Scrapeless MCP Server

Findings (35)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.15.1: 8 known vulnerabilities

  GHSA-345p-7cg4-v4c7, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-8r9q-7v3j-jr4g +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.8.4: 32 known vulnerabilities

  GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3 +27 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.0: 6 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-wqch-xfxh-vrr4, GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  defu@6.1.4: 2 known vulnerabilities

  GHSA-737v-mqg7-c878, GHSA-737v-mqg7-c878

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  extract-zip@2.0.1: 4 known vulnerabilities

  GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv, GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@9.0.5: 12 known vulnerabilities

  GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +7 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  jsondiffpatch@0.6.0: 4 known vulnerabilities

  GHSA-33vc-wfww-vjfv, GHSA-j4fx-xxwh-2485, GHSA-33vc-wfww-vjfv, GHSA-j4fx-xxwh-2485

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.11: 6 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w, GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@5.1.5: 6 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w, GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@8.2.0: 4 known vulnerabilities

  GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f, GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@4.0.2: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  tar-fs@3.1.0: 2 known vulnerabilities

  GHSA-vj76-c3g6-qr5v, GHSA-vj76-c3g6-qr5v

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@11.1.0: 2 known vulnerabilities

  GHSA-w5hq-g745-h8pq, GHSA-w5hq-g745-h8pq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@8.18.3: 4 known vulnerabilities

  GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.74: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.16.0: 8 known vulnerabilities

  GHSA-345p-7cg4-v4c7, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-8r9q-7v3j-jr4g +3 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.10.0: 32 known vulnerabilities

  GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3 +27 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  form-data@4.0.4: 1 known vulnerability

  GHSA-hmw2-7cc7-3qxx

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@4.0.3: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Install contacted hosts other than package registries

  34.9.16.104.in-addr.arpa
• lowLow. Minor, or common in normal tools. Shown for information.
  @ai-sdk/provider-utils@2.2.8: 2 known vulnerabilities

  GHSA-866g-f22w-33x8, GHSA-866g-f22w-33x8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  agents@0.0.101: 6 known vulnerabilities

  GHSA-cvhv-6xm6-c3v4, GHSA-r7x9-8ph7-w8cg, GHSA-w5cr-2qhr-jqc5, GHSA-cvhv-6xm6-c3v4, GHSA-r7x9-8ph7-w8cg +1 more

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ai@4.3.17: 1 known vulnerability

  GHSA-rwvc-j5jr-mgvh

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ajv@6.12.6: 2 known vulnerabilities

  GHSA-2g4f-4pwh-qvx6, GHSA-2g4f-4pwh-qvx6

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  diff@8.0.2: 2 known vulnerabilities

  GHSA-73rr-hh4g-fpgx, GHSA-73rr-hh4g-fpgx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  follow-redirects@1.15.9: 2 known vulnerabilities

  GHSA-r4q5-vmmm-2653, GHSA-r4q5-vmmm-2653

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  moment@2.30.1: 2 known vulnerabilities

  GHSA-4p3w-j4w9-5jqw, GHSA-4p3w-j4w9-5jqw

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.14.0: 10 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883 +5 more

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  yaml@2.8.0: 2 known vulnerabilities

  GHSA-48c2-rrv3-qjmp, GHSA-48c2-rrv3-qjmp

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ai@4.3.19: 1 known vulnerability

  GHSA-rwvc-j5jr-mgvh

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  SCRAPELESS_KEY, SCRAPELESS_BASE_URL, SCRAPELESS_IS_ONLINE, BROWSER_SESSION_TTL, BROWSER_PROFILE_ID, BROWSER_PROFILE_PERSIST

Network activity

Tools exposed (25)

• ai_scraper

  Create an AI Scraper task for an explicit Scrapeless actor, then poll every 5 seconds until the answer is ready or the timeout is reached. Supports ChatGPT, Gemini, Perplexity, Copilot, Google AI Mode, Google AI Overview, Grok, and Alexa. Defaults to a 3 minute timeout. The timeout can be se

• crawl_cancel

  Cancel an in-progress crawl job by its id (the id returned by crawl_start). Returns the cancelled status.

