Skills/npm/alterlab-mcp-server

alterlab-mcp-server@1.13.26

VERIFIED

Publisher claims: "MCP server for web scraping, structured data extraction, and screenshots — give Claude, Cursor, Windsurf, and AI agents the ability to scrape any website with automatic anti-bot bypass" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher rapiercraft · publishing for 278 daysInstalls 11,004Last detonated 1 h ago
$claude mcp add alterlab-mcp-server -- npx -y alterlab-mcp-server
WatchReport an issue

Coverage

Started with a decoy ALTERLAB_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in ALTERLAB_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
ALTERLAB_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
ALTERLAB_API_KEYConfiguration, not credentials: ALTERLAB_API_URL
Where it talks to
alterlab.io (its own)
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with a real credential

Connect it with a scoped credential, under the guard. It asks for ALTERLAB_API_KEY and talks to alterlab.io. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets ALTERLAB_API_KEY=alterlab.io -- npx -y alterlab-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 83/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 48 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
8.2sprocessdependency install exit 0
28sprocessrelaunched with a decoy ALTERLAB_API_KEY (tagged; nothing real)
48sclaimed26 tools with a decoy ALTERLAB_API_KEY: alterlab_scrape, alterlab_extract, alterlab_screenshot, alterlab_get_job, alterlab_estimate_cost, alterlab_check_balance, alterlab_get_usage, alterlab_crawl, alterlab_crawl_status, alterlab_crawl_cancel, alterlab_search, alterlab_map, alterlab_batch_scrape, alterlab_batch, alterlab_batch_status, alterlab_list_sessions, alterlab_create_session, alterlab_get_session, alterlab_update_session, alterlab_refresh_session, alterlab_validate_session, alterlab_delete_session, alterlab_list_beta_features, alterlab_list_my_beta_features, alterlab_enable_beta_feature
48stools3dc8effedf90ae3c
48stoolsae3df4832a0cfc1e
48stoolsd83307d712dd7301
48stools161437b1f68c1d56
48stools32b77106abc3fc03
48stools2a913f5bd76d664b
48stools58148358c69d84f0
48stoolsd426ddfcc20899a4
48stoolsbdeb71aa6fa73294
48stools9e51890c6f751192
48stoolsf02ce14536e85e38
48stools477cfb0d8fa6bdab
48stoolsc9d93e5c456c412d
48stools9aca44f98a90257c
48stools11ec572dfa7d8932
48stoolsd5a2fd2d9b7e7e57
48stoolsce835408a9a9b061
48stoolsc4d031a7128ea5c3
48stools0e4fd8d9a56efc15
48stoolsd64fbb67bf87bb8c
48stools0023747656f0f6f2
48stoolsaec737530c48a771
48stools24ae7b6c6c234b7a
48stoolsec24c1d36f090161
48stoolsc65b5122077ba6c9
48stools37599a7b4082c614
48sprocessscript backend runs setup only
48sprocessno install scripts to re-run

Static findings

HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/alterlab_extract:2 · Instruction aimed at the agent: section addressed to the agenth":2000,"description":"Natural language instructions for LLM extraction (e.g., 'Extract all product prices and ratings')Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/shared/tool-definitions.json:4230 · Process kill command — agent can terminate processes… grant started; an agent cannot lift a pause the user set, and takeover and the kill switch are available only from the user's own dashboard session.", "…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Prompting user to enter sensitive credentialsdist/auth.js:234 · Prompting user to enter sensitive credentials — social engineering" Paste your API key: ",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
npx invocation of non-well-known packagedist/auth.js:373 · npx invocation of non-well-known package — may execute untrusted code" npx -y alterlab-mcp-server",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈86 tok
1 file · 54 in bundle
Tool list per prompt
≈18,158 tok
26 tools · 698 per tool
Handshake
3262 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 409

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for alterlab-mcp-server@1.13.26 as of 25 min ago. This is the package itself, not its dependencies.

alterlab-mcp-server@1.13.26 safety verdict: Verified — KillerSkills