paperclipai/paperclip · error · Error

All resolved IPs for ${originalHostname} are in private/rese

Error message

All resolved IPs for ${originalHostname} are in private/reserved ranges

What it means

DNS resolved the plugin fetch hostname, but every returned IP is in a private or reserved range. The SSRF filter found no public address to use, so the outbound request is refused to protect internal networks.

Source

Thrown at server/src/services/plugin-host-services.ts:201

  const timeoutPromise = new Promise<never>((_, reject) => {
    setTimeout(
      () => reject(new Error(`DNS lookup timed out after ${DNS_LOOKUP_TIMEOUT_MS}ms for ${originalHostname}`)),
      DNS_LOOKUP_TIMEOUT_MS,
    );
  });

  try {
    const results = await Promise.race([dnsPromise, timeoutPromise]);
    if (results.length === 0) {
      throw new Error(`DNS resolution returned no results for ${originalHostname}`);
    }

    // Filter to only non-private IPs instead of rejecting the entire request
    // when some IPs are private. This handles multi-homed hosts that resolve
    // to both private and public addresses.
    const safeResults = results.filter((entry) => !isPrivateIP(entry.address));
    if (safeResults.length === 0) {
      throw new Error(
        `All resolved IPs for ${originalHostname} are in private/reserved ranges`,
      );
    }

    const resolved = safeResults[0]!;
    return {
      parsedUrl: parsed,
      resolvedAddress: resolved.address,
      hostHeader,
      tlsServername: parsed.protocol === "https:" && isIP(originalHostname) === 0
        ? originalHostname
        : undefined,
      useTls: parsed.protocol === "https:",
    };
  } catch (err) {
    // Re-throw our own errors; wrap DNS failures
    if (err instanceof Error && (
      err.message.startsWith("All resolved IPs") ||

View on GitHub (pinned to a7e689b3c3)

Solutions

1. Use a publicly routable hostname; requests to private/reserved IP ranges are blocked (SSRF protection).

When it happens

Trigger: Thrown at server/src/services/plugin-host-services.ts:201 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@a7e689b3c3 (2026-08-18). Data as JSON: /api/errors/c57ee0bdda6898dd. Report an issue: GitHub.