netguard

package

v1.1.0 Latest Latest Go to latest Published: Oct 19, 2026 License: Apache-2.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/tragent-io/acurl

Links

Open Source Insights

Documentation ¶

Overview ¶

Package netguard stops requests to private and internal networks.

acurl serve and acurl mcp fetch URLs chosen by someone else (a browser tab, an AI assistant). Without a guard they could be pointed at 127.0.0.1, the cloud metadata service or the office network (SSRF). The check runs on the resolved IP at connect time, so DNS names that resolve to private addresses, including after a rebinding, are refused.

Index ¶

Variables
func Blocked(ip netip.Addr) bool
func DialContext(timeout time.Duration) func(ctx context.Context, network, addr string) (net.Conn, error)

Constants ¶

This section is empty.

Variables ¶

View Source

var ErrBlocked = errors.New("connection to a private or internal address blocked")

ErrBlocked is returned when a connection to a non-public address is refused.

Functions ¶

func Blocked ¶

func Blocked(ip netip.Addr) bool

Blocked reports whether ip must not be connected to.

func DialContext ¶

func DialContext(timeout time.Duration) func(ctx context.Context, network, addr string) (net.Conn, error)

DialContext returns a dial function that refuses private addresses.

Types ¶

This section is empty.

Source Files ¶

View all Source files

netguard.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL