mcp-scraper@0.73.4
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not malicious install-time behavior, but it has an explicit user-command AI-agent configuration capability that warrants a warning under the stated policy. No concrete exfiltration beyond normal authentication to the package service was found.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs mcp-scraper-cli agent install claude --apply with an API key, then starts the MCP client.
Impact
The named Claude Code MCP entry may be replaced and the configured package runs when that client launches.
Mechanism
Explicit user-scope MCP registration and hosted API-key authentication.
AI rationale
This is not malicious install-time behavior, but it has an explicit user-command AI-agent configuration capability that warrants a warning under the stated policy. No concrete exfiltration beyond normal authentication to the package service was found.
Evidence
package.jsondist/bin/mcp-scraper-cli.jsdist/bin/mcp-stdio-server.js
Network endpoints1
mcpscraper.dev
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit agent-install command can remove and add the named MCP server in Claude Code's user scope.
- The registered server receives an API key and runs this package through npx.
- The stdio server reads an API key and sends it to the configured hosted MCP endpoint.
Evidence against
- package.json defines binaries but no npm preinstall, install, or postinstall hook.
- The configuration mutation requires the user to run the CLI with --apply and a supplied API key.
- The default endpoint is the package-aligned mcpscraper.dev host; no stealthy exfiltration or remote code-loading chain was found.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/bin/mcp-scraper-cli.jsView file
19import { Command } from "commander";
L20: import { spawn } from "child_process";
L21: import { mkdir as mkdir2, writeFile } from "fs/promises";
High
Child Process
Package source references child process execution.
dist/bin/mcp-scraper-cli.jsView on unpkg · L19461function apiOptions(opts) {
L462: const apiKey = String(opts.apiKey ?? process.env.MCP_SCRAPER_API_KEY ?? "").trim();
L463: if (!apiKey) throw new Error("MCP_SCRAPER_API_KEY is required. Pass --api-key or set the environment variable.");
L464: return {
L465: apiUrl: String(opts.apiUrl ?? process.env.MCP_SCRAPER_API_URL ?? "https://mcpscraper.dev").replace(/\/$/, ""),
L466: apiKey
...
L472: try {
L473: const child = spawn(command, args, { detached: true, stdio: "ignore" });
L474: child.unref();
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/mcp-scraper-cli.jsView on unpkg · L46119import { Command } from "commander";
L20: import { spawn } from "child_process";
L21: import { mkdir as mkdir2, writeFile } from "fs/promises";
...
L66: }
L67: function parseClaudeMcpGet(stdout) {
L68: const command = stdout.match(/^\s*Command:\s*(.+?)\s*$/m)?.[1];
...
L144: "",
L145: "Desktop Extension: https://mcpscraper.dev/downloads/mcp-scraper.mcpb",
L146: restart
...
L161: async function readKeyFile() {
L162: const path = process.env.MCP_SCRAPER_KEY_PATH?.trim() || join(homedir(), ".mcp-scraper-key");
L163: try {
Findings
7 High3 Medium6 Low
HighChild Processdist/bin/mcp-scraper-cli.js
HighShell
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/server-YZJPP6CB.js
HighCredential Redirect Persistencedist/server-YZJPP6CB.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighSemantic Analysis Limiteddist/chunk-F6MUGMRN.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/server-YZJPP6CB.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to mcp-scraper@0.73.4.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.73.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.