googleapis/mcp-toolbox · error

invalid allowedIpRanges

Error message

invalid allowedIpRanges: %w

What it means

This error is returned when parseCIDRs fails on the http source's allowedIpRanges configuration. Each entry must be a valid CIDR block (e.g. 10.0.0.0/8, 192.168.1.0/24); malformed IPs, missing prefixes, or non-CIDR hostnames cause the parse to fail and abort source initialization. This list gates which destination IPs the source is allowed to contact (SSRF protection).

Solutions

1. Convert plain IPs to CIDR form: "10.0.0.1" → "10.0.0.1/32"
2. Validate each prefix is 0–32 (IPv4) and the address parses, e.g. with `ipcalc` or net.ParseCIDR in a scratch program
3. Remove empty entries and surrounding whitespace from the allowedIpRanges list

Example fix

// before
allowedIpRanges:
  - 10.0.0.1
  - 192.168.1.0/24
// after
allowedIpRanges:
  - 10.0.0.1/32
  - 192.168.1.0/24

func validCIDRs(items []string) bool {
    for _, c := range items {
        if _, _, err := net.ParseCIDR(strings.TrimSpace(c)); err != nil {
            return false
        }
    }
    return true
}
// usage: if !validCIDRs(cfg.AllowedIPRanges) { fix list before Initialize }

src, err := cfg.Initialize(ctx, tracer)
if err != nil && strings.Contains(err.Error(), "invalid allowedIpRanges") {
    log.Fatalf("each allowedIpRanges entry must be valid CIDR, e.g. 10.0.0.0/8: %v", err)
}

When it happens

Trigger: parseCIDRs(r.AllowedIPRanges) returns non-nil err: entries like "10.0.0.1" (no /prefix), "10.0.0.0/33" (invalid prefix), "myhost.local" (not a CIDR), empty strings, or mixed invalid values in the comma/list field.

Common situations: Listing plain IPs without prefix lengths; typos in prefix numbers; pasting AWS security-group descriptions instead of CIDRs; whitespace or empty items in the list.

Related errors

• failed to parse BaseUrl
• parameter cannot have both 'secure' set to true and…
• is not a valid http method
• unable to parse Timeout string as time.Duration
• bucket cannot be empty for tool

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/fc4d791e3a702ad2. Report an issue: GitHub.

Appendix: source

Thrown at internal/sources/http/http.go:122

	}

	if r.DisableSslVerification {
		tr.TLSClientConfig = &tls.Config{
			InsecureSkipVerify: true,
		}

		logger.WarnContext(ctx, "WARNING: TLS certificate verification is skipped (InsecureSkipVerify: true) for HTTP source %s. This exposes all traffic for this source to Man-in-the-Middle (MITM) attacks. Do not use in production.", r.Name)
	}

	// Validate BaseURL
	parsedURL, err := url.ParseRequestURI(r.BaseURL)
	if err != nil {
		return nil, fmt.Errorf("failed to parse BaseUrl %v", err)
	}

	allowedRanges, err := parseCIDRs(r.AllowedIPRanges)
	if err != nil {
		return nil, fmt.Errorf("invalid allowedIpRanges: %w", err)
	}

	customBlocked, err := parseCIDRs(r.CustomBlockedIPRanges)
	if err != nil {
		return nil, fmt.Errorf("invalid customBlockedIpRanges: %w", err)
	}

	guard := &SSRFGuard{
		AllowPrivateNetworks: r.AllowPrivateNetworks,
		AllowedRanges:        allowedRanges,
		CustomBlocked:        customBlocked,
	}

	// Quick fast-fail check for direct IP configurations in the YAML
	if ip := net.ParseIP(parsedURL.Hostname()); ip != nil {
		if guard.IsIPBlocked(ip) {
			return nil, fmt.Errorf("invalid BaseURL %s: points to a blocked internal IP address", r.BaseURL)
		}

View on GitHub (pinned to 8cc6e09de2)