ceilf6
diff --git a/‎packages/mcp-web-fetch/.gitignore‎
Lines changed: 2 additions & 0 deletions b/‎packages/mcp-web-fetch/.gitignore‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎packages/mcp-web-fetch/package.json‎
Lines changed: 29 additions & 0 deletions b/‎packages/mcp-web-fetch/package.json‎
Lines changed: 29 additions & 0 deletions
diff --git a/‎packages/mcp-web-fetch/src/engine.lookup.test.ts‎
Lines changed: 49 additions & 0 deletions b/‎packages/mcp-web-fetch/src/engine.lookup.test.ts‎
Lines changed: 49 additions & 0 deletions
diff --git a/‎packages/mcp-web-fetch/src/engine.test.ts‎
Lines changed: 74 additions & 0 deletions b/‎packages/mcp-web-fetch/src/engine.test.ts‎
Lines changed: 74 additions & 0 deletions
@@ -0,0 +1,2 @@
+node_modules/
+dist/
@@ -0,0 +1,29 @@
+{
+  "name": "@frontagent/mcp-web-fetch",
+  "version": "2.1.1",
+  "description": "MCP Web-Fetch Adapter - Agent-friendly URL fetching (HTML→text) with SSRF guards for FrontAgent",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "undici": "^6.21.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.7"
+  }
+}
@@ -0,0 +1,49 @@
+import type { LookupAddress } from 'node:dns';
+import { describe, expect, it } from 'vitest';
+import { safeLookup } from './engine.js';
+
+/**
+ * These tests exercise `safeLookup` directly — the function undici's
+ * dispatcher actually calls at connection time. All cases use local-only
+ * resolution (loopback hostnames and IP literals), so no external network
+ * access is required:
+ *  - Literal IPs are returned by `dns.lookup` without a network query.
+ *  - 'localhost' is resolved via the hosts file (local).
+ */
+function runLookup(hostname: string): Promise<{
+  err: NodeJS.ErrnoException | null;
+  address: string | LookupAddress[];
+  family?: number;
+}> {
+  return new Promise((resolve) => {
+    safeLookup(hostname, {}, (err, address, family) => {
+      resolve({ err, address, family });
+    });
+  });
+}
+
+describe('safeLookup', () => {
+  it('blocks localhost (resolves to a loopback address)', async () => {
+    const { err } = await runLookup('localhost');
+    expect(err).not.toBeNull();
+    expect(err?.message).toMatch(/private|blocked/i);
+  });
+
+  it('blocks the literal IPv4 loopback address 127.0.0.1', async () => {
+    const { err } = await runLookup('127.0.0.1');
+    expect(err).not.toBeNull();
+    expect(err?.message).toMatch(/private|blocked/i);
+  });
+
+  it('blocks the literal IPv6 loopback address ::1', async () => {
+    const { err } = await runLookup('::1');
+    expect(err).not.toBeNull();
+    expect(err?.message).toMatch(/private|blocked/i);
+  });
+
+  it('allows a literal public IPv4 address', async () => {
+    const { err, address } = await runLookup('8.8.8.8');
+    expect(err).toBeNull();
+    expect(address).toBe('8.8.8.8');
+  });
+});
@@ -0,0 +1,74 @@
+import { describe, expect, it, vi } from 'vitest';
+import { fetchUrl } from './engine.js';
+
+describe('fetchUrl', () => {
+  it('rejects a redirect to a private address without following it', async () => {
+    const mock = vi.fn(
+      async () =>
+        new Response(null, {
+          status: 302,
+          headers: { location: 'http://127.0.0.1/secret' },
+        }),
+    );
+
+    await expect(
+      fetchUrl('https://example.com/', { fetchImpl: mock as unknown as typeof fetch }),
+    ).rejects.toThrow();
+
+    expect(mock).toHaveBeenCalledTimes(1);
+  });
+
+  it('truncates the body when it exceeds maxBytes', async () => {
+    const largeBody = 'x'.repeat(1000);
+    const mock = vi.fn(
+      async () =>
+        new Response(largeBody, {
+          status: 200,
+          headers: { 'content-type': 'text/plain' },
+        }),
+    );
+
+    const result = await fetchUrl('https://example.com/', {
+      fetchImpl: mock as unknown as typeof fetch,
+      maxBytes: 100,
+    });
+
+    expect(result.truncated).toBe(true);
+    expect(result.bytes).toBeLessThanOrEqual(100);
+  });
+
+  it('throws once the redirect count exceeds maxRedirects', async () => {
+    const mock = vi.fn(
+      async () =>
+        new Response(null, {
+          status: 302,
+          headers: { location: 'http://example.org/next' },
+        }),
+    );
+
+    await expect(
+      fetchUrl('https://example.com/', {
+        fetchImpl: mock as unknown as typeof fetch,
+        maxRedirects: 2,
+      }),
+    ).rejects.toThrow();
+  });
+
+  it('returns text and title for a successful HTML response', async () => {
+    const mock = vi.fn(
+      async () =>
+        new Response('<title>Hi</title><p>Hello</p>', {
+          status: 200,
+          headers: { 'content-type': 'text/html' },
+        }),
+    );
+
+    const result = await fetchUrl('https://example.com/', {
+      fetchImpl: mock as unknown as typeof fetch,
+    });
+
+    expect(result.status).toBe(200);
+    expect(result.title).toBe('Hi');
+    expect(result.text).toContain('Hello');
+  });
+});