Home › Search & Research › nab

nab

Token-optimized HTTP client for LLMs: fetches any URL as clean markdown. CLI and MCP server.

Go Local macOSWindowsLinux

★ 18 stars Last pushed 2026-11-09 License: MIT

View repository → Website →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (cargo 0.12.6)

Package: cargo nab

NAB_SSRF_ALLOW_PRIVATE — Set to allow fetching private/internal IP addresses (corporate dashboards). Never unblocks loopback, link-local/cloud-metadata, or other always-denied ranges. Off by default.
NAB_SSRF_ALLOWLIST — Comma-separated list of private IP/CIDR ranges to exempt from the SSRF guard (e.g. 10.252.0.0/16,192.168.1.5). Narrower, preferred alternative to NAB_SSRF_ALLOW_PRIVATE. Empty by default.
NAB_WEBMCP_STRICT — Set to a truthy value to require fetched pages advertising a WebMCP manifest to match NAB_WEBMCP_OPT_IN before ingestion is allowed (defense against prompt injection via fetched content). Off by default.
NAB_WEBMCP_OPT_IN — Comma-separated allowlist consulted when NAB_WEBMCP_STRICT is enabled. Empty by default.
NAB_STATE_DIR — Overrides the directory used to persist session/cookie state (default: ~/.nab).
NAB_KEYCHAIN_INTERACTION — Controls whether cookie extraction may prompt macOS Keychain for authorization. Set to 'never' in automated/headless callers so a background fetch cannot open a GUI dialog.
NAB_OP_BIN — Path to the 1Password CLI binary used for credential retrieval during the login tool (default: op).
NAB_MCP_CLI_BIN — Path to the mcp-cli binary used for MCP-based credential retrieval (default: mcp-cli).
NAB_NO_TELEMETRY — Set to anything other than 0 or false to skip the daily heartbeat. NO_TELEMETRY and DO_NOT_TRACK do the same.
NAB_TELEMETRY_ENDPOINT — Replace the daily heartbeat URL. An empty value leaves the default.