fix(mcp): distinguish DNS resolution failures from SSRF policy blocks

DNS lookup failures now throw McpDnsResolutionError (502) instead of
McpSsrfError (403), so transient DNS hiccups surface as retryable
upstream errors rather than confusing permission rejections.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/mcp/servers/[id]/route.ts

@@ -5,6 +5,7 @@ import { and, eq, isNull } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import { AuditAction, AuditResourceType, recordAudit } from '@/lib/audit/log'
 import {
+  McpDnsResolutionError,
   McpDomainNotAllowedError,
   McpSsrfError,
   validateMcpDomain,
@@ -53,6 +54,9 @@ export const PATCH = withMcpAuth<{ id: string }>('write')(
         try {
           await validateMcpServerSsrf(updateData.url)
         } catch (e) {
+          if (e instanceof McpDnsResolutionError) {
+            return createMcpErrorResponse(e, e.message, 502)
+          }
           if (e instanceof McpSsrfError) {
             return createMcpErrorResponse(e, e.message, 403)
           }

apps/sim/app/api/mcp/servers/route.ts

@@ -5,6 +5,7 @@ import { and, eq, isNull } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import { AuditAction, AuditResourceType, recordAudit } from '@/lib/audit/log'
 import {
+  McpDnsResolutionError,
   McpDomainNotAllowedError,
   McpSsrfError,
   validateMcpDomain,
@@ -91,6 +92,9 @@ export const POST = withMcpAuth('write')(
       try {
         await validateMcpServerSsrf(body.url)
       } catch (e) {
+        if (e instanceof McpDnsResolutionError) {
+          return createMcpErrorResponse(e, e.message, 502)
+        }
         if (e instanceof McpSsrfError) {
           return createMcpErrorResponse(e, e.message, 403)
         }

apps/sim/app/api/mcp/servers/test-connection/route.ts

@@ -2,6 +2,7 @@ import { createLogger } from '@sim/logger'
 import type { NextRequest } from 'next/server'
 import { McpClient } from '@/lib/mcp/client'
 import {
+  McpDnsResolutionError,
   McpDomainNotAllowedError,
   McpSsrfError,
   validateMcpDomain,
@@ -103,6 +104,9 @@ export const POST = withMcpAuth('write')(
       try {
         await validateMcpServerSsrf(body.url)
       } catch (e) {
+        if (e instanceof McpDnsResolutionError) {
+          return createMcpErrorResponse(e, e.message, 502)
+        }
         if (e instanceof McpSsrfError) {
           return createMcpErrorResponse(e, e.message, 403)
         }
@@ -146,6 +150,9 @@ export const POST = withMcpAuth('write')(
       try {
         await validateMcpServerSsrf(testConfig.url)
       } catch (e) {
+        if (e instanceof McpDnsResolutionError) {
+          return createMcpErrorResponse(e, e.message, 502)
+        }
         if (e instanceof McpSsrfError) {
           return createMcpErrorResponse(e, e.message, 403)
         }

apps/sim/lib/mcp/domain-check.test.ts

@@ -36,6 +36,7 @@ vi.mock('@/executor/utils/reference-validation', () => ({
 
 import {
   isMcpDomainAllowed,
+  McpDnsResolutionError,
   McpDomainNotAllowedError,
   McpSsrfError,
   validateMcpDomain,
@@ -393,10 +394,10 @@ describe('validateMcpServerSsrf', () => {
     )
   })
 
-  it('throws McpSsrfError when DNS lookup fails', async () => {
+  it('throws McpDnsResolutionError when DNS lookup fails', async () => {
     mockDnsLookup.mockRejectedValue(new Error('ENOTFOUND'))
     await expect(validateMcpServerSsrf('https://nonexistent.invalid/mcp')).rejects.toThrow(
-      'MCP server URL hostname could not be resolved'
+      McpDnsResolutionError
     )
   })
 

apps/sim/lib/mcp/domain-check.ts

@@ -21,6 +21,13 @@ export class McpSsrfError extends Error {
   }
 }
 
+export class McpDnsResolutionError extends Error {
+  constructor(hostname: string) {
+    super(`MCP server URL hostname "${hostname}" could not be resolved`)
+    this.name = 'McpDnsResolutionError'
+  }
+}
+
 /**
  * Core domain check. Returns null if the URL is allowed, or the hostname/url
  * string to use in the rejection error.
@@ -168,6 +175,6 @@ export async function validateMcpServerSsrf(url: string | undefined): Promise<vo
       hostname,
       error: error instanceof Error ? error.message : String(error),
     })
-    throw new McpSsrfError('MCP server URL hostname could not be resolved')
+    throw new McpDnsResolutionError(cleanHostname)
   }
 }