fix(transport): validate redirect targets to prevent SSRF and protocol confusion (#2700)

[teddiesloco]

Summary

Fixes #2700 (mirroring the client security hardening from python-sdk #3358).

Under default fetch behavior, redirect: "follow" causes client transports to silently follow 3xx responses into internal loopback endpoints (127.0.0.0/8, localhost), cloud instance metadata (169.254.169.254, metadata.google.internal), and private subnets (RFC 1918).

This PR introduces proactive redirect target validation in createFetchWithInit:

• Intercepts 3xx responses and validates the target hostname via isSafeRedirectTarget / isPrivateOrLoopbackHost.
• Rejects redirections from public origins into internal/loopback/cloud-metadata addresses with an explicit, actionable error message.
• Supports allowLoopbackRedirects option for local dev and testing suites.
• Preserves full backward compatibility with user-specified redirect: 'manual' or redirect: 'error'.

Motivation and Context

Fixes a security vulnerability where malicious MCP servers can redirect client requests into internal infrastructure or cloud metadata services.

How Has This Been Tested?

• Added unit tests in packages/core-internal/test/shared/transport.test.ts asserting:
  • Private & loopback host detection (127.0.0.1, [::1], 169.254.169.254, RFC 1918).
  • Rejection of public-to-private 307 redirects.
  • Seamless resolution of safe public redirects.
  • Respect of allowLoopbackRedirects: true.
• Full test suite: 1440/1440 tests passed in core-internal, 797/797 tests passed in client.
• pnpm -r typecheck clean.

Breaking Changes

None.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1e07b6a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2725

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2725

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2725

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2725

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2725

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2725

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2725

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2725

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2725

commit: 1e07b6a