Skip to content

dev.fetchgate/fetchgate

by fetchgate.dev · remote · no sign-in to list tools · v0.1.0 · published by dev.fetchgate

Fetch any URL as clean Markdown or metadata, and buy digital goods via x402 — for AI agents.

Changes · 4
CompareRegistry entry

10 tools: 4 change things and 6 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http fetchgate https://fetchgate.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

10 tools

Changes things 4Claude Code: ask
  • check_base_tokenScreen a token contract on Base before an agent buys it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Screen a token contract on Base before an agent buys it. Reads the contract (ERC-20 metadata, owner, upgradeable proxy, and mint / pause / blacklist / fee selectors in its bytecode) and its DEX liquidity (WETH and USDC held by its Uniswap and Aerodrome pools, read on-chain). Returns a verdict — ok, caution, avoid or unknown — with the reasons. A heuristic screen: it does not simulate a sell, read tax rates or check pool age. Wraps GET /v1/token/check. Same free daily tier as read_url; $0.01/call via x402 after that.
  • check_x402_endpointDecide whether an unfamiliar pay-per-call (x402) endpoint is worth paying.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Decide whether an unfamiliar pay-per-call (x402) endpoint is worth paying. Sends one unpaid GET to read its live payment challenge (format, price, network, signing domain), then adds its settled-call and unique-payer history, whether its live price matches its listed price, and its domain's reputation (template farm or not, share of its endpoints that answer). Returns a verdict — ok, caution, avoid or unknown — with the reasons. Nothing is paid. Use before an agent sends money to an endpoint it has not used before. Wraps GET /v1/x402/check. Same free daily tier as read_url; $0.01/call via x402 after that.
  • scan_for_prompt_injectionCheck untrusted content BEFORE acting on it.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Warn

      The description contains "override, tool", wording about other tools or servers.

      Matched text

      description: "...20 detection rules covering instruction override, tool hijacking, data exfiltration, system-pr..."

      What this check looks for
    Description, as the server wrote it
    Check untrusted content BEFORE acting on it. Give a `url` to fetch and scan a web page (its visible text and, separately, text hidden in HTML comments, alt/title/aria attributes and meta tags), or give `text` to scan a tool result, retrieved document or message you already have. Runs 120 detection rules covering instruction override, tool hijacking, data exfiltration, system-prompt extraction, jailbreak framing and encoding tricks (zero-width and Unicode-tag smuggling, homoglyphs, base64). Returns a 0-100 risk score, a recommended action (block / review / flag / none) and each match with its evidence. Heuristic: a clean result means nothing obvious tripped, not that the content is safe. Wraps /v1/scan. Same free daily tier as read_url; $0.003/call via x402 after that.
  • scan_mcp_serverConnect to a remote Streamable HTTP MCP server, fetch its tools/list (sends only initialize, notifications/initialized and tools/list — never tools/call) and scan every tool name, …1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...Unicode, directives aimed at the model, credential/secret references, exfiltration shapes..."

      What this check looks for
    Description, as the server wrote it
    Connect to a remote Streamable HTTP MCP server, fetch its tools/list (sends only initialize, notifications/initialized and tools/list — never tools/call) and scan every tool name, description, parameter description and the server's initialize `instructions` string for tool-poisoning patterns: hidden-instruction markers, invisible Unicode, directives aimed at the model, credential/secret references, exfiltration shapes and instructions about other tools. Returns per-tool findings with severity, excerpt and a score band. Use it before installing or trusting a third-party server. Heuristic: a clean result means nothing obvious in what the server declares about itself, not that it is safe. Wraps GET /v1/mcp-scan. Free, rate-limited per caller; private/internal-network hosts are rejected.
Only reads 6Claude Code: allow
  • get_agent_censusReturn the Agent Web Crawler Census: every named bot observed crawling a live, publicly-listed x402 + MCP endpoint over a 24-hour window, each with a case-insensitive regex `matche…No findings

