refactor(local-mcp): share the private-IPv4 range table

isPrivateHostname (core) and web-fetch's isBlockedHost (harness) each
hand-rolled the same RFC1918/link-local/CGNAT/loopback IPv4 octet-range
table. core can't import harness or node:net, so lifted the pure
octet-range predicate into @posthog/shared and had both callers use it
instead of maintaining two copies of SSRF-adjacent range logic.

isPrivateHostname now also treats 0.0.0.0/8 and 198.18.0.0/15 as private,
picking up isBlockedHost's slightly wider range set — consistent with its
own "err toward private" design.

Author: richardsolomou

packages/core/src/local-mcp/localMcpImport.ts

@@ -2,6 +2,7 @@ import type {
   CloudMcpServerImport,
   LocalMcpServerDescriptor,
 } from "@posthog/shared";
+import { isPrivateIpv4Octets } from "@posthog/shared";
 import { inject, injectable } from "inversify";
 import { LOCAL_MCP_WORKSPACE_CLIENT } from "./identifiers";
 
@@ -51,14 +52,6 @@ function parseIpv4(host: string): [number, number, number, number] | null {
   return octets as [number, number, number, number];
 }
 
-function isPrivateIpv4([a, b]: [number, number, number, number]): boolean {
-  if (a === 0 || a === 10 || a === 127) return true;
-  if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT, incl. Tailscale IPs
-  if (a === 169 && b === 254) return true; // link-local
-  if (a === 172 && b >= 16 && b <= 31) return true;
-  return a === 192 && b === 168;
-}
-
 const PRIVATE_HOST_SUFFIXES = [
   ".local",
   ".localhost",
@@ -86,14 +79,14 @@ export function isPrivateHostname(hostname: string): boolean {
     const v4Mapped = host.match(/^::ffff:(.+)$/)?.[1];
     if (v4Mapped) {
       const octets = parseIpv4(v4Mapped);
-      return octets ? isPrivateIpv4(octets) : false;
+      return octets ? isPrivateIpv4Octets(octets[0], octets[1]) : false;
     }
     // fc00::/7 unique-local, fe80::/10 link-local
     return /^(f[cd]|fe[89ab])/.test(host);
   }
 
   const octets = parseIpv4(host);
-  if (octets) return isPrivateIpv4(octets);
+  if (octets) return isPrivateIpv4Octets(octets[0], octets[1]);
 
   // Bare intranet names ("nas", "router") only resolve on the local network.
   if (!host.includes(".")) return true;

packages/harness/src/extensions/web-access/web-fetch.ts

@@ -1,5 +1,6 @@
 import { isIP } from "node:net";
 import { defineTool } from "@earendil-works/pi-coding-agent";
+import { isPrivateIpv4Octets } from "@posthog/shared";
 import { LRUCache } from "lru-cache";
 import TurndownService from "turndown";
 import { Type } from "typebox";
@@ -70,18 +71,7 @@ function isBlockedHost(rawHostname: string): boolean {
   if (lower === "localhost" || lower.endsWith(".localhost")) return true;
 
   const v4 = ipv4Octets(hostname);
-  if (v4) {
-    const [a, b] = v4;
-    if (a === 127) return true; // loopback (127.0.0.0/8)
-    if (a === 10) return true; // private (10.0.0.0/8)
-    if (a === 0) return true; // "this network" (0.0.0.0/8)
-    if (a === 169 && b === 254) return true; // link-local incl. cloud metadata (169.254.0.0/16)
-    if (a === 172 && b >= 16 && b <= 31) return true; // private (172.16.0.0/12)
-    if (a === 192 && b === 168) return true; // private (192.168.0.0/16)
-    if (a === 100 && b >= 64 && b <= 127) return true; // carrier-grade NAT (100.64.0.0/10)
-    if (a === 198 && (b === 18 || b === 19)) return true; // benchmarking (198.18.0.0/15)
-    return false;
-  }
+  if (v4) return isPrivateIpv4Octets(v4[0], v4[1]);
 
   if (isIP(hostname) === 6) {
     if (lower === "::1") return true; // loopback

packages/shared/src/index.ts

@@ -165,6 +165,7 @@ export {
   pathToFileUri,
   toRelativePath,
 } from "./path";
+export { isPrivateIpv4Octets } from "./private-network";
 export {
   buildPrOutput,
   mergePrUrls,

packages/shared/src/private-network.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import { isPrivateIpv4Octets } from "./private-network";
+
+describe("isPrivateIpv4Octets", () => {
+  it.each([
+    [0, 1, "this network"],
+    [127, 0, "loopback"],
+    [10, 0, "RFC1918 10/8"],
+    [172, 16, "RFC1918 172.16/12 lower bound"],
+    [172, 31, "RFC1918 172.16/12 upper bound"],
+    [192, 168, "RFC1918 192.168/16"],
+    [169, 254, "link-local"],
+    [100, 64, "CGNAT lower bound"],
+    [100, 127, "CGNAT upper bound"],
+    [198, 18, "benchmarking lower bound"],
+    [198, 19, "benchmarking upper bound"],
+  ])("treats %d.%d.x.x (%s) as private", (a, b) => {
+    expect(isPrivateIpv4Octets(a, b)).toBe(true);
+  });
+
+  it.each([
+    [8, 8, "public DNS"],
+    [1, 1, "public DNS"],
+    [172, 15, "just below RFC1918 172.16/12"],
+    [172, 32, "just above RFC1918 172.16/12"],
+    [100, 63, "just below CGNAT"],
+    [100, 128, "just above CGNAT"],
+    [198, 17, "just below benchmarking"],
+    [198, 20, "just above benchmarking"],
+  ])("treats %d.%d.x.x (%s) as public", (a, b) => {
+    expect(isPrivateIpv4Octets(a, b)).toBe(false);
+  });
+});

packages/shared/src/private-network.ts

@@ -0,0 +1,18 @@
+/**
+ * Whether a parsed IPv4 address falls in a non-public range: loopback
+ * (127/8), "this network" (0/8), RFC1918 private space (10/8, 172.16/12,
+ * 192.168/16), link-local (169.254/16, including the cloud metadata
+ * endpoint), carrier-grade NAT (100.64/10, which also covers Tailscale IPs),
+ * or the benchmarking range (198.18/15). Shared by every private/public host
+ * classifier in this monorepo so the range table can't drift between them —
+ * see `@posthog/core`'s `isPrivateHostname` and the web-fetch tool's
+ * `isBlockedHost`.
+ */
+export function isPrivateIpv4Octets(a: number, b: number): boolean {
+  if (a === 0 || a === 10 || a === 127) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  return a === 198 && (b === 18 || b === 19);
+}