Is Fetch MCP server safe?

An MCP tool exposes a powerful capability (files, shell, network, browser, or credentials).

@server.tool(
        name="fetch",

Why it matters: Wired into an agent, these grant it real access to your machine — confirm each is required.

Fix: Confirm each powerful tool is required and constrained; broad MCP tools (shell/filesystem/network) grant an agent significant host access.

The component can run operating-system commands or spawn processes.

subprocess.run(
                ["taskkill", "/F", "/T", "/PID", str(proc.pid)],
                stdin=subprocess.DEVNULL,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,
                check=False, …

proc = subprocess.Popen(
            argv,
            cwd=cwd,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True,
            encoding="utf-8",
            e …

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.

The component reads files from disk.

article = json.loads(result.read_text(encoding="utf-8"))

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

page.write_text(html, encoding="utf-8")

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

The component makes outbound network requests.

import httpx

ascii_name = httpx.URL(f"http://{name}/").raw_host.decode("ascii")

import httpx

return httpx.AsyncClient(proxy=proxy_url)

raise httpx.DecodingError(f"Error decoding the response body: {e}")

raise httpx.DecodingError(
        f"Unsupported content encoding {', '.join(codings)}: this server "
        f"decodes only {ACCEPT_ENCODING}"
    )

raise httpx.TooManyRedirects(
                    "Exceeded maximum allowed redirects.",
                    request=response.next_request,
                )

from httpx import HTTPError

from httpx import HTTPError

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An MCP tool surface (manifest or tool definitions) was found.

@server.tool(

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.