# mcp-safe-fetch

![tests](https://github.com/PortfolioKB/mcp-safe-fetch/actions/workflows/test.yml/badge.svg)

An injection-aware content fetcher, exposed over the Model Context Protocol.

Agents that read the open web read content nobody on your team wrote. A page or a post
can carry a fake closing tag followed by "ignore previous instructions and ...". This
server fetches a URL, strips it to text, runs defense-in-depth sanitization, caps the
size, and caches the result. It is small on purpose. It is the reference implementation
of a set of production hardening field notes, not a framework.

## Why it exists

Most MCP servers are written for a demo: one caller, one happy path, no untrusted input,
no cost ceiling. In production the failures cluster in three places, and none of them
show up on day one:

- **Untrusted content.** A single tag stripper feels safe and is not. Unicode variants and
  unclosed tags walk straight through one regex.
- **Cost.** An unbounded response body or an oversized context is money spent on noise.
- **Concurrency.** Two tools touching one SQLite file throw `database is locked`.

This server answers all three in code you can read in five minutes.

## What it does

`fetch_clean(url, max_chars=2500)` returns sanitized, size-capped text plus an audit of
what was done. The defense is order, not cleverness:

1. strip the injection wrapper by its literal name, first
2. normalize unicode (NFKC) so homoglyph tags cannot hide
3. drop script and style bodies, then the generic tag strip
4. a second net for common instruction-override phrases

It caps input size with a `[truncated]` marker (if the model has to ignore most of the
input, you are paying for nothing), clamps the per-call cap at the entry to a hard ceiling,
and caches results in SQLite opened with `WAL` and `busy_timeout` so overlapping callers
wait instead of crashing.

## Install

```bash
pip install -e .
```

## Run

As a standalone MCP server (stdio):

```bash
mcp-safe-fetch
```

Register it with an MCP client (for example, Claude Code) by pointing the client at the
`mcp-safe-fetch` command. The server exposes one tool, `fetch_clean`.

## Test

```bash
pip install -e ".[dev]"
pytest
```

## The field notes behind it

The reasoning, with the production incidents that motivated each defense, is written up
here: a short essay on MCP hardening (concurrency, prompt injection, cost) and what breaks
after day 30. The sanitizer in `src/mcp_safe_fetch/sanitize.py` is the exact function from
that write-up.

## License

MIT.