mcp-scraper@0.66.5
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious: no lifecycle hook or covert payload chain was found. It warrants a warning because it can explicitly modify an AI-agent configuration and connect that agent to a hosted MCP service.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs `mcp-scraper-cli agent install claude --apply` with an API key.
Impact
The user-approved command can replace the `mcp-scraper` Claude MCP entry; normal runtime sends requested MCP calls and its API key to the configured service.
Mechanism
Explicit named Claude MCP registration plus authenticated requests to the package service.
AI rationale
This is not malicious: no lifecycle hook or covert payload chain was found. It warrants a warning because it can explicitly modify an AI-agent configuration and connect that agent to a hosted MCP service.
Evidence
package.jsondist/bin/mcp-scraper-cli.jsdist/bin/mcp-stdio-server.js
Network endpoints1
mcpscraper.dev/mcp
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Explicit CLI --apply replaces the named Claude user-scope MCP registration.
- Runtime reads an MCP API key and sends tool calls to its configured service endpoint.
- CLI child-process use is limited to named local commands, including Claude setup and opening URLs.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- Agent configuration mutation requires the explicit `agent install <host> --apply` command.
- The default service host is package-aligned (mcpscraper.dev) and can be overridden by the user.
- No source evidence of credential harvesting, covert exfiltration, remote code loading, or destructive behavior.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
9 flaggeddist/bin/mcp-stdio-server.cjsView file
1979// src/mcp/replay-annotator.ts
L1980: var import_node_child_process = require("child_process");
L1981: var import_promises = require("fs/promises");
High
Child Process
Package source references child process execution.
dist/bin/mcp-stdio-server.cjsView on unpkg · L1979dist/server-LESUYFDI.jsView file
252import {
L253: isPrivateIpAddress,
L254: loadHtmlDocument,
...
L480: ctaHeadingItalic: "real data.",
L481: ctaBody: "MCP Scraper gives your AI workflows the web intelligence they need \u2014 SERP data, People Also Ask harvests, page extraction, YouTube transcripts, and more. All via API...
L482: sections: [
...
L743: answer: `<strong>ChatGPT makes things up because its RLHF training consistently rewarded fluent, complete-sounding answers \u2014 and human raters often cannot tell in the moment w...
L744: source: "https://techcrunch.com/2026/05/05/openai-releases-gpt-5-5-instant-a-new-default-model-for-chatgpt/"
L745: }
...
L791: question: "what is the hallucination rate of Claude in 2026",
L792: answer: `<strong>Claude's hallucination rate in 2026 spans from 0% (Claude Opus 4.1 on AA-
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
Findings
7 High5 Medium6 Low
HighChild Processdist/bin/mcp-stdio-server.cjs
HighShell
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/server-LESUYFDI.js
HighCredential Redirect Persistencedist/server-LESUYFDI.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighSemantic Analysis Limiteddist/chunk-K7Y27ND3.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/bin/api-server.cjs
MediumOversized Cli Entrypointdist/bin/api-server.cjs
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to mcp-scraper@0.66.5.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.66.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.