MCP tools
Network rules for MCP servers
MCP servers must be on public addresses. What's refused, why DNS rebinding can't get around it, and the timeouts that apply.
Reference1 min readUpdated 23 October 2026
An MCP server URL is a URL someone typed, and SentientOne calls it from its own servers. So every connection is checked first, the same way as workflow HTTP and Webhook blocks.
What's refused
- Schemes other than
httpandhttps. localhost,*.localhost,*.localand*.internalnames.- Private (10/8, 172.16/12, 192.168/16), loopback (127/8), link-local (169.254/16), carrier-grade NAT (100.64/10) and
0.xaddresses, and their IPv6 equivalents. - Any host name that resolves to one of those addresses.
A refused server fails with: "MCP servers must be on a public internet address."
How the check holds
- The host name is resolved once, every address is checked, and the connection goes to the address that was checked. A DNS answer that changes between the check and the connection (DNS rebinding) can't redirect it.
- Redirects aren't followed, and no proxy settings from the environment are used.
Timeouts
| Stage | Limit |
|---|---|
| Connect | 5 seconds |
| Read | 30 seconds |
| One tool call during a chat reply | 10 seconds |
| MCP tool call block in a workflow | 30 seconds |
| Discovery (Test connection, Refresh tools) | 10 seconds per call |
| A failed handshake | Retried after 60 seconds |
Reaching a server inside your network
Put the MCP server behind a public HTTPS endpoint you control (a gateway or reverse proxy), protect it with a bearer token or API key header, and connect that URL.
Related
Still stuck?
Email us with what you tried and any request id. A person replies.