Web Page Fetcher

io.github.paimonchanPublished by GitHub account paimonchanv0.1.2Updated Oct 24, 2026

Fetch web pages with SSRF protection. Returns clean, readable markdown from any URL.

The publisher's own server: App Store data for agents

Overview

AI-generated overview

Lets an assistant fetch a web page by URL and receive clean, readable markdown with headings, lists, tables and code blocks preserved.

What you can do
A local MCP server that takes a URL and returns the page content converted to structured markdown, using a readability-style extraction that strips ads, navigation and sidebars. It includes built-in LRU caching, per-domain rate limiting, retries on transient errors, and SSRF protection with private IP blocking and redirect validation. Optional build tags add image extraction and headless-Chrome rendering for JavaScript-heavy sites.
When to use it
Useful when an assistant needs to read articles, blog posts, documentation, news pages, forums or schedules and summarize or extract from them. It is not intended for login-protected pages, paywall bypassing, or as a replacement for full browser automation.
Requirements
Runs as a local process on the user's machine; desktop only. Install via Go, Homebrew, Scoop, Winget or Docker. No accounts or API keys. Optional JS rendering requires Chrome or Chromium installed and a build with the jsrender tag. Configuration is through environment variables such as PAIMON_MCP_FETCH_TIMEOUT, PAIMON_MCP_FETCH_MAX_LENGTH and PAIMON_MCP_FETCH_USER_AGENT.
Before you install
The server makes outbound HTTP requests to URLs chosen by the assistant, so fetched content leaves the machine to those sites. PAIMON_MCP_FETCH_DISABLE_ROBOTS turns off robots.txt checking and should be used with caution. Some antivirus software may flag unsigned Go binaries; installing via go install, Docker or building from source avoids that.

Installation

In SourceWeft

  1. Open Web Page Fetcher in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

paimon-mcp-fetch

Give your AI assistant the ability to read any webpage.

A lightweight MCP server that fetches URLs and returns clean, readable markdown. Built with Go — starts in 5ms, uses ~10MB RAM, zero runtime dependencies.

[Release] [Go Version] [License]


What It Does

You give it a URL → it returns clean markdown.

Good for:

  • Reading articles, blog posts, documentation
  • Extracting data from news sites, forums, schedules
  • Summarizing web content for your AI assistant
  • Getting structured output (headings, lists, tables, code blocks preserved)

Not good for:

  • Scraping login-protected pages
  • Bypassing paywalls
  • Replacing a full browser automation tool

Quick Start

1. Install

Pick one method:

bash
# Go (recommended)go install github.com/paimonchan/paimon-mcp-fetch/cmd/paimon-mcp-fetch@latest
# Homebrew (macOS/Linux)brew tap paimonchan/tapbrew install paimon-mcp-fetch
# Scoop (Windows)scoop bucket add paimonchan https://github.com/paimonchan/scoop-bucketscoop install paimon-mcp-fetch
# Winget (Windows)winget install paimonchan.paimon-mcp-fetch
# Dockerdocker run -i --rm ghcr.io/paimonchan/paimon-mcp-fetch:latest

2. Configure Your AI Assistant

Add this to your MCP client config:

json
{  "mcp": {    "paimon-mcp-fetch": {      "type": "local",      "command": ["paimon-mcp-fetch"],      "enabled": true    }  }}

3. Done

Your AI can now read any URL you give it.


Why This Over Other Fetch Tools?

paimon-mcp-fetchBasic text fetch
OutputStructured markdownPlain text
Article extractionReadability algorithm (strips ads, nav, sidebars)Raw HTML body
ImagesOptional extraction + processingNone
JS renderingOptional (headless Chrome)Static only
CachingBuilt-in LRU cacheNone
Rate limitingPer-domain, configurableNone
SSRF protection7-layer defenseNone
Startup time~5msVaries
Memory~10MBVaries

Configuration

Everything is controlled via environment variables. You probably don't need to change anything — defaults work well for most use cases.

