mcp-scraper@0.89.6
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package is a commercial MCP scraper with no install-time scripts. The remaining risk is user-triggered: the CLI can change Claude Code MCP settings, hosted browsers can keep cookies, and two large bundles were too large to fully parse.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs mcp-scraper-cli agent install with --apply, or an MCP client starts mcp-scraper and uses hosted-browser or SERP tools.
Impact
Local Claude Code MCP wiring can change, and saved browser cookies can be reused in later hosted sessions.
Mechanism
Explicit user-command agent config upsert and hosted browser cookie persistence
AI rationale
This package is a commercial MCP scraper with no install-time scripts. The remaining risk is user-triggered: the CLI can change Claude Code MCP settings, hosted browsers can keep cookies, and two large bundles were too large to fully parse.
Evidence
dist/bin/mcp-scraper-cli.jsdist/server-YVNOU3RK.jsdist/chunk-QPWPR5XG.jsdist/bin/mcp-stdio-server.js
Network endpoints2
mcpscraper.devserp-redirector.vercel.app
Decision evidence
public snapshotAI called this Suspicious at 74.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- A user who runs agent install with --apply can have the CLI upsert the Claude Code user-scope MCP server.
- Hosted browser sessions can save cookies and storage onto a named profile.
- Two large published bundles mix environment access, network calls, and browser control and were not fully parseable in this review.
- SERP collection can send Google search URLs through https://serp-redirector.vercel.app.
- The published stdio server loads review-harvest HTML report code and a Kernel browser HTTP client.
- package.json ships MCP and helper command entrypoints with no npm lifecycle scripts, so remaining risk is after install.
Evidence against
- package.json has no preinstall, install, or postinstall scripts.
- Claude Code config changes only happen when the user passes --apply and an API key.
- The CJS library export is harvest and video generation, not a hidden installer.
- mcp-scraper-install only prints a terminal install card.
- API keys are sent to https://mcpscraper.dev or a caller-set API URL, not a hidden drop host.
Behavioral surface
Source & flagged code
13 flaggeddist/bin/mcp-scraper-cli.jsView file
1#!/usr/bin/env node
L2: import{b as E,c as N,d as M,e as L,f as T,j as U}from"../chunk-XLWNEVUZ.js";import"../chunk-KJQXUZ4Y.js";import"../chunk-3GP5CYZX.js";import{g as v,j as b,k as D,l as K,m as H}from...
L3: `)){let l=a.match(/^\s{2,}([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);if(!l){if(a.trim().length&&!/^\s{2,}/.test(a))break;continue}p[l[1]]=l[2]}return{command:n,args:i,env:p}}function j(e){le...
High
Child Process
Package source references child process execution.
dist/bin/mcp-scraper-cli.jsView on unpkg · L11#!/usr/bin/env node
L2: import{b as E,c as N,d as M,e as L,f as T,j as U}from"../chunk-XLWNEVUZ.js";import"../chunk-KJQXUZ4Y.js";import"../chunk-3GP5CYZX.js";import{g as v,j as b,k as D,l as K,m as H}from...
L3: `)){let l=a.match(/^\s{2,}([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);if(!l){if(a.trim().length&&!/^\s{2,}/.test(a))break;continue}p[l[1]]=l[2]}return{command:n,args:i,env:p}}function j(e){le...
L4: `):c==="claude"?["# Claude Code command",a,i.exactConfig,"","# One-command Claude Code setup",u,"",`Continuation: ${i.continuation}`,`Rollback: ${i.rollback}`,"",p].join(`
L5: `):c==="claude-desktop"?["# Claude Desktop config",a,i.exactConfig,"","Desktop Extension: https://mcpscraper.dev/downloads/mcp-scraper.mcpb",`Continuation: ${i.continuation}`,`Roll...
L6: `):[`# ${i.label} MCP config`,a,
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/bin/mcp-scraper-cli.jsFindings
4 Critical9 High3 Medium5 Low
CriticalSame File Env Network Executiondist/index.cjs
CriticalCredential Exfiltrationdist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/chunk-Z45GM22P.js
HighChild Processdist/bin/mcp-scraper-cli.js
HighShell
HighBrowser Session Account Hijackdist/server-YVNOU3RK.js
HighCredential Redirect Persistencedist/server-YVNOU3RK.js
HighCommand Output Exfiltrationdist/chunk-QPWPR5XG.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
Affected versions and remediation
This report applies to mcp-scraper@0.89.6.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.89.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.