout);
+  return r && r.status >= 200 && r.status < 300 ? r.body : null;
+}
+async function fetchPage(url, timeout = 15e3) {
+  const start = Date.now();
+  const r = await guardedGet(url, timeout);
+  const ok = r !== null && r.status >= 200 && r.status < 300;
+  return { headers: r?.headers ?? {}, html: ok ? r.body : null, loadTimeMs: ok ? Date.now() - start : null };
 }
 async function runWebScan(targetUrl) {
   const domain = getDomain(targetUrl);
-  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, pageData] = await Promise.all([
+  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, page] = await Promise.all([
     fetchText(`${targetUrl}/robots.txt`),
     fetchText(`${targetUrl}/llms.txt`),
     fetchText(`${targetUrl}/ai.txt`),
@@ -4925,10 +5041,9 @@ async function runWebScan(targetUrl) {
     fetchText(`${targetUrl}/.well-known/agent-card.json`),
     fetchText(`${targetUrl}/sitemap.xml`),
     fetchText(`${targetUrl}/.well-known/http-message-signatures-directory`),
-    fetchHeaders(targetUrl),
-    fetchWithTiming(targetUrl)
+    fetchPage(targetUrl)
   ]);
-  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, html: pageData.html, loadTimeMs: pageData.loadTimeMs };
+  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, ...page };
   const checks = allChecks.map((fn) => fn(ctx));
   const totalPoints = checks.reduce((s, c) => s + c.points, 0);
   const maxPoints = checks.reduce((s, c) => s + c.maxPoints, 0);

package/dist/mcp.js

@@ -525,6 +525,33 @@ async function collectWorkspaceDependencies(root, patterns) {
   }
   return deps;
 }
+async function collectNestedPackageDependencies(root) {
+  const deps = /* @__PURE__ */ new Set();
+  try {
+    const pkgFiles = await fg(["**/package.json"], {
+      cwd: root,
+      absolute: false,
+      ignore: ["**/node_modules/**", "package.json"]
+    });
+    for (const pkgFile of pkgFiles) {
+      try {
+        const raw = await readFile(resolve(root, pkgFile), "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name) deps.add(pkg.name);
+        for (const key of ["dependencies", "devDependencies", "peerDependencies"]) {
+          if (pkg[key] && typeof pkg[key] === "object") {
+            for (const dep of Object.keys(pkg[key])) {
+              deps.add(dep);
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
 async function buildProjectContext(root, files) {
   let packageJson = null;
   let declaredDependencies = /* @__PURE__ */ new Set();
@@ -552,6 +579,10 @@ async function buildProjectContext(root, files) {
       declaredDependencies.add(dep);
     }
   }
+  const nestedDeps = await collectNestedPackageDependencies(root);
+  for (const dep of nestedDeps) {
+    declaredDependencies.add(dep);
+  }
   for (const dep of declaredDependencies) {
     const framework = DEPENDENCY_TO_FRAMEWORK[dep];
     if (framework) {
@@ -4525,6 +4556,14 @@ async function scan(options) {
   };
 }
 
