googleapis/mcp-toolbox · error

invalid BaseURL %s: points to a blocked internal IP address

Error message

invalid BaseURL %s: points to a blocked internal IP address

What it means

Error "invalid BaseURL %s: points to a blocked internal IP address" thrown in googleapis/mcp-toolbox.

Source

Thrown at internal/sources/http/http.go:139

	if err != nil {
		return nil, fmt.Errorf("invalid allowedIpRanges: %w", err)
	}

	customBlocked, err := parseCIDRs(r.CustomBlockedIPRanges)
	if err != nil {
		return nil, fmt.Errorf("invalid customBlockedIpRanges: %w", err)
	}

	guard := &SSRFGuard{
		AllowPrivateNetworks: r.AllowPrivateNetworks,
		AllowedRanges:        allowedRanges,
		CustomBlocked:        customBlocked,
	}

	// Quick fast-fail check for direct IP configurations in the YAML
	if ip := net.ParseIP(parsedURL.Hostname()); ip != nil {
		if guard.IsIPBlocked(ip) {
			return nil, fmt.Errorf("invalid BaseURL %s: points to a blocked internal IP address", r.BaseURL)
		}
	}

	client, err := createHTTPClient(duration, tr, guard, nil)
	if err != nil {
		return nil, fmt.Errorf("failed to create secure HTTP client: %w", err)
	}

	ua, err := util.UserAgentFromContext(ctx)
	if err != nil {
		warnMsg := fmt.Sprintf("Error in User Agent retrieval: %s", err)
		logger.WarnContext(ctx, warnMsg)
	}
	if r.DefaultHeaders == nil {
		r.DefaultHeaders = make(map[string]string)
	}
	if existingUA, ok := r.DefaultHeaders["User-Agent"]; ok {
		ua = ua + " " + existingUA

View on GitHub (pinned to 8cc6e09de2)

When it happens

Trigger: Thrown at internal/sources/http/http.go:139 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/7f207f79ebdec58f. Report an issue: GitHub.