MCP server · Model Context Protocol (reference server)
Fetch MCP Server
The reference MCP server for retrieving web content and converting it to Markdown for model consumption — and the classic injection entry point.
What it is, and what it costs you
The fetch server does one small thing: retrieve a URL and convert the response to Markdown so a model can read it efficiently. It is genuinely useful, frequently the first server a team connects, and the single most direct route for indirect prompt injection into an agent session.
The reason is structural rather than a flaw in the implementation. The server's entire purpose is to take content from an arbitrary internet host and place it in the model's context. There is no trust boundary available to it — it cannot know which fetched text is documentation and which is an instruction planted for an agent to find. Any page the agent visits can attempt to redirect it, and pages can serve different content to an agent than to a human reader.
Two properties make this sharper than it first appears. Injected instructions do not need to be visible: white text, HTML comments, and `aria-hidden` content all survive conversion to Markdown while being invisible in a browser. And the URL is often chosen by the model rather than the user — the agent follows a link it found in earlier content, so 'only visit sites you trust' is not a control the user actually exercises.
The server-side risk is also worth noting: a fetch tool running on a machine inside a network perimeter can be directed at internal addresses and cloud instance metadata endpoints. That is server-side request forgery with a language model as the confused deputy, and the mitigation is the ordinary one — block link-local and private address ranges at the network layer, not in the prompt.
Capability profile
What this server can reach, and why a security team cares. These are capabilities the server has by design — derived from the publisher's documentation, not from a scan.
- outbound HTTP
Any reachable URL becomes fetchable, including internal services and cloud metadata endpoints if the host network permits it.
- untrusted content ingestion
Fetched text enters the context window with the same standing as the user's own instructions. This is the primary indirect prompt injection vector.
- model-chosen destinations
The agent can follow URLs discovered in previously fetched content, so the set of visited hosts is not under the user's control.
Restrict this before you roll it out
- Restrict egress to an allowlist
If the agent only needs vendor documentation, allow those hosts and nothing else. This is the highest-leverage single control for this server.
- Block private and link-local ranges
Prevent the agent from reaching internal services and cloud instance metadata endpoints. Enforce at the network layer, never by instruction.
- Do not combine with broad credentials
A session that fetches arbitrary pages should not simultaneously hold production tokens or private repository access.
- Treat fetched text as hostile input
Require human confirmation for consequential actions taken in a session that has fetched external content.
Vincosha Assay assessment
not yet assessedWe have not published a scan verdict for Fetch MCP Server.
Everything above is a capability profile compiled by hand from the publisher's own public documentation on 2026-07-25. It describes what this artifact can reach and what to restrict before rolling it out. It is not a security verdict, and it should not be read as one.
When Vincosha Assaypublishes an assessment for this artifact it will appear here with a verdict, the findings behind it, and the date it ran. We would rather leave this space empty than fill it with a guess — inventing a security verdict about somebody else's software would be both wrong and dangerous.
What an assessment covers
- prompt-injection patterns in descriptions and instructions
- credential reads and outbound egress in bundled code
- over-scoped permissions and manifest claims
- typosquatted and impersonating names
- tool-manifest drift since the last approval
- content hash against the version you approved
Sources
This profile was compiled from the publisher's own documentation. Products change — verify against the source before making a decision that depends on a specific detail.