wetBLOCK
Open-source MCP server for AI agents: web search, content extraction, and library docs -- 5-strategy scraping, runs without API keys.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Renamed (2026-09-13): repo is nowwet— CLI-first (wetcommand). PyPI package stayswet(PyPI policy blocks new projectwet); MCP server is a secondary surface: runwetwith no subcommand.
mcp-name: io.github.n24q02m/wet
Renamed: the repo, CLI and Python module are nowwet. The PyPI distribution stays `wet-mcp` (installpip install wet-mcp/uvx wet-mcp). The MCP server remains available: runwetwith no subcommand (bare = MCP passthrough); the legacywet-mcpconsole alias still works.
Open-source MCP server for AI agents: web search, content extraction, and library docs.
Current release: v3.x.media(action="analyze")was removed in the v2.0.0 BREAKING release. Use `imagine-mcp`'sunderstandaction for vision/audio/video analysis. Seedocs/migration.mdfor the upgrade recipe.
[](https://mcp.n24q02m.com/get-started/modes-overview/) [](https://github.com/n24q02m/wet/actions/workflows/ci.yml) [](https://codecov.io/gh/n24q02m/wet) [](https://pypi.org
b2931c963ab2OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add wet-mcp --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- uvx wet-mcp==3.19.2Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
{"passwd", "shadow", "group", "sudoers", "id_rsa", "id_ed25519"}print(hash_token(args.token)) # never echo the token itself
secret = "tvly-SECRET-DEADBEEF"
secret = "brave-test-token-not-real" # noqa: S105 - low-entropy fake for leak test
.coderabbit.yaml
.gitguardian.yaml
.infisical.json
.mise.toml
.pre-commit-config.yaml
exec(guard, {"sys": fake_sys, "io": io}) # noqa: S102 - trusted project sourcef = ssh_dir / "id_rsa"
["http://safe.com/../../etc/passwd"], str(tmp_path)
"output_dir": "/tmp/evil/../../../etc",
"output_dir": "/tmp/evil/../../../etc",
"output_dir": "/tmp/evil/../../../etc",
{"content": "flurb gorb exfil quux"},assert rows[0]["content"] == "flurb gorb exfil quux"
request = httpx.Request("GET", "http://169.254.169.254/latest/meta-data/"){"action": "extract", "urls": ["http://169.254.169.254/latest/meta-data"]},"urls": ["http://169.254.169.254/latest/meta-data"],
{"action": "extract", "urls": ["http://169.254.169.254/latest/meta-data"]},assert not is_safe_url("http://169.254.169.254")endpoint is `http://127.0.0.1:8000/mcp` (Streamable HTTP) and the config root
uv run wet # serves http://127.0.0.1:8000/mcp
claude mcp add --transport http wet http://127.0.0.1:8000/mcp \
Gates applied: no_behavioural_pass.
b2931c963ab2full audit observations/trust-audit/mcp-server/n24q02m__wet.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | b2931c963ab2 | BLOCK | D | 69 | first audit |
Questions
What is the wet MCP server?
Open-source MCP server for AI agents: web search, content extraction, and library docs -- 5-strategy scraping, runs without API keys.
Is wet safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does wet need?
It reads CONTEXT7_API_KEY, GH_TOKEN, GITHUB_TOKEN, OPENROUTER_API_KEY, SEARXNG_AUTH_PASS, TAVILY_API_KEY, WET_TEST_PROXY_API_KEY and WET_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does wet run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as demo-nodejs-npm at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (b2931c963ab2), read on 2026-10-10. The repository is watched and re-audited when it changes.