googleapis/mcp-toolbox · error

invalid customBlockedIpRanges: %w

Error message

invalid customBlockedIpRanges: %w

What it means

Error "invalid customBlockedIpRanges: %w" thrown in googleapis/mcp-toolbox.

Source

Thrown at internal/sources/http/http.go:127

		}

		logger.WarnContext(ctx, "WARNING: TLS certificate verification is skipped (InsecureSkipVerify: true) for HTTP source %s. This exposes all traffic for this source to Man-in-the-Middle (MITM) attacks. Do not use in production.", r.Name)
	}

	// Validate BaseURL
	parsedURL, err := url.ParseRequestURI(r.BaseURL)
	if err != nil {
		return nil, fmt.Errorf("failed to parse BaseUrl %v", err)
	}

	allowedRanges, err := parseCIDRs(r.AllowedIPRanges)
	if err != nil {
		return nil, fmt.Errorf("invalid allowedIpRanges: %w", err)
	}

	customBlocked, err := parseCIDRs(r.CustomBlockedIPRanges)
	if err != nil {
		return nil, fmt.Errorf("invalid customBlockedIpRanges: %w", err)
	}

	guard := &SSRFGuard{
		AllowPrivateNetworks: r.AllowPrivateNetworks,
		AllowedRanges:        allowedRanges,
		CustomBlocked:        customBlocked,
	}

	// Quick fast-fail check for direct IP configurations in the YAML
	if ip := net.ParseIP(parsedURL.Hostname()); ip != nil {
		if guard.IsIPBlocked(ip) {
			return nil, fmt.Errorf("invalid BaseURL %s: points to a blocked internal IP address", r.BaseURL)
		}
	}

	client, err := createHTTPClient(duration, tr, guard, nil)
	if err != nil {
		return nil, fmt.Errorf("failed to create secure HTTP client: %w", err)

View on GitHub (pinned to 8cc6e09de2)

When it happens

Trigger: Thrown at internal/sources/http/http.go:127 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/b51ae0b37a8f47ea. Report an issue: GitHub.