{"record":{"id":"b68795e6819370bc","repo":"Hmbown/CodeWhale","slug":"mcp-http-destination-blocked-by-network-policy","errorCode":null,"errorMessage":"MCP HTTP destination blocked by network policy","messagePattern":"MCP HTTP destination blocked by network policy","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/mcp/http_client.rs","lineNumber":226,"sourceCode":"            .build()\n            .context(\"building guarded MCP HTTP client\")?;\n        let mut clients = self\n            .clients\n            .lock()\n            .unwrap_or_else(std::sync::PoisonError::into_inner);\n        if !proxied && clients.len() < 32 {\n            clients.insert(key, client.clone());\n        }\n        Ok(client)\n    }\n}\n\nfn validate_network_policy(url: &Url, network_policy: Option<&NetworkPolicyDecider>) -> Result<()> {\n    let host = url.host_str().context(\"MCP URL has no host\")?;\n    if let Some(policy) = network_policy {\n        match policy.evaluate(host, \"mcp\") {\n            Decision::Allow => {}\n            Decision::Deny => bail!(\"MCP HTTP destination blocked by network policy\"),\n            Decision::Prompt => bail!(\"MCP HTTP destination requires network approval\"),\n        }\n    }\n    Ok(())\n}\n\nfn validate_url(url: &Url) -> Result<()> {\n    if !matches!(url.scheme(), \"http\" | \"https\") || url.host_str().is_none() {\n        bail!(\"MCP HTTP requires an http:// or https:// URL with a host\");\n    }\n    Ok(())\n}\n\nfn url_has_credentials(url: &Url) -> bool {\n    !url.username().is_empty() || url.password().is_some()\n}\n\nimpl McpHttpClient {","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/mcp/http_client.rs#L208-L244","documentation":"When a NetworkPolicyDecider is configured, every MCP HTTP destination host is evaluated before any request (initial connect and each redirect). A Decision::Deny produces this error, meaning the host is explicitly forbidden by network policy (e.g. SSRF protection or allowlist enforcement).","triggerScenarios":"validate_network_policy calls policy.evaluate(host, \"mcp\") and gets Decision::Deny — triggered from McpHttpClient::new on the configured URL, or from client_for_target on a redirect target host.","commonSituations":"Connecting to localhost/metadata IPs while an SSRF-guarding policy denies private ranges; host not on the operator allowlist; DNS rebinding protection flagging the host; corporate deny-list rules.","solutions":["Ask the operator to add the host to the network-policy allowlist","Connect to an allowed public endpoint instead of the blocked host","Remove/reconfigure the NetworkPolicyDecider only if you own the policy decision and accept the SSRF risk"],"exampleFix":"// before\nlet policy = NetworkPolicy::deny_all();\nlet client = McpHttpClient::new(url, ..., Some(&policy))?; // bails\n// after\npolicy.allow_host(\"mcp.example.com\");\nlet client = McpHttpClient::new(url, ..., Some(&policy))?;","handlingStrategy":"validation","validationCode":"let host = Url::parse(endpoint)?.host_str().ok_or(\"no host\")?.to_string();\nmatch policy.evaluate(&host, \"mcp\") {\n    Decision::Allow => { /* safe to connect */ }\n    Decision::Deny => return Err(\"host denied by network policy\"),\n    Decision::Prompt => { /* obtain approval first */ }\n}","typeGuard":null,"tryCatchPattern":"match connect(...).await {\n    Err(e) if e.to_string().contains(\"blocked by network policy\") => {\n        // request allowlist change from operator; do not retry blindly\n    }\n    other => other?,\n}","preventionTips":["Maintain an up-to-date MCP host allowlist with the operator","Pre-check hosts against policy in tooling before configuring endpoints","Avoid private/metadata IPs for MCP endpoints under SSRF-guarding policies"],"tags":["mcp","http","network-policy","security","ssrf"],"backgroundTag":"permission-denied","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-22T21:17:16.096Z"}