auth-fetch-mcp
auth-fetch-mcp
MCP 服务器,允许 AI 助手从受身份验证保护的网页中获取内容。
当您的 AI 尝试读取需要登录的 URL 时,此工具会为您打开一个真实浏览器进行登录,然后将页面内容捕获为清理后的 HTML。会话会保存在本地,因此您每个服务只需登录一次。
演示

Related MCP server: byob
快速开始
Claude Code
claude mcp add --scope user auth-fetch -- npx auth-fetch-mcp@latest.mcp.json (Cursor, Windsurf 等)
{
"mcpServers": {
"auth-fetch": {
"command": "npx",
"args": ["auth-fetch-mcp@latest"]
}
}
}首次运行时,如果尚未安装 Chromium,系统会自动安装。
工作原理
让您的 AI 读取任何需要身份验证的页面 — 只需粘贴 URL。
浏览器窗口会自动打开并导航到该页面。
像往常一样登录(支持 SSO、2FA、验证码等任何方式)。
准备好后,点击右下角的 “📸 Capture” 按钮。
页面内容将以清理后的 HTML 格式捕获(去除了噪音元素,保留了媒体标签),浏览器关闭,您的 AI 将收到该内容。
工具
auth_fetch
主要工具。使用真实浏览器获取页面内容,并在需要时打开窗口进行登录。返回清理后的 HTML,其中去除了噪音元素(导航、页脚、脚本等),并保留了媒体标签(<img>, <video>, <iframe>)。
参数 | 类型 | 必需 | 描述 |
| string | 是 | 要获取内容的 URL |
| string | 否 | 捕获前等待的 CSS 选择器(对单页应用 SPA 有用) |
download_media
使用保存的浏览器会话从 URL 下载文件。使用此工具可以延迟下载在 auth_fetch 结果中找到的图像、视频或其他文件。浏览器的已保存 Cookie 会自动处理身份验证 — 无需再次登录。
参数 | 类型 | 必需 | 描述 |
| string[] | 是 | 一个或多个要下载的 URL |
| string | 否 | 保存文件的目录(默认为 |
示例流程:
1. auth_fetch("https://notion.so/my-page")
→ Returns HTML with <img src="https://s3.notion.so/signed-url..."/> tags
2. AI reads the HTML, identifies an image it needs
3. download_media(["https://s3.notion.so/signed-url..."])
→ Downloads the image using saved session cookies
→ Returns { localPath: "~/.auth-fetch-mcp/downloads/.../file-1.png" }list_pages
列出浏览器中所有打开的标签页及其 URL 和标题。
close_browser
关闭浏览器窗口。登录会话会被保存,并在下次使用时重复利用。
数据存储
所有数据均存储在本地 ~/.auth-fetch-mcp/ 下。没有任何数据发送到外部服务器。
内容 | 位置 | 时间 | 持久化? |
浏览器会话(Cookie、本地存储) |
| 首次登录后 | 是 — 重启后可重复使用 |
已下载的媒体文件 |
| 仅在调用 | 是 — 直到您删除为止 |
捕获的页面内容 (HTML) | 未保存到磁盘 | 通过 stdio 直接传递给 AI | 否 — 仅存在于 AI 的上下文中 |
要清除所有数据:
# Clear login sessions only
rm -rf ~/.auth-fetch-mcp/browser-data/
# Clear downloaded files only
rm -rf ~/.auth-fetch-mcp/downloads/
# Clear everything
rm -rf ~/.auth-fetch-mcp/支持的 AI 工具
Claude Code
Cursor
Windsurf
任何使用 stdio 传输的 MCP 兼容客户端
限制
需要本地环境(在基于 Web 的聊天界面中无法工作)
首次访问每个服务需要手动登录
超长页面会被截断以适应 LLM 上下文窗口(100K 字符)
某些具有强力机器人检测功能的网站可能无法工作(请尝试
wait_for选项)
隐私
所有数据都保留在您的机器上 — 不会发送到外部服务器
捕获的 HTML 永远不会写入磁盘 — 它仅通过 stdio 管道传递给 AI 工具
浏览器会话作为标准 Chromium 配置文件存储在本地
下载的文件会进入您控制的本地目录
贡献
欢迎贡献!请提交 Issue 或 Pull Request。
git clone https://github.com/ymw0407/auth-fetch-mcp.git
cd auth-fetch-mcp
npm install
npm run build许可证
MIT
Available Tools
4 toolsauth_fetchAuth FetchA
Read a login-protected page using a local browser and human-approved capture. Use for authenticated pages or when normal web reading returns a login screen or empty content. Tell the user to sign in and click Capture page before calling. Returns a loaded-DOM snapshot, source URL, time, links, media and completeness warnings. Prefer format=text for reading; html preserves markup. Canvas, frame contents and unloaded content are not extracted. This call waits for the user.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The URL to fetch content from | |
| format | No | Defaults to readable text. Select html when markup is needed. | text |
| wait_for | No | CSS selector that must be visible after the user captures. A missing selector returns an error. | |
| max_chars | No | Maximum returned content characters. Defaults to 20000; check truncated. | |
| timeout_seconds | No | Time allowed for manual login and Capture page. Configure the client's tool timeout to be longer. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| links | Yes | |
| media | Yes | |
| title | Yes | |
| format | Yes | |
| status | Yes | |
| content | Yes | |
| warnings | Yes | |
| truncated | Yes | |
| captured_at | Yes | |
| links_truncated | Yes | |
| media_truncated | Yes | |
