With github.com/archestra-ai/archestra/pull/6488 was the intention on this to hard block all access to the following ranges from MCP pods with no way to override if the environments networkPolicy is set to unrestricted (Allow All)?:

- 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 - RFC 1918 private ranges (cluster pods, services, nodes) <--- This is the primary one I'm wondering about

- 169.254.0.0/16 - Link-local / cloud metadata endpoints (AWS IMDSv1, GCP, Azure)

- 100.64.0.0/10 - Carrier-grade NAT (RFC 6598)

-- 127.0.0.0/8 - Loopback

-- 0.0.0.0/32 - Treated as localhost by some HTTP libraries

hey 👋

yes, it's intentional - "unrestricted" != "allow all".. it's an always-on-SSRF-floor (DNS + public internet, with RFC1918/link-local/metadata/CGNAT/loopback carved out), and there's no per-environment override for it.

if an MCP server (or Agent's sandbox) genuinely needs a cluster-internal or private-range target, set that environment to "restricted" and list the CIDR explicitly (allowed CIDRs aren't filtered against those ranges, so 10.x/8 and friends work there). the floor only applies on the unrestricted path.

does that make sense?

(our docs were a bit lacking around these details, updated that - thanks for raising this)