ruflo 3.71.3 → 3.72.0

package/README.md

@@ -112,7 +112,7 @@ User → Ruflo (CLI/MCP) → Router → Swarm → Agents → Memory → LLM prov
 
 </details>
 
-> **New to Ruflo?** You don't need to learn 314 MCP tools or 26 CLI commands. After `init`, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
+> **New to Ruflo?** You don't need to learn 406 MCP tools or 61 CLI commands. After `init`, just use Claude Code normally — the hooks system automatically routes tasks, learns from successful patterns, and coordinates agents in the background.
 
 ### An origin you can inspect
 
@@ -205,7 +205,7 @@ There are **two different install paths** with very different surface areas. Pic
 This adds slash commands and agent definitions. `ruflo-core` (installed above) does register its own MCP server on install — its tools are callable as `mcp__plugin_ruflo-core_ruflo__*` (e.g. `mcp__plugin_ruflo-core_ruflo__memory_store`), not the bare `memory_store`/`swarm_init`/`agent_spawn` names the CLI-track scaffold uses. Other plugins generally don't ship their own MCP server. For the full loop with the CLI-track tool names, use Path B below.
 
 <details>
-<summary><strong>🔌 All 35 plugins</strong></summary>
+<summary><strong>🔌 All 48 plugins</strong> (plus 3 external)</summary>
 
 #### Core & Orchestration
 
@@ -217,6 +217,14 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-loop-workers**](plugins/ruflo-loop-workers/README.md) | Schedule background tasks on a timer |
 | [**ruflo-workflows**](plugins/ruflo-workflows/README.md) | Reusable multi-step task templates |
 | [**ruflo-federation**](plugins/ruflo-federation/README.md) | Agents on different machines collaborate securely |
+| [**ruflo-console**](plugins/ruflo-console/README.md) | Cockpit inside Claude Code, and the `/ruflo` command for ruflo mods |
+| [**ruflo-mods**](plugins/ruflo-mods/README.md) | In-process Claude Code mod — routing, learning signals, and policy checks |
+| [**ruflo-ai-team**](plugins/ruflo-ai-team/README.md) | Tenant-isolated team that divides work and returns evidence |
+| [**ruflo-agntcy**](plugins/ruflo-agntcy/README.md) | AGNTCY/Outshift transport and intent-scoped tool authorization |
+| [**ruflo-bbs-federation**](plugins/ruflo-bbs-federation/README.md) | AgentBBS rooms so agents on different hosts can coordinate |
+| [**ruflo-chatgpt-federation**](plugins/ruflo-chatgpt-federation/README.md) | ChatGPT federation publisher with its own signing keys |
+| [**ruflo-x-gateway**](plugins/ruflo-x-gateway/README.md) | Signed federation messages, channels, and work claims |
+| [**ruflo-business-pods**](plugins/ruflo-business-pods/README.md) | Business-domain pod templates and a dry-run tick runner |
 
 #### Memory & Knowledge
 
@@ -237,6 +245,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-daa**](plugins/ruflo-daa/README.md) | Dynamic agent behavior and cognitive patterns |
 | [**ruflo-ruvllm**](plugins/ruflo-ruvllm/README.md) | Run local LLMs (Ollama, etc.) with smart routing |
 | [**ruflo-goals**](plugins/ruflo-goals/README.md) | Break big goals into plans and track progress |
+| [**ruflo-deepseek-harness**](plugins/ruflo-deepseek-harness/README.md) | Agents, commands, and skills for DeepSeek-backed workflows |
 
