Atlas / MCP servers / tokenizin-agency / MCP NPX Fetch

MCP NPX FetchCAUTION

mcp/tokenizin-agency/mcp-npx-fetch

A powerful MCP server for fetching and transforming web content into various formats (HTML, JSON, Markdown, Plain Text) with ease.

Verdict
CAUTION
Grade
B
Trust score
89 /100
Exposed tools
4 4r · 0w · 0d
Transport
stdio
License
MIT
Stars
42
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/@tokenizin/mcp-npx-fetch) [](https://opensource.org/licenses/MIT) [](https://www.typescriptlang.org/) [](https://github.com/modelcontextprotocol)

A powerful MCP server for fetching and transforming web content into various formats (HTML, JSON, Markdown, Plain Text) with ease.

Installation • Features • Usage • Documentation • Contributing

🚀 Features

  • 🌐 Universal Content Fetching: Supports HTML, JSON, plain text, and Markdown formats
  • 🔒 Custom Headers Support: Add authentication and custom headers to your requests
  • 🛠 Built-in Transformations: Automatic conversion between formats
  • ⚡ High Performance: Built with modern JavaScript features and optimized for speed
  • 🔌 MCP Compatible: Seamlessly integrates with Claude Desktop and other MCP clients
  • 🎯 Type-Safe: Written in TypeScript with full type definitions

📦 Installation

NPM Global Installation

npm install -g @tokenizin/mcp-npx-fetch

Direct Usage with NPX

npx @tokenizin/mcp-npx-fetch

📚 Documentation

Available Tools

fetch_html

Fetches and returns raw HTML content from any URL.

{
url: string;     // Required: Target URL
headers?: {      // Optional: Custom request headers
[key: string]: string;
};
}

fetch_json

Fetches and parses JSON data from any URL.

{
url: string;     
Read from source at commit e2af9f9f7984OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mcp-npx-fetch -- npx -y @tokenizin/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp-npx-fetch": {
      "command": "npx",
      "args": [
        "-y",
        "@tokenizin/[email protected]"
      ]
    }
  }
}
03

Exposed tools (4)

4 read · 0 write · 0 destructive.

ToolRiskDescription
fetch_htmlreadFetch a website and return the content as HTML
fetch_jsonreadFetch a JSON file from a URL
fetch_markdownreadFetch a website and return the content as Markdown
fetch_txtreadFetch a website, return the content as plain text (no HTML)
04

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (5)

MEDIUMInventory / provenance · inv.binary · CWE-1104
.DS_Store
.DS_Store
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
.yarn/install-state.gz
install-state.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
bun.lockb
bun.lockb
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
.DS_Store
.DS_Store
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, jsdom, turndown, zod, @types/jest, @types/jsdom, @types/node, @types/turndown
Why it matters. 12 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha e2af9f9f7984full audit observations/trust-audit/mcp-server/tokenizin-agency__mcp-npx-fetch.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12e2af9f9f7984CAUTIONB89first audit
06

Questions

What is the @tokenizin/mcp-npx-fetch MCP server?

A powerful MCP server for fetching and transforming web content into various formats (HTML, JSON, Markdown, Plain Text) with ease.

What tools does @tokenizin/mcp-npx-fetch expose?

4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @tokenizin/mcp-npx-fetch safe to connect to an agent?

With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does @tokenizin/mcp-npx-fetch need?

No credential environment variables were found in its source, so it appears to need none.

How does @tokenizin/mcp-npx-fetch run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @tokenizin/mcp-npx-fetch at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (e2af9f9f7984), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement