Is io.github.VelvetSP/web-retrieval-mcp safe to use?

io.github.VelvetSP/web-retrieval-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.VelvetSP/web-retrieval-mcp?

io.github.VelvetSP/web-retrieval-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.

What AI clients work with io.github.VelvetSP/web-retrieval-mcp?

io.github.VelvetSP/web-retrieval-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is io.github.VelvetSP/web-retrieval-mcp actively maintained?

io.github.VelvetSP/web-retrieval-mcp is recently maintained — last commit was 46 days ago. It has 1 GitHub stars.

io.github.VelvetSP/web-retrieval-mcp

MCP web search + tiered web fetch for AI agents (Exa, Firecrawl), SSRF-guarded, cross-platform.

1 GitHub

No known CVEs

No license

Maintained

Last commit 46d ago

Works with most clients

Transport: stdio

0 tools

Grade F

MCPpedia last refreshed this data 1h ago

Edit this pageView history

Browser Search

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-velvetsp-web-retrieval-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-velvetsp-web-retrieval-mcp-velvetsp)](https://mcppedia.org/s/io-github-velvetsp-web-retrieval-mcp-velvetsp)

Read me

What io.github.VelvetSP/web-retrieval-mcp does

MCP web search + tiered web fetch for AI agents (Exa, Firecrawl), SSRF-guarded, cross-platform.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

14/100across 5 weighted dimensions

How we score →

0255075100

−86

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.VelvetSP/web-retrieval-mcp safe to use?: io.github.VelvetSP/web-retrieval-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.VelvetSP/web-retrieval-mcp?: io.github.VelvetSP/web-retrieval-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with io.github.VelvetSP/web-retrieval-mcp?: io.github.VelvetSP/web-retrieval-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.VelvetSP/web-retrieval-mcp actively maintained?: io.github.VelvetSP/web-retrieval-mcp is recently maintained — last commit was 46 days ago. It has 1 GitHub stars.

Similar servers

Others in browser / search

View all →

Brave Search MCP Server94

Web and local search using Brave Search API

88.6k 2

Tavily Mcp94

Production ready MCP server with real-time search, extract, map & crawl.

2.2k 4

Modelcontextprotocol94

The official MCP server implementation for the Perplexity API Platform

2.4k 4

Puppeteer MCP Server93

Browser automation with Puppeteer for web scraping and testing

87.9k 5

MCP Security Weekly

Get CVE alerts and security updates for io.github.VelvetSP/web-retrieval-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Browser Search

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-velvetsp-web-retrieval-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-velvetsp-web-retrieval-mcp-velvetsp)](https://mcppedia.org/s/io-github-velvetsp-web-retrieval-mcp-velvetsp)

Read me

What io.github.VelvetSP/web-retrieval-mcp does

MCP web search + tiered web fetch for AI agents (Exa, Firecrawl), SSRF-guarded, cross-platform.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

README

web-retrieval-mcp — MCP web search & web fetch for AI agents (Exa + Firecrawl)

web-retrieval-mcp is an open-source Model Context Protocol (MCP) server that gives AI agents two web tools — neural web search (Exa) and a tiered web fetch (Exa → optional local browser → Firecrawl) — as a drop-in replacement for built-in WebSearch/WebFetch. It preserves per-source provenance, guards against SSRF, runs cross-platform (macOS/Linux/Windows), and works with Claude Code, Claude Desktop, Cursor, and any MCP client. Runs on free API tiers.

Why replace the built-in web tools?

An agent's stock WebSearch / WebFetch tend to flatten many sources into one blurry summary, drop provenance, and silently fail on JavaScript-heavy or anti-bot pages. This server fixes that:

	Built-in web tools	web-retrieval-mcp
Search results	One merged summary, sources conflated	One block per result — each keeps its own title, URL, highlights, and text, plus a `Sources` trailer
Fetch reliability	Single attempt, gives up on hard pages	Tiered fallback: Exa contents → optional local browser → Firecrawl, with a `[served by: …]` provenance header
JS / anti-bot pages	Usually fails	Opt-in real headless browser (camoufox) on demand
Safety	—	SSRF guard rejects loopback / private / link-local / multicast hosts before any request
Cost	Bundled / metered by your model vendor	Free on Exa + Firecrawl free tiers (see below)

Runs on free API tiers — and the free tiers are more than enough

Both providers have a genuinely usable free, no-credit-card tier, and because fetches hit Exa first (Firecrawl is only the fallback), a single developer or agent rarely touches the Firecrawl quota at all:

Provider	Free tier (verified 2026)	Role in this server
Exa	1,000 requests / month, no card	Powers `web_search` and the first `web_fetch` tier
Firecrawl	1,000 pages / month, no card	Fallback fetch tier only — rarely reached
camoufox (local browser)	Unlimited & free — runs on your machine	Opt-in `render="always"` tier for JS/anti-bot pages

For a personal agent that's ~33 searches and 33 hard-page fetches every day, indefinitely, for $0/month. Heavy production workloads can upgrade either provider independently — the tiering and code don't change.

Features

🔎 web_search — neural / keyword / auto search via Exa, one provenance-preserving block per result.
🌐 web_fetch — single-URL readable content through a resilient tier chain with provenance headers.
🧱 Tiered fallback — Exa contents → (opt-in) local camoufox browser → Firecrawl, so hard pages still resolve.
🛡️ SSRF guard — non-public hosts (loopback, RFC-1918, link-local, multicast, NAT64) are refused up front.
🔑 Cross-platform secrets — env vars, a key file, the keyring library, or an OS secret tool. No keys on the command line.
🚫 Hook to disable the built-ins — bundled PreToolUse hook + one-command installer so agents must use these tools.
📦 One-command install — uvx, pipx, or pip; ships two console scripts.

Quickstart

# Run with no install — uvx fetches and runs it on demand:
uvx web

... [View full README on GitHub](https://github.com/velvetsp/web-retrieval-mcp#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

14/100across 5 weighted dimensions

How we score →

0255075100

−86

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.VelvetSP/web-retrieval-mcp safe to use?: io.github.VelvetSP/web-retrieval-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.VelvetSP/web-retrieval-mcp?: io.github.VelvetSP/web-retrieval-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with io.github.VelvetSP/web-retrieval-mcp?: io.github.VelvetSP/web-retrieval-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.VelvetSP/web-retrieval-mcp actively maintained?: io.github.VelvetSP/web-retrieval-mcp is recently maintained — last commit was 46 days ago. It has 1 GitHub stars.