mcp-scraper@0.79.1
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by static inspection, but its explicit agent setup modifies an AI-client control surface and selects a floating package version. This warrants a warning under the agent-capability policy, not a publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
The user runs mcp-scraper-cli agent install claude --apply with an API key.
Impact
A user-approved setup can make Claude Code launch the latest mcp-scraper release and store its API-key setting.
Mechanism
Replaces the package's Claude MCP registration with an npx command.
AI rationale
The package is not malicious by static inspection, but its explicit agent setup modifies an AI-client control surface and selects a floating package version. This warrants a warning under the agent-capability policy, not a publication block.
Evidence
package.jsondist/bin/mcp-scraper-cli.jsdist/bin/mcp-scraper-install.jsClaude Code user-scope MCP configuration~/.mcp-scraper-key~/Downloads/mcp-scraper
Network endpoints2
mcpscraper.devregistry.npmjs.org/mcp-scraper/latest
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit agent install command can replace the user's Claude Code mcp-scraper entry.
- The replacement config runs mcp-scraper@latest through npx, allowing later releases to be selected.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- The config mutation is reachable only through the documented --apply user command and is restricted to this package's Claude entry.
- The inspected credential use sends an API key only to the configured MCP Scraper API URL during requested CLI operations.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/chunk-NH3EUCZL.jsView file
17162// src/mcp/replay-annotator.ts
L17163: import { execFile } from "child_process";
L17164: import { mkdtemp, rm, stat, writeFile } from "fs/promises";
High
Child Process
Package source references child process execution.
dist/chunk-NH3EUCZL.jsView on unpkg · L17162dist/server-MNSYIX42.jsView file
326import {
L327: createPrivateArtifact,
L328: privateArtifactOwnerId,
...
L575: ctaHeadingItalic: "real data.",
L576: ctaBody: "MCP Scraper gives your AI workflows the web intelligence they need \u2014 SERP data, People Also Ask harvests, page extraction, YouTube transcripts, and more. All via API...
L577: sections: [
...
L838: answer: `<strong>ChatGPT makes things up because its RLHF training consistently rewarded fluent, complete-sounding answers \u2014 and human raters often cannot tell in the moment w...
L839: source: "https://techcrunch.com/2026/05/05/openai-releases-gpt-5-5-instant-a-new-default-model-for-chatgpt/"
L840: }
...
L886: question: "what is the hallucination rate of Claude in 2026",
L887: answer: `<strong>Claude's hallucination rate in 2026 spans from 0% (Claude Opus 4
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
Findings
7 High3 Medium6 Low
HighChild Processdist/chunk-NH3EUCZL.js
HighShell
HighSame File Env Network Executiondist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/server-MNSYIX42.js
HighCredential Redirect Persistencedist/server-MNSYIX42.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighSemantic Analysis Limiteddist/chunk-UFJJGXVO.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptodist/server-MNSYIX42.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to mcp-scraper@0.79.1.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.79.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.