googleapis/mcp-toolbox · error

invalid allowedIpRanges: %w

Error message

invalid allowedIpRanges: %w

What it means

This error is returned when parseCIDRs fails on the http source's allowedIpRanges configuration. Each entry must be a valid CIDR block (e.g. 10.0.0.0/8, 192.168.1.0/24); malformed IPs, missing prefixes, or non-CIDR hostnames cause the parse to fail and abort source initialization. This list gates which destination IPs the source is allowed to contact (SSRF protection).

Source

Thrown at internal/sources/http/http.go:122

	}

	if r.DisableSslVerification {
		tr.TLSClientConfig = &tls.Config{
			InsecureSkipVerify: true,
		}

		logger.WarnContext(ctx, "WARNING: TLS certificate verification is skipped (InsecureSkipVerify: true) for HTTP source %s. This exposes all traffic for this source to Man-in-the-Middle (MITM) attacks. Do not use in production.", r.Name)
	}

	// Validate BaseURL
	parsedURL, err := url.ParseRequestURI(r.BaseURL)
	if err != nil {
		return nil, fmt.Errorf("failed to parse BaseUrl %v", err)
	}

	allowedRanges, err := parseCIDRs(r.AllowedIPRanges)
	if err != nil {
		return nil, fmt.Errorf("invalid allowedIpRanges: %w", err)
	}

	customBlocked, err := parseCIDRs(r.CustomBlockedIPRanges)
	if err != nil {
		return nil, fmt.Errorf("invalid customBlockedIpRanges: %w", err)
	}

	guard := &SSRFGuard{
		AllowPrivateNetworks: r.AllowPrivateNetworks,
		AllowedRanges:        allowedRanges,
		CustomBlocked:        customBlocked,
	}

	// Quick fast-fail check for direct IP configurations in the YAML
	if ip := net.ParseIP(parsedURL.Hostname()); ip != nil {
		if guard.IsIPBlocked(ip) {
			return nil, fmt.Errorf("invalid BaseURL %s: points to a blocked internal IP address", r.BaseURL)
		}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Convert plain IPs to CIDR form: "10.0.0.1" → "10.0.0.1/32"
2. Validate each prefix is 0–32 (IPv4) and the address parses, e.g. with `ipcalc` or net.ParseCIDR in a scratch program
3. Remove empty entries and surrounding whitespace from the allowedIpRanges list

Example fix

// before
allowedIpRanges:
  - 10.0.0.1
  - 192.168.1.0/24
// after
allowedIpRanges:
  - 10.0.0.1/32
  - 192.168.1.0/24

func validCIDRs(items []string) bool {
    for _, c := range items {
        if _, _, err := net.ParseCIDR(strings.TrimSpace(c)); err != nil {
            return false
        }
    }
    return true
}
// usage: if !validCIDRs(cfg.AllowedIPRanges) { fix list before Initialize }

src, err := cfg.Initialize(ctx, tracer)
if err != nil && strings.Contains(err.Error(), "invalid allowedIpRanges") {
    log.Fatalf("each allowedIpRanges entry must be valid CIDR, e.g. 10.0.0.0/8: %v", err)
}

When it happens

Trigger: parseCIDRs(r.AllowedIPRanges) returns non-nil err: entries like "10.0.0.1" (no /prefix), "10.0.0.0/33" (invalid prefix), "myhost.local" (not a CIDR), empty strings, or mixed invalid values in the comma/list field.

Common situations: Listing plain IPs without prefix lengths; typos in prefix numbers; pasting AWS security-group descriptions instead of CIDRs; whitespace or empty items in the list.

Related errors

• unable to parse Timeout string as time.Duration: %s
• failed to parse BaseUrl %v
• %s is not a valid http method
• parameter %q cannot have both 'secure' set to true and 'auth
• `introspectionEndpoint` is not allowed when `mcpEnabled` is

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/fc4d791e3a702ad2. Report an issue: GitHub.