fix(security): add ssrfWhitelist config to unblock Tailscale/CGNAT (#2669)

2026-04-04 19:43:18 +08:00
parent 193eccdac7
commit 5f08d61d8f
4 changed files with 74 additions and 3 deletions
@@ -192,6 +192,7 @@ class ToolsConfig(Base):
    exec: ExecToolConfig = Field(default_factory=ExecToolConfig)
    restrict_to_workspace: bool = False  # If true, restrict all tool access to workspace directory
    mcp_servers: dict[str, MCPServerConfig] = Field(default_factory=dict)
+    ssrf_whitelist: list[str] = Field(default_factory=list)  # CIDR ranges to exempt from SSRF blocking (e.g. ["100.64.0.0/10"] for Tailscale)


 class Config(BaseSettings):