Address OWASP Top 10 A10 Server-Side Request Forgery (SSRF) per OWASP Top 10:2025. SSRF occurs when an application fetches a remote resource without validating the user-supplied URL allowing internal network access + cloud metadata service access + or other unauthorised target access including blind SSRF + DNS rebinding + URL parsing inconsistencies. Mitigations include (a) implement URL allowlist for fetching external resources + (b) block internal IP ranges + cloud metadata service IPs (169.254.169.254 + similar) + (c) use DNS resolution checking + (d) enforce schemes + protocols + ports + (e) implement network-level egress controls + (f) protect cloud metadata via IMDSv2 + workload identity + (g) implement defence in depth.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.