mcp-scraper@0.89.0
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete malicious install-time behavior or secret exfiltration was established by source inspection. The explicit agent configuration mutation and floating runtime package reference are still a meaningful capability risk.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs mcp-scraper-cli agent install claude with --apply.
Impact
The user's Claude Code configuration can be changed to launch the package, and later launches may resolve a newer release.
Mechanism
Explicit Claude Code MCP registration using a floating npx package spec.
AI rationale
No concrete malicious install-time behavior or secret exfiltration was established by source inspection. The explicit agent configuration mutation and floating runtime package reference are still a meaningful capability risk.
Evidence
dist/bin/mcp-scraper-cli.jsdist/server-RFR2A5UJ.js
Network endpoints1
mcpscraper.dev/mcp
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The CLI has an explicit --apply path that changes a Claude Code MCP registration.
- That registration defaults to a floating mcp-scraper@latest package spec.
- The bundled server exposes a configuration template that places an API-key environment reference in an MCP client configuration.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The configuration-changing path requires an explicit CLI command and --apply flag.
- The observed API endpoint is the package's own mcpscraper.dev service; no unrelated credential-exfiltration endpoint was confirmed.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flaggeddist/chunk-PUHFVA7P.jsView file
1272</script>
L1273: </body></html>`}import{z as S}from"zod";var se=S.string().nullable(),Fe=S.record(S.string(),S.unknown()),Of=S.record(S.string(),S.unknown()),Ut={ok:S.boolean().describe("Whether th...
L1274: `)}async function U0(n){let{stdout:t}=await kb("ffprobe",["-v","error","-select_streams","v:0","-show_entries","stream=width,height","-of","json",n],{maxBuffer:1048576}),i=JSON.par...
High
Child Process
Package source references child process execution.
dist/chunk-PUHFVA7P.jsView on unpkg · L12721272</script>
L1273: </body></html>`}import{z as S}from"zod";var se=S.string().nullable(),Fe=S.record(S.string(),S.unknown()),Of=S.record(S.string(),S.unknown()),Ut={ok:S.boolean().describe("Whether th...
L1274: `)}async function U0(n){let{stdout:t}=await kb("ffprobe",["-v","error","-select_streams","v:0","-show_entries","stream=width,height","-of","json",n],{maxBuffer:1048576}),i=JSON.par...
L1275:
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/chunk-PUHFVA7P.jsView on unpkg · L1272dist/server-RFR2A5UJ.jsView file
Findings
3 Critical7 High3 Medium4 Low
CriticalSame File Env Network Executiondist/index.cjs
CriticalCredential Exfiltrationdist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighChild Processdist/chunk-PUHFVA7P.js
HighCredential Redirect Persistencedist/server-RFR2A5UJ.js
HighCommand Output Exfiltrationdist/chunk-PUHFVA7P.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighTrigger Reachable Command Output Exfiltrationdist/index.cjs
HighSemantic Analysis Limiteddist/chunk-QPWPR5XG.js#virtual:normalized:round1
MediumNetwork
Affected versions and remediation
This report applies to mcp-scraper@0.89.0.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.89.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.