MCP Fetch Server
Official MCP reference server for fetching and converting web content for agents.
About
The official reference MCP server for web fetching. It retrieves URLs and returns content converted to markdown, so agents can read web pages without a browser. It runs as a Python package via uvx.
Security note for deployers: fetched web content flows straight into the agent's context, which makes this a prompt-injection surface — untrusted pages can carry instructions. Treat its output the way you would any untrusted tool result.
What it can do
- Fetch any URL and return content as markdown
- HTML-to-markdown conversion
- Configurable content-length limits
- Runs isolated via uvx with no persistent state
Setup
- Install Python 3.10+ and
uv. - Add to your MCP client config: command
uvx, args["mcp-server-fetch"]. - Restart the client and test with the MCP Inspector.
Prerequisites
An MCP-compatible client; Python 3.10+ with uv.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier). Official reference server, ~91k monorepo stars, actively maintained, uvx install verified in the README. Docked for the mixed license state (MIT→Apache-2.0 transition) and a real operational caveat: fetched content enters agent context, so it is a prompt-injection vector by design — the score reflects the code quality, not the inherent risk of web fetching.
★ 91,183 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 9.2/10
- Maintenance · recency, releases, issue load
- 9.2/10
- Openness · license + docs
- 8.3/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · 91,183 GitHub stars (log-scaled vs catalog peers)
- · last push 1d ago; 9 releases/12mo; 488 open issues
- · manual review: official reference; uvx install verified; fetched content enters agent context — prompt-injection surface; license: MIT transitioning to Apache-2.0 (project-wide relicense in progress; LICENSE file)
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.