# io.github.mlawsonking/web-tools-mcp (npm · web-tools-mcp)

10 no-LLM web tools: URL to Markdown, metadata, JSON-LD, MX, scrape, RSS, DNS, RDAP, SSL, HTTP.

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `web-tools-mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/mlawsonking-web-tools-mcp/web-tools-mcp.md), [page](https://verifymcp.io/servers/mlawsonking-web-tools-mcp/web-tools-mcp)

## Channel facts

- Registry: `npm`
- Package: `web-tools-mcp`
- Version: `1.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1226 tokens (~122/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add mlawsonking-web-tools-mcp -- npx -y web-tools-mcp
```

### Codex

```bash
codex mcp add mlawsonking-web-tools-mcp -- npx -y web-tools-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mlawsonking-web-tools-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "web-tools-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mlawsonking-web-tools-mcp --command npx --arg -y --arg web-tools-mcp
```

### Hermes

```yaml
mcp_servers:
  mlawsonking-web-tools-mcp:
    command: "npx"
    args: ["-y", "web-tools-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "mlawsonking-web-tools-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "web-tools-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, −3)

No change was recorded against any check on this day. Supply Chain Security went from 97 to 87. Other categories moved too: Stability & Change Management rose 3.

### 2026-08-02 (score 72, +52)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-07-31 (score 20, −26)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 1.0.2 → 1.1.0
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (10)

### `read_url` (~133 tokens)

Fetch a web page and return its main readable content as Markdown, with navigation, ads and boilerplate stripped. HTML only: any other content type is refused rather than guessed at. No JavaScript is executed, so a page that builds its text in the browser comes back with little or nothing, and the response says so. Network: needs the target website. Optional packages: jsdom, turndown, @mozilla/readability. Without them this tool reports what is missing instead of guessing.

Input parameters:

- `url` (string, required): The http(s) URL of the page to read. Fetching is SSRF-guarded.

### `unfurl_url` (~123 tokens)

Read a URL's declared metadata for a link preview: title, description, preview image, site name, favicon, canonical URL, language. This is what the page says about itself in its own meta tags, not a verified fact about it. Cheaper than read_url when you only need to know what a link is. Network: needs the target website. Optional packages: cheerio. Without them this tool reports what is missing instead of guessing.

Input parameters:

- `url` (string, required): The http(s) URL to unfurl. Fetching is SSRF-guarded.

### `validate_email` (~127 tokens)

Validate an email address: syntax, a live MX or A lookup on the domain, and disposable, role and free-provider flags. Returns a deliverability call and a 0 to 1 quality score. There is no SMTP probe, so this says the domain can receive mail, never that the specific mailbox exists. The disposable list is fetched and falls back to a small built-in set when it cannot be reached, so a false "not disposable" is possible. Network: needs DNS (MX/A), disposable-email-domains list.

Input parameters:

- `email` (string, required): The email address to validate.

### `extract_web` (~160 tokens)

Pull specific values out of a web page with CSS selectors. Pass selectors as {key: "css"}. Suffix a selector with @attr for an attribute and with [] for every match, so "a.item[]@href" returns an array of links. href, src, data-src and poster values are resolved to absolute URLs. Static HTML only: nothing is executed, and a selector that matches nothing returns null or an empty array rather than an error. Network: needs the target website. Optional packages: cheerio. Without them this tool reports what is missing instead of guessing.

Input parameters:

- `selectors` (object, required): Map of output key to CSS selector.
- `url` (string, required): Page URL to scrape. Fetching is SSRF-guarded.

### `get_feed` (~131 tokens)

Fetch an RSS or Atom feed and return its items as JSON: title, link, date, author, categories, snippet. Whatever the feed publishes is what you get, including its idea of dates and ordering. A page that is not a feed is reported as such rather than parsed into an empty list. Network: needs the feed URL. Optional packages: rss-parser. Without them this tool reports what is missing instead of guessing.

Input parameters:

- `limit` (number): Max items, 1 to 100 (default 25).
- `url` (string, required): Feed URL. Fetching is SSRF-guarded.

### `dns_lookup` (~114 tokens)

Look up DNS records for a domain (A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, SRV) and report whether SPF and DMARC are published. Uses this machine's resolver, so the answers are whatever it returns, cache and all. A record type whose query failed is listed in checks_skipped rather than reported as absent. Network: needs DNS.

Input parameters:

- `domain` (string, required): Domain name.
- `type` (string): Record type or "all" (default).

### `domain_info` (~93 tokens)

Registration facts for a domain from RDAP, the JSON successor to WHOIS: creation and expiry dates, age in days, registrar, status, nameservers. Age is the useful signal, since a domain registered days ago is a common fraud marker. Coverage depends on the registry: some ccTLDs publish little or nothing through RDAP. Network: needs rdap.org.

Input parameters:

- `domain` (string, required): Domain name.

### `ssl_check` (~97 tokens)

Open a TLS connection to a host on port 443 and report its certificate: issuer, subject, validity window, days remaining, SANs, protocol, and whether it validates against the system trust store. Port 443 only, and this reads one certificate rather than grading the configuration the way a full TLS scanner would. Network: needs the target host on port 443.

Input parameters:

- `host` (string, required): Hostname, for example example.com.

### `http_inspect` (~137 tokens)

Request a URL and report the final status, the full redirect chain, every response header, and which security headers are present (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Presence is all this checks: a CSP that allows everything still counts as present. A 404 or a 500 is a result, not an error. GET only, and redirects stop at 5 hops. Network: needs the target URL.

Input parameters:

- `url` (string, required): URL to inspect. A missing scheme is treated as https. Fetching is SSRF-guarded.

### `structured_data` (~111 tokens)

Pull a page's machine-readable structured data: JSON-LD (schema.org), OpenGraph and Twitter card tags, plus the schema.org types declared. This is the page describing itself, so treat prices, ratings and availability as claims. JSON-LD that does not parse is skipped rather than repaired. Network: needs the target website. Optional packages: cheerio. Without them this tool reports what is missing instead of guessing.

Input parameters:

- `url` (string, required): Page URL. Fetching is SSRF-guarded.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/mlawsonking-web-tools-mcp/web-tools-mcp#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 72
- 2026-08-01: 20
- 2026-07-31: 20
- 2026-07-29: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/web-tools-mcp
- Socket report: https://socket.dev/npm/package/web-tools-mcp
- Repository: https://github.com/mlawsonking/MCP
- Changelog RSS feed: https://verifymcp.io/servers/mlawsonking-web-tools-mcp/web-tools-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/mlawsonking-web-tools-mcp/web-tools-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/mlawsonking-web-tools-mcp/web-tools-mcp