Announcing Beacon: Self-improving memory for coding agents
← All MCP servers
MCP server

WebScraping.AI

mcp:webscraping-ai/webscraping-ai-mcp-server

Web scraping tools with Chromium JS rendering, rotating proxies, and AI question answering.

Verdict
Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 26, 2026, 13:27 UTC at 7c7724e

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

0
findings
—
highest severity
0
threat classes
23
files scanned
375/375
checks satisfied
0
package advisories

Why this verdict

  • inconclusive: gap dynamic_metadata at src/index.js

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 3 candidate findings were refuted on review.

Execution chain 500

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 8

WEBSCRAPING_AI_API_KEY
WEBSCRAPING_AI_API_URL
WEBSCRAPING_AI_CONCURRENCY_LIMIT
WEBSCRAPING_AI_DEFAULT_JS_RENDERING
WEBSCRAPING_AI_DEFAULT_JS_TIMEOUT
WEBSCRAPING_AI_DEFAULT_PROXY_TYPE
WEBSCRAPING_AI_DEFAULT_TIMEOUT
WEBSCRAPING_AI_ENABLE_CONTENT_SANDBOXING

GitHub repositories 11

chalk/ansi-styles
chalk/ansi-styles
chalk/chalk
chalk/supports-color
chalk/wrap-ansi
prettier/prettier
sindresorhus/emittery
sindresorhus/execa
webscraping-ai/webscraping-ai-mcp-server
webscraping-ai/webscraping-ai-mcp-server
webscraping-ai/webscraping-ai-mcp-server

Network calls 5

<dynamic>
api.webscraping.ai
src/index.js:15 · url_literal
books.toscrape.com
src/index.js:518 · url_literal
host
src/index.js:246 · url_literal
webscraping.ai
src/index.js:194 · url_literal