| original_length | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing that the call blocks waiting on a human, that a missing wait_for selector errors, and that canvas, frame contents and unloaded content are not extracted. It also explains why readOnlyHint=false despite this being a read: it drives a real browser session and depends on user interaction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then precondition, then return shape, then limitations. Every sentence carries distinct information with no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the items an agent cannot infer: the human-in-the-loop requirement, the blocking wait, timeout mismatch advice, and extraction gaps. With an output schema present, it need not spell out return fields, though its brief summary of returns is a bonus.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all five parameters are already documented with defaults and constraints. The description's 'Prefer format=text for reading; html preserves markup' largely restates the enum descriptions rather than adding syntax or behavior the schema lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read a login-protected page') plus the mechanism ('local browser and human-approved capture'). This is clearly distinguishable from siblings like download_media, list_pages and close_browser, which do not read page content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('Use for authenticated pages or when normal web reading returns a login screen or empty content') and a concrete precondition workflow ('Tell the user to sign in and click Capture page before calling'). It does not name an alternative tool by name, so it stops just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
close_browserClose BrowserAIdempotent
Close the browser when the user asks to cancel. An active capture will fail; saved login sessions are retained. Do not call during capture unless cancellation is intended.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| message | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, it discloses the key side effect (an active capture will fail) and the state that survives (saved login sessions are retained), plus the operational constraint about not closing mid-capture. This is precisely the behavioral context annotations cannot convey, and it does not conflict with destructiveHint=false since no persisted data is destroyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the primary action and followed by the side effect and the guardrail. Every sentence carries distinct information with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter session-control tool with an output schema and full annotation coverage, the description supplies the trigger, the failure mode, and the persistence behavior. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4 and there is nothing for the description to disambiguate. It correctly implies the operation is unconditional on input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Close the browser') and ties it to a user intent ('when the user asks to cancel'), so the action is unambiguous. It does not explicitly distinguish itself from the sibling tools, though none of them offer an overlapping close-session capability, so the gap is minor.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger ('when the user asks to cancel') and an explicit exclusion ('Do not call during capture unless cancellation is intended'), which is exactly the when/when-not guidance an agent needs. No alternative tool competes for this action, so no further routing is required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
download_mediaDownload MediaA
Download only attachments needed for the user's task using saved browser cookies. Returns local paths, sizes, and per-file errors. Check downloaded before reporting success. Cookies may not cover sites that require JavaScript-generated authorization headers. Use include_preview to return small PNG/JPEG/WebP images directly to the AI; larger files need a local file viewer. Run after auth_fetch finishes.