 #### Code Quality & Testing
 
@@ -245,6 +254,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-testgen**](plugins/ruflo-testgen/README.md) | Find missing tests and generate them automatically |
 | [**ruflo-browser**](plugins/ruflo-browser/README.md) | Automate browser testing with Playwright |
 | [**ruflo-jujutsu**](plugins/ruflo-jujutsu/README.md) | Analyze git diffs, score risk, suggest reviewers |
+| [**ruflo-rure**](plugins/ruflo-rure/) | Static analysis of a local JS/Electron app you are authorized to study, with file and line evidence |
 | [**ruflo-docs**](plugins/ruflo-docs/README.md) | Generate and maintain documentation automatically |
 | [**agentic-qe-fleet**](https://github.com/proffesor-for-testing/agentic-qe/tree/v3.15.17/plugins/agentic-qe-fleet) | External, maintained by [Agentic QE](https://github.com/proffesor-for-testing/agentic-qe): 11 QE agents, test generation, coverage, chaos and TDD skills, the `agentic-qe` MCP server, and a guard for AQE learning data (`/plugin install agentic-qe-fleet@ruflo`). Install it from one marketplace only, `agentic-qe` or `ruflo`: enabled from both, its mod and commands load twice |
 | [**agentdb**](https://github.com/ruvnet/agentdb/tree/plugin-v3.2.0/plugins/agentdb) | External, maintained in [ruvnet/agentdb](https://github.com/ruvnet/agentdb): agentdb's own MCP server (pinned `agentdb@3.2.0`: hybrid keyword + vector search, opt-in cross-encoder rerank), a memory-specialist agent, vector-memory / learning / diagnostics skills, `/agentdb-status`, and a guard that keeps secrets out of memory and refuses delete/reset unless allowed (`/plugin install agentdb@ruflo`). Use `ruflo-agentdb` instead if you want AgentDB through ruflo's server; the two can coexist. Install it from one marketplace only, `agentdb` or `ruflo` |
@@ -256,6 +266,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 |--------|-------------|
 | [**ruflo-security-audit**](plugins/ruflo-security-audit/README.md) | Scan for vulnerabilities and CVEs |
 | [**ruflo-aidefence**](plugins/ruflo-aidefence/README.md) | Block prompt injection, detect PII, safety scanning |
+| [**ruflo-protector**](plugins/ruflo-protector/README.md) | Optional watchdog for unattended agents — learn, notify, or enforce |
 
 #### Architecture & Methodology
 
@@ -274,6 +285,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-migrations**](plugins/ruflo-migrations/README.md) | Manage database schema changes safely |
 | [**ruflo-observability**](plugins/ruflo-observability/README.md) | Structured logs, traces, and metrics in one place |
 | [**ruflo-cost-tracker**](plugins/ruflo-cost-tracker/README.md) | Track token usage, set budgets, get cost alerts |
+| [**ruflo-ruos**](plugins/ruflo-ruos/README.md) | Run swarm agents on your own ruOS cloud desktops |
 
 #### Extensibility
 
@@ -289,6 +301,7 @@ This adds slash commands and agent definitions. `ruflo-core` (installed above) d
 | [**ruflo-iot-cognitum**](plugins/ruflo-iot-cognitum/README.md) | IoT device management — trust scoring, anomaly detection, fleets |
 | [**ruflo-neural-trader**](plugins/ruflo-neural-trader/README.md) | [`neural-trader`](https://npmjs.com/package/neural-trader) — AI trading with 4 agents, backtesting, 112+ tools |
 | [**ruflo-market-data**](plugins/ruflo-market-data/README.md) | Ingest market data, vectorize OHLCV, detect patterns |
+| [**ruflo-music**](plugins/ruflo-music/README.md) | Compose and generate music through a Cognitum Music account |
 
