fetch: --allowed-hosts accepts wildcard IP entries (e.g. *.0.0.1) and matches any IPv4 ending with that suffix #5521

Problem

mcp-server-fetch's --allowed-hosts allowlist (src/fetch/src/mcp_server_fetch/allowlist.py) documents two valid entry forms:

Two entry forms only, to keep the semantics obvious: an exact host (a name or an IP literal), and *.example.com, which matches any subdomain at any depth of example.com...

However, normalize_allowed_host only checks ipaddress.ip_address(...) when not wildcard (line 37). When a wildcard prefix *. is given before an IP literal or numeric IP suffix (such as *.10.0.0.1 or *.0.0.1), httpx.URL(f"http://{name}/") parses name without error and returns *.10.0.0.1 / *.0.0.1.

Then in host_is_allowed(host, allowed_hosts), host.endswith(entry[1:]) matches any IPv4 literal ending with .0.0.1 (for example, *.0.0.1 matches both 10.0.0.1 and 127.0.0.1).

from mcp_server_fetch.allowlist import host_is_allowed, normalize_allowed_hosts

entries = normalize_allowed_hosts(["*.0.0.1"])  # returns ('*.0.0.1',)
assert host_is_allowed("127.0.0.1", entries) is True
assert host_is_allowed("10.0.0.1", entries) is True

Expected

• normalize_allowed_host rejects wildcard IP literals and numeric-TLD wildcard suffixes (*.10.0.0.1, *.0.0.1, *.[::1]) with ValueError.
• host_is_allowed does not match *. subdomain wildcards against IP address literals.