+// src/web-scanner/index.ts
+import { lookup as dnsLookup } from "dns";
+import { lookup as dnsLookupAll } from "dns/promises";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
+
 // src/web-scanner/checks.ts
 function make(id, name, description, maxPoints, severity, status, details) {
   return {
@@ -4664,72 +4703,157 @@ function getDomain(url) {
     return url;
   }
 }
-var PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "metadata.google.internal"]);
+var PRIVATE_RANGES = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["224.0.0.0", 3]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+  ["::", 96],
+  ["64:ff9b:1::", 48],
+  ["2001::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv6");
+function ipv6Groups(address) {
+  const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
+  const [head, tail] = hex.split("::");
+  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse2(head);
+  const back = parse2(tail);
+  return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
+}
+function embeddedIPv4(address) {
+  const g = ipv6Groups(address);
+  const quad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+  const zero = (from, to) => g.slice(from, to).every((x) => x === 0);
+  if (zero(0, 5) && g[5] === 65535) return quad(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zero(2, 6)) return quad(g[6], g[7]);
+  if (g[0] === 8194) return quad(g[1], g[2]);
+  return null;
+}
+function isPrivateAddress(address) {
+  const ip = address.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  const family = isIP(ip);
+  if (family === 4) return PRIVATE_RANGES.check(ip, "ipv4");
+  if (family !== 6) return false;
+  const v4 = embeddedIPv4(ip);
+  return v4 !== null && PRIVATE_RANGES.check(v4, "ipv4") || PRIVATE_RANGES.check(ip, "ipv6");
+}
 function isPrivateHost(hostname) {
-  if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
-  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (ipv4) {
-    const [, a, b] = ipv4.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    if (a === 100 && b >= 64 && b <= 127) return true;
-    if (a === 198 && (b === 18 || b === 19)) return true;
-  }
-  return false;
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal")) return true;
+  return isPrivateAddress(host);
 }
-function validateRedirectUrl(responseUrl) {
+async function resolvesToPrivateAddress(hostname) {
   try {
-    const parsed = new URL(responseUrl);
-    return !isPrivateHost(parsed.hostname);
+    const addresses = await dnsLookupAll(hostname.replace(/^\[|\]$/g, ""), { all: true });
+    return addresses.some((a) => isPrivateAddress(a.address));
   } catch {
     return false;
   }
 }
-async function fetchText(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return null;
-    return r.ok ? await r.text() : null;
-  } catch {
-    return null;
+var guardedLookup = (hostname, options, callback) => {
+  dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) return callback(err, "");
+    const blocked = addresses.find((a) => isPrivateAddress(a.address));
+    if (blocked) {
+      return callback(Object.assign(new Error(`${hostname} resolves to private address ${blocked.address}`), { code: "EPRIVATEADDR" }), "");
+    }
+    if (options.all) return callback(null, addresses);
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+};
+var USER_AGENT = "Prodlint-WebScanner/1.0";
+var MAX_REDIRECTS = 5;
+var MAX_BODY_BYTES = 5 * 1024 * 1024;
+function flattenHeaders(res) {
+  const headers = {};
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value !== void 0) headers[key] = Array.isArray(value) ? value.join(", ") : value;
   }
+  return headers;
 }
-async function fetchHeaders(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return {};
-    const h = {};
-    r.headers.forEach((v, k) => {
-      h[k.toLowerCase()] = v;
+function readBody(res) {
+  const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+  const decoder = encoding === "gzip" || encoding === "x-gzip" ? createGunzip() : encoding === "deflate" ? createInflate() : encoding === "br" ? createBrotliDecompress() : null;
+  const stream = decoder ? res.pipe(decoder) : res;
+  return new Promise((resolve5, reject) => {
+    const chunks = [];
+    let size = 0;
+    const done = () => resolve5(Buffer.concat(chunks).toString("utf8"));
+    stream.on("data", (chunk) => {
+      if (size >= MAX_BODY_BYTES) return;
+      chunks.push(chunk.subarray(0, MAX_BODY_BYTES - size));
+      size += chunk.length;
+      if (size >= MAX_BODY_BYTES) {
+        done();
+        res.destroy();
+        decoder?.destroy();
+      }
     });
-    return h;
-  } catch {
-    return {};
-  }
+    stream.on("end", done);
+    stream.on("error", reject);
+    res.on("error", reject);
+  });
 }
-async function fetchWithTiming(url, timeout = 15e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const start = Date.now();
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    const html = await r.text();
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
-    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
-  } catch {
-    return { html: null, loadTimeMs: null };
-  }
+function guardedGet(url, timeoutMs, lookup = guardedLookup) {
+  return new Promise((resolve5) => {
+    let current;
+    const finish = (result) => {
+      clearTimeout(timer);
+      current?.destroy();
+      resolve5(result);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const attempt = (target, redirectsLeft) => {
+      if (target.protocol !== "http:" && target.protocol !== "https:" || isPrivateHost(target.hostname)) return finish(null);
+      const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+      current = send(target, { agent: false, lookup, headers: { "User-Agent": USER_AGENT, "Accept-Encoding": "gzip, deflate, br" } }, (res) => {
+        const status = res.statusCode ?? 0;
+        const location = res.headers.location;
+        if (status >= 300 && status < 400 && location) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(location, target);
+          } catch {
+            return finish(null);
+          }
+          return redirectsLeft > 0 ? attempt(next, redirectsLeft - 1) : finish(null);
+        }
+        readBody(res).then((body) => finish({ status, headers: flattenHeaders(res), body }), () => finish(null));
+      });
+      current.on("error", () => finish(null));
+      current.end();
+    };
+    try {
+      attempt(new URL(url), MAX_REDIRECTS);
+    } catch {
+      finish(null);
+    }
+  });
+}
+async function fetchText(url, timeout = 8e3) {
+  const r = await guardedGet(url, timeout);
+  return r && r.status >= 200 && r.status < 300 ? r.body : null;
+}
+async function fetchPage(url, timeout = 15e3) {
+  const start = Date.now();
+  const r = await guardedGet(url, timeout);
+  const ok = r !== null && r.status >= 200 && r.status < 300;
+  return { headers: r?.headers ?? {}, html: ok ? r.body : null, loadTimeMs: ok ? Date.now() - start : null };
 }
 function normalizeUrl(input) {
   let url = input.trim();
@@ -4741,7 +4865,7 @@ function normalizeUrl(input) {
 }
 async function runWebScan(targetUrl) {
   const domain = getDomain(targetUrl);
-  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, pageData] = await Promise.all([
+  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, page] = await Promise.all([
     fetchText(`${targetUrl}/robots.txt`),
     fetchText(`${targetUrl}/llms.txt`),
     fetchText(`${targetUrl}/ai.txt`),
@@ -4749,10 +4873,9 @@ async function runWebScan(targetUrl) {
     fetchText(`${targetUrl}/.well-known/agent-card.json`),
     fetchText(`${targetUrl}/sitemap.xml`),
     fetchText(`${targetUrl}/.well-known/http-message-signatures-directory`),
-    fetchHeaders(targetUrl),
-    fetchWithTiming(targetUrl)
+    fetchPage(targetUrl)
   ]);
-  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, html: pageData.html, loadTimeMs: pageData.loadTimeMs };
+  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, ...page };
   const checks = allChecks.map((fn) => fn(ctx));
   const totalPoints = checks.reduce((s, c) => s + c.points, 0);
   const maxPoints = checks.reduce((s, c) => s + c.maxPoints, 0);
@@ -4854,7 +4977,7 @@ server.tool(
       };
     }
     const hostname = new URL(normalizedUrl).hostname;
-    if (isPrivateHost(hostname)) {
+    if (isPrivateHost(hostname) || await resolvesToPrivateAddress(hostname)) {
       return {
         content: [{ type: "text", text: "Error: Cannot scan private or internal hosts." }],
         isError: true