How to check an MCP server for SSRF yourself

Read the server's own tool list. Anything with a parameter named url, uri, endpoint, webhook, src, image or callback is in scope, and so is anything taking a document or page identifier that the server resolves for you.

This is a larger set than people expect. A tool that summarises a web page is obvious. A tool that renders a preview, imports a spreadsheet or checks a link is the same shape wearing different words.

Run the server locally with a listener on a port nothing else is using, then call the tool with a URL pointing at that port. If your listener receives a request, the server fetches whatever it is given.

That alone is not a finding. It becomes one at the next step, which is whether it will fetch somewhere it should never be able to reach.

The cloud metadata address, the loopback address, a private range address on your own network, and a redirect: a public URL you control that responds with a redirect to one of the first three.

The redirect is the one that catches otherwise careful software. A server can validate the URL it was handed, fetch it, and follow the redirect without validating again, which means the check it passed never applied to the request it actually made.

A blocked request should fail clearly and say so. A request that connects and returns an error page has still reached a host on your internal network, and an attacker learns from the difference between one error and another.

Time the responses as well. A server that refuses instantly for a blocked host and hangs for a real one has just told an attacker which internal addresses exist.

A server that publishes the hosts it may contact has made a commitment you can hold it to and a control you can enforce. One that does not has, in effect, declared every host, and every other permission you grant it becomes a data-loss permission.

In a large independent scan of public MCP servers in 2026, more than a third of URL-accepting servers failed exactly this check, which is why it is one of the sixteen in our rubric rather than an optional extra.