mcp-scraper@0.73.6
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a commercial MCP scraper with no npm lifecycle hooks; scanner-flagged network, env, and process use is product-aligned. The remaining issue is an explicit CLI that writes Claude Code MCP config for this same package, which is warn-level agent setup rather than a publish block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs mcp-scraper-cli agent install claude --apply with an API key.
Impact
Later Claude Code sessions start this package over npx with the supplied API key in the MCP environment.
Mechanism
spawn of claude mcp remove and claude mcp add for mcp-scraper
AI rationale
This is a commercial MCP scraper with no npm lifecycle hooks; scanner-flagged network, env, and process use is product-aligned. The remaining issue is an explicit CLI that writes Claude Code MCP config for this same package, which is warn-level agent setup rather than a publish block.
Evidence
dist/bin/mcp-scraper-cli.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The published mcp-scraper-cli command can change Claude Code user-scope MCP config when a user runs agent install claude --apply.
- That apply path spawns the local claude binary to remove and re-add an mcp-scraper server that launches via npx.
Evidence against
- package.json has no preinstall, install, or postinstall scripts.
- Agent config is written only after an explicit --apply command and a required API key, not on npm install or import.
- CLI and stdio traffic use https://mcpscraper.dev with the caller-supplied MCP Scraper API key.
- Scanner child_process and platform checks are ffmpeg/ffprobe replay helpers and checkout URL opening, not a hidden shell payload.
- serp-redirector.vercel.app and ipify/ipwho/ipapi lookups are SERP/harvest geo helpers, not a credential gateway.
- The stdio entry prints an install card in a human terminal and does not rewrite agent config by itself.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
8 flaggeddist/chunk-HCBQHUON.jsView file
16036// src/mcp/replay-annotator.ts
L16037: import { execFile } from "child_process";
L16038: import { mkdtemp, rm, stat, writeFile } from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-HCBQHUON.jsView on unpkg · L16036dist/server-6JEC3JHU.jsView file
341import {
L342: isPrivateIpAddress,
L343: loadHtmlDocument,
...
L566: ctaHeadingItalic: "real data.",
L567: ctaBody: "MCP Scraper gives your AI workflows the web intelligence they need \u2014 SERP data, People Also Ask harvests, page extraction, YouTube transcripts, and more. All via API...
L568: sections: [
...
L829: answer: `<strong>ChatGPT makes things up because its RLHF training consistently rewarded fluent, complete-sounding answers \u2014 and human raters often cannot tell in the moment w...
L830: source: "https://techcrunch.com/2026/05/05/openai-releases-gpt-5-5-instant-a-new-default-model-for-chatgpt/"
L831: }
...
L877: question: "what is the hallucination rate of Claude in 2026",
L878: answer: `<strong>Claude's hallucination rate in 2026 spans from 0% (Claude Opus 4.1 on AA-
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
Findings
8 High3 Medium6 Low
HighChild Processdist/chunk-HCBQHUON.js
HighShell
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/server-6JEC3JHU.js
HighCredential Redirect Persistencedist/server-6JEC3JHU.js
HighCommand Output Exfiltrationdist/server-6JEC3JHU.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighSemantic Analysis Limiteddist/chunk-F6MUGMRN.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/server-6JEC3JHU.js
Affected versions and remediation
This report applies to mcp-scraper@0.73.6.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.73.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.