| Name | Required | Description | Default |
|---|---|---|---|
| urls | Yes | One or more URLs to download | |
| output_dir | No | Optional directory to save files to. Defaults to ~/.auth-fetch-mcp/downloads/<timestamp>/ | |
| include_preview | No | Include small PNG/JPEG/WebP images as MCP image content, within a shared 1 MiB preview budget. Local paths are always returned. |
Output Schema
| Name | Required | Description |
|---|---|---|
| files | Yes | |
| total | Yes | |
| status | Yes | |
| directory | Yes | |
| downloaded | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (readOnlyHint=false, destructiveHint=false, openWorldHint=true) cover the mutation/open-world profile, and the description adds genuinely new context: cookie limitations against JavaScript-generated authorization headers, per-file error reporting, and the 1 MiB preview budget behavior. Does not contradict the write-hint by hiding that files land on disk.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then limitation, then verification requirement, then the preview branch. Every sentence carries actionable information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return shapes need not be restated, yet the description still notes the returned fields and error surface. Combined with the auth caveat and sequencing relative to auth_fetch, an agent has everything needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning to include_preview (returns small PNG/JPEG/WebP to the AI within a budget; larger files require an external viewer) beyond what the schema states. output_dir and urls remain schema-only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (download) and resource (attachments/media) plus the mechanism (saved browser cookies) and scope constraint (only what the task needs). It is clearly distinguishable from siblings like auth_fetch and list_pages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit sequencing ('Run after auth_fetch finishes'), a success-verification instruction ('Check downloaded before reporting success'), and a conditional routing rule for include_preview (small images inline vs. larger files needing a local viewer). Covers both when to use and how to branch.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_pagesList PagesARead-onlyIdempotent
Inspect open browser tabs without navigating. Returns URLs and titles; it does not capture page content.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| count | Yes | |
| pages | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint=false, so the safety profile is covered. The description adds genuinely new behavioral context: it does not navigate (no side effects on the pages) and 'does not capture page content', explicitly bounding what the tool will and will not return. That boundary is the kind of detail annotations cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero filler, with the scope constraint ('without navigating') placed first and the output/limitation statement second. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only, idempotent list tool with an output schema present, the description covers everything needed to call it correctly: what it enumerates, that it has no navigation side effect, and what data it returns versus omits. Return-value detail is legitimately delegated to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case per the rubric. There is nothing for the description to clarify, and it correctly describes the output shape (URLs and titles) instead of inventing parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Inspect) and resource (open browser tabs), and the qualifier 'without navigating' narrows the scope precisely. It does not name or differentiate against siblings like close_browser or auth_fetch, but the resource is unambiguous enough that confusion is unlikely.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the phrase 'open browser tabs' rather than stated: an agent can infer this is the tool for enumerating existing tabs. There is no explicit when-to-use condition, no exclusions, and no reference to the sibling tools that also touch browser state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v4.0.0- Changed
auth_fetch5 fields changed- added
Input schema / properties / formatAdded value: +{ + "default": "text", + "description": "Defaults to readable text. Select html when markup is needed.", + "enum": [ + "html", + "text" + ], + "type": "string" +} - added
Input schema / properties / max_charsAdded value: +{ + "default": 20000, + "description": "Maximum returned content characters. Defaults to 20000; check truncated.", + "maximum": 100000, + "minimum": 1000, + "type": "integer" +} - added
Input schema / properties / timeout_secondsAdded value: +{ + "default": 600, + "description": "Time allowed for manual login and Capture page. Configure the client's tool timeout to be longer.", + "maximum": 1800, + "minimum": 30, + "type": "integer" +} - changed