 </details>
 
@@ -323,6 +336,8 @@ npm install -g ruflo@latest
 claude mcp add claude-flow -- npx ruflo@latest mcp start
 ```
 
+For static inspection of local applications and binaries, see the [ruRE plugin guide](plugins/ruflo-rure/README.md).
+
 ---
 
 ## What You Get
@@ -343,7 +358,7 @@ claude mcp add claude-flow -- npx ruflo@latest mcp start
 | <img src="docs/assets/readme/icons/learning.svg" width="28" height="28" alt=""> **Self-Learning** | SONA neural patterns, ReasoningBank, trajectory learning |
 | <img src="docs/assets/readme/icons/memory.svg" width="28" height="28" alt=""> **Vector Memory** | HNSW-indexed AgentDB — measured ~1.9x faster at N=20k, ~3.2x–4.7x at N=5k vs brute force (recall@10 ~0.99); ANN wins above the crossover, ties/loses at small N. See [audit](docs/reviews/intelligence-system-audit-2026-05-29.md) + [`scripts/benchmark-intelligence.mjs`](scripts/benchmark-intelligence.mjs) |
 | <img src="docs/assets/readme/icons/workers.svg" width="28" height="28" alt=""> **Background Workers** | 12 auto-triggered workers (audit, optimize, testgaps, etc.) |
-| <img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Plugin Marketplace** | 33 native Claude Code plugins + 21 npm plugins |
+| <img src="docs/assets/readme/icons/plugins.svg" width="28" height="28" alt=""> **Plugin Marketplace** | 48 native Claude Code plugins + 14 in-tree npm plugins |
 | <img src="docs/assets/readme/icons/routing.svg" width="28" height="28" alt=""> **Multi-Provider** | Claude, GPT, Gemini, Cohere, Ollama with smart routing |
 | <img src="docs/assets/readme/icons/security.svg" width="28" height="28" alt=""> **Security** | AIDefence, input validation, CVE remediation, path traversal prevention |
 | <img src="docs/assets/readme/icons/federation.svg" width="28" height="28" alt=""> **Agent Federation** | Cross-installation agent collaboration with zero-trust security |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruflo",
-  "version": "3.71.3",
+  "version": "3.72.0",
   "description": "Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration",
   "main": "bin/ruflo.js",
   "type": "module",
@@ -40,7 +40,7 @@
     "package:rvf": "bash src/scripts/package-rvf.sh"
   },
   "dependencies": {
-    "@claude-flow/cli": "3.71.3"
+    "@claude-flow/cli": "3.72.0"
   },
   "optionalDependencies": {},
   "overrides": {

package/src/mcp-bridge/test-local-browser-guard.mjs

@@ -11,6 +11,8 @@
  *   G6. an Origin listed in MCP_CORS_ORIGIN is still accepted
  *   G7. with MCP_AUTH_TOKEN set the guard is off and bearer auth decides
  *
+ * Runs against both bridges (src/mcp-bridge and src/ruvocal/mcp-bridge).
+ *
  *   node test-local-browser-guard.mjs
  */
 import { spawn } from "node:child_process";
@@ -19,7 +21,13 @@ import path from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 
-const ENTRY = path.join(path.dirname(fileURLToPath(import.meta.url)), "index.js");
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+// Both bridges carry the same guard; ruvocal's copy missed #4226 until it was ported.
+const ENTRIES = [
+  { label: "src/mcp-bridge", entry: path.join(HERE, "index.js") },
+  { label: "src/ruvocal/mcp-bridge", entry: path.join(HERE, "..", "ruvocal", "mcp-bridge", "index.js") },
+];
+let ENTRY = ENTRIES[0].entry;
 const QUIET = {
   MCP_GROUP_INTELLIGENCE: "false",
   MCP_GROUP_AGENTS: "false",
@@ -64,6 +72,9 @@ function request(port, { method = "POST", path: p = "/mcp", headers = {}, body }
 const initialize = JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: {} });
 const json = { "Content-Type": "application/json" };
 
+for (const { label, entry } of ENTRIES) {
+ENTRY = entry;
