Skills/npm/alterlab-mcp-server

alterlab-mcp-server@1.13.25

VERIFIED

Publisher claims: "MCP server for web scraping, structured data extraction, and screenshots — give Claude, Cursor, Windsurf, and AI agents the ability to scrape any website with automatic anti-bot bypass" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher rapiercraft · publishing for 277 daysInstalls 10,180Last detonated 24 h ago
$claude mcp add alterlab-mcp-server -- npx -y alterlab-mcp-server
WatchReport an issue

Coverage

Started with a decoy ALTERLAB_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in ALTERLAB_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
ALTERLAB_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
ALTERLAB_API_KEYConfiguration, not credentials: ALTERLAB_API_URL
Where it talks to
alterlab.io (its own)
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with a real credential

Connect it with a scoped credential, under the guard. It asks for ALTERLAB_API_KEY and talks to alterlab.io. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets ALTERLAB_API_KEY=alterlab.io -- npx -y alterlab-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 83/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 47 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
6.5sprocessdependency install exit 0
27sprocessrelaunched with a decoy ALTERLAB_API_KEY (tagged; nothing real)
47sclaimed26 tools with a decoy ALTERLAB_API_KEY: alterlab_scrape, alterlab_extract, alterlab_screenshot, alterlab_get_job, alterlab_estimate_cost, alterlab_check_balance, alterlab_get_usage, alterlab_crawl, alterlab_crawl_status, alterlab_crawl_cancel, alterlab_search, alterlab_map, alterlab_batch_scrape, alterlab_batch, alterlab_batch_status, alterlab_list_sessions, alterlab_create_session, alterlab_get_session, alterlab_update_session, alterlab_refresh_session, alterlab_validate_session, alterlab_delete_session, alterlab_list_beta_features, alterlab_list_my_beta_features, alterlab_enable_beta_feature
47stools3dc8effedf90ae3c
47stoolsae3df4832a0cfc1e
47stoolsd83307d712dd7301
47stools161437b1f68c1d56
47stools32b77106abc3fc03
47stools2a913f5bd76d664b
47stools58148358c69d84f0
47stoolsd426ddfcc20899a4
47stoolsbdeb71aa6fa73294
47stools9e51890c6f751192
47stoolsf02ce14536e85e38
47stools477cfb0d8fa6bdab
47stoolsc9d93e5c456c412d
47stools9aca44f98a90257c
47stools11ec572dfa7d8932
47stoolsd5a2fd2d9b7e7e57
47stoolsce835408a9a9b061
47stoolsc4d031a7128ea5c3
47stools0e4fd8d9a56efc15
47stoolsd64fbb67bf87bb8c
47stools0023747656f0f6f2
47stoolsaec737530c48a771
47stools24ae7b6c6c234b7a
47stoolsec24c1d36f090161
47stoolsc65b5122077ba6c9
47stools37599a7b4082c614
47sprocessscript backend runs setup only
47sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagedist/auth.js:373 · npx invocation of non-well-known package — may execute untrusted code" npx -y alterlab-mcp-server",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Prompting user to enter sensitive credentialsdist/auth.js:234 · Prompting user to enter sensitive credentials — social engineering" Paste your API key: ",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/alterlab_extract:2 · Instruction aimed at the agent: section addressed to the agenth":2000,"description":"Natural language instructions for LLM extraction (e.g., 'Extract all product prices and ratings')Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/shared/tool-definitions.json:4226 · Process kill command — agent can terminate processes… grant started; an agent cannot lift a pause the user set, and takeover and the kill switch are available only from the user's own dashboard session.", "…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈86 tok
1 file · 54 in bundle
Tool list per prompt
≈18,158 tok
26 tools · 698 per tool
Handshake
2799 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 409

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for alterlab-mcp-server@1.13.25 as of 24 h ago. This is the package itself, not its dependencies.