From ebd8a9c8f5a83478bba35b750ab74f8955054441 Mon Sep 17 00:00:00 2001
From: shinchan-zhai <zhai@vergex.trade>
Date: Mon, 23 Mar 2026 01:30:14 +0800
Subject: [PATCH] fix: bypass SSRF DNS resolver for AI API calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SSRF protection was blocking AI API calls because Go's custom resolver
couldn't resolve external domains (DNS timeout). curl worked because it
uses the system resolver.

Fix: Agent creates MCP client with standard http.Client (no SSRF filter)
since we control the API URLs.

Tested: '帮我看看拓维信息这只股，我有10万元，帮我制定1个月交易计划'
→ Returns professional A-share analysis with entry/exit strategy in 5.8s
---
 agent/agent.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/agent/agent.go b/agent/agent.go
index becf885e..bac1abfa 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -9,6 +9,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"strconv"
 	"strings"
 	"time"
@@ -62,7 +63,9 @@ func (a *Agent) EnsureAIClient() {
 			for _, m := range models {
 				apiKey := string(m.APIKey)
 				if apiKey != "" && m.CustomAPIURL != "" {
-					client := mcp.NewClient()
+					// Use standard HTTP client (no SSRF protection) since we control the URLs
+					httpClient := &http.Client{Timeout: 60 * time.Second}
+					client := mcp.NewClient(mcp.WithHTTPClient(httpClient))
 					name := m.CustomModelName
 					if name == "" { name = m.ID }
 					client.SetAPIKey(apiKey, m.CustomAPIURL, name)