+console.log(`\n[${label}]`);
 console.log("local-only mode (no MCP_AUTH_TOKEN)");
 await withBridge({ MCP_CORS_ORIGIN: "" }, async (port) => {
   check((await request(port, { headers: json, body: initialize })).status === 200, "G1 native client reaches /mcp");
@@ -82,6 +93,7 @@ await withBridge({ MCP_AUTH_TOKEN: "t0ken" }, async (port) => {
   const res = await request(port, { headers: { ...json, Origin: "https://example.com", Authorization: "Bearer t0ken" }, body: initialize });
   check(res.status === 200, "G7 bearer token decides when set");
 });
+}
 
 console.log(failed ? `\n${failed} check(s) failed` : "\nall checks passed");
 process.exit(failed ? 1 : 0);

package/src/ruvocal/mcp-bridge/index.js

@@ -1069,6 +1069,7 @@ app.use((req, res, next) => {
 const CORS_ALLOWLIST = (process.env.MCP_CORS_ORIGIN || "*")
   .split(",").map(s => s.trim()).filter(Boolean);
 const CORS_WILDCARD = CORS_ALLOWLIST.length === 1 && CORS_ALLOWLIST[0] === "*";
+app.use((req, res, next) => localBrowserGuard(req, res, next));
 app.use((req, res, next) => {
   const origin = req.get("origin") || "";
   if (CORS_WILDCARD) {
@@ -1087,6 +1088,43 @@ app.use((req, res, next) => {
 // ---------- Auth middleware ----------
 // No-op in local-only mode (MCP_AUTH_TOKEN unset). Enforces 401 when token is set.
 const MCP_TOKEN = process.env.MCP_AUTH_TOKEN || "";
+
+// ---------- Local-only browser guard (#4226; same guard as ruflo/src/mcp-bridge) ----------
+// Binding to loopback does not keep web pages out: any page the user opens
+// can send requests to 127.0.0.1, and a DNS-rebinding page can even make the
+// request look same-origin. CORS only decides whether the page may READ the
+// reply; a "simple" cross-origin POST runs without a preflight. So when there
+// is no MCP_AUTH_TOKEN, refuse requests that a browser sent on behalf of a
+// foreign page:
+//   - the Host header must name a loopback address (stops DNS rebinding);
+//   - a request carrying an Origin header must come from a loopback origin or
+//     from an origin listed explicitly in MCP_CORS_ORIGIN.
+// Native MCP clients (CLI, IDE, curl) send no Origin and a loopback Host.
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function hostnameOf(value) {
+  try {
+    return new URL(value.includes("://") ? value : `http://${value}`).hostname.toLowerCase();
+  } catch {
+    return "";
+  }
+}
+function isLoopbackHostname(hostname) {
+  return LOOPBACK_HOSTNAMES.has(hostname) || hostname.endsWith(".localhost");
+}
+function localBrowserGuard(req, res, next) {
+  if (MCP_TOKEN) return next();
+  if (!isLoopbackHostname(hostnameOf(req.get("host") || ""))) {
+    return res.status(403).json({ error: "forbidden host" });
+  }
+  const origin = req.get("origin");
+  if (origin !== undefined) {
+    const explicitlyAllowed = !CORS_WILDCARD && CORS_ALLOWLIST.includes(origin);
+    if (!explicitlyAllowed && !isLoopbackHostname(hostnameOf(origin))) {
+      return res.status(403).json({ error: "forbidden origin" });
+    }
+  }
+  next();
+}
 function requireAuth(req, res, next) {
   if (req.path === "/health") return next();
   if (!MCP_TOKEN) return next();

package/src/ruvocal/src/lib/server/mcp/serverTrust.ts

@@ -0,0 +1,25 @@
+import { isValidUrl, ssrfSafeFetch } from "$lib/server/urlSafety";
+import { getMcpServers } from "./registry";
+
+/**
+ * An MCP server URL the operator configured (MCP_SERVERS). Only these may use
+ * loopback, Docker-internal or other private addresses; a URL supplied in a
+ * request — including by an anonymous chat session — must be public.
+ */
+export function isConfiguredMcpUrl(url: string): boolean {
+	return getMcpServers().some((s) => s.url === url);
