What it is
Fetch is one of the seven reference servers still maintained in the modelcontextprotocol/servers repository; it was not among the servers moved to servers-archived. It is a small Python server with one tool, fetch, which downloads a page, converts the HTML to markdown and returns up to 5,000 characters by default. The model can pass start_index to read the rest in chunks, or ask for raw HTML.
The October 2026 releases (latest 2026.10.19 on PyPI) rebuilt it on the MCP Python SDK 2.x and let it speak both the 2025-11-25 and 2026-07-28 protocol versions over stdio. Run it with uvx mcp-server-fetch, pip or the mcp/fetch Docker image. It needs no API key and is MIT-licensed.
Install
uvx mcp-server-fetchOur review
Fetch is the default answer when a client has no built-in way to read the web. One tool, no account, markdown output and chunked reading keep it cheap on context: the 5,000-character default is roughly a page of documentation per call, and the model can ask for more with start_index.
The bigger risk is not the network but the content. Every page Fetch returns goes into the model's context verbatim, and the server does nothing to strip or flag instructions hidden in it. The tool is annotated openWorldHint, which is the protocol's way of saying it reaches arbitrary hosts. Pair it with a write-capable server, such as GitHub or a filesystem, and a malicious page can try to steer the agent into using those tools. Approve tool calls by hand in that setup, or screen fetched text before the agent acts on it.
The network guard has improved. It now refuses loopback, private, link-local and cloud metadata addresses such as 169.254.169.254 by default, and checks every redirect hop. The README admits it does not stop DNS rebinding, and an open issue from 19 October reports the NAT64 prefix 64:ff9b::/96 slips past the check. Another open issue notes the Docker images create an app user but still run as root. Keep --allow-private-ips off on any machine that can see internal services.
It also respects robots.txt when the model, rather than the user, asks for a page, and sends a user agent marked 'Autonomous', so some sites refuse it. Without JavaScript rendering, single-page apps come back thin. Firecrawl and Playwright handle those, at the cost of an API bill or a headless browser, and Claude Code users already have a built-in fetch tool.
Where it earns its place
A developer using an MCP client with no built-in web access
Read API documentation pages while writing an integration
The model fetches the docs page as markdown and pages through it in 5,000-character chunks. Free, and a typical page costs a few thousand tokens of context rather than the raw HTML.
A platform engineer rolling MCP out to 50 developers
Offer web reading without opening a path to internal services
Ship Fetch with the default private-address guard, no --allow-private-ips, and per-call approval when it runs next to write tools. Costs nothing to run; the work is policy, not licences.
A research analyst at a consultancy
Summarise a list of public reports and press releases
Feed the agent URLs one at a time; Fetch converts each to markdown for summarising. Sites that block autonomous user agents via robots.txt need --ignore-robots-txt or a different tool.
Before you commit
- Setup
- Add uvx mcp-server-fetch (or docker run -i --rm mcp/fetch) to the client config; the README documents Claude Desktop and VS Code. Installing Node.js is optional but gives a sturdier HTML simplifier. First call works within a minute.
- Integrations
- One read-only tool, fetch, with url, max_length, start_index and raw arguments, plus a fetch prompt for user-initiated reads. Supports HTTP and SOCKS5 proxies and a custom user agent.
- Data and privacy
- Runs locally with no credentials; it can reach any public URL. Fetched content is untrusted and goes into the model's context unfiltered, which is the main prompt-injection route. No published security advisories for Fetch; the repository's advisories concern the git and filesystem servers.
- Cost at scale
- Free. The real cost is context: each call returns up to 5,000 characters by default, about 1,200 tokens, so an agent reading ten pages a task adds roughly 12,000 input tokens to your model bill.
- Limits
- No JavaScript rendering, a 30-second timeout that cannot be changed according to an open issue, robots.txt enforcement for model requests, and readability extraction that fails on some content types.
What's good
- No API key or account needed
- Chunked reading keeps long pages within context
- Blocks private, loopback and metadata addresses by default
- Actively maintained in the official repository
What's not
- Passes untrusted page text to the model unfiltered
- No JavaScript rendering or web search
- SSRF guard misses DNS rebinding and, per an open issue, NAT64 addresses
- Docker images run as root
Best for
Developers who want a basic, free page reader for an MCP client that lacks one.
Alternatives
Fetch (reference server): common questions
- Is Fetch (reference server) worth it?
- A free, keyless page reader that does exactly one job, and hands whatever a stranger's web page says straight to your model. We rate it 3.7 out of 5.
- How much does Fetch (reference server) cost?
- Free and open source.
- What are the downsides of Fetch (reference server)?
- Passes untrusted page text to the model unfiltered; no JavaScript rendering or web search; sSRF guard misses DNS rebinding and, per an open issue, NAT64 addresses; docker images run as root.
- Who is Fetch (reference server) best for?
- Developers who want a basic, free page reader for an MCP client that lacks one.
- How much does Fetch (reference server) cost for a team or in production?
- Free. The real cost is context: each call returns up to 5,000 characters by default, about 1,200 tokens, so an agent reading ten pages a task adds roughly 12,000 input tokens to your model bill.
- Is Fetch (reference server) safe for company data?
- Runs locally with no credentials; it can reach any public URL. Fetched content is untrusted and goes into the model's context unfiltered, which is the main prompt-injection route. No published security advisories for Fetch; the repository's advisories concern the git and filesystem servers.
- What are the best Fetch (reference server) alternatives?
- The closest alternatives we have reviewed are Firecrawl MCP and Playwright MCP.
Answers checked Oct 23, 2026.