Fetch (MCP reference server) vs SERPHouse

Fetch (MCP reference server) 72

2026.10.28, stamped and tagged v2.2.0 on 28 October 2026, 7 days before this check (30). Releases of this package in the 90 days from 6 August are 2026.8.18 (an SDK pin and a README note), 2026.10.10 (tag v1.0.0), 2026.10.19 (tag v2.0.0), 2026.10.24 (tag v2.1.0) and 2026.10.28, the last four with code changes. Dates come from the repository's tags and CalVer stamps, since pypi.org didn't resolve from our shell today. The package has no separate CLI or plugin (20). Fixes for fetch merged through October cite issues filed for them; reply times on issues couldn't be read (12). Not in the official MCP registry on 4 November (a search for server-fetch returns nothing), though the README carries an mcp-name for io.github.modelcontextprotocol/server-fetch (0). Current SDK (mcp>=2.3,<3), CI on push, a dependency sweep and a pip-audit step before each release (10). 30+20+12+0+10 = 72.

SERPHouse 23

Read for a closed service, with its repositories read as code. No changelog or dated API change was found. The newest release is MCP server 1.1.0 on 6 July 2026, 123 days before 6 November, and the last commit in its repository was on 22 July (10). No release or dated change in the 90 days from 8 August; the about page's 2026 entry (Forums, Place Details and Scraper APIs) is undated (0). No changelog; support by email. Issues weren't read, since the GitHub API refused us for its rate limit (5 of 25). Not in the official MCP registry, though the repository's server.json names io.github.SERPHouse/serphouse-mcp. Node.js SDK last changed 24 June 2026, PHP SDK 10 May 2024, and no Python SDK repository was found under the SERPHouse organisation (5 of 15). The MCP repository has an npm publish workflow and no tests (3 of 10). 10 + 0 + 5 + 5 + 3 = 23.

Fetch (MCP reference server) 47

No credentials to leak and nothing to scope, so the middle band (20). GET only. Since 2026.10.10 the server refuses private, loopback, link-local and cloud metadata addresses by default and checks the robots.txt request and every redirect hop the same way, with --allow-private-ips to turn the guard off. The README says it doesn't cover DNS rebinding between the check and the connection, or a host only a proxy can resolve (15, judgement call). It returns untrusted page text unmarked, and the README has no prompt-injection guidance (0). No call log (0). SECURITY.md, rewritten on 29 September 2026 and on main since the v1.0.0 tag, names fetch in scope, takes private reports through GitHub and publishes advisories once a fixed release is out. No bounty or certification. Graded as the filesystem and sequential-thinking servers (12). OSV holds no advisory for mcp-server-fetch. Three fixes merged on 24 October from branches named for GHSA-66qx-2266-pmj6, GHSA-3jqg-r5pp-rmp2 and GHSA-v38p-wf49-hx2j shipped in 2026.10.24. None is in OSV or in GitHub's own advisory database on 4 November, so none is published as far as can be read and none is counted (as the filesystem server's four). 20+15+0+0+12 = 47.

SERPHouse 11

One key per account, one account per user, no scopes or rotation found (10). The REST API documents api_token in the query string and the hosted MCP server takes the key only in its URL path, less 10 (0 of 30). Searches only read, with no read-only or restricted key (8 of 20). Results are third-party snippets and AI Overview text, with no prompt-injection guidance (0). An account tool shows plan and credit usage; no per-call log was found (3 of 15). No security.txt (404), disclosure policy, bug bounty or certification found (0 of 20). 0 + 8 + 0 + 3 + 0 = 11.

Fetch (MCP reference server) 93

One tool, about 1,160 characters of definition, roughly 300 tokens (25). max_length and start_index page through long documents, and a truncated response names the next start_index (20). Invalid input returns INVALID_PARAMS, and a robots.txt or private-address refusal explains why and what the user can do (16). Since 2026.10.19 the tool carries readOnlyHint true, destructiveHint false, idempotentHint true and openWorldHint true, and a GET is safe to repeat (20). Only url is required and the defaults are sensible. Python only, plus a Docker image (12). 25+20+16+20+12 = 93.

SERPHouse 64

23 MCP tools with no toolsets or filtering (15 of 25). num_result, max_pages, paging, device, location, language, date and video filters (16 of 20). Status codes are tabulated, but a 200 can also mean an error and the body carries only 'Please try again' (10 of 20). Searches only read and failed requests aren't charged, but the MCP tools carry no readOnlyHint or other annotations (10 of 20). serphouse_search needs only q and defaults to the US; most other tools need loc or loc_id. Official Node.js, PHP and Python SDKs are documented (13 of 15). 15 + 16 + 10 + 10 + 13 = 64.

Fetch (MCP reference server) 75

The package is MIT, inside a repository moving new contributions to Apache-2.0, both OSI licences (28). Local software that keeps nothing and sends nothing beyond the request. There's no written statement, but the source is short and shows it (20). RELEASING.md describes the CalVer scheme and the README states the SDK requirement, but there's no deprecation policy or changelog for this package (8). No telemetry in the code (20). 28+20+8+20 = 76.

SERPHouse 50

Closed service under terms naming Patoliya Infotech LLP in India, and the MCP server is MIT (18 of 30). The terms give retention periods (JSON results up to 6 months, HTML up to 1 month, search history indefinitely) and say personal data sits on DigitalOcean in India, and they advise EEA users not to use the service. The privacy policy is generic and neither document carries a date (15 of 30). No deprecation policy, and the terms allow products to be discontinued without notice (0 of 20). DigitalOcean in India named for account data; no sub-processor list (6 of 20). 18 + 15 + 0 + 6 = 39.

Fetch (MCP reference server) 60

Free, self-hosted, nothing to buy, so 20 + 20 + 20. No payment protocol (0).

SERPHouse 40

No x402, MPP or L402 (0). Per-1,000 prices for SERP, autocomplete and top-100 requests published without login (20). Free trial of 4,000 credits for 7 days, 'No Credit Card Required' (20). A person signs up in a browser and confirms an email (0). 0 + 20 + 20 + 0 = 40.

Fetch (MCP reference server) 55

Scored as a local stdio package. Official PyPI package mcp-server-fetch and the mcp/fetch Docker image, Python 3.10 or later stated (20). The monorepo's python.yml runs ruff, pyright and pytest for fetch on push, with 13 test files for this server. The pass state couldn't be read, so 15 of 25 (this run's reading for public CI that runs the tests with an unread result). The October releases close filed issues, among them #4838 (private addresses), #767, #4988, #5134, #5158, #5181, #5197 and #5199; the open issue list couldn't be read (15). CalVer versions (2026.10.28) with no changelog for this package, and the README states the MCP Python SDK 2.x requirement (5). The classifier still says 4 - Beta and the repository calls its servers reference implementations, not production-ready (0). 20+15+15+5+0 = 55.

SERPHouse 40

Read with the hosted lines. No status page is linked from the site or docs, and status.serphouse.com did not answer on 6 November 2026 (0). No readable incident history (5). Rate limits published, 60 requests a minute and 60 concurrent on every self-serve plan (15). 429 is documented as 'slow down', and a 200 can carry "status": "error" with 'Please try again', with no Retry-After or backoff guidance. Failed requests aren't charged (5 of 15). The pricing page lists a 99.99% uptime SLA on Basic and Regular and the docs a 99.95% one, but no SLA terms or credits were found in the terms (5 of 10). Generally available (10). 0 + 5 + 15 + 5 + 5 + 10 = 40.