MCP, MCP server
WebReaper
AI-native web scraper.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
.agents/skills/tdd/mocking.md, line 44
getUser: (id) => fetch(`/users/${id}`),
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Pass
No shell or command execution found, and no extra permission was declared.
Install and update
Note
README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.
INSTALL_DOCUMENTED_INSTALLER
README.md, line 24
curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh
WebReaper.Cli/skill/SKILL.md, line 219
`curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh`
WebReaper.Cli/UpdateNotifier.cs, line 21
"curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh -s -- --upgrade";
Show more
docs/AI-ONBOARDING.md, line 29
curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh
docs/adr/0070-cli-distribution-channels.md, line 85
curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh
scripts/install.sh, line 5
# curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh
scripts/install.sh, line 7
# curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh -s -- --force
scripts/install.sh, line 65
# curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh
website/content/docs/getting-started.mdx, line 19
curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh
website/content/docs/installation.mdx, line 28
curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh
website/content/docs/installation.mdx, line 34
curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh -s -- --upgrade
website/lib/site.ts, line 11
curl: "curl -fsSL https://raw.githubusercontent.com/alex-on-ai/WebReaper/master/scripts/install.sh | sh",
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
.agents/skills/tdd/mocking.md, line 44
getUser: (id) => fetch(`/users/${id}`),
.agents/skills/tdd/mocking.md, line 45
getOrders: (userId) => fetch(`/users/${userId}/orders`),
.agents/skills/tdd/mocking.md, line 46
createOrder: (data) => fetch('/orders', { method: 'POST', body: data }),
Show more
.agents/skills/tdd/mocking.md, line 51
fetch: (endpoint, options) => fetch(endpoint, options),
WebReaper.Cdp/CdpPageLoadTransport.cs, line 15
/// WebSocket (either BYO via <c>WithCdpPageLoader(cdpUrl)</c> or a
website/app/api/playground/scrape/route.ts, line 44
upstream = await fetch(upstreamUrl, {
website/app/api/playground/tier-b/scrape/route.ts, line 60
upstream = await fetch(upstreamUrl, {
website/components/playground/waitlist-nudge.tsx, line 25
const res = await fetch("/api/checkout", {
website/components/pricing/pricing-table.tsx, line 200
const res = await fetch("/api/checkout", {
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
.agents/skills/tdd/mocking.md, line 32
const client = new StripeClient(process.env.STRIPE_KEY);
cloud/README.md, line 51
Then set the matching values in the Vercel project (see `website/.env.example`):
website/.env.example, line 2
# Copy to .env.local for local dev, or set in the Vercel project settings.
Show more
website/.gitignore, line 33
# env files (can opt-in for committing if needed)
website/.gitignore, line 36
!.env.example
website/lib/billing.ts, line 44
* .env.example for the env vars.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read. the file cap was reached before every file was read.
OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED
Examples/WebReaper.ScraperWorkerService/logs/log20230417.txt, line 1
2023-04-17 19:30:48.468 +03:00 [INF] Start ScraperEngine.RunAsync
WebReaper.Stealth.CloakBrowser/CloakBrowserBuilderExtensions.cs, line 1
using Microsoft.Extensions.Logging;
Licence
Pass
A licence file is present (LICENSE.txt).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit c32d196e2e46. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.
Date and source
Date checked:
github.com
Commit graded: c32d196e2e46d0443af7f8d71e8b4695b8b28249
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.