Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.77777R7/octocrawl

NPM · @OCTOCRAWL/MCP · 3 COMPONENTS

Web scraper for agents: blocked, empty and wrong pages reported as such, with an Evidence Record.

72 Trust /100

Last scanned (9 hours ago)

Scores higher than 41% of npm servers

Category Web Scraping

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to 77777R7/Octocrawl). View diagnostics → Pass
  • Clear OSI-approved license (AGPL-3.0-only).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability39
  • AI-judged instruction clarity (fair).Partial
  • Context-footprint check failed: tool/resource definitions use about 12282 tokens (~323/item across 38 items; 38 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
  • Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage87
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 55% of tool parameters carry a description.Partial
  • Structured output schemas are declared (3% of tools); any adoption earns full credit.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "remove_login" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 38 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 16 Oct 26 +1
    • Tool safety: pass → unverified ▼ security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • Tool coverage: 100 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Stability: unverified → 0.07 ▲ functional
    • Package version: 0.4.2 → 0.5.0 functional
  • 14 Oct 26 +33
    • Injection markers: unverified → pass ▲ security
    • Known CVEs: unverified → pass ▲ security
    • First check of Judged manipulation: pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • Tool coverage: unverified → 100 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • Dependency health: unverified → 0.84 ▲ functional
    • First check of Schema quality: fail functional
    • First check of Schema quality: fair functional
    • First check of Tool coverage: 55 functional
    • First check of Schema quality: fail functional
    • First check of Destructive annotations: 0 functional
    • First check of Tool coverage: 3 functional
  • 13 Oct 26 −11
    • Known CVEs: pass → unverified ▼ security
    • Security disclosure: unverified → fail ▼ functional
    • Dependency health: 0.84 → unverified ▼ functional
    • Package version: 0.4.1 → 0.4.2 functional
  • 12 Oct 26 49

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 16 Oct 2026 · Analysed npm/@octocrawl/mcp@0.5.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo 77777R7/Octocrawl
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/77777R7/Octocrawl/.github/workflows/release.yml@refs/tags/v0.5.0
Rekor log index 3282927995
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:a8e6111ff76ebf30926e657971b213fe45004ab0e4aed32018ee9d0c86bf68824ed609bcb8316279a2af096293da773e4c67367b12bec9e2038408c92

Background: How many MCP packages publish verified provenance →

Dependencies 92 packages
Packages resolved 92
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 38 exposed · ~12,282 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
batch_products ~43

Queue 1-1000 distinct Amazon.sg product URLs with the reviewed JSON schema. Returns taskId; page results with get_batch_items.

NameTypeReqDescription
urlsarrayyes–

No output schema declared.

No examples provided.

batch_scrape ~3,108

Persist and run 1-1000 explicit URLs. Returns a taskId (with ignoreInvalidURLs also invalidURLs, the entries skipped); use get_batch_items for paginated results and get_batch_errors for the URLs that failed or that robots.txt refused. With appendToId the urls are added to that existing batch instead (the answer carries requested and appended); with idempotencyKey a retried call returns the first call's answer (replayed: true) instead of a second job.

