Security Restrictions

The runtime validates your endpoint URL twice, once when you save it, and again on every invocation. The second pass is a defense against DNS rebinding (where a hostname resolves to a public IP at save time but flips to a private IP at call time).

​

URL shape rules

​

Blocked IPv4 ranges

Every range is checked against the resolved IP, not just the URL hostname.

​

Blocked IPv6 ranges

​

Self-host blocklist

We block URLs pointing at our own infrastructure to prevent reflection attacks:

• aisky.co.za and any subdomain
• *.supabase.co
• *.supabase.in
• *.amazonaws.com
• localhost and *.localhost

​

Redirect handling

We do not follow redirects. Any 3xx response from your endpoint produces HTTP_TOOL_TOO_MANY_REDIRECTS (technically, “any redirect at all”, the name is historical). Why: each hop is a fresh URL that would need re-SSRF-checking, and a malicious endpoint could redirect to a private IP after passing the initial check. Simpler and safer to require direct resolution. Fix: Resolve the final URL on your side and point the tool at that directly.

​

Response content-type allowlist

A missing Content-Type header is tolerated, we treat it as text/plain.

​

Response size cap

64 KB. We start reading the response stream and abort as soon as we cross the cap. The first 64 KB is passed to the AI, with a [truncated; full response was N bytes] footer appended. The full byte count is logged so you can investigate. This is not a 502 error, it’s a successful invocation marked with HTTP_TOOL_RESPONSE_TOO_LARGE in the invocations log.

​

Timeouts

Once 10s elapses we abort the request and return HTTP_TOOL_TIMEOUT. The AI tells the caller “lookup timed out” and continues.

​

What you can’t disable

For safety reasons, none of the above can be turned off, not even with a support ticket. If you have a use case that the rules block, reach out and we’ll work with you on a v2 that solves it without dropping the SSRF guard.

​

Best-case scenario

If your endpoint:

• Uses HTTPS with a valid public certificate
• Resolves to a public, non-blocked IP
• Returns 2xx with Content-Type: application/json and a body under 4 KB
• Responds in under 2 seconds

…then your tool feels instant from the caller’s perspective. That’s the bar we recommend designing for.