registry / mcp-scraper / 0.73.1
mcp-scraper@0.73.1
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiScanner flags match a large user-invoked MCP web-intelligence product: no install hooks, first-party API traffic, and documented browser and CLI helpers. Dual-use session and agent-config features run only when the user starts those commands, not on npm install.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs an MCP client, mcp-scraper-cli, or the hosted API; npm install does not execute package code.
Impact
No confirmed unconsented credential theft, persistence, or foreign agent hijack.
Mechanism
User-invoked MCP web intelligence tools
AI rationale
Scanner flags match a large user-invoked MCP web-intelligence product: no install hooks, first-party API traffic, and documented browser and CLI helpers. Dual-use session and agent-config features run only when the user starts those commands, not on npm install.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The human CLI can spawn the Claude command to add or replace a user-scope MCP server when the user passes --apply.
- Hosted browser tools can reuse a saved ChatGPT or Claude login and store an account email on the connection record.
- Harvest debug code looks up the egress IP at api64.ipify.org.
- Replay code runs ffmpeg, and Maps navigation can wrap Google URLs through serp-redirector.vercel.app.
- The stdio MCP server sends the user-supplied API key to https://mcpscraper.dev.
- Published bins expose the MCP server, installer, and CLI.
Evidence against
- package.json has no preinstall, install, or postinstall scripts; mcp-scraper-install only prints a banner.
- Agent config writes register this same package and require an explicit CLI command plus API key.
- Browser, Gmail, Nango, and OAuth paths match the documented web-intelligence product, not silent theft.
- Network targets are the product host or named vendors, not a hidden drop box.
- child_process uses are ffmpeg, opening a checkout URL, and the Claude MCP helper.
- Library import only exports harvest and video helpers; it does not run those tools at load time.
Source & flagged code
8 flaggeddist/chunk-G75QXTBE.jsView file
16036// src/mcp/replay-annotator.ts
L16037: import { execFile } from "child_process";
L16038: import { mkdtemp, rm, stat, writeFile } from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-G75QXTBE.jsView on unpkg · L16036dist/server-663CRTGY.jsView file
341import {
L342: isPrivateIpAddress,
L343: loadHtmlDocument,
...
L566: ctaHeadingItalic: "real data.",
L567: ctaBody: "MCP Scraper gives your AI workflows the web intelligence they need \u2014 SERP data, People Also Ask harvests, page extraction, YouTube transcripts, and more. All via API...
L568: sections: [
...
L829: answer: `<strong>ChatGPT makes things up because its RLHF training consistently rewarded fluent, complete-sounding answers \u2014 and human raters often cannot tell in the moment w...
L830: source: "https://techcrunch.com/2026/05/05/openai-releases-gpt-5-5-instant-a-new-default-model-for-chatgpt/"
L831: }
...
L877: question: "what is the hallucination rate of Claude in 2026",
L878: answer: `<strong>Claude's hallucination rate in 2026 spans from 0% (Claude Opus 4.1 on AA-
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
Findings
8 High3 Medium6 Low
HighChild Processdist/chunk-G75QXTBE.js
HighShell
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/server-663CRTGY.js
HighCredential Redirect Persistencedist/server-663CRTGY.js
HighCommand Output Exfiltrationdist/server-663CRTGY.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighSemantic Analysis Limiteddist/chunk-F6MUGMRN.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/server-663CRTGY.js
Affected versions and remediation
This report applies to mcp-scraper@0.73.1.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.73.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.