diff --git a/extensions/msteams/src/attachments/shared.ts b/extensions/msteams/src/attachments/shared.ts
index 97e5eb5ac8b..9f065d8bc5f 100644
--- a/extensions/msteams/src/attachments/shared.ts
+++ b/extensions/msteams/src/attachments/shared.ts
@@ -5,8 +5,8 @@ import {
   isHttpsUrlAllowedByHostnameSuffixAllowlist,
   isPrivateIpAddress,
   normalizeHostnameSuffixAllowlist,
-} from "../../runtime-api.js";
-import type { SsrFPolicy } from "../../runtime-api.js";
+  type SsrFPolicy,
+} from "openclaw/plugin-sdk/ssrf-policy";
 import type { MSTeamsAttachmentLike } from "./types.js";
 
 type InlineImageCandidate =
diff --git a/extensions/msteams/src/secret-input.ts b/extensions/msteams/src/secret-input.ts
index da9ca2993b7..7fd9bc2aa33 100644
--- a/extensions/msteams/src/secret-input.ts
+++ b/extensions/msteams/src/secret-input.ts
@@ -2,6 +2,6 @@ import {
   hasConfiguredSecretInput,
   normalizeResolvedSecretInputString,
   normalizeSecretInputString,
-} from "../runtime-api.js";
+} from "openclaw/plugin-sdk/secret-input";
 
 export { hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString };
diff --git a/package.json b/package.json
index 666241c9223..935a2cb397d 100644
--- a/package.json
+++ b/package.json
@@ -151,6 +151,10 @@
       "types": "./dist/plugin-sdk/runtime-group-policy.d.ts",
       "default": "./dist/plugin-sdk/runtime-group-policy.js"
     },
+    "./plugin-sdk/ssrf-policy": {
+      "types": "./dist/plugin-sdk/ssrf-policy.d.ts",
+      "default": "./dist/plugin-sdk/ssrf-policy.js"
+    },
     "./plugin-sdk/ssrf-runtime": {
       "types": "./dist/plugin-sdk/ssrf-runtime.d.ts",
       "default": "./dist/plugin-sdk/ssrf-runtime.js"
diff --git a/scripts/lib/plugin-sdk-entrypoints.json b/scripts/lib/plugin-sdk-entrypoints.json
index 11cbe94b060..9ab450f561c 100644
--- a/scripts/lib/plugin-sdk-entrypoints.json
+++ b/scripts/lib/plugin-sdk-entrypoints.json
@@ -27,6 +27,7 @@
   "infra-runtime",
   "runtime-config-snapshot",
   "runtime-group-policy",
+  "ssrf-policy",
   "ssrf-runtime",
   "media-runtime",
   "media-understanding-runtime",
diff --git a/src/plugin-sdk/ssrf-policy.ts b/src/plugin-sdk/ssrf-policy.ts
index 976f2d527cd..1ea7681ae3e 100644
--- a/src/plugin-sdk/ssrf-policy.ts
+++ b/src/plugin-sdk/ssrf-policy.ts
@@ -6,6 +6,8 @@ import {
   type SsrFPolicy,
 } from "../infra/net/ssrf.js";
 
+export { isPrivateIpAddress };
+
 export function ssrfPolicyFromAllowPrivateNetwork(
   allowPrivateNetwork: boolean | null | undefined,
 ): SsrFPolicy | undefined {