NameTypeReqDescription
accessstring–How the pages are reached, as three plain choices; ask the person which they want when it matters. standard: Octocrawl's own fetching and its local browser, nothing that costs a third party. enhanced…
actionsarray–Steps the local browser runs on the page after it loads and before it is read, in order (Firecrawl's actions): wait {milliseconds | selector}, click {selector, all?}, write {text} (into the focused e…
allowExternalLinksboolean–Accepted as false only, which already holds: a batch fetches the URLs given and follows no link. true is refused by name; a crawl takes allowExternalLinks, and extraction across links is the M5 multi…
appendToIdstring–Add urls to this existing batch instead of starting a new job: the job keeps its mode, formats, includeLinks, maxConcurrency and page options (sending one is refused by name), and the answer carries…
blockAdsboolean–Abort requests to a bundled list of ad-serving hosts on the browser lane and remove ad and cookie-banner elements before extraction. Default true; false keeps them.
excludeTagsarray–CSS selectors removed, with everything inside them, from the main content, the whole page (onlyMainContent false) and an includeTags selection. The same selectors and limit as includeTags.
fastModeboolean–http lane only, no browser escalation: a page that needs script execution returns the http lane's verdict (a shell is failed/empty_unverified, never rendered). Default false.
formatsarray–What to return. html is the cleaned HTML the Markdown is written from (the main content, the whole page when onlyMainContent is false, or the includeTags selection). rawHtml is the page as received:…
headersobject–Extra request headers sent to the requested origin (the page, its same-origin hops and the files it loads from that origin) after Octocrawl's declared identity, and recorded in the trace: accept, acc…
idempotencyKeystring–A client-chosen key (1 to 200 characters): a retried call with the same key and the same arguments returns the first call's taskId with replayed: true instead of starting a second job; the same key w…
ignoreInvalidURLsboolean–Start with the entries of urls that are http(s) URLs and report the rest as invalidURLs (on the answer and on get_batch) instead of refusing the batch. Default false: an entry that is not a URL is re…
includeLinksboolean––
includeSubdomainsboolean–Accepted as false only, which already holds: a batch fetches the URLs given and follows no link. true is refused by name; a crawl takes allowSubdomains.
includeTagsarray–CSS selectors naming the only elements to keep: the content is those elements in document order (a named navigation included), whatever onlyMainContent says. Nothing matching is an empty answer. Tag,…
integrationstring–Your own label for the integration or workflow this request belongs to (1 to 100 printable characters, no spaces). Stored in Octocrawl's records (the scrape record, the task status), never sent to th…
lanestring–On a server running on the person's machine: read every page in the person's own Chrome, one at a time, instead of fetching it (lane my_browser, never cached). The person clicks Allow in Chrome, then…
lockdownboolean–Cache only: answer from a stored result and never fetch the page; one with none is failed with cache_miss. A crawl in lockdown needs sitemap "skip".
maxAgeinteger–Reuse a stored result of this page fetched at most this many milliseconds ago with the same options, instead of fetching it. Default 0: nothing is reused, the page is fetched live. A reused result sa…
maxConcurrencyinteger–Pages of this batch in flight at once; the per-host ceiling still applies. Only lowers the service's worker count; omitted takes it.
maxFileBytesinteger–Largest file (PDF, CSV, XLSX, ZIP, JSON, text) to download, in bytes, below the server's own cap (W2L_MAX_FILE_BYTES, default 50 MiB). A larger file is failed with body_too_large and not saved.
minAgeinteger–Reuse only a stored result at least this many milliseconds old (at most maxAge; without maxAge, any age from this one on).
mobileboolean–Fetch as a declared mobile Chrome identity (Android UA, mobile client hints, 412x915 viewport). Default false.
modestring–authed reads the page with the login the person saved for its site (import_login), signed in as them: ask the person first, naming the site. Not with executeJavascript or a webhook: a script could re…
onlyMainContentboolean–false returns the whole page (header, navigation and footer kept) instead of the main content. Default true.
removeBase64Imagesboolean–Leave an image whose src is a data: URI out of the Markdown, keeping its alt text (default true, Firecrawl's default). false keeps it as ![alt](data:…), which contentTokens then counts. html and rawH…
robotsOverridesarray–Recorded robots overrides, each for one URL of urls (see robotsOverride on scrape).
skipTlsVerificationboolean–Local only: load a site with an invalid or self-signed certificate; recorded in the trace and a tls_unverified warning; refused in hosted mode.
storeInCacheboolean–Store this page's result for later reuse when it succeeds. Default true, except for a request with custom headers, which stores only with true (the stored trace keeps their values); mode authed never…
timeoutinteger–Deadline in milliseconds for the whole scrape (per page for crawl and batch). When it fires the result is partial with the content so far, or failed/timeout. Default 300000.
urlsarrayyes–
verifyobject–A task contract: the configured checks, judged after the fetch into the answer's verification (passed, failed with the checks that failed and why, or not_requested); status stays the fetch's. markdow…
waitForinteger–Milliseconds the browser waits after load before capture. Starts at the browser rung and counts toward timeout. Default 0.
webhook––Where the job posts its events as durable, retried deliveries: a URL string, or { url, headers, metadata, events, secretEnv }. Events: started (sequence 0), one page per page recorded (the page as ge…

No output schema declared.

