Agentic RSS Parser
An enterprise-grade Node.js library for parsing RSS and Atom feeds — a drop-in rss-parser replacement with agentic analysis, deduplication, enrichment, and native MCP tooling.
Why it exists
rss-parser hasn't received a security update since 2022, yet it remains widely used across production agent pipelines. Agentic RSS Parser is a from-scratch rebuild that keeps the API you already know while closing the supply-chain gap — zero runtime dependencies, a custom XML engine, and native LLM adapters built directly on fetch().
Migrate in one line
All existing parseURL, parseString, parseFile, customFields, headers, timeout, and callback-style usage is preserved exactly. The agentic pipeline is an optional layer on top.
// Before
import Parser from 'rss-parser';
// After — zero other changes needed
import Parser from 'agentic-rss-parser';
Core features
- RSS 2.0 & Atom — namespaces, CDATA, HTML entities,
dc:creator,media:content,content:encoded - Drop-in compatibility —
parseURL,parseString,parseFile,customFields, callback and promise styles - OPML import —
parseOpml()extracts feed URLs and categories from OPML subscription lists, including nested folders - Continuous feed watcher —
createFeedWatcher()is an event emitter for background polling with automatic conditional-GET support andresult/poll/feedErrorevents - Vector database export —
storage.exportForEmbedding()formats analysed items into ready-to-embed documents for Pinecone, Chroma, pgvector, or any other vector store - Heuristic analysis — signal-based relevance scoring, no API key needed, fully configurable via
signals,extraSignals, andthreshold - LLM analysis — OpenAI, Anthropic, and local (Ollama) providers via native
fetch() - Article enrichment — fetches and strips full article body from feed item URLs
- MCP server — stdio JSON-RPC 2.0 server exposing
fetch_rss_feedandfetch_full_article, compatible with Claude Desktop, Cursor, VS Code, and any MCP host - SQLite deduplication — items are SHA-256 deduplicated across runs, with
pruneOlderThan()for long-running deployments - Retry & conditional GET — automatic exponential-backoff retries on 429/5xx, plus ETag / If-Modified-Since support to skip unchanged feeds
- SDK integrations — ready-to-use examples for Anthropic SDK, OpenAI Agents SDK, Vercel AI SDK, LangChain, and Google ADK
userAgentoverride — avoid 403s on feeds that block bot user-agents (Reddit, HN, Lobste.rs)
Quick start
npm install agentic-rss-parser
import Parser from 'agentic-rss-parser';
const parser = new Parser({ timeout: 10000 });
const feed = await parser.parseURL('https://news.ycombinator.com/rss');
for (const item of feed.items) {
console.log(`- ${item.title} — ${item.link}`);
}
Agentic pipeline
Run the full fetch → parse → deduplicate → analyse pipeline with zero API key required, using the built-in heuristic engine:
import { runAgenticParser } from 'agentic-rss-parser';
const { results, feedErrors } = await runAgenticParser({
feedUrls: ['https://news.ycombinator.com/rss'],
dbPath: './data/rss-agent.db'
});
for (const { item, analysis } of results) {
if (analysis.decision === 'relevant') {
console.log(`[${analysis.confidence}%] ${item.title}`);
}
}
Import an OPML list and watch it continuously
New in v1.6.0: import a subscription list and poll it in the background without wiring a timer yourself.
import { parseOpml, createFeedWatcher } from 'agentic-rss-parser';
import { readFileSync } from 'node:fs';
const { feeds } = parseOpml(readFileSync('./subscriptions.opml', 'utf8'));
const watcher = createFeedWatcher({
feedUrls: feeds.map((f) => f.xmlUrl),
intervalMs: 5 * 60_000,
dbPath: './data/rss-agent.db'
});
watcher.on('result', ({ item, analysis }) => {
if (analysis.decision === 'relevant') console.log(item.title);
});
watcher.start();
Security posture
Safe to deploy in security-sensitive environments. The production runtime is intentionally small and auditable:
XXE / Billion Laughs
DOCTYPE and ENTITY declarations are ignored; entity expansion is never performed.
XSS mitigation
<script>, <iframe>, <object>, <embed>, <form> stripped from content snippets.
Prompt injection
Feed content is sanitised — control characters stripped, newlines collapsed — before LLM interpolation.
Response size caps
Feed responses capped at 5 MB; LLM responses capped at 1 MB — enforced by counting bytes as the response streams in, not after buffering the full body.
SSRF & DNS-rebinding protection
Non-HTTP(S) schemes rejected. Private ranges, loopback, link-local, and carrier-grade-NAT addresses blocked on every request and redirect hop — including hostnames that only resolve to a blocked address rather than embedding one literally.
Stack safety
XML is parsed iteratively via a state machine, never recursively — immune to stack overflow attacks.
Requirements
- Node.js ≥ 22.5.0 (required for
node:sqlite) - ESM-only package
- Linux, macOS, Windows
Get involved
Agentic RSS Parser is MIT licensed and developed in the open. Star it, file an issue, or open a pull request.