registry / mcp-scraper / 0.73.5
mcp-scraper@0.73.5
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiHigh scanner labels are noisy product primitives: a user-invoked CLI, a first-party stdio MCP client, and a hosted browser research server. There is no install hook, no self-dependency lifecycle chain, and no concrete unconsented attack path.
Static reason
One or more suspicious static signals were detected.
Trigger
No npm install lifecycle runs package code. Behavior starts only when a user launches an MCP client, CLI, harvest, or API-server command.
Impact
No confirmed secret theft, stealth persistence, remote payload execution, or foreign agent hijack.
Mechanism
User-invoked first-party MCP tools and optional explicit Claude Code registration
AI rationale
High scanner labels are noisy product primitives: a user-invoked CLI, a first-party stdio MCP client, and a hosted browser research server. There is no install hook, no self-dependency lifecycle chain, and no concrete unconsented attack path.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json publishes user-facing bins and has no preinstall, install, or postinstall hooks.
- The human CLI spawns local processes and opens URLs, with a platform check for macOS, Windows, or Linux.
- Explicit mcp-scraper-cli agent install --apply registers only the first-party mcp-scraper server with Claude Code.
- The stdio MCP entry reads the product API key and calls the first-party hosted API.
- The shipped server bundle captures ChatGPT and Claude citation fan-out from a user-opened hosted browser session and allowlists OAuth redirects.
- The harvest driver looks up the current proxy IP through public IP APIs.
Evidence against
- Install does not run package code; mcp-scraper-install only prints a terminal card.
- Agent config mutation is an explicit user command and only upserts mcp-scraper, not a foreign MCP server.
- Network use is the product API at mcpscraper.dev plus documented vendors such as npm, Nango, OpenRouter, and DeepInfra.
- ChatGPT and Claude session reuse is the documented query-fanout research tool, not stealth account takeover.
- The CLI platform check only chooses open, start, or xdg-open for checkout links.
Source & flagged code
8 flaggeddist/bin/mcp-scraper-cli.jsView file
19import { Command } from "commander";
L20: import { spawn } from "child_process";
L21: import { mkdir as mkdir2, writeFile } from "fs/promises";
High
Child Process
Package source references child process execution.
dist/bin/mcp-scraper-cli.jsView on unpkg · L19461function apiOptions(opts) {
L462: const apiKey = String(opts.apiKey ?? process.env.MCP_SCRAPER_API_KEY ?? "").trim();
L463: if (!apiKey) throw new Error("MCP_SCRAPER_API_KEY is required. Pass --api-key or set the environment variable.");
L464: return {
L465: apiUrl: String(opts.apiUrl ?? process.env.MCP_SCRAPER_API_URL ?? "https://mcpscraper.dev").replace(/\/$/, ""),
L466: apiKey
...
L472: try {
L473: const child = spawn(command, args, { detached: true, stdio: "ignore" });
L474: child.unref();
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/bin/mcp-scraper-cli.jsView on unpkg · L46119import { Command } from "commander";
L20: import { spawn } from "child_process";
L21: import { mkdir as mkdir2, writeFile } from "fs/promises";
...
L66: }
L67: function parseClaudeMcpGet(stdout) {
L68: const command = stdout.match(/^\s*Command:\s*(.+?)\s*$/m)?.[1];
...
L144: "",
L145: "Desktop Extension: https://mcpscraper.dev/downloads/mcp-scraper.mcpb",
L146: restart
...
L161: async function readKeyFile() {
L162: const path = process.env.MCP_SCRAPER_KEY_PATH?.trim() || join(homedir(), ".mcp-scraper-key");
L163: try {
Findings
8 High3 Medium6 Low
HighChild Processdist/bin/mcp-scraper-cli.js
HighShell
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/server-RSICBHZK.js
HighCredential Redirect Persistencedist/server-RSICBHZK.js
HighCommand Output Exfiltrationdist/server-RSICBHZK.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighSemantic Analysis Limiteddist/chunk-F6MUGMRN.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/server-RSICBHZK.js
Affected versions and remediation
This report applies to mcp-scraper@0.73.5.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.73.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.