Don't let agents invent your site: fetch, cache, and cite with a stdio MCP server

Ask an agent what a public site says about a product page, a topic note, or an essay. You usually get fluent prose: a stack list, a couple of metrics, a confident "this project uses X." What you rarely get is a URL you can open.

That is the failure mode. The model is not retrieving the site. It is interpolating a site-shaped answer from training data, prior chat, and whatever fragments happened to be in the prompt. Project names drift. Metrics get rounded. Pages that never existed sound real.

The fix is not a better system prompt. It is a tool boundary: the client should only claim what a tool returned, and the tool should only return text it fetched, with the public URLs attached.

site-context-mcp is a small Python MCP server that does exactly that. It speaks MCP over stdio via FastMCP, fetches a public llms.txt plus the same-host pages it links, caches them in-process (~1 hour TTL), and exposes four tools. Every response is JSON text with a top-level sources[].

This is site/project context, not an identity server. A sibling package, resume-mcp, already answers "who is this person" from resume.json. Mixing those jobs is how you get a resume tool that starts inventing product pages.

The contract: no citation, no claim

MCP is a typed tool protocol. A local process lists tools; the model calls them; the host returns structured results. The interesting part is what you put in those results.

This server treats sources as a required field, not a nicety. A helper merges the tool body with a de-duplicated URL list and json.dumps the whole thing. Error paths do the same: an empty search query, a missing page, a failed corpus load — all still include sources. If a fetch partially fails, the surviving pages are returned and the failures show up in cache_notes.

FastMCP instructions tell the host model to answer from the cached corpus and to cite those URLs. Instructions are not enforcement. The enforcement is the payload: if the snippet is not in the tool result, it did not come from this server.

Seed from llms.txt, then same-host only

On process start the server tries cache.ensure_loaded() (and again on first tool use if that failed, or when the in-process TTL expires — CACHE_TTL_SECONDS = 3600). The cache then:

1. GETs the wired host's /llms.txt (default: https://yongbo-yu.vercel.app/llms.txt)
2. Parses markdown links in document order
3. Fetches each allowed URL
4. Always seeds home, a known /projects/... evidence page, and /resume.json if parsing is thin

Allowlisting is the security model. A URL is kept only if it is HTTPS, on the wired host, not a binary extension (images, fonts, PDFs, archives), and not a blocked fragment (off-host social, private admin hosts, internal app paths). Redirects that leave the host are dropped. There are no API keys and no cookies.

The default corpus is one public site. The shape — llms.txt as the machine-readable index, same-host follow, in-memory TTL — is the reusable part. Change the host constant to another public site that publishes llms.txt and you get the same tools.

HTML is stripped with a small html.parser.HTMLParser: skip script / style / svg / noscript, prefer main / article over the rest of body, take