
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
Fetch clean markdown snapshots of any web page — optimized for AI agents, RAG pipelines, and context-aware workflows.
Reduces token overhead by ~90% compared to raw HTML while preserving the content structure LLMs need.
AI agents and LLMs work better with markdown than HTML. Feeding raw HTML into a context window wastes tokens on tags, scripts, styles, and boilerplate. mdrip solves this by fetching any URL and returning clean, structured markdown.
Sites that support Cloudflare's Markdown for Agents return markdown natively at the edge. For all other sites, mdrip's built-in converter handles headings, links, lists, code blocks, tables, blockquotes, and more, while filtering hidden/non-visible content (including hidden attributes, aria-hidden, inline hidden styles, templates/forms, and HTML comments).
npm install -g mdrip
Or use directly with npx:
npx mdrip <url>
# Fetch one page
mdrip https://example.com/docs/getting-started
# Fetch multiple pages
mdrip https://example.com/docs https://example.com/api
# Custom timeout (ms)
mdrip https://example.com --timeout 45000
# Strict mode — only accept native markdown, no HTML fallback
mdrip https://example.com --no-html-fallback
# Raw mode — print markdown to stdout, no file writes
mdrip https://example.com --raw
mdrip list
mdrip list --json
mdrip remove https://example.com/docs/getting-started
# Remove all
mdrip clean
# Remove only one domain
mdrip clean --domain example.com
--raw prints markdown to stdout and skips all file writes and prompts. Useful for piping content directly into agent loops.
mdrip https://example.com --raw | your-agent-cli
npm install mdrip
| Import path | Method | Returns | Purpose |
|---|---|---|---|
mdrip | fetchMarkdown(url, options?) | Promise<MarkdownResponse> | Fetch one URL to markdown with metadata |
mdrip | fetchRawMarkdown(url, options?) | Promise<string> | Fetch one URL to markdown string only |
mdrip/node | fetchMarkdown(url, options?) | Promise<MarkdownResponse> | Node entrypoint alias for in-memory fetch |
mdrip/node | fetchRawMarkdown(url, options?) | Promise<string> | Node entrypoint alias for markdown-only fetch |
mdrip/node | fetchToStore(url, options?) | Promise<FetchResult> | Fetch one URL and persist to mdrip/pages/... |
mdrip/node | fetchManyToStore(urls, options?) | Promise<FetchResult[]> | Fetch many URLs and persist successful results |
mdrip/node | listStoredPages(cwd?) | Promise<PageEntry[]> | List tracked snapshots from mdrip/sources.json |
FetchMarkdownOptions supports: timeoutMs, userAgent, htmlFallback, fetchImpl.
StoreFetchOptions extends that with cwd.
import { fetchMarkdown } from "mdrip";
const page = await fetchMarkdown("https://example.com/docs");
console.log(page.markdown); // clean markdown content
console.log(page.markdownTokens); // estimated token count
console.log(page.source); // "cloudflare-markdown" or "html-fallback"
import { fetchToStore, listStoredPages } from "mdrip/node";
const result = await fetchToStore("https://example.com/docs", {
cwd: process.cwd(),
});
if (result.success) {
console.log(`Saved to ${result.path}`);
}
const pages = await listStoredPages(process.cwd());
mdrip is available as a remote service at mdrip.createmcp.dev with MCP transports and a direct JSON API.
| Endpoint | Transport | Use case |
|---|---|---|
/mcp | Streamable HTTP MCP | Recommended for MCP clients |
/sse | SSE MCP | Legacy MCP client compatibility |
/api | JSON over HTTP | Direct non-MCP integration |
fetch_markdown:
url (required), timeout_ms (optional), html_fallback (optional)resolvedUrl, status, contentType, source, markdownTokens, contentSignal)batch_fetch_markdown:
urls (required array, 1-10), timeout_ms (optional), html_fallback (optional)/api)GET /api expects query params:
url (required)timeout (optional ms)html_fallback (optional true/false)curl "https://mdrip.createmcp.dev/api?url=https://example.com&timeout=30000&html_fallback=true"
POST /api supports both single and batch bodies:
{ "url": "https://example.com", "timeout_ms": 30000, "html_fallback": true }
{
"urls": ["https://example.com", "https://example.com/docs"],
"timeout_ms": 30000,
"html_fallback": true
}
Single responses return one fetch result object.
Batch responses return { "results": [...] } with success: true|false per URL.
Add to claude_desktop_config.json:
{
"mcpServers": {
"mdrip": {
"command": "npx",
"args": ["mcp-remote", "https://mdrip.createmcp.dev/mcp"]
}
}
}
claude mcp add mdrip-remote --transport sse https://mdrip.createmcp.dev/sse
Enter mdrip.createmcp.dev/sse at playground.ai.cloudflare.com.
On first run, mdrip can optionally update:
.gitignore — adds mdrip/tsconfig.json — excludes mdrip/AGENTS.md — adds a section pointing agents to your snapshotsChoice is stored in mdrip/settings.json. Use --modify or --modify=false to skip the prompt.
--raw mode bypasses this entirely.
mdrip/
├── settings.json
├── sources.json
└── pages/
└── example.com/
└── docs/
└── getting-started/
└── index.md
Measured across popular pages (values vary as pages change):
| Page | Mode | Chars saved | Tokens saved |
|---|---|---|---|
| blog.cloudflare.com/markdown-for-agents | cloudflare-markdown | 94.9% | 94.9% |
| developers.cloudflare.com/.../markdown-for-agents | cloudflare-markdown | 95.7% | 95.7% |
| en.wikipedia.org/wiki/Markdown | html-fallback | 72.7% | 72.7% |
| github.com/cloudflare/skills | html-fallback | 96.3% | 96.3% |
| Average | 89.9% | 89.9% |
pnpm build && pnpm benchmark
This repo includes an AI-consumable skills catalog in skills/, following the agentskills format.
npx skills add charl-kruger/mdrip
Charl Kruger
Apache-2.0
FAQs
Fetch markdown snapshots of web pages using Cloudflare Markdown for Agents
The npm package mdrip receives a total of 13 weekly downloads. As such, mdrip popularity was classified as not popular.
We found that mdrip demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.