Is mcp@2.19.0 safe to install?

mcp@2.19.0

VERIFIED

Publisher claims: "Zenrows MCP server: Fetch, Extract, Batch, and Browser Sessions for AI agents" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher zenrows · publishing for 247 daysInstalls 6,587Last detonated 6 h ago

$claude mcp add mcp -- npx -y @zenrows/mcp

Watch Report an issue

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

It will ask for: MCP_ORIGIN_SECRETOAUTH_AUTH_SERVERZENROWS_API_KEYConfiguration, not credentials: CLAUDE_CODE_ENTRYPOINT, CLAUDECODE, CODEX_SANDBOX, CODEX_SANDBOX_NETWORK_DISABLED, CODEX_THREAD_ID, CURSOR_TRACE_ID, MCP_SERVER, PROTECTED_RESOURCE_PATH, TERM_PROGRAM, ZENROWS_BROWSER_URL, ZENROWS_CONFIG_HOME, ZENROWS_FETCH_RETRIES, ZENROWS_JS_RENDER, ZENROWS_PREMIUM_PROXY, ZENROWS_RESPONSE_TYPE
Where it talks to: zenrows.com (its own)Also spa.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names spa.com as well as its own vendor. The guard injects MCP_ORIGIN_SECRET, OAUTH_AUTH_SERVER, ZENROWS_API_KEY only into requests to zenrows.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets MCP_ORIGIN_SECRET=zenrows.com,OAUTH_AUTH_SERVER=zenrows.com,ZENROWS_API_KEY=zenrows.com -- npx -y @zenrows/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 83/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 31 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

10sprocessdependency install exit 0

30sclaimed63 tools: account_signup_answer, scrape, extract, prepare_domain, prepared_domain_status, batch_create, batch_status, batch_wait, batch_results, batch_content, batch_list, batch_cancel, batch_pause, batch_resume, batch_rerun, batch_delete, crawl_create, crawl_get, crawl_results, crawl_content, crawl_list, crawl_stop, crawl_wait, crawl_download, account_usage

30stools6647e61a3295765d

30stools281287e1edab6e8e

30stools1a95bb6710adbe26

30stoolsba91ab09c28aad64

30stools8d9e1b7f40106a79

30stoolsfe0aa94d62a07f84

30stools7d1f4e1ef1fcd45c

30stoolsffbf8b819409a066

30stoolsc4a2f67becf7e65c

30stools7a3205e878e83374

30stools114d1a23a60ad250

30stoolsc29a6552eb4841e9

30stools01156242b878605f

30stools9c81b91303ee449a

30stools75bc0fd42b51279e

30stools963cc0c02180efe9

30stools6800aea49dda9716

30stools7c56c6110457b1a3

30stoolsf98c1b54b319f886

30stoolsf2f96759ece84e41

30stoolse93113a69583586f

30stools4f759858ea31c25d

30stools784b0160c806f8e3

30stools61089d84e4f05b9e

30stoolse2398c103a710694

30stools455eefc77462d4c6

30stools8579e0f7f3f898c4

30stoolseca4bbde66d4a381

30stools0cf93096cd733071

30stoolsfe34241a57ef9d47

30stools6c1f031bc3167702

30stools8895d55058dc6078

30stools066cad196d911a73

30stools19b9e2b48a52ffeb

30stools9b772ea8db7baf50

30stools8849c7cc0952d49b

30stools6010d76c02947710

30stools379087b8743bd64a

30stoolsb9cab9e155a66c53

30stools23a07ffb0c56de8c

30stools9ab10e60be612f47

30stools006b87a2f6bc362a

30stools56df38b826727450

30stools2bdc656488c533f5

30stools7f37d609c0d98a84

30stools9b065cf2a804047a

30stoolsa0cec1ad68b04f97

30stools7d7a83b7e414d6a1

30stools428ea59683df204e

30stools26212ceaec694204

30stools5b2c3d597a527abf

30stools8c9a161676a62646

30stools1fc3fbebf4f454d7

30stools8de9d501608c5d4d

30stools09d52d1ff50abb0a

30stools5ef61f0cd6dc922f

30stools1df59b833bb2531c

30stools6d0899613fea138c

30stools07e9ab03b194420c

30stoolsa72160e6618a9298

30stoolsce592a4d6e6dc8fb

30stoolsa1facf4ee635afca

30stoolsbf78034bc03213b5

30sprocessscript backend runs setup only

30sprocessno install scripts to re-run

Static findings

MEDIUM

File permission modification commandpackage.json:13 · File permission modification command — agent changes file ownership/permissions"build": "tsc && chmod +x dist/index.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

Access to sensitive file pathspackage.json:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"dev": "node --env-file=.env --import tsx src/index.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathspackage.json:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"dev:http": "node --env-file=.env --import tsx src/http.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actiondist/http.js:336 · File type combined with upload action — agent may exfiltrate local data filesreturn c.json({ error: "This server does not offer a GET event stream. Use POST." }, 405, { Allow: "POST" });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagedist/http.js:271 · npx invocation of non-well-known package — may execute untrusted code// npx clients default ZENROWS_BROWSER_URL to https://mcp.zenrows.com, so theirFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actiondist/auth/claim-hint.js:103 · File type combined with upload action — agent may exfiltrate local data files// account.json is a local file; never echo a link into tool output unless it is oursFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)dist/http.js:124 · MCP server using network transport (SSE/HTTP) — data sent over networkconst MCP_SERVER = process.env.MCP_SERVER ?? "https://mcp.zenrows.com";Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

Process kill commanddist/auth/claim-refresh.js:100 · Process kill command — agent can terminate processes// Another process may have stored a fresh link meanwhile; minting one would kill it.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

Cost to the agent

Instructions loaded

≈53 tok

1 file · 40 in bundle

Tool list per prompt

≈17,185 tok

63 tools · 273 per tool

Handshake

3124 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 376

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @zenrows/mcp@2.19.0 as of 7d ago. This is the package itself, not its dependencies.