No examples provided.

cancel_batch ~24

cancel_batch for a persistent URL-array batch

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

cancel_crawl ~27

Cancel a crawl task. Completed pages remain queryable.

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

cancel_monitor_run ~34

Explicitly cancel a queued or running Monitor run.

NameTypeReqDescription
idstringyes–
runIdstringyes–

No output schema declared.

No examples provided.

crawl ~2,945

Start a multi-page crawl. Returns { taskId } (HTTP 202 equivalent). By default it follows links in the start URL's path subtree on its host and www twin, folds similar URLs into one page, and reports every collapsed or refused link in get_crawl's discovery counters and each page's links_offered trace event (get_crawl_pages with debug).

NameTypeReqDescription
accessstring–How the pages are reached: standard is Octocrawl's own fetching and its local browser, nothing that costs a third party; enhanced also uses the paid providers the server's operator approved (an acces…
allowExternalLinksboolean–Follow links to any host, each with its own robots.txt read; maxDepth and maxPages bound the walk. Default false. Cannot be combined with allowlistedDomains.
allowSubdomainsboolean–Follow links to every host under the start URL's apex (the host with one leading www. removed; no public-suffix list, so a seed on www.gov.uk admits every *.gov.uk host). Default false. Each new host…
allowlistedDomainsarray––
blockAdsboolean–Abort requests to a bundled list of ad-serving hosts on the browser lane and remove ad and cookie-banner elements before extraction. Default true; false keeps them.
crawlEntireDomainboolean–Follow links anywhere on the start URL's host. Default false: links on that host are followed only inside the start URL's path subtree (its directory, or the directory of the file it names); the rest…
deduplicateSimilarURLsboolean–Treat /a and /a/, / and /index.html, www and apex, http and https as one page: the first variant seen is fetched, later ones are reported as collapsed. Default true. A page fetched and then found to…
excludePathsarray–Pathname regexes that skip a discovered link; they win over includePaths.
excludeTagsarray–CSS selectors removed, with everything inside them, from the main content, the whole page (onlyMainContent false) and an includeTags selection. The same selectors and limit as includeTags.
fastModeboolean–http lane only, no browser escalation: a page that needs script execution returns the http lane's verdict (a shell is failed/empty_unverified, never rendered). Default false.
formatsarray–What to return. html is the cleaned HTML the Markdown is written from (the main content, the whole page when onlyMainContent is false, or the includeTags selection). rawHtml is the page as received:…
headersobject–Extra request headers sent to the requested origin (the page, its same-origin hops and the files it loads from that origin) after Octocrawl's declared identity, and recorded in the trace: accept, acc…
idempotencyKeystring–A client-chosen key (1 to 200 characters): a retried call with the same key and the same arguments returns the first call's taskId with replayed: true instead of starting a second job; the same key w…
ignoreQueryParametersboolean–Treat URLs that differ only in their query string as one page: the first variant seen is fetched, later ones are reported as collapsed in the page's links_offered trace event and the report's discove…
ignoreRobotsTxtboolean–Fetch the pages and sitemap files robots.txt disallows, or whose robots.txt could not be read. robots.txt is still read for every host and its verdict recorded, Crawl-delay applied; each page fetched…
includeLinksboolean––
includePathsarray–Pathname regexes a discovered link must match; the start URL is always fetched.
includeTagsarray–CSS selectors naming the only elements to keep: the content is those elements in document order (a named navigation included), whatever onlyMainContent says. Nothing matching is an empty answer. Tag,…
integrationstring–Your own label for the integration or workflow this request belongs to (1 to 100 printable characters, no spaces). Stored in Octocrawl's records (the scrape record, the task status), never sent to th…
lockdownboolean–Cache only: answer from a stored result and never fetch the page; one with none is failed with cache_miss. A crawl in lockdown needs sitemap "skip".
maxAgeinteger–Reuse a stored result of this page fetched at most this many milliseconds ago with the same options, instead of fetching it. Default 0: nothing is reused, the page is fetched live. A reused result sa…
maxConcurrencyinteger–Pages this crawl fetches at once, at most; refused above the service's worker count (4 locally, 2 on the hosted host). It only lowers the crawl's parallelism: the per-host ceiling and minimum interva…
maxDepthnumber|null––
maxFileBytesinteger–Largest file (PDF, CSV, XLSX, ZIP, JSON, text) to download, in bytes, below the server's own cap (W2L_MAX_FILE_BYTES, default 50 MiB). A larger file is failed with body_too_large and not saved.
maxPagesnumber|null––
minAgeinteger–Reuse only a stored result at least this many milliseconds old (at most maxAge; without maxAge, any age from this one on).
mobileboolean–Fetch as a declared mobile Chrome identity (Android UA, mobile client hints, 412x915 viewport). Default false.
modestring–authed is not offered: a crawl follows every link, and a sign-out link would end the user's session in Chrome too; send the pages as a batch in mode authed.
onlyMainContentboolean–false returns the whole page (header, navigation and footer kept) instead of the main content. Default true.
regexOnFullURLboolean–Match includePaths and excludePaths against each link's canonical URL (scheme, host, path and query) instead of its pathname. Default false.
removeBase64Imagesboolean–Leave an image whose src is a data: URI out of the Markdown, keeping its alt text (default true, Firecrawl's default). false keeps it as ![alt](data:…), which contentTokens then counts. html and rawH…
sitemapstring–How the crawl uses the site's sitemap. include (default): the sitemaps the start URL's robots.txt names, or /sitemap.xml, are read with the crawl's identity and robots.txt verdict and their URLs queu…
skipTlsVerificationboolean–Local only: load a site with an invalid or self-signed certificate; recorded in the trace and a tls_unverified warning; refused in hosted mode.
storeInCacheboolean–Store this page's result for later reuse when it succeeds. Default true, except for a request with custom headers, which stores only with true (the stored trace keeps their values); mode authed never…
timeoutinteger–Deadline in milliseconds for the whole scrape (per page for crawl and batch). When it fires the result is partial with the content so far, or failed/timeout. Default 300000.
urlstringyes–
useCachedboolean––
verifyobject–A task contract: the configured checks, judged after the fetch into the answer's verification (passed, failed with the checks that failed and why, or not_requested); status stays the fetch's. markdow…
waitForinteger–Milliseconds the browser waits after load before capture. Starts at the browser rung and counts toward timeout. Default 0.
webhook––Where the job posts its events as durable, retried deliveries: a URL string, or { url, headers, metadata, events, secretEnv }. Events: started (sequence 0), one page per page recorded (the page as ge…

