stacklok / toolhive / 27706585515

push

github

Add WithDialControl option to vMCP backend client (#5551)

Embedders running vMCP in-process want to adopt the full
NewHTTPBackendClient (and its outgoing-auth strategy registry and
RoundTripper chain) while preserving a hardened SSRF / DNS-rebinding
posture on the outbound connection. Until now the per-backend
*http.Client was built entirely internally, so an embedder needing a
custom dialer had to abandon NewHTTPBackendClient and hand-roll a
BackendClient, losing the auth and trace/identity machinery.

Add a functional-option WithDialControl that installs a per-connection
net.Dialer.Control hook on every backend transport. The hook classifies
the resolved peer IP before the TCP handshake — the per-connection check
that actually defeats DNS rebinding, which a host-string check cannot.
The option is additive: nil/absent reproduces today's behavior exactly,
and it composes with the existing per-backend CA-bundle handling rather
than replacing the transport.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

21 of 23 new or added lines in 1 file covered. (91.3%)

69045 of 103032 relevant lines covered (67.01%)

63.89 hits per line