Open-Source MCP Server for Trusted Web Sources

An open-source MCP server for trusted web sources gives an AI client a narrow toolset for searching and reading a source collection that you control. Instead of asking the agent to browse from scratch on every run, you curate RSS feeds and watched websites once, then expose folders, feeds, search results, and individual articles through authenticated MCP tools.

Sparkfeed provides this workflow today. Its Community Edition is AGPL-3.0-only, its MCP endpoint uses Streamable HTTP, and its workspace-scoped API keys determine which tools a client can see. This guide explains the architecture, setup, and security limits without treating curation as a substitute for prompt-injection defenses.

What is an open-source MCP server?

An open-source MCP server is software whose source code can be inspected and modified and that exposes data or actions through the Model Context Protocol. MCP standardizes how an AI client discovers tools, supplies inputs, and receives results.

The official MCP transport specification defines Streamable HTTP for remote servers. It uses HTTP POST and GET against one MCP endpoint and recommends authentication, origin validation, and binding local servers to localhost.

Open source answers one set of questions: what code runs, where keys are checked, and how tools are registered. It does not prove that every source is accurate or safe. A public webpage can still contain false claims or instructions intended to manipulate an agent.

Why use a curated source server instead of open-web scraping?

A curated source server reduces repeated fetching, narrows the source set, preserves dates and metadata, and lets an agent search before loading full text. It does not remove the need to treat every article as untrusted content.

The main differences are operational:

Open-web fetch on each run	Curated feed and MCP server
Discovery and retrieval repeat for every task	Sources are chosen and collected once
The agent sees whatever search returns that day	The workspace has an explicit source list
Full pages may enter context before relevance is known	Search results can return compact metadata first
Every task needs its own deduplication and freshness logic	The collector stores dates, identifiers, and reading state
Access may be broad and difficult to audit	One endpoint and scoped key define the available tools

The source list improves relevance and reproducibility. It is not a security boundary by itself. OWASP’s prompt-injection guidance explicitly includes web pages and documents as indirect prompt-injection sources. Retrieved text should be treated as data, not as instructions.

For a business use case built on the same source model, see how to gather competitive intelligence from public sources.

How the Sparkfeed MCP architecture works

Sparkfeed collects RSS, Atom, and supported pages without feeds. It normalizes and stores the resulting items in a workspace. The same internal tool registry generates the REST API and the MCP toolset, so the interfaces use the same operations and validation.

The client queries a stored source collection rather than rebuilding discovery and ingestion for every prompt.

The current remote endpoint is:

https://beta.sparkfeed.dev/api/mcp

A self-hosted installation uses the same /api/mcp path on its own origin. The server runs independently of the browser, so the web app does not need to stay open.

Which tools does the MCP server expose?

Sparkfeed exposes orientation, reading, discovery, charting, and scoped write operations. A key’s scopes determine which tools are registered. A read-only client does not see write tools in its tool list.

Tool	Purpose
`get_workspace_info`	Return workspace counts, plan, key permissions, and limits
`list_folders`	List the folder tree and feed counts
`list_feeds`	List sources, optionally within one folder
`search_articles`	Search titles and summaries or return newest items
`get_article`	Read one article as Markdown, text, or HTML
`find_feeds`	Search the source catalog or scan a site for feeds
`verify_feed`	Fetch and parse one address to confirm it is a valid feed
`read_url`	Read a public page that is not already stored in the workspace
`chart_workspace`	Chart volume, posting cadence, unread folders, or top sources
`add_feed`	Subscribe to a feed or resolvable site when feed-write scope exists
`create_folder`	Create a top-level or nested folder when feed-write scope exists
`move_feed`	Move a feed between folders when feed-write scope exists
`set_favorite`	Favorite or unfavorite articles when write scope exists
`mark_read`	Change shared reading state when write scope exists

List tools return snippets rather than full article bodies. get_article loads one article at a time. read_url is the one read tool that fetches an address chosen from the conversation, so clients should treat it differently from a cached workspace read. Results have size limits and pagination so a broad query does not fill the client’s context with an entire workspace.

The design also separates discovery from reading. An agent can list folders, search a seven-day window, inspect titles and summaries, then fetch only the articles required for the task.

How do you connect a client?

Create an API key in Developer > API keys inside Sparkfeed. The key belongs to one workspace and is displayed only once. Store it like a password.

For Claude Code, the current documented command is:

claude mcp add --transport http sparkfeed https://beta.sparkfeed.dev/api/mcp \
  --header "Authorization: Bearer sfk_live_YOUR_KEY"

Then confirm registration:

claude mcp list

For clients that accept JSON MCP configuration, Sparkfeed generates this shape in Developer > MCP:

{
  "mcpServers": {
    "sparkfeed": {
      "type": "http",
      "url": "https://beta.sparkfeed.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer sfk_live_YOUR_KEY"
      }
    }
  }
}

The configuration uses a static bearer key. Sparkfeed publishes OAuth protected-resource discovery metadata, but it does not run an OAuth authorization server. If a bridge begins an OAuth registration flow, check the bearer header first. The most common cause is a missing Bearer prefix.

