Package com.axelor.ai.mcp

Class McpEgressGuard

java.lang.Object

com.axelor.ai.mcp.McpEgressGuard

public final class McpEgressGuard
extends Object

Validates an MCP server URL before any outbound connection: HTTPS only, host on the administrator allowlist, and not resolving to a private/loopback/link-local address. Address classification is shared with the HTTP tool executor via OutboundAddresses; the allowlist and the HTTPS requirement are what MCP adds on top.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	McpEgressGuard.Pinned	A validated URL paired with the address checked during DNS resolution.

Method Summary

Modifier and Type	Method	Description
static URI	checkAllowlisted(String url, Set<String> allowedHosts)	Validates the scheme and allowlist without performing DNS resolution.
static McpEgressGuard.Pinned	resolveAndValidate(String url, Set<String> allowedHosts)	Like validate(java.lang.String, java.util.Set<java.lang.String>), but also returns the address to pin the real connection to.
static URI	validate(String url, Set<String> allowedHosts)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

validate

public static URI validate(String url,
 Set<String> allowedHosts)

resolveAndValidate

public static McpEgressGuard.Pinned resolveAndValidate(String url,
 Set<String> allowedHosts)

Like validate(java.lang.String, java.util.Set<java.lang.String>), but also returns the address to pin the real connection to.

checkAllowlisted

public static URI checkAllowlisted(String url,
 Set<String> allowedHosts)

Validates the scheme and allowlist without performing DNS resolution.