Function executeToolRequest

apps/sim/tools/index.ts:1526–1921

* Execute a tool request directly * Internal routes (/api/...) use regular fetch * External URLs use SSRF-protected fetch with DNS validation and IP pinning

(
  toolId: string,
  tool: ToolConfig,
  params: Record<string, any>,
  signal?: AbortSignal
)

 * External URLs use SSRF-protected fetch with DNS validation and IP pinning
 */
async function executeToolRequest(
  toolId: string,
  tool: ToolConfig,
  params: Record<string, any>,
  signal?: AbortSignal
): Promise<ToolResponse> {
  const requestId = generateRequestId()

  const requestParams = formatRequestParams(tool, params)

  try {
    const endpointUrl =
      typeof tool.request.url === 'function' ? tool.request.url(params) : tool.request.url
    const isInternalRoute = endpointUrl.startsWith('/api/')
    const baseUrl = isInternalRoute ? getInternalApiBaseUrl() : getBaseUrl()

    const fullUrlObj = new URL(endpointUrl, baseUrl)

    if (isInternalRoute) {
      const workflowId = params._context?.workflowId
      if (workflowId) {
        fullUrlObj.searchParams.set('workflowId', workflowId)
      }
      const userId = params._context?.userId
      if (userId) {
        fullUrlObj.searchParams.set('userId', userId)
      }
    }

    const fullUrl = fullUrlObj.toString()

    if (isCustomTool(toolId) && tool.request.body) {
      const requestBody = tool.request.body(params)
      if (
        typeof requestBody === 'object' &&
        requestBody !== null &&
        'schema' in requestBody &&
        'params' in requestBody
      ) {
        try {
          validateClientSideParams(
            requestBody.params as Record<string, any>,
            requestBody.schema as {
              type: string
              properties: Record<string, any>
              required?: string[]
            }
          )
        } catch (validationError) {
          logger.error(`[${requestId}] Custom tool validation failed for ${toolId}:`, {
            error: toError(validationError).message,
          })
          throw validationError
        }
      }
    }

    const headers = new Headers(requestParams.headers)