registry / mcp-scraper / 0.100.2
mcp-scraper@0.100.2
Authenticated public client for hosted MCP Scraper tools and REST APIs
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found no lifecycle hook or confirmed attack behavior. The flagged credential and network operations are API-client behavior directed to the configured service endpoint, with a package-aligned default.
Static reason
One or more suspicious static signals were detected.
Trigger
A user invokes a CLI command or uses the exported client.
Impact
No unrelated credential recipient or command-output exfiltration was established.
Mechanism
The code sends the supplied API key in request headers to the configured endpoint; defaults point to mcpscraper.dev.
AI rationale
Source inspection found no lifecycle hook or confirmed attack behavior. The flagged credential and network operations are API-client behavior directed to the configured service endpoint, with a package-aligned default.
Network endpoints1
mcpscraper.dev
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines the client entrypoints and commander dependency; it has no lifecycle scripts.
- The CLI sends its API key with API requests to the configured API URL, which defaults to mcpscraper.dev.
- The library client validates its configured HTTP(S) endpoint and sends the API key with MCP requests there.
- The CLI’s memory-ingest helper sends artifact metadata to the configured MCP Scraper base URL.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/bin/mcp-scraper-cli.jsView file
1#!/usr/bin/env node
L2: import{Command as Fe}from"commander";import{spawn as ye}from"node:child_process";import{mkdir as ze,writeFile as Ze}from"node:fs/promises";import{basename as Qe,join as ge}from"nod...
L3: command = "npx"
High
Child Process
Package source references child process execution.
dist/bin/mcp-scraper-cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import{Command as Fe}from"commander";import{spawn as ye}from"node:child_process";import{mkdir as ze,writeFile as Ze}from"node:fs/promises";import{basename as Qe,join as ge}from"nod...
L3: command = "npx"
...
L10: `):[`# ${n.label} MCP config`,l,n.exactConfig,"",`Continuation: ${n.continuation}`,`Rollback: ${n.rollback}`,...n.restartRequired?["",a]:[]].join(`
L11: `)}import{homedir as $e}from"node:os";import{join as Ee}from"node:path";function k(e){return e?.trim()||process.env.MCP_SCRAPER_OUTPUT_DIR?.trim()||Ee($e(),"Downloads","mcp-scraper...
L12: Fix: ${n.fix}`:"";return`[${r[n.status]}] ${n.label}: ${n.detail}${a}`}),"",`Recommended MCP command: npx ${e.recommendedConfig.args.join(" ")}`].join(`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/mcp-scraper-cli.jsView on unpkg · L1Findings
7 High3 Medium2 Low
HighChild Processdist/bin/mcp-scraper-cli.js
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighCredential Exfiltrationdist/bin/mcp-scraper-cli.js
HighCommand Output Exfiltrationdist/bin/mcp-scraper-cli.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighTrigger Reachable Credential Exfiltrationdist/bin/mcp-scraper-cli.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/mcp-scraper-cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to mcp-scraper@0.100.2.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.100.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.