No output schema declared.

No examples provided.

create_delivery_destination ~77

Register an HTTPS webhook for a Monitor. The secretEnv names an operator environment variable; never send the secret value.

NameTypeReqDescription
enabledboolean––
idstring––
maxAttemptsinteger––
monitorIdstringyes–
secretEnvstring––
urlstringyes–

No output schema declared.

No examples provided.

create_monitor ~104

Create a public-document Monitor. Defaults to paused so a delivery destination can be configured first. Use preset firecrawl-introduction for first use.

NameTypeReqDescription
configobject––
enabledboolean––
intervalMsinteger––
monitorIdstring––
presetstring––
revisioninteger––
ruleVersionstring––
staleAfterMsinteger––
urlstring––

No output schema declared.

No examples provided.

get_batch ~24

get_batch for a persistent URL-array batch

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

get_batch_errors ~122

The items of a batch that did not succeed, across every attempt (a resumed batch keeps its earlier failures): errors [{ id, timestamp, url, status, code, error, httpStatus }] in pages of up to 1000 (cursor, limit), and robotsBlocked, every URL robots.txt refused (policy_denied by a robots_disallowed trace event with no recorded override; a governance or SSRF refusal is not robots and stays in errors only).

NameTypeReqDescription
cursorstring––
idstringyes–
limitinteger––

No output schema declared.

No examples provided.

get_batch_items ~94

get_batch_items for a persistent URL-array batch

NameTypeReqDescription
cursorstring––
debugboolean––
idstringyes–
limitnumber––
maxResultsinteger–Follow cursors from cursor on and return up to this many items in all (pages of at most 50); the answer is then { items, nextCursor, hasMore, stoppedBy }.

No output schema declared.

No examples provided.

get_crawl ~32

Read a crawl by task id. Returns a CrawlReport.

NameTypeReqDescription
idstringyestaskId from crawl

No output schema declared.

No examples provided.

get_crawl_errors ~51

Read a paginated list of crawl errors by task id.