+}
+
+/** Whether an MCP server URL may be contacted at all. */
+export function isAllowedMcpUrl(url: string): boolean {
+	return isValidUrl(url, { allowPrivate: isConfiguredMcpUrl(url) });
+}
+
+/**
+ * The fetch an MCP transport should use: the default for operator-configured
+ * servers, and one pinned to public addresses at connect time for everything
+ * else, so a public hostname that resolves to a private address is refused.
+ */
+export function mcpFetchFor(url: string): typeof fetch | undefined {
+	return isConfiguredMcpUrl(url) ? undefined : ssrfSafeFetch;
+}

package/src/ruvocal/src/lib/server/mcp/tools.ts

@@ -2,6 +2,7 @@ import { Client } from "@modelcontextprotocol/sdk/client";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import type { McpServerConfig } from "./httpClient";
+import { mcpFetchFor } from "./serverTrust";
 import { logger } from "$lib/server/logger";
 // use console.* for lightweight diagnostics in production logs
 
@@ -71,11 +72,13 @@ async function listServerTools(
 		try {
 			const transport = new StreamableHTTPClientTransport(url, {
 				requestInit: { headers: server.headers, signal: opts.signal },
+				fetch: mcpFetchFor(server.url),
 			});
 			await client.connect(transport);
 		} catch {
 			const transport = new SSEClientTransport(url, {
 				requestInit: { headers: server.headers, signal: opts.signal },
+				fetch: mcpFetchFor(server.url),
 			});
 			await client.connect(transport);
 		}

package/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts

@@ -2,7 +2,7 @@ import { config } from "$lib/server/config";
 import { mergeMcpServers } from "./mergeServers";
 import { MessageUpdateType, type MessageUpdate } from "$lib/types/MessageUpdate";
 import { getMcpServers } from "$lib/server/mcp/registry";
-import { isValidUrl } from "$lib/server/urlSafety";
+import { isAllowedMcpUrl } from "$lib/server/mcp/serverTrust";
 import { resetMcpToolsCache } from "$lib/server/mcp/tools";
 import { getOpenAiToolsForMcp } from "$lib/server/mcp/tools";
 import type {
@@ -144,7 +144,7 @@ export async function* runMcpFlow({
 		const before = servers.slice();
 		servers = servers.filter((s) => {
 			try {
-				return isValidUrl(s.url);
+				return isAllowedMcpUrl(s.url);
 			} catch {
 				return false;
 			}

package/src/ruvocal/src/lib/server/urlSafety.spec.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import { isValidUrl } from "./urlSafety";
+
+// URLs from a request (custom MCP servers, fetch-url) must be public HTTPS.
+// The local-development allowances apply only to operator-configured URLs.
+describe("isValidUrl", () => {
+	it("accepts public HTTPS URLs", () => {
+		expect(isValidUrl("https://mcp.example.com/mcp")).toBe(true);
+		expect(isValidUrl("https://8.8.8.8/")).toBe(true);
+	});
+
+	it("refuses loopback, Docker-internal, dotless and private targets by default", () => {
+		for (const url of [
+			"http://localhost:3001/mcp",
+			"https://localhost/mcp",
+			"http://127.0.0.1:3001/mcp",
+			"https://[::1]/",
+			"http://host.docker.internal:3001/mcp",
+			"http://mongodb:27017/",
+			"http://metadata/computeMetadata/v1/",
+			"https://metadata/",
+			"https://10.0.0.5/",
+			"https://192.168.1.10/",
+			"https://169.254.169.254/latest/meta-data/",
+			"https://[fd00::1]/",
+			"https://bridge.localhost/",
+			"https://metadata.google.internal/",
+			"http://mcp.example.com/mcp",
+		]) {
+			expect(isValidUrl(url), url).toBe(false);
+		}
+	});
+
+	it("keeps the local allowances for operator-configured URLs", () => {
+		expect(isValidUrl("http://localhost:3001/mcp", { allowPrivate: true })).toBe(true);
