MCP Data Fetch Server

MCP Data Fetch Server is secure, sandboxed server that fetches web content and extracts data via the Model Control Protocol (MCP). without executing JavaScript.

Table of Contents

• Features
• Installation & Quick Start
• CommandLine Options
• Integration with LMStudio
• MCP API Overview
  • initialize
  • tools/list
  • tools/call
• Available Tools
  • fetch_webpage
  • extract_links
  • download_file
  • get_page_metadata
  • check_url
• Security Features

Features

• Secure web page fetching strips scripts, iframes and cookie banners; no JavaScript execution.
• Rich data extraction retrieve links, metadata, OpenGraph/Twitter cards, and downloadable resources.
• Safe file downloads size limits, filename sanitisation, and pathtraversal protection within a sandboxed cache.
• Builtin caching optional cache directory reduces repeated network calls.
• Promptinjection detection validates URLs and fetched content for malicious instructions.

Installation & Quick Start

# Clone the repository (or copy the MCPDataFetchServer.1 folder)
git clone https://github.com/undici77/MCPDataFetchServer.git
cd MCPDataFetchServer

# Make the startup script executable
chmod +x run.sh

# Run the server, pointing to a sandboxed working directory
./run.sh -d /path/to/working/directory

Threestep overview
1 The script creates a virtual environment and installs dependencies.
2 It prepares a cache folder (.fetch_cache) inside the project root.
3 main.py launches the MCP server, listening on stdin/stdout for JSONRPC requests.

CommandLine Options

Integration with LMStudio (or any MCPcompatible client)

Add an entry to your mcp.json configuration so that LMStudio can launch the server automatically.

{
  "mcpServers": {
    "datafetch": {
      "command": "/absolute/path/to/MCPDataFetchServer.1/run.sh",
      "args": [
        "-d",
        "/absolute/path/to/working/directory"
      ],
      "env": { "WORKING_DIR": "." }
    }
  }
}

Tip: Ensure run.sh is executable (chmod +x ) and that the virtual environment can install the required Python packages on first launch.

MCP API Overview

All communication follows JSONRPC2.0 over stdin/stdout.

initialize

Request:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {}
}

Response contains the protocol version, server capabilities and basic metadata (e.g., name=mcp-datafetch-server, version=2.1.0).

tools/list

Request:

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/list",
  "params": {}
}

Response: { "tools": [ tool definitions ] }. Each definition includes name, description and an input schema (JSONSchema).

tools/call

Generic request shape (replace <tool_name> and arguments as needed):

{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "<tool_name>",
    "arguments": {  }
  }
}

The server validates the request against the tools schema, executes the operation, and returns a ToolResult containing one or more content blocks.

Available Tools

fetch_webpage

• Securely fetches a web page and returns clean content in the requested format.

Example

{
  "jsonrpc": "2.0",
  "id": 10,
  "method": "tools/call",
  "params": {
    "name": "fetch_webpage",
    "arguments": {
      "url": "https://example.com/article",
      "format": "markdown",
      "include_links": true,
      "include_images": false,
      "remove_banners": true
    }
  }
}

Note: The tool sanitises HTML, removes scripts/iframes, and checks for promptinjection patterns before returning content.

extract_links

• Extracts and categorises all hyperlinks from a page.

Example

{
  "jsonrpc": "2.0",
  "id": 11,
  "method": "tools/call",
  "params": {
    "name": "extract_links",
    "arguments": {
      "url": "https://example.com/blog",
      "filter": "internal"
    }
  }
}

Note: Links are classified as internal (same domain) or external; resource links (images, PDFs) can be filtered with resources.

download_file

• Safely downloads a remote file into the sandboxed cache directory.

Example

{
  "jsonrpc": "2.0",
  "id": 12,
  "method": "tools/call",
  "params": {
    "name": "download_file",
    "arguments": {
      "url": "https://example.com/files/report.pdf",
      "filename": "report_latest.pdf"
    }
  }
}

Note: The server enforces a 100MB download limit, validates the URL against blocked domains/extensions, and returns the relative path inside the working directory for crossagent access.

get_page_metadata

• Extracts structured metadata (title, description, OpenGraph, Twitter Cards) from a web page.

Example

{
  "jsonrpc": "2.0",
  "id": 13,
  "method": "tools/call",
  "params": {
    "name": "get_page_metadata",
    "arguments": { "url": "https://example.com/product/42" }
  }
}

Note: The tool returns a formatted text block with title, description, keywords, OpenGraph properties and Twitter Card fields.

check_url

• Performs a lightweight HEAD request to report status code, headers and size without downloading the body.

Example

{
  "jsonrpc": "2.0",
  "id": 14,
  "method": "tools/call",
  "params": {
    "name": "check_url",
    "arguments": { "url": "https://example.com/resource.zip" }
  }
}

Note: The response includes the final URL after redirects, a concise status summary (OK or Error), and selected HTTP headers such as ContentType and ContentLength.

Security Features

• Pathtraversal protection all file operations are confined to the sandboxed working directory.
• Promptinjection detection in URLs, fetched HTML and generated content.
• Blocked domains & extensions (localhost, private IP ranges, executable/script files).
• Contentsize limits max50MB for page fetches, max100MB for file downloads.
• HTML sanitisation removes <script>, <iframe>, event handlers and other risky elements before processing.
• Cookie/banner handling optional removal of consent banners and popups during fetch.

• 2025 Undici77 All rights reserved.*