Fetch MCP ServerFetch MCP Server
把网页内容转成 Markdown 的 reference server，官方在其 README 里明确标注了安全警告：它能访问本地与内网 IP。
A reference server that converts web pages to Markdown, with an explicit security warning in its official README: it can reach local and internal IPs.
适合与不适合When to use it, when not to
把公开网页内容转成 Markdown 供 Agent 读取。
不适合在能访问内网的环境中使用（官方明确警告）。 也不适合需要登录态的页面，或内容由 JS 渲染的单页应用。
Scenarios needing to pull a web page's content as Markdown for an agent to read.
Not a fit for anything where reaching local or internal network addresses matters — the official README carries an explicit security warning on exactly this point.
中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-10-20
- 出品属地Origin
- 国外出品foreign-made 国外主体（网信办公示名单未见对应备案主体）。foreign entity (no matching filing entity in the CAC registry).
- 国内使用Direct access
- 大陆可直连direct OK 官网仓库在 GitHub，大陆直连波动（同日实测 200/000 混合）；npm / PyPI 安装源实测稳定可达。Hosted on GitHub — direct reachability from mainland fluctuates (200/000 mixed on the same day); npm / PyPI install routes measured stable.
- 备案状态CAC filing
- 未见于备案名单not in filing list：未见于网信办公示名单（2026-10-20 检索 13 批附件，https://www.cac.gov.cn/2024-04/02/c_1713729983803145.htm）；该产品未面向大陆公众提供服务，备案不适用。not in the CAC public registry (13 batch attachments searched 2026-10-20, https://www.cac.gov.cn/2024-04/02/c_1713729983803145.htm); the product does not serve the mainland public, so filing does not apply.
备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.
固定坐标系Fixed coordinate system
11 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.
- 模型与开放条件Model & openness
本身不调用模型，是被客户端调用的接口实现。 核心是把网页 HTML 转换为 Markdown，便于 LLM 消费。
It calls no model itself; it is an interface implementation called by clients. Its core is converting web-page HTML into Markdown for LLM consumption.
- 运行位置Where it runs
本地 Python 进程，通过 stdio 通信。 依赖 Python MCP SDK 1.x（要求 mcp=1.29.0,2），SDK 2.0 重命名了该 server 使用的 API。
2026-08-30 修复了容器 bind mount 在 Docker / Podman / SELinux 下的安全与兼容问题。
A local Python process communicating over stdio. It depends on the Python MCP SDK 1.x (requires mcp=1.29.0,2); SDK 2.0 renamed the APIs this server uses.
A 2026-08-30 fix addressed security and compatibility issues of container bind mounts under Docker / Podman / SELinux.
- 本地文件Local files
无文件读写工具。核心能力是网络抓取，不涉及本地文件。
No file read/write tools. The core capability is web fetching; local files are not involved.
- 关机后的任务Tasks after shutdown
不支持。单次抓取为同步操作，随客户端进程结束。
Not supported. A single fetch is a synchronous operation, ending with the client process.
- 工具与扩展Tools & extensions
提供 fetch 工具获取网页内容并转换为 Markdown。 输出为转换后的文本，结构化程度取决于目标页面本身。
It provides the fetch tool to retrieve web content and convert it to Markdown. Output is converted text; its degree of structure depends on the target page itself.
- 上下文与记忆Context & memory
无状态。每次调用独立，不保留历史抓取记录。
Stateless. Each call is independent; no fetch history is kept.
- 权限与限制Permissions & limits
官方明确警告安全风险：README 声明本 server 可访问本地与内网 IP 地址，可能构成安全风险。 需谨慎使用，确保不会暴露敏感数据。 无独立审批机制，无法限制目标地址范围。
The official docs warn explicitly about the security risk: the README states this server can access local/internal IP addresses and may represent a security risk. Use with caution and make sure no sensitive data is exposed. There is no separate approval mechanism, and the target-address range cannot be restricted.
- 适合什么任务Best for
把公开网页内容转成 Markdown 供 Agent 读取。 不适合在能访问内网的环境中使用， 也不适合需要登录态的页面。
Converts public web content to Markdown for an Agent to read. Not a fit for environments with intranet access, nor for pages requiring login state.
- 传输方式Transport
支持 stdio，并提供容器部署方式（Docker / Podman）。 2026-08-30 修复了 bind mount 的安全与兼容问题（含 SELinux）。
官方 README（2026-10-08 全文核验）只给本地进程接入： uvx / pip / Docker；没有远程传输的官方启动方式。
Supports stdio, and offers container deployment (Docker / Podman). The 2026-08-30 fix addressed bind-mount security and compatibility (including SELinux).
The official README (full-text verification 2026-10-08) gives only local-process integration: uvx / pip / Docker; there is no official launch method for a remote transport.
- 认证机制Authentication
无独立认证层。stdio 形态继承客户端用户权限。 容器形态的认证配置仓库未说明。
No separate authentication layer. In stdio form it inherits the client user's permissions. Authentication configuration for the container form is not stated in the repo.
- 权限范围Permission scope
风险最高的一类：文件范围无限制（不涉及文件）， 但网络范围无法收敛—— 官方警告它可访问本地与内网 IP。 无地址白名单、无审批机制。 在生产或含内网服务的环境中使用前必须评估。
The highest-risk class: no file scope (files are not involved), but the network range cannot be narrowed — the official warning says it can access local/internal IPs. No address allowlist, no approval mechanism. An assessment is mandatory before using it in production or in environments hosting intranet services.
头号误解Top misconception
- 在内网可达的环境里直接启用，官方明确警告可访问本地与内网 IPEnabling it directly where the intranet is reachable — the official docs warn it can reach local and internal IPs
- 以为它能抓需要登录的页面，它只是无状态抓取Assuming it fetches pages behind a login — it is a stateless fetch
- 以为输出是干净的 Markdown，实际结构随目标页面变化Assuming the output is clean Markdown — the structure varies with the target page
未知项清单Known unknowns
- 是否支持 Streamable HTTP（仓库未声明）
- 是否有超时与重试策略
- 大页面的截断行为
- 容器形态下的认证配置
- Whether Streamable HTTP is supported (not declared in the repo)
- Whether there are timeout and retry policies
- Truncation behaviour on very large pages
- Authentication configuration in the container form
证据来源Evidence sources
判断可回到以下一手源复核。本站核验日Every judgement can be rechecked against the primary sources below. Verified on 2026-10-23，内容更新日content updated on 2026-10-08。
| 类型Type | 名称Name | 链接Link |
|---|---|---|
| docs | MCP · Fetch Server（含官方安全警告）MCP · Fetch Server (with the official security warning) | https://github.com/modelcontextprotocol/servers/tree/main/src/fetch |
| changelog | MCP · Fetch 目录变更历史MCP · Fetch directory change history | https://github.com/modelcontextprotocol/servers/commits/main/src/fetch |
| changelog | MCP · Servers ReleasesMCP · Servers Releases | https://github.com/modelcontextprotocol/servers/releases |
| repo | MCP · Servers 仓库 README（生产环境免责声明）MCP · Servers repo README (production-use disclaimer) | https://github.com/modelcontextprotocol/servers |
实测记录Measured runs
本档未在真实客户端逐项跑通；工具清单与权限来自官方 README。
实测建议：这个 server 的实测不应在含内网敏感服务的环境中进行。 建议在隔离容器或测试网络中验证抓取成功率与输出质量。
This site has not completed measured runs. The test protocol is at protocols/mcp/_protocol.md.
Suggested measurement: measurement of this server should not be done in environments containing sensitive intranet services. Verify fetch success rate and output quality in an isolated container or test network.
官方警告：可访问本地与内网地址⚠ The official security warning (original wording)
CAUTION This server can access local/internal IP addresses and may represent a security risk. Exercise caution when using this MCP server to ensure this does not expose any sensitive data.
翻译：本 server 能访问本地与内网 IP 地址，可能构成安全风险。 使用时务必谨慎，确保不会暴露敏感数据。
这是本分区里官方自己标注风险最明确的一个， 也是本站认为最有价值的一条一手信息——因为这类警告极少见， 大多数同类工具只会写「使用前请注意安全」。
CAUTION This server can access local/internal IP addresses and may represent a security risk. Exercise caution when using this MCP server to ensure this does not expose any sensitive data.
This is the clearest self-flagged risk by the official side in this entire section, and the site considers it the most valuable first-hand information — such warnings are rare; most comparable tools only write "be careful when using".
