Fetch MCP Server

@yawlabs/fetch-mcp

A comprehensive HTTP fetch MCP server for AI assistants. Bring-your-own client: runs as a stdio MCP server so any MCP-compatible client (Claude Code, Claude Desktop, Cursor, mcph, …) can fetch web content safely.

One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.

What it gives the model

Safety

SSRF protection is on by default. The server refuses requests to:

• Loopback (127.0.0.0/8, ::1)
• RFC1918 private ranges (10/8, 172.16/12, 192.168/16)
• Link-local (169.254/16, fe80::/10) — including the cloud metadata endpoint 169.254.169.254
• CGNAT (100.64/10)
• Unique-local IPv6 (fc00::/7)
• Multicast / broadcast
• IPv4-mapped IPv6 (::ffff:0:0/96) re-checked against the IPv4 rules
• Non-http/https schemes (file://, gopher://, javascript:, …)
• Hostname localhost and any *.localhost

DNS is resolved once per redirect hop, every returned address is checked, and the verified IP is pinned into the HTTP dispatcher so the subsequent TCP connection dials that exact address — closing the DNS-rebinding TOCTOU window. Authorization headers are stripped on cross-origin redirects. A 302 to http://127.0.0.1 through a public host gets caught. Set allowprivatehosts: true per-request when you really do need internal access (e.g. development).

Install & run

# One-off (auto-updates each spawn via @latest)
npx -y @yawlabs/fetch-mcp@latest

# Or globally
npm i -g @yawlabs/fetch-mcp
fetch-mcp

Requires Node ≥20.

Configure in Claude Code / Claude Desktop

Add to your client's MCP config (usually claudedesktopconfig.json or ~/.claude.json):

{
  "mcpServers": {
    "fetch": {
      "command": "npx",
      "args": ["-y", "@yawlabs/fetch-mcp@latest"]
    }
  }
}

Or via mcph:

mcph add fetch

Tool reference

httpget, httppost, httpput, httppatch, httpdelete, httphead, http_options

Common parameters:

Shortened. The full README is on GitHub.