fix(mcp): anchor TP3 loopback URL exemption to a host boundary

[jichaowang02-lang]

Summary

The TP3 (parameter injection) analyzer's malicious-default-URL check can be
bypassed: a default value pointing at an attacker-controlled host whose
name merely starts with localhost / 127.0.0.1 is treated as benign
loopback and produces no finding.

Root cause

mcp_tool_poisoning.py:

_TP3_MALICIOUS_URL_RE = re.compile(
    r"https?://(?!localhost|127\.0\.0\.1)\S+",
    re.IGNORECASE,
)

The negative lookahead matches the bare substring localhost / 127.0.0.1
with no host boundary, so any host that begins with that prefix is
exempted. _check_tp3 gates the malicious-default finding on this regex, so an
exfiltration default like http://localhost.evil.com/exfil yields zero TP3
findings. An attacker only needs to register a host beginning with
localhost. (or 127.0.0.1.).

>>> bool(_TP3_MALICIOUS_URL_RE.search("http://localhost.attacker.com/exfil?d=secrets"))
False   # ← treated as loopback, not flagged
>>> bool(_TP3_MALICIOUS_URL_RE.search("http://attacker.com/exfil"))
True

default URL	before	after
http://localhost.evil.com/exfil	❌ not flagged	✅ TP3
http://127.0.0.1.evil.com/x	❌ not flagged	✅ TP3
http://attacker.com/exfil	✅ TP3	✅ TP3
http://localhost:8080/cb (loopback)	exempt	exempt
http://127.0.0.1/cb (loopback)	exempt	exempt

Fix

Anchor the loopback exemption to a real host boundary (port / path / query /
fragment / end of string):

r"https?://(?!(?:localhost|127\.0\.0\.1)(?:[:/?#]|$))\S+"

Only genuine loopback hosts are exempt; external hosts that share the prefix
are now flagged.

Testing

$ pytest tests/test_mcp_tool_poisoning.py -q
24 passed
$ ruff check ... && ruff format --check ...
All checks passed!

Adds test_localhost_prefixed_attacker_url_is_flagged (the bypass cases) and
test_genuine_loopback_default_url_is_exempt (regression guard). Verified
end-to-end against _check_tp3 / node() on Python 3.13.

(No pre-existing issue — newly found while reading the analyzer. Commit is
DCO Signed-off-by.)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.