registry / @fouradata/mcp / 0.3.0

@fouradata/mcp@0.3.0

MCP server for the FourA web scraping API — three tools for HTTP requests, rotating proxies, and full browser sessions, usable from any MCP client.

AI Security Review

scanned 22h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A user or MCP client invokes foura_proxy, foura_browser, or foura_auto.

Impact

Dual-use automation can facilitate evasive collection from public websites.

Mechanism

Remote web scraping via FourA API with proxy rotation and browser challenge solving.

Rationale

No concrete malicious chain was found, but the exposed proxy rotation and anti-bot-solving browser capability is dangerous dual-use under the review policy. Warn rather than block because it is explicit, package-aligned runtime behavior with SSRF checks and no lifecycle abuse.

Evidence

package.jsondist/tools/proxy.jsdist/tools/browser.jsdist/tools/auto.jsdist/safe-target.jsdist/auth.jsbin/foura-mcp.jsdist/stdio.jsdist/server.jsdist/resources.jsdist/http.jsdist/tools/single.js

Network endpoints4

api.foura.ai/api/single/api.foura.ai/api/proxy/

@fouradata/mcp@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code