Post

Spent the weekend adding DCR and CIMD support to our MCP server, to remove friction. It’s been hard, even with the help of Claude

MODUL - Dargel Solutions

@modul-ds.bsky.social

With CIMD your server now fetches whatever URL a client hands it as client_id. Block private and loopback addresses on that fetch, cap the response size and cache per URL, or the friction you removed comes back as an SSRF hole.

Pachi

@facilethings.com

you’re right. we’ve needed AI reviewers to criticise the SSRF design and make it as solid as possible

5/10/26, 2:52 pm0 reposts1 like

MODUL - Dargel Solutions

@modul-ds.bsky.social

Reviewers read the design. Also send real requests at the fetch: a redirect to 127.0.0.1 and a hostname resolving to a private IP. Filters usually leak there.