mcp-scraper@0.101.0
Authenticated public client for hosted MCP Scraper tools and REST APIs
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe CLI forwards its service API key to an unrestricted configurable endpoint during workflow artifact ingestion, creating conditional credential exposure. The hosted-service default and user-configurable destination support a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Run a workflow that saves an artifact while MCP_SCRAPER_API_KEY is set.
Impact
A custom endpoint can receive the API key and workflow artifact metadata.
Mechanism
Artifact saving calls the memory-ingest helper, which posts the key in an authentication header to MCP_SCRAPER_BASE_URL or its hosted-service default; the endpoint is not restricted to the service host.
AI rationale
The CLI forwards its service API key to an unrestricted configurable endpoint during workflow artifact ingestion, creating conditional credential exposure. The hosted-service default and user-configurable destination support a warning rather than a block.
Evidence
dist/bin/mcp-scraper-cli.js
Network endpoints1
mcpscraper.dev/memory/mcp-call
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The workflow CLI can send MCP_SCRAPER_API_KEY in a request to a base URL set by MCP_SCRAPER_BASE_URL.
- Saving workflow artifacts invokes the memory-ingest helper, which sends artifact metadata with that request.
- The package exposes the flagged CLI as an npm binary.
Evidence against
- The memory-ingest helper defaults to the package’s hosted service and requires the API key to be present in the environment.
- The request carries artifact metadata and a local artifact path, not the artifact contents.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggeddist/bin/mcp-scraper-cli.jsView file
1#!/usr/bin/env node
L2: import{Command as Fe}from"commander";import{spawn as ye}from"node:child_process";import{mkdir as ze,writeFile as Ze}from"node:fs/promises";import{basename as Qe,join as ge}from"nod...
L3: command = "npx"
High
Child Process
Package source references child process execution.
dist/bin/mcp-scraper-cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import{Command as Fe}from"commander";import{spawn as ye}from"node:child_process";import{mkdir as ze,writeFile as Ze}from"node:fs/promises";import{basename as Qe,join as ge}from"nod...
L3: command = "npx"
...
L10: `):[`# ${n.label} MCP config`,l,n.exactConfig,"",`Continuation: ${n.continuation}`,`Rollback: ${n.rollback}`,...n.restartRequired?["",a]:[]].join(`
L11: `)}import{homedir as $e}from"node:os";import{join as Ee}from"node:path";function k(e){return e?.trim()||process.env.MCP_SCRAPER_OUTPUT_DIR?.trim()||Ee($e(),"Downloads","mcp-scraper...
L12: Fix: ${n.fix}`:"";return`[${r[n.status]}] ${n.label}: ${n.detail}${a}`}),"",`Recommended MCP command: npx ${e.recommendedConfig.args.join(" ")}`].join(`
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/mcp-scraper-cli.jsView on unpkg · L1Findings
7 High3 Medium2 Low
HighChild Processdist/bin/mcp-scraper-cli.js
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighCredential Exfiltrationdist/bin/mcp-scraper-cli.js
HighCommand Output Exfiltrationdist/bin/mcp-scraper-cli.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighTrigger Reachable Credential Exfiltrationdist/bin/mcp-scraper-cli.js
HighTrigger Reachable Command Output Exfiltrationdist/bin/mcp-scraper-cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to mcp-scraper@0.101.0.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.101.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.