http_get
Perform HTTP GET requests to retrieve web content with status, headers, and body. Includes JSON parsing, redirect following, and SSRF protection that blocks private/loopback addresses unless explicitly allowed.
Instructions
Perform an HTTP GET. Returns status, headers, and body. Automatically parses JSON when the server responds with application/json. Follows redirects (each hop re-validated against SSRF rules). Refuses URLs that resolve to private/loopback/link-local addresses unless allow_private_hosts is set.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Target URL (http:// or https://) | |
| headers | No | Extra request headers as a key/value object | |
| retries | No | Retries on 408/425/429/500/502/503/504 with exponential backoff (default 0) | |
| max_bytes | No | Max response body size in bytes before the body is truncated (default 5MiB, ceiling 100MiB) | |
| basic_auth | No | HTTP Basic auth credentials | |
| timeout_ms | No | Request timeout in ms (default 10000, max 120000) | |
| user_agent | No | User-Agent override (default identifies as @yawlabs/fetch-mcp) | |
| decode_text | No | Force text decoding (true) or binary base64 (false). Defaults to auto — text for text/*, json, xml, etc; binary otherwise. | |
| bearer_token | No | Bearer token sent as Authorization: Bearer <token> | |
| max_redirects | No | Max redirect hops to follow (default 5) | |
| allow_private_hosts | No | Allow requests to loopback / private / link-local addresses. SSRF protection is on by default — only flip this when intentionally talking to localhost. |