.env.example

# WebFetch MCP — legacy environment variable configuration
#
# NOTE: The recommended approach is now a YAML config file, which supports
# all options (headers, output format, timeout, retry, proxy) per domain
# in a single readable file.  See webfetch.yaml.example for details.
#
# To use YAML config, set:
#   WEBFETCH_CONFIG=/absolute/path/to/webfetch.yaml
#
# When WEBFETCH_CONFIG is set, the variables below are ignored.
# When it is NOT set, the variables below continue to work as before.

# WEBFETCH_HEADERS — domain-scoped headers for outbound HTTP requests.
#
# Format: a JSON object where each key is either:
#   "*"          → headers applied to ALL requests (global/catch-all)
#   "domain.tld" → headers applied only when the request hostname ends with
#                  this value (e.g. "example.com" matches "www.example.com")
#
# Headers are merged in this order (later wins on conflict):
#   global ("*")  →  domain-specific  →  per-call extra_headers from the MCP client
#
# Must be a single-line JSON string.
WEBFETCH_HEADERS={"*": {"User-Agent": "MyBot/1.0"}, "example.com": {"X-Auth-Token": "token-for-example"}, "example2.com": {"X-Auth-Token": "token-for-example2"}}

# WEBFETCH_OUTPUT — domain-scoped output format for HTTP responses.
#
# Format: a JSON object where each key is either:
#   "*"          → output format applied to ALL responses (global/catch-all)
#   "domain.tld" → output format applied when hostname ends with this value
#
# Supported formats:
#   "raw"         — return raw HTML as-is (default)
#   "markdown"    — convert full HTML to Markdown (via markdownify)
#   "trafilatura" — extract main content and return as Markdown (via trafilatura)
#   "json"        — pretty-print JSON body (auto-detected from Content-Type too)
#
# Merge order (later wins): "*" → domain-specific → per-call output_format
#
# Must be a single-line JSON string.
WEBFETCH_OUTPUT={"*": "raw", "example.com": "trafilatura", "news.com": "markdown"}

# WEBFETCH_ALLOWED_DOMAINS — comma-separated list of allowed outbound domains.
#
# When non-empty, only these domains (and their subdomains) can be fetched.
# Any hostname not matching the list is blocked with an error.
# Loopback, link-local, and RFC-1918 ranges are ALWAYS blocked regardless.
#
# Example: restrict to company APIs and public docs only
# WEBFETCH_ALLOWED_DOMAINS=api.mycompany.com,docs.mycompany.com

# WEBFETCH_DENIED_DOMAINS — comma-separated list of explicitly blocked domains.
#
# When non-empty, requests to these domains (and subdomains) are always rejected.
# Takes effect even when WEBFETCH_ALLOWED_DOMAINS is empty (block-list mode).
#
# Example: block internal corporate domains from LLM access
# WEBFETCH_DENIED_DOMAINS=internal.corp,intranet.corp

# WEBFETCH_SELECTORS — domain-scoped CSS selector for HTML element extraction.
#
# Format: a JSON object where each key is either:
#   "*"          → selector applied to ALL responses (global/catch-all)
#   "domain.tld" → selector applied when hostname ends with this value
#
# The selected element(s) are extracted from the raw HTML *before* the
# output format conversion (markdown/trafilatura/etc.) is applied.
# All matching elements are concatenated.  If the selector matches nothing
# the full HTML is used as fallback.
#
# Merge order (later wins): "*" → domain-specific → per-call css_selector
#
# Must be a single-line JSON string.
# WEBFETCH_SELECTORS={"example.com": "article.main-content", "news.com": "div#article-body"}

# WEBFETCH_RENDER_JS — enable headless browser rendering for all requests.
#
# When set to true/1/yes, pages are fetched using Playwright (headless Chromium)
# instead of plain HTTP.  JavaScript is fully executed and the post-render HTML
# is returned.  All output format options (trafilatura, markdown, etc.) still
# apply to the rendered HTML.
#
# Default: false (use plain HTTP via httpx — no JavaScript execution)
#
# Requires: pip install playwright && playwright install chromium
#
# WEBFETCH_RENDER_JS=false