    Why it is in this group

    • The name "get_agent_census" says "get": a word for reading.
    Description, as the server wrote it
    Return the Agent Web Crawler Census: every named bot observed crawling a live, publicly-listed x402 + MCP endpoint over a 24-hour window, each with a case-insensitive regex `matcher` and a behavioural `category` (liveness-monitor, directory-crawler, price-scraper, security-research, ai-training, ...) so you can classify your own access log. Observed first-hand, not aggregated from third-party bot lists. Notable finding: of the named agent-web crawlers in the census, zero have ever presented a payment, and several declare that in their own User-Agent string. Wraps GET /v1/agent-census.json. Free, unmetered, no payment required. CC BY 4.0.
  • get_metadataFetch a URL server-side and return structured metadata: title, description, canonical URL, OpenGraph/Twitter card fields, favicon URL, language, and published/modified timestamps w…No findings

    Why it is in this group

    • The name "get_metadata" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a URL server-side and return structured metadata: title, description, canonical URL, OpenGraph/Twitter card fields, favicon URL, language, and published/modified timestamps when present. Wraps GET /v1/meta. Same free tier as read_url; priced at $0.001/call via x402 once exhausted.
  • get_purchase_infoLook up a product by id (from list_products) and explain exactly how to buy it: its price, and the x402 purchase flow step by step (the 402 challenge shape, the PAYMENT-SIGNATURE h…No findings

    Why it is in this group

    • The name "get_purchase_info" says "get": a word for reading.
    Description, as the server wrote it
    Look up a product by id (from list_products) and explain exactly how to buy it: its price, and the x402 purchase flow step by step (the 402 challenge shape, the PAYMENT-SIGNATURE header, and the signed download URL you get back on success). Does not take payment itself — informational only, mirroring the pre-payment leg of GET /v1/buy/:id.
  • list_productsList Fetchgate's digital-goods catalog: id, name, description, priceUsd, currency, file format, size, sha256, and a walletless humanUrl checkout link for each product for sale.No findings

    Why it is in this group

    • The name "list_products" says "list": a word for reading.
    Description, as the server wrote it
    List Fetchgate's digital-goods catalog: id, name, description, priceUsd, currency, file format, size, sha256, and a walletless humanUrl checkout link for each product for sale. Wraps GET /v1/products. Free, no rate limit, no payment required just to browse.
  • read_urlFetch a URL server-side and return its main content as clean Markdown, with scripts/styles/nav/ads/boilerplate stripped out.No findings

    Why it is in this group

    • The name "read_url" says "read": a word for reading.
    Description, as the server wrote it
    Fetch a URL server-side and return its main content as clean Markdown, with scripts/styles/nav/ads/boilerplate stripped out. Wraps GET /v1/read. Free tier: 30 calls/day per caller; priced at $0.002/call via x402 once that's exhausted (see get_purchase_info for how the x402 flow works). Only http:// and https:// URLs are accepted; private/internal-network hosts are rejected.
  • search_x402_servicesSearch for a pay-per-call (x402) API that does what you need.No findings

    Why it is in this group

    • The name "search_x402_services" says "search": a word for reading.
    Description, as the server wrote it
    Search for a pay-per-call (x402) API that does what you need. Unlike a raw directory, results are limited to endpoints that answered a real x402 payment challenge AND had at least 5 settled calls from at least 2 distinct payers in the last 30 days, so dead, never-bought and template-farm listings are left out. Each result has the endpoint URL, method, price in USD, networks, 30-day calls and unique payers, and a flag when the payer count looks farmed. Use it when you need a paid API (search, scraping, enrichment, LLM, market data…) and want one that demonstrably works. Wraps GET /v1/x402/search. Same free daily tier as read_url; $0.005/call via x402 after that.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http fetchgate https://fetchgate.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__fetchgate__read_url",
      "mcp__fetchgate__get_metadata",
      "mcp__fetchgate__list_products",
      "mcp__fetchgate__get_purchase_info",
      "mcp__fetchgate__get_agent_census",
      "mcp__fetchgate__search_x402_services"
    ],
    "ask": [
      "mcp__fetchgate__scan_for_prompt_injection",
      "mcp__fetchgate__check_x402_endpoint",
      "mcp__fetchgate__check_base_token",
      "mcp__fetchgate__scan_mcp_server"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as fetchgate. Review it before you use it.