Address API7:2023 Server Side Request Forgery (SSRF) + input validation per OWASP API Security Top 10 2023 + OWASP-API-PRG-05 Input and Output Validation. SSRF occurs when an API fetches a remote resource without validating the user-supplied URL allowing internal network access + cloud metadata service access + or other unauthorised target access. Mitigations include (a) implement URL allowlist for fetching external resources + (b) block internal IP ranges + cloud metadata service IPs (169.254.169.254 + similar) + (c) use DNS resolution checking + (d) enforce schemes + protocols + ports + (e) implement network-level egress controls. Input and Output Validation must (a) validate input format + length + content + (b) sanitise + escape output appropriate to context (HTML + URL + JSON + SQL + LDAP + similar) + (c) use parameterised queries against SQL injection + (d) implement output encoding per context, (e) integrate with WAF and API gateway protections.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.