* Returns true if the hostname is localhost or a loopback IP literal. * Expects IPv6 brackets to already be stripped.
(hostname: string)
| 115 | * Expects IPv6 brackets to already be stripped. |
| 116 | */ |
| 117 | function isLocalhostHostname(hostname: string): boolean { |
| 118 | const clean = hostname.toLowerCase() |
| 119 | if (clean === 'localhost') return true |
| 120 | return ipaddr.isValid(clean) && isLoopbackIP(clean) |
| 121 | } |
| 122 | |
| 123 | /** |
| 124 | * Validates an MCP server URL against SSRF attacks by resolving DNS and |
no test coverage detected