Packages 1

npm:webscraping-ai-mcp@1.4.0
server.json:22 · launch:server.json

URLs 475

http://user:password@host:port
https://api.webscraping.ai
https://api.webscraping.ai
https://books.toscrape.com/catalogue/a-light-in-the-attic_1000/index.html
https://dotenvx.com
https://eslint.org/version-support
https://feross.org/support
https://feross.org/support
https://github.com/chalk/ansi-styles?sponsor=1
https://github.com/chalk/ansi-styles?sponsor=1
https://github.com/chalk/chalk?sponsor=1
https://github.com/chalk/supports-color?sponsor=1
https://github.com/chalk/wrap-ansi?sponsor=1
https://github.com/prettier/prettier?sponsor=1
https://github.com/sindresorhus/emittery?sponsor=1
https://github.com/sindresorhus/execa?sponsor=1
https://github.com/sponsors/ai
https://github.com/sponsors/ai
https://github.com/sponsors/ai
https://github.com/sponsors/colinhacks
https://github.com/sponsors/dubzzz
https://github.com/sponsors/epoberezkin
https://github.com/sponsors/epoberezkin
https://github.com/sponsors/epoberezkin
https://github.com/sponsors/express-rate-limit
https://github.com/sponsors/fastify
https://github.com/sponsors/feross
https://github.com/sponsors/feross
https://github.com/sponsors/isaacs
https://github.com/sponsors/isaacs
https://github.com/sponsors/jonschlinkert
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/ljharb
https://github.com/sponsors/nodeca
https://github.com/sponsors/nzakas
https://github.com/sponsors/panva
https://github.com/sponsors/puzrin
https://github.com/sponsors/RubenVerborgh
https://github.com/sponsors/sibiraj-s
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/sponsors/sindresorhus
https://github.com/webscraping-ai/webscraping-ai-mcp-server
https://github.com/webscraping-ai/webscraping-ai-mcp-server.git
https://github.com/webscraping-ai/webscraping-ai-mcp-server/issues
https://mcp.webscraping.ai/mcp
https://opencollective.com/babel
https://opencollective.com/browserslist
https://opencollective.com/browserslist
https://opencollective.com/browserslist
https://opencollective.com/eslint
https://opencollective.com/eslint
https://opencollective.com/eslint
https://opencollective.com/eslint
https://opencollective.com/eslint
https://opencollective.com/eslint
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/express
https://opencollective.com/fast-check
https://opencollective.com/fastify
https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz
https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz
https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz
https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz
https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz
https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz
https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz
https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz
https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz
https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz
https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz
https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz
https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz
https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz
https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz
https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz
https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz
https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz
https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.29.7.tgz
https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz
https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz
https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.29.7.tgz
https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz
https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz
https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz
https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz
https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz
https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz
https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz
https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz
https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.29.7.tgz
https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz
https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz
https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz
https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz
https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz
https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz
https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-2.1.4.tgz
https://registry.npmjs.org/@eslint/js/-/js-8.57.1.tgz
https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.17.tgz
https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.13.0.tgz
https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz
https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.3.tgz
https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz
https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz
https://registry.npmjs.org/@jest/console/-/console-29.7.0.tgz
https://registry.npmjs.org/@jest/core/-/core-29.7.0.tgz
https://registry.npmjs.org/@jest/environment/-/environment-29.7.0.tgz
https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-29.7.0.tgz
https://registry.npmjs.org/@jest/expect/-/expect-29.7.0.tgz
https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-29.7.0.tgz
https://registry.npmjs.org/@jest/globals/-/globals-29.7.0.tgz
https://registry.npmjs.org/@jest/reporters/-/reporters-29.7.0.tgz
https://registry.npmjs.org/@jest/schemas/-/schemas-29.6.3.tgz
https://registry.npmjs.org/@jest/source-map/-/source-map-29.6.3.tgz
https://registry.npmjs.org/@jest/test-result/-/test-result-29.7.0.tgz
https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-29.7.0.tgz
https://registry.npmjs.org/@jest/transform/-/transform-29.7.0.tgz
https://registry.npmjs.org/@jest/types/-/types-29.6.3.tgz
https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz
https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz
https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz
https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz
https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz
https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.2.tgz
https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz
https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz
https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz
https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.12.tgz
https://registry.npmjs.org/@sinonjs/commons/-/commons-3.0.1.tgz
https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-10.3.0.tgz
https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz
https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz
https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz
https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz
https://registry.npmjs.org/@types/graceful-fs/-/graceful-fs-4.1.9.tgz
https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz
https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.3.tgz
https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.4.tgz
https://registry.npmjs.org/@types/node/-/node-26.6.3.tgz
https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz
https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.3.tgz
https://registry.npmjs.org/@types/yargs/-/yargs-17.0.35.tgz
https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz
https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz
https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz
https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz
https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz
https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz
https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz
https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz
https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz
https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz
https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz
https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz
https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz
https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz
https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz
https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz
https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz
https://registry.npmjs.org/axios/-/axios-1.20.0.tgz
https://registry.npmjs.org/babel-jest/-/babel-jest-29.7.0.tgz
https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-6.1.1.tgz
https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-29.6.3.tgz
https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.2.0.tgz
https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-29.6.3.tgz
https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz
https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.26.tgz
https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz
https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz
https://registry.npmjs.org/braces/-/braces-3.0.3.tgz
https://registry.npmjs.org/browserslist/-/browserslist-4.29.1.tgz
https://registry.npmjs.org/bser/-/bser-2.1.1.tgz
https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz
https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz
https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz
https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz
https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz
https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz
https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz
https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001812.tgz
https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz
https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz
https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz
https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.4.3.tgz
https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz
https://registry.npmjs.org/co/-/co-4.6.0.tgz
https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.3.tgz
https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz
https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz
https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz
https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz
https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz
https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz
https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz
https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz
https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz
https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz
https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz
https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz
https://registry.npmjs.org/cors/-/cors-2.8.6.tgz
https://registry.npmjs.org/create-jest/-/create-jest-29.7.0.tgz
https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz
https://registry.npmjs.org/debug/-/debug-4.4.3.tgz
https://registry.npmjs.org/dedent/-/dedent-1.7.2.tgz
https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz
https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz
https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz
https://registry.npmjs.org/depd/-/depd-2.0.0.tgz
https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz
https://registry.npmjs.org/diff-sequences/-/diff-sequences-29.6.3.tgz
https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz
https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz
https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz
https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz
https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.439.tgz
https://registry.npmjs.org/emittery/-/emittery-0.13.1.tgz
https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz
https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz
https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz
https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz
https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz
