Internal IPs used for GCP-hosted servers

[jkeys089]

MCP server URL or name

https://fanalytics.fanflix.co/api/mcp

How are you connecting to this server?

From a custom connector URL I entered manually

Where does the issue occur?

When pressing the Connect button

When did you last reproduce this?

2026-06-09 1:50PM PT

Browser and OS

Chrome 149 on macOS 26.5.1

Describe the issue

Our app is deployed on Google App Engine and utilizes the GAE firewall to filter traffic. We noticed that we weren't seeing any traffic when attempting to add our MCP connector despite allowlisting 160.79.104.0/21 per https://platform.claude.com/docs/en/api/ip-addresses#i-pv4-2. After some debugging, we briefly opened the app to the public internet and we were able to connect immediately without any issue. After re-enabling the firewall, the connector stops working but we had some traffic logs to inspect. To our surprise, all traffic coming from Anthropic (identified by Claude-User useragent) came from IPs like 0.0.0.0 or fda3:e722:ac3:cc00:94:f957:feff:9454. These are internal IPs from GCP's own routing infrastructure. In other words, it appears Anthropic's MCP services are also hosted on GCP and are routing internally to our host instead of going over the public inet / utilizing egress IPs documented at https://platform.claude.com/docs/en/api/ip-addresses#i-pv4-2.

This leaves us in the unfortunate position of either opening 0.0.0.0/32 and fda3:e722:ac3::/48 (i.e. all internal GCP routing) or implementing a hacky workaround (e.g. forwarding proxy outside GCP or custom L7 solution in our app).

Error details

Couldn't register with Fanalytics's sign-in service. You can try again, or add an OAuth Client ID in the connector settings. If this persists, share this reference with support: "ofid_c4bc7e36276e68bc"

Expected behavior

MCP traffic is routed over public IP range documented at https://platform.claude.com/docs/en/api/ip-addresses#i-pv4-2

Additional context

No response

[localden]

Thank you for taking the time to report this.

The reference ID you shared (ofid_c4bc7e36276e68bc) is now past our log retention window, so we could not pull the exact trace for that attempt. Based on the symptom, this is very likely our private-address safety check.

claude.ai connectors reach your MCP server from Anthropic's infrastructure over the public internet. Before connecting, we resolve the server address and refuse any private or reserved destination: RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), the 100.64.0.0/10 shared address space, and .internal hostnames all fall into this. If the URL you entered is an internal IP, an internal load balancer address, or a hostname whose public DNS record points at one of those, the connection is refused immediately with a generic "couldn't reach the server" error. This is intentional; a private address is not routable from our side regardless.

To use this server as a claude.ai connector, give it an address that is reachable from the public internet, for example by putting the MCP endpoint behind an external HTTPS load balancer or a public tunnel, keeping OAuth as the authentication layer.

Closing as working as intended. If you would like us to confirm exactly what happened, please retry the connection and reopen with the new ofid_... reference and we will trace it.