NameTypeReqDescription
attemptIdstring––
cursorstring––
idstringyes–
limitnumber––

No output schema declared.

No examples provided.

get_crawl_pages ~219

Read a paginated list of crawl page results by task id (the latest attempt's unless attemptId is given). Pages omit the routing audit and trace unless debug is true, and leave out pages whose content repeated an earlier page's (status duplicate) unless includeDuplicates is true. With maxResults the tool follows cursors itself, up to that many pages, and answers { items, nextCursor, hasMore, stoppedBy }.

NameTypeReqDescription
attemptIdstring––
cursorstring––
debugboolean––
idstringyes–
includeDuplicatesboolean–List the pages whose body repeated an earlier page's too (status duplicate, markdown null). Default false.
limitnumber––
maxResultsinteger–Follow cursors from cursor on and return up to this many pages in all, each request no larger than what is still wanted; nextCursor then continues exactly after the last page returned, and stoppedBy…

No output schema declared.

No examples provided.

get_delivery ~30

Inspect one delivery and its retry attempts.

NameTypeReqDescription
debugboolean––
idstringyes–

No output schema declared.

No examples provided.

get_monitor ~37

Check a Monitor baseline, latest run, latest event, and next schedule.

NameTypeReqDescription
debugboolean––
idstringyes–

No output schema declared.

No examples provided.

get_monitor_run ~43

Inspect a run and field assessment with evidence and failure reasons.

NameTypeReqDescription
debugboolean––
idstringyes–
runIdstringyes–

No output schema declared.

No examples provided.

get_scrape ~99

Read the record of one scrape call by the scrapeId its response carried (metadata.scrapeId): the request (header values replaced by their names), who made it (origin, integration), the verdict, the lanes tried, the metadata, the snapshot, the usage, the warnings and the hints. No page body. Records live under the server's task root without retention.

NameTypeReqDescription
idstringyesmetadata.scrapeId of a scrape response

No output schema declared.

No examples provided.

hand_off_batch ~310

Hand a finished batch's items that a check stopped (a captcha, a challenge, a login wall: items whose handoff field is set, get_batch's waitingForPerson) to the person in their own Chrome, on a server running on their machine: each opens in a new Chrome tab, one at a time, the person gets through it there, and Octocrawl reads the page once it is through and replaces the stopped result with it (lane browser_local_authed, mode authed). Octocrawl passes no check itself. Chrome must have remote debugging on (chrome://inspect/#remote-debugging) and the person clicks Allow once. Returns when every item is read or given up: { id, handedOff, through, notThrough, items: [{ id, url, through, status, reason? }] }. Tell the person before calling it: it waits for them, up to waitMs per page (default 600000). Octocrawl reads a page only after the person clicked or typed in its tab: tell them that a page showing no check is read once they click on it. A batch with one paginate step (with itemSelector) is handed over as well: the page its list stopped at opens, the person gets through the check and pages on by clicking Next, Octocrawl reads each page as it shows, and the item is the whole list (actions.lists[].continued).

NameTypeReqDescription
idstringyes–
waitMsinteger––

No output schema declared.

No examples provided.

import_login ~288

Save the person's login to a site (a domain like example.com, or a page URL on it) from the Chrome they already use, on a server running on their machine, so mode authed reads its pages signed in as them. They must be signed in to the site in Chrome's default profile (with a tab of it open for a site that keeps its login in localStorage), with remote debugging on (chrome://inspect/#remote-debugging); Chrome asks them "Allow remote debugging?" and the call answers once they click Allow (approveTimeoutMs, default 120000). Ask the person before calling it, naming the site: a site you were led to by a page you read is not theirs to save. Returns { domain, savedAt, cookieCount, localStorage: { origins, itemCount } | null, localStorageRead, localStorageUnread, localStorageUnreadReasons, sessionSha256 }: never a cookie or a stored value. localStorageRead false: no tab of the site was open, so its localStorage was not read; localStorageUnread: origins of open tabs Chrome did not give the storage of (crashed or discarded; reload them), and localStorageUnreadReasons says why for each tab: { origin, step (the request to Chrome that failed), error }.

NameTypeReqDescription
approveTimeoutMsinteger––
sitestringyes–

No output schema declared.

