mcp-server-fetch: readabilipy 0.3.0 writes npm install output to stdout, the stdio JSON-RPC channel #5310

Problem

With readabilipy 0.3.0 (what an unpinned uvx / pip install of mcp-server-fetch resolves today, and what the lock moves to in #5303's PR), the first HTML extraction with Node.js on PATH runs npm install from inside the tool call (readabilipy.utils.run_npm_install, via have_node()). That subprocess.run(["npm", "install"], check=True) inherits the server's stdout, which over stdio is the JSON-RPC channel, so npm's progress text is written into the protocol stream.

readabilipy 0.3.0 has a second write to stdout: when the Node script fails, simple_json_from_html_string does print(e.stderr) before re-raising.

#2895 reported the npm symptom (Unexpected token 'r', " run npm f"... is not valid JSONin Claude Desktop's log) and was closed, but fetch has no code that keeps a child process or a libraryprint` off fd 1. #4830 lists "npm's output reaches stdout" as one point of a documentation issue; this issue is the code defect itself.

Reproduction

A fresh environment with readabilipy 0.3.0 and Node/npm on PATH:

uv venv /tmp/rp && uv pip install --python /tmp/rp/bin/python readabilipy==0.3.0
/tmp/rp/bin/python -c "import readabilipy.simple_json as s; s.simple_json_from_html_string('<html><body><article><p>hello world</p></article></body></html>', use_readability=True)" 2>/dev/null

stdout:

added 38 packages, and audited 39 packages in 470ms

9 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

In mcp-server-fetch over stdio, those lines reach the client as non-JSON on the first fetch of an HTML page.

Expected

Nothing but JSON-RPC is written to the server's stdout. Output from readabilipy's subprocesses and prints goes to stderr (or nowhere), for example by redirecting fd 1 around the extraction call, or by provisioning readabilipy's node_modules outside the tool call.

Related: #4830 (docs, egress), #4199 / #5307 (--no-readability-js opt-out, which avoids the npm path but does not fix the default), #5306 (timeout and event-loop blocking in the same call).