+		expect(isValidUrl("http://mcp-bridge:3001/mcp", { allowPrivate: true })).toBe(true);
+		expect(isValidUrl("https://10.0.0.5/", { allowPrivate: true })).toBe(true);
+	});
+});

package/src/ruvocal/src/lib/server/urlSafety.ts

@@ -1,8 +1,11 @@
 import { Address4, Address6 } from "ip-address";
 import { isIP } from "node:net";
+import dns from "node:dns";
+import { Agent, fetch as undiciFetch } from "undici";
 
 const UNSAFE_IPV4_SUBNETS = [
 	"0.0.0.0/8",
+	"10.0.0.0/8",
 	"100.64.0.0/10",
 	"127.0.0.0/8",
 	"169.254.0.0/16",
@@ -25,30 +28,41 @@ function isUnsafeIp(address: string): boolean {
 			const v4 = addr.to4();
 			return UNSAFE_IPV4_SUBNETS.some((subnet) => v4.isInSubnet(subnet));
 		}
-		return addr.isLoopback() || addr.isLinkLocal();
+		// Unique-local (fc00::/7) is private address space, like 10/8 for IPv4.
+		const ula = addr.isInSubnet(new Address6("fc00::/7"));
+		return addr.isLoopback() || addr.isLinkLocal() || ula || cleanIsUnspecified(address);
 	}
 
 	return true; // Unknown format → block
 }
 
+function cleanIsUnspecified(address: string): boolean {
+	return /^(::|0:0:0:0:0:0:0:0)$/.test(address);
+}
+
 /**
  * Synchronous URL validation: checks protocol and hostname string.
+ *
+ * By default only public HTTPS URLs pass: no loopback or Docker-internal
+ * names, no dotless hosts, no private IP literals. `allowPrivate` restores the
+ * local-development allowances and is only for URLs the operator configured
+ * (MCP_SERVERS), never for URLs taken from a request.
  */
-export function isValidUrl(urlString: string): boolean {
+export function isValidUrl(urlString: string, opts: { allowPrivate?: boolean } = {}): boolean {
 	try {
 		const url = new URL(urlString.trim());
 		const hostname = url.hostname.toLowerCase();
 		// Allow HTTP for localhost/loopback/Docker-internal (dev & local MCP bridge)
-		if (
+		if (opts.allowPrivate && (
 			hostname === "localhost" ||
 			hostname === "127.0.0.1" ||
 			hostname === "::1" ||
 			hostname === "host.docker.internal"
-		) {
+		)) {
 			return url.protocol === "http:" || url.protocol === "https:";
 		}
 		// Allow HTTP for Docker-internal service names (no dots = private network)
-		if (!hostname.includes(".") && url.protocol === "http:") {
+		if (opts.allowPrivate && !hostname.includes(".") && url.protocol === "http:") {
 			return true;
 		}
 		if (url.protocol !== "https:") {
@@ -57,7 +71,10 @@ export function isValidUrl(urlString: string): boolean {
 		// If the hostname is a raw IP literal, validate it
 		const cleanHostname = hostname.replace(/^\[|]$/g, "");
 		if (isIP(cleanHostname)) {
-			return !isUnsafeIp(cleanHostname);
+			return opts.allowPrivate || !isUnsafeIp(cleanHostname);
+		}
+		if (!opts.allowPrivate && (!hostname.includes(".") || hostname.endsWith(".localhost") || hostname.endsWith(".internal") || hostname.endsWith(".local"))) {
+			return false;
 		}
 		return true;
 	} catch {
@@ -75,3 +92,37 @@ export function assertSafeIp(address: string, hostname: string): void {
 		throw new Error(`Resolved IP for ${hostname} is internal (${address})`);
 	}
 }
+
+/**
+ * Undici dispatcher that validates resolved IPs at connection time,
+ * preventing TOCTOU DNS rebinding attacks.
+ */
+export const ssrfSafeAgent = new Agent({
+	connect: {
+		lookup: (hostname, options, callback) => {
+			dns.lookup(hostname, options, (err, address, family) => {
+				if (err) return callback(err, "", 4);
+				if (typeof address === "string") {
+					try {
+						assertSafeIp(address, hostname);
+					} catch (e) {
+						return callback(e as Error, "", 4);
+					}
+				} else if (Array.isArray(address)) {
+					for (const entry of address) {
+						try {
