Fetchmcp

io.github.labtools-studioPublished by GitHub account labtools-studiov0.1.1Updated Oct 24, 2026

Drop-in fetch MCP: clean Markdown from any URL, with JS rendering and anti-bot.

VerifiedSTDIODesktop onlyWeb Search & ScrapingBrowser Automation

Overview

AI-generated overview

A local MCP server that fetches any URL and returns clean Markdown, rendering JavaScript and handling basic bot protection when needed.

What you can do
Fetch a web page as clean Markdown, with optional raw HTML, length cap and paging through long pages, and control over JavaScript rendering or automatic detection of empty single-page-app shells. Read documentation pages with navigation, headers and footers stripped so API docs come back as clean reference text. Pass extra request headers such as authorization or cookie values for pages that need them. Report typed failure statuses (blocked, blocked_ssrf, needs_js, http_error, timeout, network_error, unsupported_content, empty) instead of returning a bot wall or error page as content.
When to use it
Useful when an assistant needs to read modern, JavaScript-heavy pages or documentation that a plain fetch tool returns empty or truncated for. A reasonable drop-in replacement for a basic fetch server when you want full-length output, honest error reporting and private-address blocking by default.
Requirements
Runs locally via npx as a stdio process; Node.js is required. No account or API key is needed. Static reading works immediately; the first page that needs JavaScript triggers a one-time automatic download of a stealth Chromium browser (about 150 MB), which can be pre-downloaded or skipped with environment variables. Optional environment variables tune timeout, retries, private-IP access and an optional self-hosted FlareSolverr endpoint. Network access is required.
Before you install
The server makes outbound requests to whatever URLs the assistant supplies, so page content and any headers you pass reach those sites. Extra headers can carry credentials such as authorization tokens or cookies; only supply them for sites you trust. Private and localhost addresses are refused by default, and enabling private-IP access widens what can be reached from the machine. The optional browser download fetches a large binary automatically on first JavaScript use unless disabled. It is a p

Installation

In SourceWeft

  1. Open Fetchmcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

fetchmcp

A drop-in replacement for the official fetch MCP that actually works on modern web pages.

[npm] [node] [license] [PRs welcome]

The official fetch MCP is broken on JavaScript-heavy pages, truncates output at 5,000 characters, and ships an unpatched SSRF vulnerability. fetchmcp returns clean, LLM-ready Markdown from any URL — rendering JavaScript when needed, passing basic bot protection without paid proxies, and telling you honestly when a page is blocked instead of hallucinating content. npx and go.

[Before and after: the official fetch MCP returns an empty SPA shell, fetchmcp returns clean Markdown]

jsonc
// Replace the official fetch server with this — one line in your MCP config:"fetchmcp": { "command": "npx", "args": ["-y", "@labtoolsstudio/fetchmcp"] }

[Add to Cursor]   [Install in VS Code]

Why switch

official fetchfetchmcp
JavaScript pages❌ empty / broken✅ auto-renders in a real browser
Output length✂️ truncated at 5,000 chars✅ full page, with paging
Bot protection (403 / Cloudflare)❌ fails silently✅ passes mid-tier walls, no paid proxy
Blocked page❌ returns the CAPTCHA as "content"✅ honest typed error, never fakes it
SSRF safety❌ CVE-2025-65513 (CVSS 9.3)✅ private/metadata IPs refused by default
Costfreefree, self-hosted, $0

Install

Add to your MCP client config (claude_desktop_config.json, Cursor mcp.json, Cline, etc.):

jsonc
{  "mcpServers": {    "fetchmcp": {      "command": "npx",      "args": ["-y", "@labtoolsstudio/fetchmcp"]    }  }}

The install is light — no browser is downloaded up front, and static reading (fetch → Readability → Markdown) works immediately. The first time a page actually needs JavaScript, fetchmcp downloads a stealth Chromium once (~150 MB) automatically, then renders it — still zero-config. To pre-download it at install time, set FETCHMCP_PREINSTALL_BROWSER=1. To stay static-only and never download it, set FETCHMCP_SKIP_BROWSER_DOWNLOAD=1 (JS pages then return an honest needs_js).

Tools

read_url

Fetch any web page as clean Markdown.

argtypedescription
urlstringthe URL to fetch (http/https)
renderbooleanJS rendering: true = always, false = never, omitted = automatic (only for empty SPA shells)
rawbooleanreturn raw HTML instead of Markdown
headersobjectextra request headers, e.g. {"Authorization": "Bearer …", "Cookie": "…"}
max_lengthintegercap characters returned (0 = unlimited, the default)
start_indexintegeroffset for paging through a long page

read_docs

Same engine, tuned for documentation: strips navigation sidebars, headers, and footers so API docs and guides come back as clean reference text. Takes url, render, headers, max_length, start_index.

Honest statuses

fetchmcp never returns a bot wall, an error page, or a truncated shell dressed up as real content. When it can't read a page it says why, with a typed status: blocked (bot protection, with the vendor), blocked_ssrf, needs_js, http_error, timeout, network_error, unsupported_content, or empty.

Configuration (env vars)

vardefaultmeaning
FETCHMCP_TIMEOUT_MS30000per-request timeout
FETCHMCP_MAX_RETRIES2retries on network errors / 429 / 503 (with backoff + Retry-After)
FETCHMCP_ALLOW_PRIVATE_IPunsetset to 1 to allow private/localhost IPs (trusted intranet docs)
FETCHMCP_FLARESOLVERR_URLunsetself-hosted FlareSolverr endpoint for tougher challenges
FETCHMCP_SKIP_BROWSER_DOWNLOADunsetset to 1 for static-only: never download Chromium; JS pages return needs_js
FETCHMCP_PREINSTALL_BROWSERunsetset to 1 to download Chromium at install time instead of on first JS use

Development & testing

bash
npm install          # installs deps (Chromium downloads on first JS use)npm run build        # compile TypeScript to dist/npm test             # unit tests (block detection, SSRF) — no networknpm run test:e2e     # live end-to-end suite against real sites
# Poke at any tool/URL by hand — no need to write a script:node test/probe.mjs read_url  https://example.comnode test/probe.mjs read_url  https://some-spa.example.com --rendernode test/probe.mjs read_docs https://docs.python.org/3/library/json.htmlnode test/probe.mjs read_url  https://api.example.com --header "Authorization=Bearer x" --max-length 500node test/probe.mjs read_url  https://example.com --full     # print the whole response

test/probe.mjs --help semantics are documented at the top of that file.

How it works

Three tiers, escalating only as needed:

  1. Static — plain fetch → Readability → Markdown. Fast path for most pages.
  2. Browser — lazy patchright (stealth Chromium) when the static HTML is an empty SPA shell, a bot wall, or a 403/429/503.
  3. FlareSolverr (optional) — only if you've configured an endpoint, for challenges the browser can't clear.

Star history

If fetchmcp saved you from one more fetch-returns-nothing moment, a star helps others find it.

[Star History Chart]

License

MIT — see LICENSE.

Source: README.md at commit 87f95a5

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts