Cn Scraper Mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  requests shell access. No manifest field names shell or command execution.

  PERMISSION_SHELL_UNDECLARED

  scripts/mcp_smoke_test.py, line 135

  proc = subprocess.Popen(

  scripts/release.py, line 90

  result = subprocess.run(

  src/cn_scraper_mcp/diagnostics.py, line 91

  completed = subprocess.run(

  Show more

  src/cn_scraper_mcp/engines/cdp.py, line 28

  launch_chrome() and launch_obscura() return the subprocess.Popen

  src/cn_scraper_mcp/engines/cdp.py, line 258

  _managed_processes: dict[int, subprocess.Popen] = {}

  src/cn_scraper_mcp/engines/cdp.py, line 266

  def _register_process(port: int, proc: subprocess.Popen) -> None:

  src/cn_scraper_mcp/engines/cdp.py, line 428

  ) -> subprocess.Popen | None:

  src/cn_scraper_mcp/engines/cdp.py, line 438

  subprocess.Popen handle on success, or None if Chrome didn't

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  scripts/platform_health.py, line 621

  resp = urllib.request.urlopen(req, timeout=probe["timeout"])

  scripts/platform_health.py, line 747

  resp = urllib.request.urlopen(url, timeout=2)

  scripts/release.py, line 348

  with urllib.request.urlopen(request, timeout=15) as response:

  Show more

  src/cn_scraper_mcp/http.py, line 329

  resp = urllib.request.urlopen(req, timeout=self.timeout)

  src/cn_scraper_mcp/engines/cdp.py, line 73

  resp = urllib.request.urlopen(u, timeout=5)

  src/cn_scraper_mcp/engines/cdp.py, line 287

  urllib.request.urlopen(f"http://127.0.0.1:{port}/json/version", timeout=1)

  src/cn_scraper_mcp/engines/cdp.py, line 417

  urllib.request.urlopen(f"http://127.0.0.1:{port}/json/version", timeout=2)

  src/cn_scraper_mcp/engines/xiaohongshu.py, line 5

  - Guest curl → ~9KB shell titled "你访问的页面不见了", empty __INITIAL_STATE__

  src/cn_scraper_mcp/engines/zhihu.py, line 32

  - Guest: curl with mobile UA (limited results, no logged-in content)

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_DOTENV

  src/cn_scraper_mcp/__init__.py, line 7

  # ── auto-load .env if python-dotenv is installed ──────────

  src/cn_scraper_mcp/__init__.py, line 10

  """Try to load .env file from project root (optional dependency)."""

  src/cn_scraper_mcp/__init__.py, line 16

  # Look for .env in: project root (dev install) or cwd

  Show more

  src/cn_scraper_mcp/__init__.py, line 18

  candidates = [root / ".env", Path.cwd() / ".env"]

  .dockerignore, line 35

  # Environment

  .dockerignore, line 36

  .env

  .env.example, line 2

  # Copy this to .env and fill in your paths.

  .env.example, line 3

  # .env is gitignored - never committed.

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit f878f78f844e. requests shell access. No manifest field names shell or command execution. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked: 27 Oct 2026

Read how this letter is chosen