VariableDefaultWhat it does
PAIMON_MCP_FETCH_TIMEOUT_MS12000Request timeout (ms)
PAIMON_MCP_FETCH_MAX_HTML_BYTES10485760Max page size (10MB)
PAIMON_MCP_FETCH_CACHE_TTL_SECS300Cache lifetime (5 min)
PAIMON_MCP_FETCH_RATE_LIMIT_PER_SECOND5.0Requests/sec per domain
PAIMON_MCP_FETCH_RATE_LIMIT_BURST10Max burst size
PAIMON_MCP_FETCH_RETRY_MAX_ATTEMPTS3Retry on transient errors
PAIMON_MCP_FETCH_JS_RENDER_ENABLEDfalseEnable headless Chrome

Optional Features

Image Processing

Extract and process images from webpages:

bash
go build -tags image -o paimon-mcp-fetch ./cmd/paimon-mcp-fetch/

JS Rendering

For JavaScript-heavy sites (SPAs, dynamic content):

bash
go build -tags jsrender -o paimon-mcp-fetch ./cmd/paimon-mcp-fetch/PAIMON_MCP_FETCH_JS_RENDER_ENABLED=true ./paimon-mcp-fetch

Note: Requires Chrome or Chromium installed. Slower (~3-5s/page) but handles sites that static fetch can't.


Supported AI Assistants

Works with any MCP-compatible client. Add the configuration below to your client's config file.

OpenCode

Config file: ~/.config/opencode/opencode.json

json
{  "mcp": {    "paimon-mcp-fetch": {      "type": "local",      "command": ["paimon-mcp-fetch"],      "enabled": true    }  }}

Claude Desktop

Config file: claude_desktop_config.json

json
{  "mcpServers": {    "paimon-mcp-fetch": {      "command": "paimon-mcp-fetch"    }  }}

Cursor

Config file: .cursor/mcp.json (project) or ~/.cursor/mcp.json (global)

json
{  "mcpServers": {    "paimon-mcp-fetch": {      "command": "paimon-mcp-fetch",      "env": {}    }  }}

VS Code (GitHub Copilot)

Config file: .vscode/mcp.json (workspace) or user settings

json
{  "servers": {    "paimon-mcp-fetch": {      "type": "stdio",      "command": "paimon-mcp-fetch"    }  }}

Cline

Config file: .cline/mcp.json

json
{  "mcpServers": {    "paimon-mcp-fetch": {      "command": "paimon-mcp-fetch"    }  }}

Windsurf

Config file: .windsurf/mcp.json

json
{  "mcpServers": {    "paimon-mcp-fetch": {      "command": "paimon-mcp-fetch"    }  }}

With Custom Configuration

All clients support environment variables. Example with custom timeout and cache:

json
{  "mcpServers": {    "paimon-mcp-fetch": {      "command": "paimon-mcp-fetch",      "env": {        "PAIMON_MCP_FETCH_TIMEOUT_MS": "30000",        "PAIMON_MCP_FETCH_CACHE_TTL_SECS": "600"      }    }  }}

Security

Built with security in mind from day one:

  • SSRF Protection — 7-layer defense against server-side request forgery
  • Private IP blocking — Can't access localhost or internal networks
  • Redirect validation — Every redirect hop re-checked for safety
  • Size limits — Stream-based reading, no memory bombs
  • Timeouts — All requests have deadlines
  • No secrets in logs — API keys and tokens never logged

Windows Antivirus

Some antivirus may flag unsigned Go binaries as a false positive. This is a known industry issue. Solutions:

  1. Use go install — antivirus sees the signed Go compiler
  2. Use Docker — no local binary
  3. Build from source — verify the code yourself

Architecture

Built with Clean Architecture principles:

MCP Server → UseCase → Domain (entities, ports)                        ↑            Adapters implement interfaces
  • Domain — Business rules, zero external dependencies
  • UseCase — Orchestration logic
  • Adapters — HTTP client, content extractor, cache, rate limiter, image processor, JS renderer

Full details in the project plan.


License

MIT — do whatever you want with it.


Built with Go. Zero runtime dependencies. Single binary. ~10MB RAM. Starts in 5ms.

Source: README.md at commit 8ca944b

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Fetcher integrations