io.github.mlawsonking/web-tools-mcp
NPM · WEB-TOOLS-MCP · SCANNED AUG 3
10 no-LLM web tools: URL to Markdown, metadata, JSON-LD, MX, scrape, RSS, DNS, RDAP, SSL, HTTP.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1226 tokens (~122/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · web-tools-mcp
claude mcp add mlawsonking-web-tools-mcp -- npx -y web-tools-mcp
codex mcp add mlawsonking-web-tools-mcp -- npx -y web-tools-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mlawsonking-web-tools-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"web-tools-mcp"
],
"enabled": true
}
}
} openclaw mcp add mlawsonking-web-tools-mcp --command npx --arg -y --arg web-tools-mcp
mcp_servers:
mlawsonking-web-tools-mcp:
command: "npx"
args: ["-y", "web-tools-mcp"] {
"mcpServers": {
"mlawsonking-web-tools-mcp": {
"command": "npx",
"args": [
"-y",
"web-tools-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 −3
No change was recorded against any check on this day. Supply Chain Security went from 97 to 87. Other categories moved too: Stability & Change Management rose 3.
- 2 Aug 26 +52
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Stability: unverified → 0.20 ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Licence: MIT functional
- 31 Jul 26 −26
- Malware scan: pass → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 1.0.2 → 1.1.0 functional
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
dns_lookup ~114
Look up DNS records for a domain (A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, SRV) and report whether SPF and DMARC are published. Uses this machine's resolver, so the answers are whatever it returns, cache and all. A record type whose query failed is listed in checks_skipped rather than reported as absent. Network: needs DNS.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name. |
| type | string | — | Record type or "all" (default). |
No output schema declared.
No examples provided.
domain_info ~93
Registration facts for a domain from RDAP, the JSON successor to WHOIS: creation and expiry dates, age in days, registrar, status, nameservers. Age is the useful signal, since a domain registered days ago is a common fraud marker. Coverage depends on the registry: some ccTLDs publish little or nothing through RDAP. Network: needs rdap.org.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain name. |
No output schema declared.
No examples provided.
extract_web ~160
Pull specific values out of a web page with CSS selectors. Pass selectors as {key: "css"}. Suffix a selector with @attr for an attribute and with [] for every match, so "a.item[]@href" returns an array of links. href, src, data-src and poster values are resolved to absolute URLs. Static HTML only: nothing is executed, and a selector that matches nothing returns null or an empty array rather than an error. Network: needs the target website. Optional packages: cheerio. Without them this tool reports what is missing instead of guessing.
| Name | Type | Req | Description |
|---|---|---|---|
| selectors | object | yes | Map of output key to CSS selector. |
| url | string | yes | Page URL to scrape. Fetching is SSRF-guarded. |
No output schema declared.
No examples provided.
get_feed ~131
Fetch an RSS or Atom feed and return its items as JSON: title, link, date, author, categories, snippet. Whatever the feed publishes is what you get, including its idea of dates and ordering. A page that is not a feed is reported as such rather than parsed into an empty list. Network: needs the feed URL. Optional packages: rss-parser. Without them this tool reports what is missing instead of guessing.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Max items, 1 to 100 (default 25). |
| url | string | yes | Feed URL. Fetching is SSRF-guarded. |
No output schema declared.
No examples provided.
http_inspect ~137
Request a URL and report the final status, the full redirect chain, every response header, and which security headers are present (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Presence is all this checks: a CSP that allows everything still counts as present. A 404 or a 500 is a result, not an error. GET only, and redirects stop at 5 hops. Network: needs the target URL.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL to inspect. A missing scheme is treated as https. Fetching is SSRF-guarded. |
No output schema declared.
No examples provided.
read_url ~133
Fetch a web page and return its main readable content as Markdown, with navigation, ads and boilerplate stripped. HTML only: any other content type is refused rather than guessed at. No JavaScript is executed, so a page that builds its text in the browser comes back with little or nothing, and the response says so. Network: needs the target website. Optional packages: jsdom, turndown, @mozilla/readability. Without them this tool reports what is missing instead of guessing.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The http(s) URL of the page to read. Fetching is SSRF-guarded. |
No output schema declared.
No examples provided.
ssl_check ~97
Open a TLS connection to a host on port 443 and report its certificate: issuer, subject, validity window, days remaining, SANs, protocol, and whether it validates against the system trust store. Port 443 only, and this reads one certificate rather than grading the configuration the way a full TLS scanner would. Network: needs the target host on port 443.
| Name | Type | Req | Description |
|---|---|---|---|
| host | string | yes | Hostname, for example example.com. |
No output schema declared.
No examples provided.
structured_data ~111
Pull a page's machine-readable structured data: JSON-LD (schema.org), OpenGraph and Twitter card tags, plus the schema.org types declared. This is the page describing itself, so treat prices, ratings and availability as claims. JSON-LD that does not parse is skipped rather than repaired. Network: needs the target website. Optional packages: cheerio. Without them this tool reports what is missing instead of guessing.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Page URL. Fetching is SSRF-guarded. |
No output schema declared.
No examples provided.
unfurl_url ~123
Read a URL's declared metadata for a link preview: title, description, preview image, site name, favicon, canonical URL, language. This is what the page says about itself in its own meta tags, not a verified fact about it. Cheaper than read_url when you only need to know what a link is. Network: needs the target website. Optional packages: cheerio. Without them this tool reports what is missing instead of guessing.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The http(s) URL to unfurl. Fetching is SSRF-guarded. |
No output schema declared.
No examples provided.
validate_email ~127
Validate an email address: syntax, a live MX or A lookup on the domain, and disposable, role and free-provider flags. Returns a deliverability call and a 0 to 1 quality score. There is no SMTP probe, so this says the domain can receive mail, never that the specific mailbox exists. The disposable list is fetched and falls back to a small built-in set when it cannot be reached, so a false "not disposable" is possible. Network: needs DNS (MX/A), disposable-email-domains list.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | The email address to validate. |
No output schema declared.
No examples provided.