Server-side request forgery (SSRF)

Why this agent matters

SSRF turns your server into a proxy into your own network. On cloud hosts that often means the instance metadata endpoint and the credentials behind it — the path used in the 2019 Capital One breach. It has its own slot in the OWASP Top 10 (A10).

Scanners can see an outbound HTTP call but not whether its destination is fixed, allow-listed or user-controlled. This agent makes that call, and checks the defences that are easy to miss: redirects, DNS rebinding and internal address ranges.

What it checks

• HTTP clients, URL fetchers, webhooks and file/URL loaders whose target comes from a request
• Missing host and scheme allow-lists
• Redirect following and DNS-rebinding exposure
• Reachability of metadata (169.254.169.254), localhost and RFC 1918 ranges

When it marks a finding as a likely false positive

• The URL is fixed in code or config
• The destination is validated against an explicit allow-list

The fix it suggests

• An allow-list of explicit hosts and schemes
• Blocking internal and metadata ranges after DNS resolution
• Disabling automatic redirects

Scope and limits

This agent validates findings reported by Semgrep, Gitleaks and Trivy; it doesn't hunt for new bugs on its own. A finding reaches it when its CWE or rule/path keywords match this vulnerability class. It sees only the minimal code around the finding, with secrets redacted, and returns a verdict with a confidence score, a plain-English explanation and a suggested patch.

Common questions

Related agents

• SQL injection — Decides whether attacker-controlled input actually reaches a SQL or NoSQL query unparameterized.
• Cross-site scripting (XSS) — Checks whether untrusted data is rendered into HTML or JavaScript without contextual encoding.
• Command & code injection — Checks whether user input reaches a shell, eval or template-evaluation sink.

See all 20 review agents → · Agent setup reviewer · How the pipeline works