# Security Hardening Measures in CLI-Anything: MCP Harness Protection Explained

> Discover CLI-Anything's robust security hardening including URL whitelisting, private network blocking, and prompt injection sanitization for protected MCP harnesses.

- Repository: [✨Data Intelligence Lab@HKU✨/CLI-Anything](https://github.com/HKUDS/CLI-Anything)
- Tags: deep-dive
- Published: 2026-05-18

---

**CLI-Anything implements defense-in-depth security hardening measures across its MCP harnesses through URL scheme whitelisting, private network blocking, prompt injection sanitization, and configurable environment-based policies.**

CLI-Anything by HKUDS ships with comprehensive security hardening measures designed to protect its Model Context Protocol (MCP) harnesses from common attack vectors. These safeguards are applied at the lowest level of the stack before any external request reaches the underlying browser or Safari tools. The framework enforces strict validation through configurable environment variables and explicit failure reporting to ensure agents interact with external resources safely.

## URL Scheme Validation and Whitelisting

The foundation of CLI-Anything’s security model is strict URL scheme validation implemented in [`browser/utils/security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/browser/utils/security.py) and [`safari/utils/security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/safari/utils/security.py). By default, only `http` and `https` schemes are permitted, while all potentially dangerous protocols are explicitly blocked before any network request is initiated.

### Blocked Dangerous Schemes

The validator maintains a comprehensive deny list of high-risk schemes that could enable local file access, code execution, or browser-specific exploits. Blocked schemes include `file`, `javascript`, `data`, `vbscript`, `about`, `chrome`, `chrome-extension`, `moz-extension`, `edge`, `safari`, `opera`, `brave`, `x-apple`, and `feed`. Any URL utilizing these schemes is rejected immediately with a clear error message explaining the violation.

### Configurable Allow Lists via Environment Variables

Operators can customize the permitted schemes without modifying source code by setting the `CLI_ANYTHING_<HARNES>_ALLOWED_SCHEMES` environment variable. This comma-separated list overrides the default `http`/`https` whitelist, enabling fine-grained control over what protocols the MCP harnesses may access.

```python
from cli_anything.browser.utils.security import validate_url

# Validating a safe URL

url = "https://example.com/dashboard"
ok, err = validate_url(url)
if not ok:
    raise ValueError(f"Unsafe URL: {err}")

# Attempting to access a blocked scheme

ok, err = validate_url("file:///etc/passwd")

# err -> "Blocked URL scheme: file"

```

## Private Network Blocking for SSRF Prevention

To mitigate Server-Side Request Forgery (SSRF) attacks against internal infrastructure, CLI-Anything provides optional private network blocking controlled by the `CLI_ANYTHING_<HARNES>_BLOCK_PRIVATE` environment variable. When set to `true` or `1`, the validator rejects any URL resolving to private IP ranges including RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback interfaces (127.0.0.0/8), link-local addresses (169.254.0.0/16), and IPv6 Unique Local Addresses (ULA).

This check is performed in the same security modules ([`browser/utils/security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/browser/utils/security.py) and [`safari/utils/security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/safari/utils/security.py)) and operates before DNS resolution when possible, ensuring internal services remain inaccessible even when hostnames are provided rather than raw IP addresses.

## Prompt Injection Sanitization

Beyond URL validation, CLI-Anything protects against prompt injection attacks through the `sanitize_dom_text` function in [`browser/utils/security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/browser/utils/security.py). This utility processes DOM text extracted from web pages through a multi-layered sanitization pipeline:

- **Character filtering**: Strips non-printable characters that could obfuscate malicious payloads
- **Length truncation**: Limits text size to a configurable default of 10KB to prevent context window exhaustion attacks
- **Pattern detection**: Scans for known "ignore-previous-instruction" patterns across multiple languages, including English phrases like *ignore previous*, Chinese characters such as *忘记之前的*, and HTML comment markers like `<!--`

When suspicious patterns are detected, the content is flagged and shortened, with `[FLAGGED: Potential prompt injection]` prepended to alert downstream consumers.

```python
from cli_anything.browser.utils.security import sanitize_dom_text

raw = "<script>alert(1)</script> Click here"
clean = sanitize_dom_text(raw)

# clean -> "[FLAGGED: Potential prompt injection] <script>..."

