FFetch MCPMCP server for fetch web page content using Playwright headless browser.

mcp-so:fetch-mcp_jae-jae

View source

100/100

First Seen

Feb 19, 2026

Last Scanned

Feb 20, 2026

Findings

Score

100/100

LOW 1

Findings (1)

LOW

npx auto-install without confirmation EXTDL_003

external-download L22

Detects npx with -y flag that bypasses user confirmation for package installation

npx -y

FIX

Replace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.

FP?

Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.