Webfetch Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Webfetch Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that fetches webpages by URL, renders JavaScript using Puppeteer with stealth plugins to avoid bot detection, converts the HTML content to clean Markdown, and returns it for LLM analysis.
Build the image (no server needed to be running):
make build
# or: docker build -t webfetch-mcp-server .Configure your MCP client to use streamable transport with Docker. The container will be started on-demand by the MCP client.
A Makefile is included for easy management:
make build # Build the Docker image
make clean # Remove container and image
make logs # Follow container logs (if running)
make debug # Run in foreground to see outputRun directly from your GitHub repository without cloning:
npx git+https://github.com/Sh1d0w/webfetch-mcp.git -- -iOr with the package name:
npx webfetch-mcp-server@latest -- -iInstall dependencies:
npm installRun in development mode:
npm run devOr build and run:
npm run build
npm start| Variable | Description | Default |
|---|---|---|
PUPPETEER_SKIP_CHROMIUM_DOWNLOAD | Skip Chromium download (use system) | true |
PUPPETEER_EXECUTABLE_PATH | Path to Chromium executable | /usr/bin/chromium-browser |
Configure your MCP client to use streamable transport. The container starts on-demand when the MCP client connects.
Docker run command (for reference):
docker run --rm -i webfetch-mcp-server node dist/index.jsAdd to your .cursorrules or Cursor MCP settings:
{
"mcpServers": {
"webfetch": {
"command": "docker",
"args": ["run", "--rm", "-i", "webfetch-mcp-server", "node", "dist/index.js"]
}
}
}Edit ~/Library/Application Support/Claude/claude_config.json:
{
"mcpServers": {
"webfetch": {
"command": "docker",
"args": ["run", "--rm", "-i", "webfetch-mcp-server", "node", "dist/index.js"]
}
}
}Edit ~/.config/claude/claude_config.json:
{
"mcpServers": {
"webfetch": {
"command": "docker",
"args": ["run", "--rm", "-i", "webfetch-mcp-server", "node", "dist/index.js"]
}
}
}In LM Studio MCP settings:
dockerrun --rm -i webfetch-mcp-server node dist/index.jsWhy this works:
--rm: Automatically removes container after exit (clean state each time)-i: Keeps stdin open for MCP communicationAdd to your opencode configuration:
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
// In your config file
{
mcpServers: {
webfetch: {
command: 'docker',
args: ['run', '--rm', '-i', 'webfetch-mcp-server', 'node', 'dist/index.js']
}
}
}Even in "headless" mode, Chromium/Puppeteer requires an X server for rendering. The Dockerfile includes:
Without Xvfb, Puppeteer will crash immediately after starting, causing the container to restart in a loop.
fetch_urlFetches a webpage and converts it to Markdown.
Parameters:
url (string, required): The URL of the webpage to fetchReturns:
Example Usage:
User: Please analyze this article about MCP protocol
Assistant: [calls tool] fetch_url with url="https://modelcontextprotocol.io"The server returns content in the following format:
# Page Title
https://example.com
---
[Clean markdown content here...]<script>, <style>, nav, footer, header, aside elements.ad, .advertisement, #ads)Build with Make (recommended):
make buildOr directly with Docker:
docker build -t webfetch-mcp-server .Configure your MCP client to use the built image with streamable transport. No persistent server needed.
Cause: Puppeteer needs a virtual display (Xvfb) even in headless mode. Chromium's headless mode still requires an X server for rendering.
Solution: The Dockerfile includes Xvfb automatically. If you're using a custom setup, ensure:
apk add xvfb (Alpine) or apt-get install xvfb (Debian/Ubuntu)Xvfb :99 -screen 0 1024x768x24 &export DISPLAY=:99Cause: Container crashed when the MCP client tried to connect.
Solution: Ensure you're using docker run --rm in your MCP configuration. This starts a fresh container for each connection, avoiding issues with stale containers.
make logs
# or: docker logs -f webfetch-mcp-serverThe default timeout is 30 seconds. For slower websites, you may need to increase this in the source code.
Some websites have advanced bot detection. The stealth plugin helps but cannot guarantee bypass for all sites.
Run tests:
npm testLint and type-check:
npm run lint
npm run typecheckMIT License - See LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.