Can you test the MCP server without an account?

Yes. The demo workspace has a public, rate-limited, read-only key:

claude mcp add --transport http sparkfeed-demo https://demo.sparkfeed.dev/api/mcp \
  --header "Authorization: Bearer sfk_demo_public"

The demo registers read tools only. It cannot create or modify structural data, and live fetching is disabled for uncached articles. That makes it suitable for testing client compatibility, not for evaluating private-workspace behavior.

You can also ask the endpoint for its tool list directly:

curl -s \
  -X POST https://demo.sparkfeed.dev/api/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'Authorization: Bearer sfk_demo_public' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

A successful request returns the tools available to that key. An authenticated key with broader scopes can expose more tools.

How should API-key scopes be assigned?

Give each client the smallest set of operations it needs. Sparkfeed keys can carry these scopes:

Scope	Access
`mcp`	Connect to the MCP endpoint
`workspace:read`	Workspace information, folders, and feeds
`articles:read`	Article search and full text
`feeds:write`	Feed subscriptions, folders, and moves
`articles:write`	Favorite and read-state changes

A summarizer usually needs mcp, workspace:read, and articles:read. It does not need articles:write. Create separate keys for separate clients so one integration can be revoked without interrupting the rest.

Production rejects demo-prefixed keys. Sparkfeed stores a hash of a live key rather than the raw value and records last use. If a key appears in a repository, log, or shared document, revoke it and create a replacement.

Does a curated feed prevent prompt injection?

No. Curation reduces the number of sources and makes provenance clearer, but any webpage, feed summary, or retrieved article can contain malicious or misleading instructions.

Curation helps, but the real safety boundary is a layered design with limited tools and approval for risky actions.

Practical controls include:

Preserve the source URL and publication date with every item.
Separate retrieved text from system and user instructions.
Use read-only scopes for research tasks.
Do not let article content choose a tool call or destination.
Require approval before messages, purchases, deletions, or other consequential actions.
Log tool calls and rotate keys on a schedule.
Review source additions instead of allowing an agent to expand its own trust list silently.

OWASP’s agent-security guidance recommends least privilege, data classification, auditability, and controls for direct and indirect prompt injection.

When does self-hosting help?

Self-hosting helps when the team needs control over the application, database, backups, source list, retention, and provider configuration. It does not make third-party source requests invisible. The source website can still see the fetch, and any external AI provider can receive the content sent to it.

Sparkfeed Community Edition includes workspaces, sharing, Spark AI, REST, API keys, and MCP under AGPL-3.0-only. It supports up to ten registered people per deployment. The operator is responsible for PostgreSQL, email, TLS, upgrades, backups, and any AI-provider key.

The guide to self-hosting a feed reader with your own AI provider covers the operational trade-offs. The guide to turning any website into a feed explains how no-RSS sources enter the collection.

Teams comparing the surrounding research stack can also review the market intelligence tools guide.

When should you use REST instead of MCP?

Use REST when your application already knows the endpoint and response it needs. Use MCP when an AI client should discover available tools and decide which operation fits the task. RSS remains the simplest option for passive publication and subscription.

The detailed RSS API versus MCP comparison maps these interfaces to ingestion, automation, and agent use cases. Sparkfeed generates REST and MCP from the same internal tool definitions, so a team can use both against one workspace.

For a research workflow, that can mean REST for a scheduled internal report and MCP for an analyst’s interactive questions. Both use workspace-scoped bearer keys.

Sources and further reading

Frequently Asked Questions

Is there an open-source MCP server for RSS feeds?

Sparkfeed is an AGPL-3.0-only reader and content-intelligence workspace with a built-in MCP server. It combines RSS and Atom feeds with supported websites that do not publish feeds, then exposes workspace search and reading tools over MCP.

Can I run an MCP server locally?

Yes. MCP servers can run as local processes over standard input and output or as HTTP services bound to localhost. Sparkfeed runs as a web application and exposes Streamable HTTP at /api/mcp on the deployment origin.

What are the best free MCP servers?

The answer depends on the data or action the client needs. Use the official MCP registry and project documentation to verify ownership, permissions, transport, and maintenance. For trusted RSS and website sources, Sparkfeed Community Edition is free to self-host under AGPL-3.0-only.

How much does an MCP server cost?

MCP is a protocol, so it has no protocol fee. Cost comes from hosting, storage, source fetching, model usage, operations, and any commercial product wrapped around the server. A self-hosted Sparkfeed operator pays those infrastructure and provider costs directly.

Does Sparkfeed use OAuth for MCP?

Sparkfeed uses workspace-scoped static bearer keys. It publishes protected-resource metadata for client discovery but does not provide an OAuth authorization server. Include Authorization: Bearer followed by the key on each request.

Can an AI agent trust every item in a curated feed?

No. A curated feed identifies the publisher and limits the source set, but article content remains untrusted input. Keep source provenance, use read-only tools, isolate instructions from retrieved text, and require approval for consequential actions.