SCAL-336249 Add whitelabled MCP server

[shikharbsar]

No description provided.

[snyk-io]

⛔ Snyk checks have failed. 1 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (1)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
⛔	Code Security	0	1	0	0	1 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

  Server-Side Request Forgery (SSRF)

Unsanitized input from the request URL flows into fetch, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

Line 147 | CWE-918 | Priority score 650 | Learn more about this vulnerability

Data flow: 9 steps

Step 1 - 7

developer-examples/mcp/node-proxy-trusted-auth/src/index.ts

Line 143 in 53ff340

upstreamUrl.search = req.originalUrl.slice(queryIndex);

Step 8 - 9

developer-examples/mcp/node-proxy-trusted-auth/src/index.ts

Line 147 in 53ff340

const upstreamRes = await fetch(upstreamUrl, {

---

⚡ Refresh the page to see if a fix suggestion is available 🔄

[snyk-io]

⚡ Snyk Agent Fix suggestion 1 of 1

The Server-Side Request Forgery (SSRF) vulnerability was fixed by validating that the constructed upstream URL's origin matches the trusted upstream base origin and then rebuilding the fetch target as a string from the trusted origin plus only the path and search components.

Code changes

--- mcp/node-proxy-trusted-auth/src/index.ts
+++ mcp/node-proxy-trusted-auth/src/index.ts
@@ -137,14 +137,20 @@
 			}
 		}
 
-		const upstreamUrl = new URL(upstreamPath, upstreamBaseUrl);
+		const upstreamBase = new URL(upstreamBaseUrl);
+		const upstreamUrl = new URL(upstreamPath, upstreamBase);
 		const queryIndex = req.originalUrl.indexOf("?");
 		if (queryIndex !== -1) {
 			upstreamUrl.search = req.originalUrl.slice(queryIndex);
 		}
+		if (upstreamUrl.origin !== upstreamBase.origin) {
+			res.status(400).json({ error: "Invalid upstream URL" });
+			return;
+		}
+		const safeUpstreamUrl = `${upstreamBase.origin}${upstreamUrl.pathname}${upstreamUrl.search}`;
 
 		const hasBody = !["GET", "HEAD"].includes(req.method);
-		const upstreamRes = await fetch(upstreamUrl, {
+		const upstreamRes = await fetch(safeUpstreamUrl, {
 			method: req.method,
 			headers: {
 				...forwardableRequestHeaders(req),

Content generated by AI, expires on 2026-09-17 22:24:08 UTC. Refresh the page after running Snyk commands.

Commands

• ✅ To apply this fix and create a commit - reply with @snyk /apply 1