Summary

Git clone tools validate URL schemes but do not filter by host/IP. The spec notes this as a future consideration to prevent SSRF against internal networks (loopback, link-local, private ranges).

Design Spec Reference

• §11.1.1 Built-in git tools — Future note at end

Scope

• Host/IP allowlisting/denylisting for GitCloneTool
• Block loopback (127.0.0.0/8, ::1), link-local (169.254.0.0/16), private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) by default
• Configurable allowlist for legitimate internal hosts