Input schema / properties / wait_for / descriptionPrevious value: -"Optional CSS selector to wait for before capturing (useful for SPAs)"New value: +"CSS selector that must be visible after the user captures. A missing selector returns an error." - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "captured_at": { + "type": "string" + }, + "content": { + "type": "string" + }, + "format": { + "enum": [ + "html", + "text" + ], + "type": "string" + }, + "links": { + "items": { + "additionalProperties": false, + "properties": { + "label": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "url", + "label" + ], + "type": "object" + }, + "type": "array" + }, + "links_truncated": { + "type": "boolean" + }, + "media": { + "items": { + "additionalProperties": false, + "properties": { + "downloadable": { + "type": "boolean" + }, + "label": { + "$ref": "#/properties/links/items/properties/label" + }, + "type": { + "type": "string" + }, + "url": { + "$ref": "#/properties/links/items/properties/url" + } + }, + "required": [ + "url", + "label", + "type", + "downloadable" + ], + "type": "object" + }, + "type": "array" + }, + "media_truncated": { + "type": "boolean" + }, + "original_length": { + "type": "number" + }, + "status": { + "const": "ok", + "type": "string" + }, + "title": { + "type": "string" + }, + "truncated": { + "type": "boolean" + }, + "url": { + "type": "string" + }, + "warnings": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "status", + "url", + "title", + "content", + "format", + "captured_at", + "truncated", + "original_length", + "links", + "media", + "links_truncated", + "media_truncated", + "warnings" + ], + "type": "object" +}
- Changed
close_browser1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "message": { + "type": "string" + } + }, + "required": [ + "message" + ], + "type": "object" +}
- Changed
download_media4 fields changed- added
Input schema / properties / include_previewAdded value: +{ + "default": false, + "description": "Include small PNG/JPEG/WebP images as MCP image content, within a shared 1 MiB preview budget. Local paths are always returned.", + "type": "boolean" +} - added
Input schema / properties / urls / maxItemsAdded value: +50 - added
Input schema / properties / urls / minItemsAdded value: +1 - changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "directory": { + "type": "string" + }, + "downloaded": { + "type": "number" + }, + "files": { + "items": { + "additionalProperties": false, + "properties": { + "error": { + "type": "string" + }, + "localPath": { + "type": "string" + }, + "preview_included": { + "type": "boolean" + }, + "size": { + "type": "number" + }, + "url": { + "type": "string" + } + }, + "required": [ + "url" + ], + "type": "object" + }, + "type": "array" + }, + "status": { + "enum": [ + "ok", + "partial", + "error" + ], + "type": "string" + }, + "total": { + "type": "number" + } + }, + "required": [ + "status", + "directory", + "downloaded", + "total", + "files" + ], + "type": "object" +}
- Changed
list_pages1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "count": { + "type": "number" + }, + "pages": { + "items": { + "additionalProperties": false, + "properties": { + "title": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "url", + "title" + ], + "type": "object" + }, + "type": "array" + } + }, + "required": [ + "pages", + "count" + ], + "type": "object" +}
1 tool update
- Added
download_media
3 tool updates
v2.0.7- First observed
auth_fetch - First observed
close_browser - First observed
list_pages
TDQS
Scored across 4 tools
Each tool targets a distinct browser action: list_pages inspects tabs, auth_fetch captures content, download_media fetches attachments, and close_browser tears down. Boundaries are clean and the descriptions reinforce the sequencing (auth_fetch before download_media, close only when cancelling).
close_browser, download_media, and list_pages follow a clear verb_noun snake_case pattern. auth_fetch deviates slightly (reads as noun/qualifier + verb) but remains readable and consistent in casing.
Four tools is well-scoped for a narrow authenticated-fetching purpose, with each tool earning its place. No redundant or filler tools, nothing obviously missing at this count.
The full lifecycle is covered: inspect tabs, capture content, download media, and close the browser. A dedicated navigation/URL-open tool appears absent, but list_pages plus the user-driven capture flow largely compensates.
Maintenance
Related MCP Connectors
Cloud browsers for AI agents: get past bot detection, sign in with MFA, run web tasks at scale.
Read, crawl and act on websites, signed in as the user, and turn any site into an API.
Stealth web automation for AI agents. Login, signup, navigate, screenshot.
Stealth web automation for AI agents. Login, signup, navigate, screenshot.
Related MCP Servers
- FlicenseNot gradedqualityNot gradedmaintenanceEnables AI agents to authenticate with websites using a real Chromium browser with anti-detection measures and human-in-the-loop support for captchas and 2FA. Features stealth browsing, human-like interactions, and persistent session storage to automate and resume login workflows.-
- AlicenseNot gradedqualityBmaintenanceLets AI assistants control your real Chrome browser to perform web tasks like reading pages, taking screenshots, clicking, and typing, using your existing logged-in sessions.143MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI tools to browse the web as the user by providing access to a persistent browser session with logged-in accounts, supporting recipes for email, PRs, calendar, and more.8 npm5MIT
- AlicenseNot gradedqualityDmaintenanceProvides a persistent browser profile for AI agents, enabling them to log in once and maintain sessions across restarts. Supports 20 tools for browsing, navigation, text extraction, and screenshot.1MIT