Initial release

An MCP server that fetches web content for an agent and is correct and secure
where the popular fetch servers are not — provably correct against the edge
cases that produced real 2026 CVEs in other fetch servers.

Highlights

• fetch_url MCP tool: clean markdown (or raw text) output, with
  structuredContent and chunked reading via start_index.
• SSRF defense: allowlist-first, resolve-once-and-pin, re-validate every
  redirect hop. Blocks loopback, RFC-1918, link-local/cloud metadata (always,
  even with SAFE_FETCH_ALLOW_LOCAL=true), IPv6 ULA/link-local, IPv4-mapped
  IPv6, non-http(s) schemes, and embedded userinfo — no third-party
  IP-classification library, hand-written and fully unit-tested.
• Connection pinning via a custom DNS lookup hook, specifically to close the
  TOCTOU gap where Node's global fetch/undici re-resolves DNS at connect
  time and silently defeats prior IP validation.
• stdio (default) and Streamable HTTP transports, with Host-header
  allow-listing, Origin/CORS validation, and per-IP rate limiting on HTTP mode.
• Untrusted-content framing and structured audit logging
  (OWASP MCP06:2025 / MCP08:2025 mitigations).
• 62-test threat-matrix suite; external validation via
  agent-audit-kit:
  13 findings → 2, zero critical/high remaining.

See SECURITY.md
for the full OWASP MCP Top 10 mapping and scanner evidence trail.

Full Changelog: https://github.com/Sanoy24/safe-fetch-mcp-server/blob/main/CHANGELOG.md#010---2026-08-11