safefetch-mcp-server

Secure web fetch for local AI agents. A security-focused web fetch service for local AI agents.

> License: AGPL-3.0 (dual-license model, see COMMERCIAL.md) > Feedback: GitHub Issues / Pull Requests

Think of it as a "digital security guard" for AI web access. It focuses on three things:

• Block internal targets: default SSRF guardrails (scheme checks, DNS/IP validation, per-hop redirect validation)
• Prevent resource blow-ups: raw/decompressed size limits to stop oversized payloads and decompression bombs
• Improve troubleshooting: stable JSON contract for automatic agent decisions and retry control

In one line: safer, more stable, and more controllable web fetching for AI agents.

• SSRF defenses: scheme guard, DNS/IP checks, redirect re-validation
• Resource guardrails: raw/decompressed byte limits + MIME allowlist
• Stable output: flat JSON contract for automation
• OpenClaw ready: skill templates + mcporter examples
• Beginner-friendly: one-command bootstrap scripts

Before installation, make sure these dependencies exist on your machine:

• Python >= 3.10 (recommended: 3.11)
• mcporter available in your PATH
• OpenClaw with local agent/skills support

Quick checks:

python3 --version
which mcporter
mcporter --help
openclaw --version

If mcporter is missing, install it first (example options):

pip install mcporter
# or
uv pip install mcporter

> ~/ and <YOUR_PATH> both represent your local clone path. Replace them with your actual location.

cd ~/safefetch-mcp-server
bash bootstrap.sh

bash start-mcp.sh

source .venv/bin/activate
python server.py --self-test

If your network resolves public domains into restricted ranges, use:

WEBFETCH_ALLOW_CIDRS=198.18.0.0/15 python server.py --self-test