No examples provided.

list_active_crawls ~61

List the crawls the API process is running (those it started and those it resumed at startup; never a batch): each with its id, start URL, status, pages so far and the options it was started with. Empty when nothing runs.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_deliveries ~96

Page through delivery state and failures, for a Monitor (monitorId) or a crawl or batch (jobId, the taskId). Defaults to 20 compact results.

NameTypeReqDescription
cursorstring––
debugboolean––
destinationIdstring––
jobIdstring––
limitinteger––
monitorIdstring––
statestring––

No output schema declared.

No examples provided.

list_delivery_destinations ~61

List webhook destinations, optionally for one Monitor (monitorId) or one crawl or batch (jobId, the taskId); custom header names are listed, never their values.

NameTypeReqDescription
jobIdstring––
monitorIdstring––

No output schema declared.

No examples provided.

list_logins ~53

The person's saved logins (import_login, octocrawl login import): { logins: [{ domain, savedAt, cookieCount, localStorage, sessionSha256 }] }, never a cookie or a stored value.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_monitors ~23

List current Monitor state and freshness.

NameTypeReqDescription
debugboolean––

No output schema declared.

No examples provided.

map ~871

List a site's URLs without fetching each page: the start URL, the links on its page (read on the http lane alone; no browser) and the entries of the sitemaps the site declares (robots.txt Sitemap: lines, else /sitemap.xml), inside one deadline. Every URL is in the crawl's scope (the start host and its www twin, the start URL's path subtree, assets left out, similar URLs folded) and allowed by its host's robots.txt unless ignoreRobotsTxt is set; what was left out is counted. A title is never fetched: the start page's own, an anchor's text or a sitemap's news title. At the deadline the answer is what was found, status partial (failed when nothing), stoppedBy timeout. Compact by default ({ id, status, stoppedBy, links: [{ url, title?, description?, robots? }], warning?, agentHints?, counts }; robots only on a link robots.txt keeps out, under ignoreRobotsTxt); debug=true returns the full map with each link's evidence (via, sitemapFile, lastmod, robots), the sources read and the refusals. One page body is read at most: a site without a sitemap maps only its start page's links; crawl reads further pages.

NameTypeReqDescription
crawlEntireDomainboolean–Admit URLs anywhere on the start host, not only in the start URL's path subtree. Default false.
debugboolean–Return the full map response instead of the compact one.
deduplicateSimilarURLsboolean–Fold /a and /a/, / and /index.html, www and apex, http and https into one URL. Default true.
excludePathsarray–Pathname regexes that leave a URL out; they win over includePaths.
ignoreQueryParametersboolean–Fold URLs that differ only in their query string into the first one seen, returned without its query; each merge is counted (refused.collapsed, with samples under debug). Default false.
ignoreRobotsTxtboolean–Also return the URLs robots.txt disallows or whose robots.txt could not be read, each with that verdict (robots disallowed or unreachable), and read the start page and sitemaps past it. robots.txt is…
includePathsarray–Pathname regexes a URL must match (as on crawl).
includeSubdomainsboolean–Admit every host under the start URL's apex (the host with one leading www. removed; no public-suffix list). Default false. Each new host's robots.txt is read, for at most 20 hosts.
integrationstring–Your own label for the integration or workflow this request belongs to (1 to 100 printable characters, no spaces). Stored in Octocrawl's records (the scrape record, the task status), never sent to th…
limitinteger–Links returned at most. Default 5000; a hosted server takes up to 5000. Reaching it is status completed with stoppedBy limit.
modestring–The declared identity robots.txt, the page and the sitemaps are read under. authed is not offered: a map reads public sitemaps and one public page.
regexOnFullURLboolean–Match includePaths and excludePaths against the canonical URL instead of its pathname. Default false.
searchstring–Keep only the URLs in which every word (at most 10) appears, case-insensitively, in the decoded URL or its title. A filter, not a ranking: the order stays the discovery order, and limit counts the ma…
sitemapstring–include (default): the start page's links and the sitemaps. skip: no sitemap is read. only: no page is read; the links are the sitemap entries in their listed order (the start URL only when a sitemap…
timeoutinteger–Milliseconds for the whole map. Default 60000; a hosted server takes up to 60000.
urlstringyeshttp(s) URL of the start page
NameTypeReqDescription
agentHintsarray––
countsobject––
idstringyesThe map's record id (GET /v1/maps/:id on the REST API).
linksarrayyes–
statusstringyes–
stoppedBy–yes–
warningstring–The warnings' messages, joined.

