Affected by GO-2026-5996 and 2 other vulnerabilities

GO-2026-5996: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway in github.com/stacklok/toolhive

GO-2026-6002: ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

GO-2026-6526: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement in github.com/stacklok/toolhive

retriever

package

v0.1.6 Latest Latest Go to latest Published: Jul 10, 2025 License: Apache-2.0 Imports: 10 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/stacklok/toolhive

Links

Open Source Insights

Documentation ¶

Overview ¶

Package retriever contains logic for fetching or building MCP servers.

Index ¶

Constants
Variables
func GetMCPServer(ctx context.Context, serverOrImage string, rawCACertPath string, ...) (string, *registry.ImageMetadata, error)

Constants ¶

View Source

const (
	// VerifyImageWarn prints a warning when image validation fails.
	VerifyImageWarn = "warn"
	// VerifyImageEnabled treats validation failure as a fatal error.
	VerifyImageEnabled = "enabled"
	// VerifyImageDisabled turns off validation.
	VerifyImageDisabled = "disabled"
)

Variables ¶

View Source

var (
	// ErrBadProtocolScheme is returned when the provided serverOrImage is not a valid protocol scheme.
	ErrBadProtocolScheme = errors.New("invalid protocol scheme provided for MCP server")
	// ErrImageNotFound is returned when the specified image is not found in the registry.
	ErrImageNotFound = errors.New("image not found in registry, please check the image name or tag")
)

Functions ¶

func GetMCPServer ¶

func GetMCPServer(
	ctx context.Context,
	serverOrImage string,
	rawCACertPath string,
	verificationType string,
) (string, *registry.ImageMetadata, error)

GetMCPServer retrieves the MCP server definition from the registry.

Types ¶

This section is empty.

Source Files ¶

View all Source files

retriever.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL