Gave AI a web-reading tool—so blocking intranet addresses by default makes it safe?

Fetch MCP is a web-reading tool among MCP servers, and it can read web pages into Markdown. In the source code, the request timeout is set to 30 seconds. It blocks intranet addresses by default, but the project itself also notes that it cannot prevent DNS rebinding.

DeaglePc mentioned that when connecting a web-reading tool to an agent, you still need to restrict the networks it can access, and not treat it as complete isolation.

A netizen Pluto added that the DNS rebinding point is often overlooked. When connecting a web-reading tool to an Agent, you should not only block intranet IPs but also hard-code a whitelist of domains that can be resolved; otherwise, 'blocking intranet by default' is effectively useless. Another netizen said the line most worth copying is the last one: tools that read web pages also need network restrictions.

DNS rebinding is not hard to understand. A domain can first resolve to a public server, and later switch to an intranet IP. If the tool only literally blocks intranet addresses, does not check the domain whitelist, and does not look at the final resolution and redirect results, it may be led into the intranet. The default configuration can serve as a brake, but not as an isolation wall.

Project address: https://github.com/modelcontextprotocol/servers

Connecting a web-reading tool to an Agent is equivalent to opening a network egress for it. Restricting accessible networks, hard-coding domain whitelists, and checking resolution and redirects—these actions cannot be skipped. Blocking intranet by default is only the first threshold, not complete isolation.