fix(transport): validate redirect targets to prevent SSRF and protocol confusion (#2700)

[teddiesloco]

Summary

Fixes #2700 (mirroring the client security hardening from python-sdk #3358).

Under default fetch behavior, redirect: "follow" causes client transports to silently follow 3xx responses into internal loopback endpoints (127.0.0.0/8, localhost), cloud instance metadata (169.254.169.254, metadata.google.internal), and private subnets (RFC 1918).

This PR introduces proactive redirect target validation in createFetchWithInit:

• Intercepts 3xx responses and validates the target hostname via isSafeRedirectTarget / isPrivateOrLoopbackHost.
• Rejects redirections from public origins into internal/loopback/cloud-metadata addresses with an explicit, actionable error message.
• Supports allowLoopbackRedirects option for local dev and testing suites.
• Preserves full backward compatibility with user-specified redirect: 'manual' or redirect: 'error'.

Motivation and Context

Fixes a security vulnerability where malicious MCP servers can redirect client requests into internal infrastructure or cloud metadata services.

How Has This Been Tested?

• Added unit tests in packages/core-internal/test/shared/transport.test.ts asserting:
  • Private & loopback host detection (127.0.0.1, [::1], 169.254.169.254, RFC 1918).
  • Rejection of public-to-private 307 redirects.
  • Seamless resolution of safe public redirects.
  • Respect of allowLoopbackRedirects: true.
• Full test suite: 1440/1440 tests passed in core-internal, 797/797 tests passed in client.
• pnpm -r typecheck clean.

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1e07b6a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2725

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2725

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2725

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2725

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2725

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2725

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2725

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2725

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2725

commit: 1e07b6a

[tarunag10]

This needs a transport-scoped approach before it is safe to merge.

1. createFetchWithInit(fetch) still returns the original fetch, so the normal no-options call path remains redirect-following and the vulnerability is unmitigated there.
2. Reimplementing follow with redirect: "manual" preserves headers and credentials across every hop and only rewrites 303. That differs from Fetch/Undici redirect handling and can leak an authenticated MCP request to a public redirect target (301/302 POST handling is also not equivalent).

Please avoid a generic manual-follow loop. Put an explicit redirect policy at the Streamable HTTP transport boundary, preserve existing Fetch semantics for callers that opt in to redirects, and add regressions for the default no-options path plus cross-origin authenticated 302/307 behavior.