# Refused hosts

A base URL is checked before anything is fetched. These are refused, with the message the MCP page shows. A message never repeats the URL, in case a secret was pasted into it.

| Refused | Message |
| --- | --- |
| A URL that's too long | `Use a shorter URL.` |
| Anything but `https`, or a URL that doesn't parse | `Use an https:// URL.` |
| A user name or password in the URL | `Leave out the user name and password: store the credential instead.` |
| A port | `Leave out the port: only the default https port is called.` |
| A query or a fragment | `Leave out the query and the fragment: each tool adds its own.` |
| An IP address, a single-label name, a private name, latitude10.tech or Cloudflare's own names | `Use your API’s public host name, not an IP address or a private name.` |

Private names are those under `localhost`, `local`, `internal`, `localdomain`, `lan`, `arpa`, `test`, `invalid`, `example` and `onion`. An IP address is refused in any spelling, numeric names included.

The same check guards the API client's proxy hosts and the servers Try it may call.

## Where this comes from

- `app/hosted-mcp/_lib/upstream.ts`
- `app/reference/_lib/playground/proxy.ts`
- `app/reference/_lib/playground/csp.ts`