doc-fetcher

SUSPICIOUS. The core behavior matches the stated purpose and is mostly proportionate, but it depends on a third-party MCP server that may receive Cloudflare credentials, and it ingests untrusted web content for later agent use. No direct malware or exfiltration is shown, but the trust boundary is broader than a simple documentation fetcher.