← All rules

mcp-scan rule

Raw IP endpoint

network-egress-raw-iphigh

What mcp-scan saw

The scanner collected dotted-quad IPv4 addresses and full eight-group IPv6 addresses from the arguments and the serialized config. IPv4 is filtered through a private and invalid check that drops 0.x, 10.x, 127.x, 100.64-127.x CGNAT, 169.254.x link-local, 172.16-31.x, 192.168.x, and anything at or above 224. IPv6 drops addresses starting ::, fe80:, fc, or fd. What survives is public and reports here.

Why it fires

A raw IP defeats every policy layer that works on names: allowlists, DNS filtering, certificate name checks, and your own reading of the config. It also defeats rotation, since the host behind an address can change without the config changing. The private-range filter exists so that internal and Tailscale addresses do not drown the signal.

When this is a false positive

  • A public resolver pinned on purpose, for example 8.8.8.8 or 1.1.1.1 in a DNS-related argument, is public by definition and reports here.
  • Any four-part dotted number in the config matches the shape. A build identifier or a four-segment version like 12.34.56.78 is read as an address.
  • A self-hosted service on a public address you own and control. The rule is about the reviewability of the config, not about who owns the host.
  • The scanner takes only the first IPv4 match per scanned string, so a config with several addresses may report one and hide the rest. A single finding here does not mean a single endpoint.

How to fix it

  1. Read the address from the finding text and confirm you recognize it. A reverse lookup or a whois is faster than reasoning about it.
  2. Replace the literal address with a hostname wherever the destination has one, so allowedDomains and DNS policy can apply.
  3. If the host must stay pinned by address, add a comment in your own runbook, since .mcp-scan.json's allowedDomains matches on domain suffix and cannot express a bare IP.
  4. For an internal service, move it onto a private range or a Tailscale address, which the private-IP filter already excludes.
  5. To suppress, add 'network-egress-raw-ip' to suppressRules in .mcp-scan.json.