https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz
https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz
https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz
https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz
https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz
https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz
https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-9.1.2.tgz
https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.2.2.tgz
https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz
https://registry.npmjs.org/eslint/-/eslint-8.57.1.tgz
https://registry.npmjs.org/espree/-/espree-9.6.1.tgz
https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz
https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz
https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz
https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz
https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz
https://registry.npmjs.org/etag/-/etag-1.8.1.tgz
https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz
https://registry.npmjs.org/eventsource-parser/-/eventsource-parser-3.1.1.tgz
https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz
https://registry.npmjs.org/execa/-/execa-5.1.1.tgz
https://registry.npmjs.org/exit/-/exit-0.1.2.tgz
https://registry.npmjs.org/expect/-/expect-29.7.0.tgz
https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.0.tgz
https://registry.npmjs.org/express/-/express-5.2.1.tgz
https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz
https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz
https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz
https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz
https://registry.npmjs.org/fastq/-/fastq-1.20.3.tgz
https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz
https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz
https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz
https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz
https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz
https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz
https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz
https://registry.npmjs.org/flat-cache/-/flat-cache-3.2.0.tgz
https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz
https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz
https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz
https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz
https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz
https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz
https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz
https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz
https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz
https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz
https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz
https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz
https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz
https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz
https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz
https://registry.npmjs.org/glob/-/glob-7.2.3.tgz
https://registry.npmjs.org/globals/-/globals-13.24.0.tgz
https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz
https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz
https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz
https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz
https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz
https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz
https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz
https://registry.npmjs.org/hono/-/hono-4.13.13.tgz
https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz
https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz
https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz
https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz
https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz
https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz
https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz
https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz
https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz
https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz
https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz
https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz
https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz
https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz
https://registry.npmjs.org/is-core-module/-/is-core-module-2.17.0.tgz
https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz
https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz
https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz
https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz
https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz
https://registry.npmjs.org/is-path-inside/-/is-path-inside-3.0.3.tgz
https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz
https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz
https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz
https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz
https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-5.2.1.tgz
https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-6.0.3.tgz
https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz
https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.1.tgz
https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz
https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-29.7.0.tgz
https://registry.npmjs.org/jest-circus/-/jest-circus-29.7.0.tgz
https://registry.npmjs.org/jest-cli/-/jest-cli-29.7.0.tgz
https://registry.npmjs.org/jest-config/-/jest-config-29.7.0.tgz
https://registry.npmjs.org/jest-diff/-/jest-diff-29.7.0.tgz
https://registry.npmjs.org/jest-docblock/-/jest-docblock-29.7.0.tgz
https://registry.npmjs.org/jest-each/-/jest-each-29.7.0.tgz
https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-29.7.0.tgz
https://registry.npmjs.org/jest-get-type/-/jest-get-type-29.6.3.tgz
https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-29.7.0.tgz
https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-29.7.0.tgz
https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-29.7.0.tgz
https://registry.npmjs.org/jest-message-util/-/jest-message-util-29.7.0.tgz
https://registry.npmjs.org/jest-mock-extended/-/jest-mock-extended-4.0.1.tgz
https://registry.npmjs.org/jest-mock/-/jest-mock-29.7.0.tgz
https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz
https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-29.6.3.tgz
https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-29.7.0.tgz
https://registry.npmjs.org/jest-resolve/-/jest-resolve-29.7.0.tgz
https://registry.npmjs.org/jest-runner/-/jest-runner-29.7.0.tgz
https://registry.npmjs.org/jest-runtime/-/jest-runtime-29.7.0.tgz
https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-29.7.0.tgz
https://registry.npmjs.org/jest-util/-/jest-util-29.7.0.tgz
https://registry.npmjs.org/jest-validate/-/jest-validate-29.7.0.tgz
https://registry.npmjs.org/jest-watcher/-/jest-watcher-29.7.0.tgz
https://registry.npmjs.org/jest-worker/-/jest-worker-29.7.0.tgz
https://registry.npmjs.org/jest/-/jest-29.7.0.tgz
https://registry.npmjs.org/jose/-/jose-6.2.12.tgz
https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz
https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz
https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz
https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz
https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz
https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz
https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz
https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz
https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz
https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz
https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz
https://registry.npmjs.org/json5/-/json5-2.2.3.tgz
https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz
https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz
https://registry.npmjs.org/leven/-/leven-3.1.0.tgz
https://registry.npmjs.org/levn/-/levn-0.4.1.tgz
https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz
https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz
https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz
https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz
https://registry.npmjs.org/lodash.isequal/-/lodash.isequal-4.5.0.tgz
https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz
https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz
https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz
https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz
https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz
https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz
https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz
https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz
https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz
https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz
https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz
https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz
https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz
https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz
https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz
https://registry.npmjs.org/ms/-/ms-2.1.3.tgz
https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz
https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz
https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz
https://registry.npmjs.org/node-releases/-/node-releases-2.0.57.tgz
https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz
https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz
https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz
https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz
https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz
https://registry.npmjs.org/once/-/once-1.4.0.tgz
https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz
https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz
https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz
https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz
https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz
https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz
https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz
https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz
https://registry.npmjs.org/p-queue/-/p-queue-8.1.1.tgz
https://registry.npmjs.org/p-timeout/-/p-timeout-6.1.4.tgz
https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz
https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz
https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz
https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz
https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz
https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz
https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz
https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz
https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz
https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz
https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz
https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz
https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz
https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz
https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz
https://registry.npmjs.org/prettier/-/prettier-3.9.9.tgz
https://registry.npmjs.org/pretty-format/-/pretty-format-29.7.0.tgz
https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz
https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz
https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz
https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz
https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz
https://registry.npmjs.org/qs/-/qs-6.16.1.tgz
https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz

