Skip to content

v0.2.1 — Installable plugin, PyPI packaging, security hardening

Latest
Latest

Choose a tag to compare

View all tags
@ManiaSacha ManiaSacha released this 19 Aug 13:54
· 3 commits to main since this release
v0.2.1
a18c315
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First version of web-mcp actually published to PyPI. (v0.1.0 and v0.2.0 exist as GitHub tags but were never released to PyPI — v0.2.0 predates a fix below that its own release gate correctly caught before publishing.)

The GitHub repo and Claude Code plugin are named web-mcp; the PyPI distribution is feed-mcp, because PyPI rejects web-mcp as too similar to an unrelated existing webmcp package. pip install feed-mcp gives you both a web-mcp and a feed-mcp command — same program, use whichever you like.

Install

pip install feed-mcp

Then either add it as an MCP server directly, or install the Claude Code plugin, which also brings in the bundled skills and agents:

/plugin marketplace add ManiaSacha/web-mcp
/plugin install web-mcp@maniasacha-web-mcp

See the README for all install paths and Claude Desktop config.

Fixed

  • A clean install was broken. mcp shipped a 2.0.0 release that renamed FastMCP to MCPServer with no deprecation shim. web-mcp now tries the new API and falls back to the old one, verified against both versions in isolated environments.

Security

  • DNS rebinding closed. The address that passes the SSRF check is now the exact address connected to — no second DNS lookup where the answer could differ.
  • Redirects re-validated. Every hop of a redirect chain now goes back through the same SSRF check, so a public feed URL can't bounce the fetch to an internal host or a cloud metadata endpoint.
  • Full detail: docs/SECURITY-MODEL.md.

Added

  • Installable as a Claude Code plugin — one command installs the MCP server plus the feed-curation and feed-digest skills and the pm, security-reviewer, and git-pipeline agents.
  • CI: tests on Python 3.10–3.13, lint, and a packaging job that verifies the built wheel's console scripts actually run.
  • SECURITY.md, issue templates (including a dedicated feed-compatibility form), a PR template, and CHANGELOG.md.

Tools

Tool Description
add_feed(url) Add an RSS/Atom feed and index its articles
remove_feed(url) Remove a feed and its indexed articles
list_feeds() List configured feeds with article counts
search(query, limit, max_days) Recency-boosted TF-IDF ranked search
recent(limit) Most recent articles across all feeds
trending(hours, limit) Trending terms in the last N hours
digest(hours, limit) Markdown digest grouped by feed
source_health() Which feeds are healthy, late, or erroring
refresh() Force-refresh all feeds immediately

Full changelog: https://github.com/ManiaSacha/web-mcp/blob/main/CHANGELOG.md

Assets 2
Loading