Repository navigation
mcp-server-fetch SSL verify Off #508
Description
Is your feature request related to a problem? Please describe.
I need to fetch some local systems with either self-signed or invalid SSL i.e when using DDEV deployments.
Currently fetch refuses to connect to the DDEV server hosted on the same machine as claude due to SSL issues.
Describe the solution you'd like
Id like a flag to enable ignore bad ssl certificates to allow it to communicate with my ddev server.
Describe alternatives you've considered
None as proxying would also require a SSL cert issue.
Reacted by Chris K Wensel
Activity
GeertJohan commentedon Mar 31, 2025
I set up the MCP with the flag
?sslmode=requirein the connection string. This normally would tell a postgres client that CA verification is not needed. But the MCP still complains that the certificate is self-signed.Stefs-2142 commentedon Apr 2, 2025
Same problem (
rlacotte commentedon Apr 9, 2025
Same here ...
leonowski commentedon Apr 25, 2025
I was able to workaround this when connecting to an RDS postgres server by specifying the root cert in the connection string:
postgresql://username:password@pghost:5432/db_name?sslmode=allow&sslrootcert=/cert.pemA list of downloadable certs are here: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html
I downloaded the pem for my region, renamed it as 'cert.pem' and mounted it as /cert.pem in container.
Connoropolous commentedon May 17, 2025
using sslmode=require&sslrootcert=/path/to/cert.crt I was able to get it to work with digitalocean
https://chatgpt.com/share/6828e4e9-f4f8-8007-8c18-8991c7081ed6
#1803 (comment)
MarxICB commentedon Jul 2, 2025
open the installation location of the Python library, for example, site-packages\mcp_server_fetch, and modify function in server.py. The function uses httpx, so change the corresponding line to:
async with AsyncClient(verify=False) as client:
This will disable certificate verification.
nayannandakumar1698-cloud commentedon Dec 1, 2025
if you are using StdioServerParameters and getting the error use
server_params = StdioServerParameters(
command="npx",
args=["-y", "@openbnb/mcp-server-airbnb", "--ignore-robots-txt"],
env= {
"NODE_TLS_REJECT_UNAUTHORIZED": "0"
}
)
env= {
"NODE_TLS_REJECT_UNAUTHORIZED": "0"
}
like this
feat: resolve SSL issue modelcontextprotocol#508, implement SSRF prot…
fix(fetch): add configurable SSL certificate verification
fix(fetch): add configurable SSL certificate verification
fix(fetch): add configurable SSL certificate verification
fix(fetch): add configurable SSL certificate verification
fix(fetch): add configurable SSL certificate verification
fix(fetch): add configurable SSL certificate verification
fix(fetch): add configurable SSL certificate verification
fix(fetch): add configurable SSL certificate verification
fix(fetch): add configurable SSL certificate verification
cliffhall commentedon Oct 19, 2026
Closing: out of scope for the reference servers.
Thank you for the suggestion, and apologies for the long wait for a response.
These servers are reference implementations: they exist to show how each part of MCP is used, not to be general-purpose products, so new features are taken selectively (
CONTRIBUTING.md). A switch that disables TLS certificate verification weakens a reference server's security posture; trusting a local CA through the standard certificate environment settings is the better route. This is not a judgment on the idea or on you; a server in the MCP Registry may well offer it, and anyone is welcome to build on these servers to do so. This is happening as part of the backlog triage in #4875.