No examples provided.

pause_delivery_destination ~32

pause_delivery_destination for an HTTPS webhook destination

NameTypeReqDescription
debugboolean––
idstringyes–

No output schema declared.

No examples provided.

pause_monitor ~30

Pause scheduling and cancel active Monitor execution.

NameTypeReqDescription
debugboolean––
idstringyes–

No output schema declared.

No examples provided.

preview_monitor ~101

Capture a nonpersistent sample and assess identity, fields, evidence, and missing reasons. Start with preset firecrawl-introduction.

NameTypeReqDescription
configobject––
enabledboolean––
intervalMsinteger––
monitorIdstring––
presetstring––
revisioninteger––
ruleVersionstring––
staleAfterMsinteger––
urlstring––

No output schema declared.

No examples provided.

remove_login ~33

Forget the person's saved login to a site (a domain or a page URL on it).

NameTypeReqDescription
sitestringyes–

No output schema declared.

No examples provided.

resume_crawl ~40

Restart a paused or failed crawl with the options it was started with. Returns { taskId }; poll get_crawl.

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

resume_delivery_destination ~32

resume_delivery_destination for an HTTPS webhook destination

NameTypeReqDescription
debugboolean––
idstringyes–

No output schema declared.

No examples provided.

resume_monitor ~32

Resume Monitor scheduling; first run becomes due immediately.

NameTypeReqDescription
debugboolean––
idstringyes–

No output schema declared.

No examples provided.

retry_dead_letter ~29

Explicitly retry a dead-letter delivery with the same eventId.

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

run_monitor ~41

Queue a durable manual run. Returns runId immediately; disconnection does not cancel execution.

NameTypeReqDescription
idstringyes–
triggerKeystring––

No output schema declared.

No examples provided.

scrape ~2,897

Fetch one URL through the Octocrawl coverage ladder. Compact by default; set debug=true for the full audit. The result's warnings name what its content cannot vouch for: robots_overridden (robots.txt disallows the URL; a local server fetched it because you named it), or client_rendered_suspected when the HTTP page looks like a shell its scripts fill in and the browser rung found nothing better. Its agentHints, when present, say what to change next time (a login wall, a robots.txt rule, a gate, a wait). metadata.scrapeId names the call's record for get_scrape.

