feed-mcp

The server includes robust URL validation (scheme, private IP blocking) and a custom `FuzzValidateFeedURL` test to prevent Server-Side Request Forgery (SSRF) attacks. It uses the `gofeed` library for feed parsing, which is generally secure against common XML parsing vulnerabilities. The `fetch_link` tool and image embedding feature expand the attack surface by performing arbitrary HTTP requests, but these are mitigated by the extensive URL validation and built-in circuit breakers/timeouts. OPML parsing is handled, and fuzz tests explicitly address XML vulnerabilities (e.g., XXE). The design prioritizes security-by-default with explicit opt-in for less secure options (e.g., `--allow-private-ips`). No hardcoded secrets or malicious patterns were identified in the truncated source.