Is io.github.VelvetSP/web-retrieval-mcp safe to use?

io.github.VelvetSP/web-retrieval-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.VelvetSP/web-retrieval-mcp?

io.github.VelvetSP/web-retrieval-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with io.github.VelvetSP/web-retrieval-mcp?

io.github.VelvetSP/web-retrieval-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is io.github.VelvetSP/web-retrieval-mcp actively maintained?

io.github.VelvetSP/web-retrieval-mcp is actively maintained — last commit was 27 days ago.

io.github.VelvetSP/web-retrieval-mcp

web-retrieval-mcp

MCP web search + tiered web fetch for AI agents (Exa, Firecrawl), SSRF-guarded, cross-platform.

GitHub PyPI

No known CVEs

No license

Actively maintained

Last commit 27d ago

Works with most clients

Transport: stdio

0 tools

Grade F

Edit this pageView history

Browser Search

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "web-retrieval": {
      "env": {
        "EXA_API_KEY": "exa-...",
        "FIRECRAWL_API_KEY": "fc-..."
      },
      "command": "web-retrieval-mcp"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-velvetsp-web-retrieval-mcp)](https://mcppedia.org/s/io-github-velvetsp-web-retrieval-mcp)

Read me

What io.github.VelvetSP/web-retrieval-mcp does

web-retrieval-mcp is an open-source Model Context Protocol (MCP) server that gives AI agents two web tools — neural web search (Exa) and a tiered web fetch (Exa → optional local browser → Firecrawl) — as a drop-in replacement for built-in WebSearch/WebFetch. It preserves per-source provenance, guards against SSRF, runs cross-platform (macOS/Linux/Windows), and works with Claude Code, Claude Desktop, Cursor, and any MCP client. Runs on free API tiers.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'web-retrieval-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

54/100across 5 weighted dimensions

How we score →

0255075100

−46

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked web-retrieval-mcp against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.VelvetSP/web-retrieval-mcp safe to use?: io.github.VelvetSP/web-retrieval-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.VelvetSP/web-retrieval-mcp?: io.github.VelvetSP/web-retrieval-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.VelvetSP/web-retrieval-mcp?: io.github.VelvetSP/web-retrieval-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.VelvetSP/web-retrieval-mcp actively maintained?: io.github.VelvetSP/web-retrieval-mcp is actively maintained — last commit was 27 days ago.

Similar servers

Others in browser / search

View all →

Brave Search MCP Server98

Web and local search using Brave Search API

87.9k 2

Context797

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

58.3k 2

Puppeteer MCP Server96

Browser automation with Puppeteer for web scraping and testing

87.9k 5

Tavily Mcp96

Production ready MCP server with real-time search, extract, map & crawl.

2.2k 4

MCP Security Weekly

Get CVE alerts and security updates for io.github.VelvetSP/web-retrieval-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Browser Search

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "web-retrieval": {
      "env": {
        "EXA_API_KEY": "exa-...",
        "FIRECRAWL_API_KEY": "fc-..."
      },
      "command": "web-retrieval-mcp"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-velvetsp-web-retrieval-mcp)](https://mcppedia.org/s/io-github-velvetsp-web-retrieval-mcp)

Read me

What io.github.VelvetSP/web-retrieval-mcp does

web-retrieval-mcp is an open-source Model Context Protocol (MCP) server that gives AI agents two web tools — neural web search (Exa) and a tiered web fetch (Exa → optional local browser → Firecrawl) — as a drop-in replacement for built-in WebSearch/WebFetch. It preserves per-source provenance, guards against SSRF, runs cross-platform (macOS/Linux/Windows), and works with Claude Code, Claude Desktop, Cursor, and any MCP client. Runs on free API tiers.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'web-retrieval-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

web-retrieval-mcp — MCP web search & web fetch for AI agents (Exa + Firecrawl)

web-retrieval-mcp is an open-source Model Context Protocol (MCP) server that gives AI agents two web tools — neural web search (Exa) and a tiered web fetch (Exa → optional local browser → Firecrawl) — as a drop-in replacement for built-in WebSearch/WebFetch. It preserves per-source provenance, guards against SSRF, runs cross-platform (macOS/Linux/Windows), and works with Claude Code, Claude Desktop, Cursor, and any MCP client. Runs on free API tiers.

Why replace the built-in web tools?

An agent's stock WebSearch / WebFetch tend to flatten many sources into one blurry summary, drop provenance, and silently fail on JavaScript-heavy or anti-bot pages. This server fixes that:

	Built-in web tools	web-retrieval-mcp
Search results	One merged summary, sources conflated	One block per result — each keeps its own title, URL, highlights, and text, plus a `Sources` trailer
Fetch reliability	Single attempt, gives up on hard pages	Tiered fallback: Exa contents → optional local browser → Firecrawl, with a `[served by: …]` provenance header
JS / anti-bot pages	Usually fails	Opt-in real headless browser (camoufox) on demand
Safety	—	SSRF guard rejects loopback / private / link-local / multicast hosts before any request
Cost	Bundled / metered by your model vendor	Free on Exa + Firecrawl free tiers (see below)

Runs on free API tiers — and the free tiers are more than enough

Both providers have a genuinely usable free, no-credit-card tier, and because fetches hit Exa first (Firecrawl is only the fallback), a single developer or agent rarely touches the Firecrawl quota at all:

Provider	Free tier (verified 2026)	Role in this server
Exa	1,000 requests / month, no card	Powers `web_search` and the first `web_fetch` tier
Firecrawl	1,000 pages / month, no card	Fallback fetch tier only — rarely reached
camoufox (local browser)	Unlimited & free — runs on your machine	Opt-in `render="always"` tier for JS/anti-bot pages

For a personal agent that's ~33 searches and 33 hard-page fetches every day, indefinitely, for $0/month. Heavy production workloads can upgrade either provider independently — the tiering and code don't change.

Features

🔎 web_search — neural / keyword / auto search via Exa, one provenance-preserving block per result.
🌐 web_fetch — single-URL readable content through a resilient tier chain with provenance headers.
🧱 Tiered fallback — Exa contents → (opt-in) local camoufox browser → Firecrawl, so hard pages still resolve.
🛡️ SSRF guard — non-public hosts (loopback, RFC-1918, link-local, multicast, NAT64) are refused up front.
🔑 Cross-platform secrets — env vars, a key file, the keyring library, or an OS secret tool. No keys on the command line.
🚫 Hook to disable the built-ins — bundled PreToolUse hook + one-command installer so agents must use these tools.
📦 One-command install — uvx, pipx, or pip; ships two console scripts.

Quickstart

# Run with no install — uvx fetches and runs it on demand:
uvx web

... [View full README on GitHub](https://github.com/velvetsp/web-retrieval-mcp#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

54/100across 5 weighted dimensions

How we score →

0255075100

−46

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked web-retrieval-mcp against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.VelvetSP/web-retrieval-mcp safe to use?: io.github.VelvetSP/web-retrieval-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.VelvetSP/web-retrieval-mcp?: io.github.VelvetSP/web-retrieval-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.VelvetSP/web-retrieval-mcp?: io.github.VelvetSP/web-retrieval-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.VelvetSP/web-retrieval-mcp actively maintained?: io.github.VelvetSP/web-retrieval-mcp is actively maintained — last commit was 27 days ago.