mcp-scraper@0.52.2
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's account-hijack and credential-redirection labels overstate user-invoked, package-aligned behavior. The authenticated-browser and explicit agent-setup features merit a warning as a dangerous capability, not a block.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the MCP server or explicitly invoking CLI/browser tools.
Impact
A user who authorizes an agent to operate a saved browser profile grants that agent broad web-session capability.
Mechanism
User-authorized hosted browser automation and authenticated API requests.
AI rationale
The scanner's account-hijack and credential-redirection labels overstate user-invoked, package-aligned behavior. The authenticated-browser and explicit agent-setup features merit a warning as a dangerous capability, not a block.
Evidence
package.jsondist/bin/mcp-stdio-server.jsdist/bin/mcp-scraper-cli.jsdist/chunk-NWI3G65G.js
Network endpoints2
mcpscraper.devregistry.npmjs.org/mcp-scraper/latest
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/bin/mcp-stdio-server.js reads a supplied API key and sends it to its configured hosted MCP endpoint.
- dist/chunk-NWI3G65G.js exposes hosted-browser tools with saved authenticated profiles and browser actions.
- dist/bin/mcp-scraper-cli.js can invoke the local Claude CLI, but only for explicit `agent install claude --apply`.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The default endpoint is the package-aligned https://mcpscraper.dev, with configurable overrides.
- Profile login requires the user to authenticate in a live browser; existing cookies are explicitly not imported.
- Agent configuration mutation is opt-in, limited to the package's own Claude MCP entry, and includes rollback logic.
- No eval, dynamic payload loading, covert credential harvesting, or unsolicited persistence was confirmed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggeddist/bin/mcp-stdio-server.cjsView file
1369// src/mcp/replay-annotator.ts
L1370: var import_node_child_process = require("child_process");
L1371: var import_promises = require("fs/promises");
High
Child Process
Package source references child process execution.
dist/bin/mcp-stdio-server.cjsView on unpkg · L1369dist/server-H7R3GWWX.jsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/server-H7R3GWWX.js:
isLoopbackBaseUrl,
answer: "<strong>Claude Code is an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools</strong> \u2014 available in...
answer: "<strong>Install via one curl command (`curl -fsSL https://claude.ai/install.sh | bash`), or use Homebrew (`brew install --cask claude-code`) on Mac or WinGet (`winget inst...
answer: "<strong>Yes \u2014 there is no restriction to commercial or professional use</strong>; the Pro plan at $20/month or an Anthropic API key with pay-as-you-go billing both co...
body: "An Anthropic API key unlocks full Claude
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
Findings
7 High3 Medium6 Low
HighChild Processdist/bin/mcp-stdio-server.cjs
HighShell
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/bin/api-server.cjs
HighCredential Redirect Persistencedist/server-H7R3GWWX.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighSemantic Analysis Limiteddist/bin/api-server.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/server-H7R3GWWX.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to mcp-scraper@0.52.2.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.52.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.