googleapis/mcp-toolbox · error

failed to resolve redirect host %s: %w

Error message

failed to resolve redirect host %s: %w

What it means

For redirects to hostname-based (non-literal-IP) URLs, the source performs a DNS lookup (resolver.LookupHost) so it can vet every resolved address against the SSRF guard before following. If DNS resolution itself fails, the redirect is refused and this wrapped error is returned. The original resolver error is included via %w.

Source

Thrown at internal/sources/http/http.go:369

	client := &http.Client{
		Timeout:   duration,
		Transport: tr,
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			if len(via) >= 10 {
				return fmt.Errorf("stopped after 10 redirects")
			}

			hostname := req.URL.Hostname()
			if ip := net.ParseIP(hostname); ip != nil {
				if guard.IsIPBlocked(ip) {
					return fmt.Errorf("redirect to blocked IP %s denied", ip)
				}
				return nil
			}

			addrs, err := resolver.LookupHost(req.Context(), hostname)
			if err != nil {
				return fmt.Errorf("failed to resolve redirect host %s: %w", hostname, err)
			}

			for _, addr := range addrs {
				if ip := net.ParseIP(addr); ip != nil {
					if guard.IsIPBlocked(ip) {
						return fmt.Errorf("redirect host %s resolves to blocked IP %s", hostname, addr)
					}
				}
			}

			return nil
		},
	}
	return client, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Fix the server-side redirect so it points at a resolvable, valid hostname.
2. Check DNS connectivity from the host running the toolbox (nslookup/getent hosts <hostname>).
3. Verify the container's DNS configuration (/etc/resolv.conf) and that the hostname exists in the relevant DNS zone.

Example fix

// server-side before: redirect to https://old.example.internal/... (NXDOMAIN)
// after: redirect to a live host
w.Header().Set("Location", "https://new.example.com/path")

const host = new URL(redirectTarget).hostname;
const res = await require('dns').promises.lookup(host).catch(() => null);
if (!res) console.warn(`hostname ${host} will fail DNS resolution on redirect; fix the redirect target`);

try {
  const result = await callHttpTool(url);
} catch (err) {
  if (String(err).startsWith('failed to resolve redirect host')) {
    const host = err.match(/redirect host ([^:]+):/)?.[1];
    console.error(`DNS failure for redirect host ${host}; check DNS config and the redirect target.`);
  } else throw err;
}

When it happens

Trigger: A redirect Location header whose hostname cannot be resolved by the configured DNS resolver: NXDOMAIN, no network/DNS server, or resolver timeout during CheckRedirect.

Common situations: Redirect to a stale/decommissioned domain; DNS outage or misconfigured resolver in the container (e.g. missing resolv.conf entries); typos in a redirect target set up server-side.

Related errors

• unable to create client: %w
• stopped after 10 redirects
• redirect host %s resolves to blocked IP %s
• toolbox failed to start listener: %w
• toolbox failed to start listener: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/fe8a37917ed473b9. Report an issue: GitHub.