mcp-scraper@0.90.5
Upgrade to mcp-scraper 0.98.0 or newer. Older releases include obsolete local execution code; see the packaged README for hosted-client migration.
MCP server for MCP Scraper web intelligence tools
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThere is no install-time hook, but the documented --apply path deliberately rewrites the Claude Code user MCP entry for this package and places the API key in that registration. That is explicit user-command agent setup, so it is a warning rather than an unconsented install hijack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The operator runs mcp-scraper-cli agent install claude --apply, or the claude-code host alias, with an API key present.
Impact
The existing user-scope mcp-scraper Claude Code entry is replaced and the API key is stored in that client config. Other hosts only receive printed instructions.
Mechanism
The CLI shells out to claude mcp remove and then claude mcp add --scope user, passing npx mcp-scraper and MCP_SCRAPER_API_KEY in the registered environment.
AI rationale
There is no install-time hook, but the documented --apply path deliberately rewrites the Claude Code user MCP entry for this package and places the API key in that registration. That is explicit user-command agent setup, so it is a warning rather than an unconsented install hijack.
Evidence
dist/bin/mcp-scraper-cli.js
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- mcp-scraper-cli agent install only mutates Claude Code when the user passes --apply, and that flag is documented as upserting the user-scope mcp-scraper server.
- On --apply the CLI builds claude arguments mcp add mcp-scraper --scope user and appends the caller API key as --env MCP_SCRAPER_API_KEY.
- The apply path spawns the claude binary to remove any existing mcp-scraper user entry and then add the new npx registration.
- Without --apply, the same command only prints host config text and does not spawn claude.
Evidence against
- package.json has no preinstall, install, or postinstall scripts and does not depend on its own package name.
- The stdio bin only starts the MCP server and does not register a host.
- Workflow files are written under an output directory defaulting to Downloads/mcp-scraper, and API calls use MCP_SCRAPER_API_URL or https://mcpscraper.dev with the product API key.
- Unicode escapes of the identifier kernel are browser-automation option names in the scraper schema, not a hidden loader.
Behavioral surface
ChildProcess
Source & flagged code
13 flaggeddist/chunk-JHMI6HEO.jsView file
1import{c as be}from"./chunk-KJQXUZ4Y.js";import{b as T,l as ve}from"./chunk-2TZBO52D.js";import{a as _e,c as ke,d as X,e as Re,f as Se}from"./chunk-WO3N5FH2.js";function xe(e){retu...
L2: `);return["<section>",`<h2>${I(e.title)}</h2>`,'<div class="table-wrap"><table>',`<thead><tr>${e.columns.map(n=>`<th>${I(n)}</th>`).join("")}</tr></thead>`,`<tbody>${t||`<tr><td co...
High
Child Process
Package source references child process execution.
dist/chunk-JHMI6HEO.jsView on unpkg · L1dist/server-NTIME7TQ.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = mcp-scraper@0.90.4
matchedIdentity = npm:bWNwLXNjcmFwZXI:0.90.4
similarity = 0.885
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/server-NTIME7TQ.jsView on unpkgFindings
4 Critical9 High3 Medium5 Low
CriticalSame File Env Network Executiondist/index.cjs
CriticalCredential Exfiltrationdist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalPrevious Version Dangerous Deltadist/server-NTIME7TQ.js
HighChild Processdist/chunk-JHMI6HEO.js
HighShell
HighBrowser Session Account Hijackdist/server-NTIME7TQ.js
HighCredential Redirect Persistencedist/server-NTIME7TQ.js
HighCommand Output Exfiltrationdist/chunk-M5QHXNFZ.js
HighSandbox Evasion Gated Capabilitydist/bin/mcp-scraper-cli.js
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
Affected versions and remediation
This report applies to mcp-scraper@0.90.5.
See all versions of mcp-scraper for other recorded verdicts.
- Review the evidence and your use of mcp-scraper@0.90.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.