Is mcp@4.8.0 safe to install?

mcp@4.8.0

VERIFIED

Publisher claims: "An MCP interface into the Bright Data toolset" Observed in sandbox: calls api.brightdata.com only, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher brightdata · publishing for 585 daysInstalls 73,483Last detonated 4d ago

$claude mcp add mcp -- npx -y @brightdata/mcp

Watch Report an issue

Coverage

Started with a decoy API_TOKEN; tool list observed. Tool calls with a real credential not tested.

Tested: server startup with a tagged decoy in API_TOKEN · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with a real credential
Needs: API_TOKEN — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for: API_TOKENConfiguration, not credentials: BASE_MAX_RETRIES, BASE_TIMEOUT, BROWSER_FILTERED_SNAPSHOT, BROWSER_ZONE, CONTENT_GATE, CONTENT_GATE_PROGRESS_MS, CONTENT_GATE_TIMEOUT, GROUPS, RATE_LIMIT, SERP_ZONE, TOOLS
Where it talks to: brightdata.com (its own)Also chatgpt.com, perplexity.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · reached only api.brightdata.com (its own)
What we could not test: what the tools do when called with a real credential

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names chatgpt.com, perplexity.ai as well as its own vendor. The guard injects API_TOKEN only into requests to brightdata.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets API_TOKEN=brightdata.com -- npx -y @brightdata/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-11 and scored it 89/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: calls api.brightdata.com only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 49 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

8.4sprocessdependency install exit 0

28sprocessrelaunched with a decoy API_TOKEN (tagged; nothing real)

48snetworkCONNECT tcp://api.brightdata.com:443

48sclaimed30 tools with a decoy API_TOKEN: ask_brightdata_assistant, search_engine, scrape_as_markdown, search_engine_batch, scrape_batch, list_dataset_fields, search_dataset, search_scrapers, get_scraper_details, run_scraper, get_scraper_progress, get_scraper_results, refresh_scrapers, session_stats, chatgpt_ai_insights, perplexity_ai_insights, scraping_browser_navigate, scraping_browser_go_back, scraping_browser_go_forward, scraping_browser_snapshot, scraping_browser_click_ref, scraping_browser_type_ref, scraping_browser_screenshot, scraping_browser_network_requests, scraping_browser_wait_for_ref

48sprocessscript backend runs setup only

48sprocessno install scripts to re-run

Static findings

HIGH

Collapsed <details> block carrying instructionsREADME.md:66 · Collapsed <details> block carrying instructions

<summary><b>Claude Desktop</b></summary> 1. Go to: Settings → Connectors → Add custom connector 2. Name: `Bright Data` 3. URL: `https://mcp.brightdata.com/mcp?t