```

## Integration Points and Explicit Failure Reporting

All security validations return explicit `(bool, str)` tuples rather than raising exceptions directly. This design allows callers to handle failures gracefully while receiving descriptive error messages. Every high-level command that accepts a URL passes it through `validate_url` before invoking the underlying MCP.

In the Browser harness, [`browser/core/page.py`](https://github.com/HKUDS/CLI-Anything/blob/main/browser/core/page.py) implements this in the `Page.navigate` method. The Safari harness enforces the same policy in [`safari/safari_cli.py`](https://github.com/HKUDS/CLI-Anything/blob/main/safari/safari_cli.py) through the `_validate_url_or_exit` wrapper. These integration points guarantee that no unsafe URL ever reaches the external tool, regardless of the entry point used by the agent.

## Comprehensive Test Coverage

The security hardening is protected against regression by dedicated test suites in [`browser/tests/test_security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/browser/tests/test_security.py) and [`safari/tests/test_security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/safari/tests/test_security.py). These tests verify every blocked scheme, validate private-network detection logic, and ensure that environment variable configuration functions correctly across different harness types. This test-driven approach ensures that security boundaries cannot be inadvertently weakened during future development.

## Summary

- **Input sanitization** filters malicious URL schemes at the entry point before any external request is made.
- **Network-level isolation** optionally blocks private IP ranges via the `CLI_ANYTHING_<HARNES>_BLOCK_PRIVATE` environment variable to prevent SSRF attacks.
- **Content-level filtering** scans DOM text for prompt injection patterns using `sanitize_dom_text` and truncates oversized content.
- **Explicit configuration** allows operators to customize allowed schemes through `CLI_ANYTHING_<HARNES>_ALLOWED_SCHEMES` without code changes.
- **Validation guarantees** are enforced at integration points in [`browser/core/page.py`](https://github.com/HKUDS/CLI-Anything/blob/main/browser/core/page.py) and [`safari/safari_cli.py`](https://github.com/HKUDS/CLI-Anything/blob/main/safari/safari_cli.py) with clear error messaging.

## Frequently Asked Questions

### How does CLI-Anything prevent unauthorized local file access?

The framework blocks dangerous URL schemes including `file`, `javascript`, `data`, and browser-specific protocols like `chrome-extension` in the security modules located at [`browser/utils/security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/browser/utils/security.py) and [`safari/utils/security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/safari/utils/security.py). When `validate_url` encounters these schemes, it returns `(False, "Blocked URL scheme: {scheme}")` before the request reaches the underlying browser harness.

### Can operators customize which URL schemes are permitted?

Yes. By setting the `CLI_ANYTHING_<HARNES>_ALLOWED_SCHEMES` environment variable to a comma-separated list (e.g., `http,https,ftp`), operators can override the default whitelist of `http` and `https` without modifying source code. This configuration is read at initialization in the security utility modules.

### What protections exist against prompt injection through web content?

The `sanitize_dom_text` function in [`browser/utils/security.py`](https://github.com/HKUDS/CLI-Anything/blob/main/browser/utils/security.py) implements content-level defenses by stripping non-printable characters, truncating text to 10KB by default, and detecting multilingual "ignore previous instruction" patterns. Detected payloads are flagged and shortened to prevent manipulation of agent behavior through malicious webpage content.

### How does the framework prevent SSRF attacks against internal services?

When the `CLI_ANYTHING_<HARNES>_BLOCK_PRIVATE` environment variable is set to `true` or `1`, the validator rejects URLs resolving to private networks (RFC 1918, loopback, link-local, and IPv6 ULA ranges). This check occurs in the security modules before the request is handed to the MCP, effectively isolating the agent from internal infrastructure.