为什么这个风险值得单独说Why this risk deserves its own section
| 场景 | 风险 |
|---|---|
内网有数据库管理面板（10.x / 192.168.x） | Agent 可能抓到内网页面 |
云环境 metadata 服务（如 169.254.169.254） | 可能拿到实例元数据与凭据 |
| 本机有开发服务器 | 可能抓到本机服务的响应 |
| Agent 被诱导抓取恶意 URL | 可探测内网拓扑 |
关键：没有地址白名单，也没有审批机制。 一旦启用，Agent 就有了探测内网的通道。
| Scenario | Risk |
|---|---|
Intranet has database admin panels (10.x / 192.168.x) | The Agent may fetch intranet pages |
Cloud metadata services (e.g. 169.254.169.254) | Instance metadata and credentials may be obtained |
| A dev server runs on the local machine | Local service responses may be fetched |
| The Agent is lured into fetching a malicious URL | Intranet topology can be probed |
The key point: there is no address allowlist and no approval mechanism. Once enabled, the Agent has a channel for probing the intranet.
变更记录说明Change-log notes
本对象无独立 changelog 页，变更记录在目录 commit 历史中：
| 日期 | 内容 |
|---|---|
| 2026-08-30 | 修复容器 bind mount 安全与兼容问题（Docker / Podman / SELinux） |
| 2026-08-18 | 文档补充 Python MCP 1.x 版本要求 |
| 2026-08-18 | 固定依赖 mcp>=1.29.0,<2 |
| 2026-07-29 | uv 依赖批量更新 |
两条值得注意：
- 08-18 的版本固定：SDK 2.0 重命名了本 server 使用的 API，官方明确锁在 1.x。 如果你的环境装了 SDK 2.x，这个 server 可能起不来。
- 08-30 的容器修复和 git / time 是同一条 commit（#2205），说明这三个 server 有共同的容器化问题。
This object has no standalone changelog page; change records are in the directory's commit history:
| Date | Content |
|---|---|
| 2026-08-30 | Fix container bind-mount security and compatibility (Docker / Podman / SELinux) |
| 2026-08-18 | Document the Python MCP 1.x version requirement |
| 2026-08-18 | Pin the dependency mcp>=1.29.0,<2 |
| 2026-07-29 | Batch uv dependency updates |
Two entries worth noting:
- The 08-18 version pin: SDK 2.0 renamed the APIs this server uses, and the official side pins it to 1.x. If your environment has SDK 2.x installed, this server may fail to start.
- The 08-30 container fix is the same commit (#2205) as git / time, showing these three servers shared a containerization problem.
输出质量评估Output-quality assessment
输出结构取决于目标页面本身，不是统一 schema：
| 目标页面类型 | 输出质量 |
|---|---|
| 文档站（结构规整） | 好 |
| 博客正文 | 中 |
| 单页应用（内容由 JS 渲染） | 差 — 抓不到正文 |
| 需要登录的页面 | 失败 |
| 纯图片 / PDF | 不可用 |
这不是 server 的缺陷，但它决定了这个工具的适用边界。
Output structure depends on the target page itself; there is no unified schema:
| Target page type | Output quality |
|---|---|
| Documentation sites (regular structure) | good |
| Blog article bodies | medium |
| Single-page apps (content rendered by JS) | poor — the body text cannot be fetched |
| Pages requiring login | fails |
| Pure images / PDFs | unusable |
This is not a defect of the server, but it defines the tool's applicability boundary.
部署建议Deployment advice
如果确实要用，在以下条件下才考虑：
| 条件 | 说明 |
|---|---|
| 隔离网络环境 | 不与内网服务同网段 |
| 或容器化并限制出网 | 白名单出站，只允许目标域名 |
| 且不接受内网访问需求 | 因为它无法被限制 |
注意：容器化本身不解决这个风险—— 容器内依然能访问宿主网络，除非配置网络策略。
If you really need it, consider it only under these conditions:
| Condition | Explanation |
|---|---|
| Isolated network environment | not on the same segment as intranet services |
| or containerized with egress restricted | allowlist outbound, only target domains permitted |
| and no intranet-access requirement is accepted | because it cannot be restricted |
Note: containerization alone does not solve this risk — inside a container the host network is still reachable unless network policies are configured.
相关条目Related entries
- Sequential Thinking MCP ServerSequential Thinking MCP Server权限风险最低的对照The lowest permission-risk contrast
- Filesystem MCP ServerFilesystem MCP Server文件方向，权限设计更保守The file direction, with more conservative permission design
- xAI Grok BotxAI Grok Bot另一层 · AI 编程Other layer · AI coding
本页由This page is generated from the ai-handbook 数据层生成（CC BY 4.0）。data layer (CC BY 4.0).
方法论与坐标系定义见仓库内For the methodology and coordinate definitions, see METHODOLOGY.md.