mcp-scraper@0.89.5
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe inspected source establishes a real, user-invoked agent and authenticated-browser capability, not an automatic malicious install chain. No lifecycle hook, self-dependency, or confirmed secret exfiltration was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user signs in through browser_profile_connect or runs the CLI agent install command with apply enabled.
Impact
The package can access actions available to a user-authorized browser session; this is a dangerous capability but not a confirmed covert attack.
Mechanism
User-authorized authenticated browser automation and MCP registration.
AI rationale
The inspected source establishes a real, user-invoked agent and authenticated-browser capability, not an automatic malicious install chain. No lifecycle hook, self-dependency, or confirmed secret exfiltration was found.
Evidence
dist/chunk-4A5F7IUA.jsdist/bin/mcp-scraper-cli.js
Network endpoints1
mcpscraper.dev
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The browser-agent workflow creates hosted profiles for logged-in account sessions, including ChatGPT and Claude.
- The user-run CLI has an explicit apply mode that can register its MCP server with Claude Code.
Evidence against
- package.json has no lifecycle scripts or self-dependency.
- The profile flow requires a user sign-in link and an authenticated-status check before opening a saved session.
- No source inspected showed automatic credential harvesting, hidden exfiltration, or install-time configuration changes.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flaggeddist/bin/mcp-scraper-cli.jsView file
1#!/usr/bin/env node
L2: import{b as E,c as N,d as M,e as L,f as T,j as U}from"../chunk-XLWNEVUZ.js";import"../chunk-KJQXUZ4Y.js";import"../chunk-3GP5CYZX.js";import{g as v,j as b,k as D,l as K,m as H}from...
L3: `)){let l=a.match(/^\s{2,}([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);if(!l){if(a.trim().length&&!/^\s{2,}/.test(a))break;continue}p[l[1]]=l[2]}return{command:n,args:i,env:p}}function j(e){le...
High
Child Process
Package source references child process execution.
dist/bin/mcp-scraper-cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import{b as E,c as N,d as M,e as L,f as T,j as U}from"../chunk-XLWNEVUZ.js";import"../chunk-KJQXUZ4Y.js";import"../chunk-3GP5CYZX.js";import{g as v,j as b,k as D,l as K,m as H}from...
L3: `)){let l=a.match(/^\s{2,}([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);if(!l){if(a.trim().length&&!/^\s{2,}/.test(a))break;continue}p[l[1]]=l[2]}return{command:n,args:i,env:p}}function j(e){le...
L4: `):c==="claude"?["# Claude Code command",a,i.exactConfig,"","# One-command Claude Code setup",u,"",`Continuation: ${i.continuation}`,`Rollback: ${i.rollback}`,"",p].join(`
L5: `):c==="claude-desktop"?["# Claude Desktop config",a,i.exactConfig,"","Desktop Extension: https://mcpscraper.dev/downloads/mcp-scraper.mcpb",`Continuation: ${i.continuation}`,`Roll...
L6: `):[`# ${i.label} MCP config`,a,
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/bin/mcp-scraper-cli.jsFindings
3 Critical8 High3 Medium4 Low
CriticalSame File Env Network Executiondist/index.cjs
CriticalCredential Exfiltrationdist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighChild Processdist/bin/mcp-scraper-cli.js
HighBrowser Session Account Hijackdist/server-7TSXB24M.js
HighCredential Redirect Persistencedist/server-7TSXB24M.js
HighCommand Output Exfiltrationdist/chunk-QPWPR5XG.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighTrigger Reachable Command Output Exfiltrationdist/index.cjs
HighSemantic Analysis Limited
Affected versions and remediation
This report applies to mcp-scraper@0.89.5.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.89.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.