Linked repositories 7

GitHub repositories it links to or installs from, and whether their names can be taken over.

chalk/ansi-styles
url · not tracked
chalk/chalk
url · not tracked
chalk/supports-color
url · not tracked
chalk/wrap-ansi
url · not tracked
prettier/prettier
url · not tracked
sindresorhus/emittery
url · not tracked
sindresorhus/execa
url · not tracked
Refuted findings 3

Candidates the review stage examined and rejected, kept for transparency.

Privilege escalation

mediumRefutedlow confidence

The webscraping_ai_serp tool (and webscraping_ai_data) exposes a model-settable disable_content_sandboxing flag that returns raw scraped content without the prompt-injection boundaries, letting an agent or injected instruction weaken the server's own safety control.

Return the raw result without the external-content security boundaries that guard against prompt
Why it was refuted

This is an openly described, opt-in output option. It defaults to off and only a literal true disables sandboxing. It grants no new capability and is not concealed, and nothing instructs the agent to set it.

Privilege escalation

mediumRefutedlow confidence

The webscraping_ai_serp tool (and webscraping_ai_data) exposes an agent-controllable disable_content_sandboxing flag that returns raw third-party content without the prompt-injection security boundaries, letting the model weaken a safety control; it is a disclosed option, not concealed.

if (disable_content_sandboxing === true) return { content: [{ type: 'text', text }] };
Why it was refuted

The strict `=== true` branch is the implementation of the documented opt-in flag. Sandboxing stays on by default, the flag is disclosed in the schema, and no instruction or source-to-sink chain pushes the agent to disable it.

Privilege escalation

mediumRefutedlow confidence

The webscraping_ai_data tool exposes an agent-settable parameter that turns off the prompt-injection security boundaries around scraped third-party content, so a manipulated agent could remove that protection.

Return the raw result without the external-content security boundaries
Why it was refuted

This is the same disclosed, default-off opt-in parameter on the data tool. It adds no privilege and is not hidden, and nothing tells the agent to enable it.

Coverage gaps 6

Parts of the artifact the static analysis could not fully examine.

dynamic_metadata line 254: tool 'webscraping_ai_question' config is computed: toolConfig( 'Ask a Question About a Page', "Scrape a web page and have an LLM answer a question about it, using
src/index.js
dynamic_metadata line 279: tool 'webscraping_ai_fields' config is computed: toolConfig( 'Extract Fields from a Page', "Scrape a web page and have an LLM extract named values from it, using
src/index.js
dynamic_metadata line 303: tool 'webscraping_ai_html' config is computed: toolConfig( 'Get Page HTML', 'Get the full rendered HTML of a web page (with JavaScript execution by default). A
src/index.js
dynamic_metadata line 327: tool 'webscraping_ai_text' config is computed: toolConfig( 'Get Page Text', "Get a web page's main content as Markdown, with boilerplate stripped and structure
src/index.js
dynamic_metadata line 358: tool 'webscraping_ai_selected' config is computed: toolConfig( 'Get Selected Element HTML', 'Get the HTML of the first page element matching a CSS selector. API do
src/index.js
dynamic_metadata line 382: tool 'webscraping_ai_selected_multiple' config is computed: toolConfig( 'Get Multiple Selected Elements HTML', 'Get the HTML of all page elements matching a list of CSS sel
src/index.js