- Shipped
- September 23, 2026 at 1:50 AM UTC
- Author
- Kamo
- Commit
- e6502a2
Defense in depth alongside the AIService commit that closes AiMcpController's missing right checks and STDIO refusal at the source: this service is the one that actually calls new **************** ...) with config.getEnvVars() in the environment, on gateway start and on every restart the 30s health check triggers, so it does not simply trust that AIService's checks were never bypassed (a direct DB write, a future regression upstream). A STDIO config now only starts if its id is listed in mcp.stdio.allowed-config-ids — empty by default, since no config should legitimately need it today (ai_mcp_server_configs has 0 rows). McpSseTransport.connect (used for both SSE and HTTP configs) gets its own OutboundUrlGuard check, mirroring AIService's: resolves the host and refuses **************** unspecified addresses and cluster-only names, immediately before every connect — on gateway start and on every restart — not just relying on AIService's save-time check. Tests: **************** (the allowlist refusal, verified red with the guard removed — using a command that cannot exist, so even a mutated guard cannot spawn anything real) and OutboundUrlGuardTest (the host rule itself, plus McpSseTransport.connect wiring).