+							assertSafeIp(entry.address, hostname);
+						} catch (e) {
+							return callback(e as Error, "", 4);
+						}
+					}
+				}
+				return callback(null, address, family);
+			});
+		},
+	},
+});
+
+/** fetch() whose connections may only reach public addresses (see ssrfSafeAgent). */
+export const ssrfSafeFetch = ((input: string | URL, init?: RequestInit) =>
+	undiciFetch(input, { ...(init as object), dispatcher: ssrfSafeAgent } as Parameters<typeof undiciFetch>[1])) as unknown as typeof fetch;

package/src/ruvocal/src/routes/api/fetch-url/+server.ts

@@ -1,8 +1,7 @@
 import { error } from "@sveltejs/kit";
 import { logger } from "$lib/server/logger.js";
-import { Agent, fetch } from "undici";
-import { isValidUrl, assertSafeIp } from "$lib/server/urlSafety";
-import dns from "node:dns";
+import { fetch } from "undici";
+import { isValidUrl, ssrfSafeAgent } from "$lib/server/urlSafety";
 
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
 const FETCH_TIMEOUT = 30000; // 30 seconds
@@ -16,36 +15,6 @@ const SECURITY_HEADERS: HeadersInit = {
 	"Referrer-Policy": "no-referrer",
 };
 
-/**
- * Undici dispatcher that validates resolved IPs at connection time,
- * preventing TOCTOU DNS rebinding attacks.
- */
-const ssrfSafeAgent = new Agent({
-	connect: {
-		lookup: (hostname, options, callback) => {
-			dns.lookup(hostname, options, (err, address, family) => {
-				if (err) return callback(err, "", 4);
-				if (typeof address === "string") {
-					try {
-						assertSafeIp(address, hostname);
-					} catch (e) {
-						return callback(e as Error, "", 4);
-					}
-				} else if (Array.isArray(address)) {
-					for (const entry of address) {
-						try {
-							assertSafeIp(entry.address, hostname);
-						} catch (e) {
-							return callback(e as Error, "", 4);
-						}
-					}
-				}
-				return callback(null, address, family);
-			});
-		},
-	},
-});
-
 export async function GET({ url }) {
 	const targetUrl = url.searchParams.get("url");
 

package/src/ruvocal/src/routes/api/mcp/health/+server.ts

@@ -5,7 +5,7 @@ import type { KeyValuePair } from "$lib/types/Tool";
 import { config } from "$lib/server/config";
 import { logger } from "$lib/server/logger";
 import type { RequestHandler } from "./$types";
-import { isValidUrl } from "$lib/server/urlSafety";
+import { isAllowedMcpUrl, mcpFetchFor } from "$lib/server/mcp/serverTrust";
 import { isStrictHfMcpLogin, hasNonEmptyToken, isExaMcpServer } from "$lib/server/mcp/hf";
 
 interface HealthCheckRequest {
@@ -40,7 +40,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 
 		// URL validation handled above
 
-		if (!isValidUrl(url)) {
+		if (!isAllowedMcpUrl(url)) {
 			return new Response(
 				JSON.stringify({
 					ready: false,
@@ -111,7 +111,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 				version: "1.0.0",
 			});
 
-			const transport = new StreamableHTTPClientTransport(baseUrl, { requestInit });
+			const transport = new StreamableHTTPClientTransport(baseUrl, { requestInit, fetch: mcpFetchFor(url) });
 			logger.info({}, `[MCP Health] Connecting to ${url}...`);
 			await client.connect(transport);
 			logger.info({}, `[MCP Health] Connected successfully via HTTP`);
@@ -174,7 +174,7 @@ export const POST: RequestHandler = async ({ request, locals }) => {
 					version: "1.0.0",
 				});
 
-				const sseTransport = new SSEClientTransport(baseUrl, { requestInit });
+				const sseTransport = new SSEClientTransport(baseUrl, { requestInit, fetch: mcpFetchFor(url) });
 				logger.info({}, `[MCP Health] Connecting via SSE...`);
 				await client.connect(sseTransport);
 				logger.info({}, `[MCP Health] Connected successfully via SSE`);