• crawl_result

  Fetch the result of a crawl job by its id (the id returned by crawl_start). Polls the job status until it reaches a terminal state (completed / failed / cancelled) or the timeout is reached. If the timeout is reached before the job finishes, the latest status is returned along with the job i

• crawl_start

  Start an asynchronous crawl job. Crawls a website starting from a base URL, following links according to the provided options, and captures page content in various formats (markdown, html, links, screenshot, etc.). Returns a job id that can be used with crawl_result to fetch results and crawl_ca

• google_search

  Universal Information Search Engine.Retrieves any data information; Explanatory queries (why, how).Comparative analysis requests

• google_trends

  Get trending search data from Google Trends. Restrictions: Activated for queries about trends, popularity, or interest over time. Valid: Find the search interest for "AI" over the last year. Invalid: A general question like "What is AI?" (use google_search).

• scrape_html

  Scrape a URL and return its full HTML content. Restrictions: Activated for URLs that require JavaScript rendering or bot protection. Valid: Get HTML from a dynamic, JS-heavy single-page application. Invalid: Fetching a simple static page (use a standard HTTP client).

• scrape_markdown

  Scrape a URL and return its content as Markdown. Restrictions: Best for articles, blog posts, and other text-heavy pages. Valid: Scrape a news article to get its readable content. Invalid: Scrape a complex web application dashboard.

• scrape_screenshot

  Capture a high-quality screenshot of any webpage. Restrictions: Bypasses bot detection and CAPTCHAs using residential proxies. Valid: Get a screenshot of a price-checker page protected by Cloudflare. Invalid: Taking a screenshot of the local browser (use browser_screenshot)

• browser_click

  Click a specific element on the page. Restrictions: Requires a valid CSS selector for the target element. Valid: Click the button with selector "#submit-button". Invalid: Click "the login button" without providing a selector.

• browser_close

  Closes the current session by disconnecting the cloud browser. This will terminate the recording for the session.

• browser_create

  Create or reuse a cloud browser session using Scrapeless. Updates the active session.

• browser_get_html

  Get the full HTML of the current page. Restrictions: Returns the entire raw HTML source code. Valid: Get the HTML of the current page to parse its structure. Invalid: Get only the visible text (use "browser_get_text")

• browser_get_text

  Get all visible text from the current page. Restrictions: Extracts only text content, ignoring HTML tags. Valid: Get the text content of the current page for summarization. Invalid: Get the page's HTML structure (use "browser_get_html")

• browser_go_back

  Go back one step in browser history. Restrictions: Only works if a previous page exists in the session history. Valid: After navigating from page A to B, go back to A. Invalid: Attempting to go back on the first page of a session.

• browser_go_forward

  Go forward one step in browser history. Restrictions: Only works after a "go_back" action has been performed. Valid: After going back from page B to A, go forward to B. Invalid: Attempting to go forward without a preceding "go_back" action.

• browser_goto

  Navigate browser to a specified URL. Restrictions: Only for direct URL navigation, not for searches. Valid: Go to https://google.com. Invalid: Search for "cats" on Google (use google_search).

• browser_press_key

  Simulate a key press. Restrictions: Must specify a valid key name; optional target selector. Valid: Press Enter in #search. Invalid: Press a key without specifying the key name.

• browser_screenshot

  Capture a screenshot of the current page. Restrictions: Can capture either the full page or the visible viewport. Valid: Take a screenshot of the current browser view. Invalid: Capture a screenshot of a specific element (not supported).

• browser_scroll

  Scroll the current page to a specific position. Restrictions: Requires pixel coordinates for scrolling. Valid: Scroll to the bottom of the page (e.g., { x: 0, y: 10000 }). Invalid: Scroll to "the top" without specifying coordinates.

• browser_scroll_to

  Scroll a specific element into view. Restrictions: Requires a valid CSS selector for the target element. Valid: Scroll to the element "#footer". Invalid: Scroll to the bottom of the page (use "browser_scroll").

• browser_snapshot

  Capture the complete structure of a webpage, including DOM and resources, for inspection and analysis.

• browser_type

  Type text into a specified input field. Restrictions: Requires a CSS selector for an input/textarea and the text to type. Valid: Type "hello world" into input "[name='q']". Invalid: Type "hello world" without specifying a target field.

• browser_wait

  Pause execution for a fixed duration. Restrictions: Requires a duration in milliseconds. Should be used sparingly. Valid: Wait for 2000 milliseconds. Invalid: Wait for a page to finish loading (use "browser_wait_for")

• browser_wait_for

  Wait for a specific page element to appear. Restrictions: Requires a valid CSS selector for the element to wait for. Valid: Wait for the element "#results" to become visible. Invalid: Wait for "the results to load" without a selector.