1. Conduid
  2. Developer Tools
  3. Secure Fetch
MCP server · Developer Tools

Secure Fetch

by · github.com/appsec-innovation-labs/secure-mcp-fetch

Secure fetch to prevent access to local resources

Unclaimed MIT browser
InstallView source
39Low

Scored 4 months ago · breakdown

About Secure Fetch

Secure Fetch is an MCP server published by appsec-innovation-labs in the Developer Tools category: secure fetch to prevent access to local resources. It has been installed 0 times through Conduid.

Install

Install
npx secure-mcp-fetch

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Secure Fetch

Powered by Claude · Grounded in docs

I know everything about Secure Fetch. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • ·README presentNot checked yet.
  • ·License declaredNot checked yet.
  • ·Tests presentNot checked yet.
  • ·Dependencies pinnedNot checked yet.
  • ·No dynamic code executionNot checked yet.
  • !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.

README

Secure Fetch

This project implements a secure URL fetching tool using FastMCP.

Prerequisites

  • Python 3.7+
  • uv (Python package installer and environment manager)

Installation

  1. Install uv if you haven't already:
pip install uv
  1. Create a new virtual environment and install dependencies:
uv venv
source .venv/bin/activate
uv pip install fastmcp requests

Usage

  1. Set the allowlist environment variable (optional):
export SECURE_FETCH_ALLOWLIST="example.com,trusted-domain.org"
  1. Run the script:
uv run main.py

Features

  • Fetches URLs securely
  • Resolves domains to IPs
  • Checks for private/internal IPs
  • Handles redirects (up to 3)
  • Supports custom HTTP methods and headers
  • Uses an allowlist for trusted domains/IPs

Security Considerations

  • The tool prevents access to private/internal IPs unless explicitly allowed
  • Only HTTP and HTTPS schemes are permitted
  • SNI is set to match the hostname for HTTPS connections

Example Usage

Once the script is running, you can use the fetch_url function to securely fetch URLs. The function will return a dictionary containing the status code, response body, and content length.

Note

This tool is designed for secure URL fetching. Always review and understand the code before using it in your environment.

README mirrored from the source repository 4 months ago. The original is authoritative.

Questions

About Secure Fetch

How do I install Secure Fetch?

Run npx secure-mcp-fetch, then add the server to your MCP client's configuration. Conduid has recorded 0 installs, so the command is known to work with current clients.

Is Secure Fetch safe to use with an AI agent?

Its trust score is 39 out of 100 (low). It passes 0 of 1 static security checks; the failures are listed above. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Secure Fetch still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.