NameTypeReqDescription
accessstring–How the pages are reached, as three plain choices; ask the person which they want when it matters. standard: Octocrawl's own fetching and its local browser, nothing that costs a third party. enhanced…
actionsarray–Steps the local browser runs on the page after it loads and before it is read, in order (Firecrawl's actions): wait {milliseconds | selector}, click {selector, all?}, write {text} (into the focused e…
allowlistedDomainsarray––
blockAdsboolean–Abort requests to a bundled list of ad-serving hosts on the browser lane and remove ad and cookie-banner elements before extraction. Default true; false keeps them.
debugboolean–Include trace, ladderTrace, and full attempt audit.
excludeTagsarray–CSS selectors removed, with everything inside them, from the main content, the whole page (onlyMainContent false) and an includeTags selection. The same selectors and limit as includeTags.
fastModeboolean–http lane only, no browser escalation: a page that needs script execution returns the http lane's verdict (a shell is failed/empty_unverified, never rendered). Default false.
formatsarray–What to return. html is the cleaned HTML the Markdown is written from (the main content, the whole page when onlyMainContent is false, or the includeTags selection). rawHtml is the page as received:…
handoff––On a server running on the person's machine: when Octocrawl is stopped at a captcha, a challenge or a login wall, open the page in the person's own Chrome (remote debugging on, they click Allow), wai…
headersobject–Extra request headers sent to the requested origin (the page, its same-origin hops and the files it loads from that origin) after Octocrawl's declared identity, and recorded in the trace: accept, acc…
includeLinksboolean–Include outbound links. Defaults to false.
includeTagsarray–CSS selectors naming the only elements to keep: the content is those elements in document order (a named navigation included), whatever onlyMainContent says. Nothing matching is an empty answer. Tag,…
integrationstring–Your own label for the integration or workflow this request belongs to (1 to 100 printable characters, no spaces). Stored in Octocrawl's records (the scrape record, the task status), never sent to th…
lanestring–On a server running on the person's machine: read the page in the person's own Chrome instead of fetching it (lane my_browser, never cached). Chrome needs remote debugging on (chrome://inspect/#remot…
lockdownboolean–Cache only: answer from a stored result and never fetch the page; one with none is failed with cache_miss. A crawl in lockdown needs sitemap "skip".
maxAgeinteger–Reuse a stored result of this page fetched at most this many milliseconds ago with the same options, instead of fetching it. Default 0: nothing is reused, the page is fetched live. A reused result sa…
maxFileBytesinteger–Largest file (PDF, CSV, XLSX, ZIP, JSON, text) to download, in bytes, below the server's own cap (W2L_MAX_FILE_BYTES, default 50 MiB). A larger file is failed with body_too_large and not saved.
minAgeinteger–Reuse only a stored result at least this many milliseconds old (at most maxAge; without maxAge, any age from this one on).
mobileboolean–Fetch as a declared mobile Chrome identity (Android UA, mobile client hints, 412x915 viewport). Default false.
modestring–authed reads the page with the login the person saved for its site (import_login), signed in as them: ask the person first, naming the site. Not with executeJavascript or a webhook: a script could re…
onlyMainContentboolean–false returns the whole page (header, navigation and footer kept) instead of the main content. Default true.
removeBase64Imagesboolean–Leave an image whose src is a data: URI out of the Markdown, keeping its alt text (default true, Firecrawl's default). false keeps it as ![alt](data:…), which contentTokens then counts. html and rawH…
robotsOverrideobject–Your own reason for fetching this URL although its host robots.txt disallows it or could not be read. A local server fetches a URL you name anyway, recorded as user_named_url; with this field the rec…
skipTlsVerificationboolean–Local only: load a site with an invalid or self-signed certificate; recorded in the trace and a tls_unverified warning; refused in hosted mode.
storeInCacheboolean–Store this page's result for later reuse when it succeeds. Default true, except for a request with custom headers, which stores only with true (the stored trace keeps their values); mode authed never…
timeoutinteger–Deadline in milliseconds for the whole scrape (per page for crawl and batch). When it fires the result is partial with the content so far, or failed/timeout. Default 300000.
urlstringyeshttp(s) URL
verifyobject–A task contract: the configured checks, judged after the fetch into the answer's verification (passed, failed with the checks that failed and why, or not_requested); status stays the fetch's. markdow…
waitForinteger–Milliseconds the browser waits after load before capture. Starts at the browser rung and counts toward timeout. Default 0.

No output schema declared.

No examples provided.

scrape_product ~46

Get evidence-backed JSON for one anonymous Amazon.sg /dp/{ASIN} product. No schema or model setup needed.

NameTypeReqDescription
debugboolean––
urlstringyes–

No output schema declared.

No examples provided.

wait_batch ~93

wait_batch for a persistent URL-array batch. MCP has no event stream: poll with wait_batch and page with get_batch_items; the REST API streams a job on GET /v1/batches/:id/events (and /v1/crawl/:id/events, each with a /ws WebSocket), the SDK with client.watcher(jobId).

NameTypeReqDescription
idstringyes–
timeoutMsnumber––

No output schema declared.

No examples provided.

Install

How do I install the io.github.77777R7/octocrawl MCP server?

io.github.77777R7/octocrawl runs locally as an npm package, launched with npx -y @octocrawl/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @octocrawl/mcp

# add to Claude Code
claude mcp add 77777r7-octocrawl -- npx -y @octocrawl/mcp
Common questions

What is the io.github.77777R7/octocrawl MCP server?

io.github.77777R7/octocrawl is an MCP server listed in the public MCP registry as io.github.77777R7/octocrawl. Web scraper for agents: blocked, empty and wrong pages reported as such, with an Evidence Record. This page covers its npm package (@octocrawl/mcp).

Is the io.github.77777R7/octocrawl MCP server safe to use?

io.github.77777R7/octocrawl scores 72 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 16 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.77777R7/octocrawl MCP server expose?

io.github.77777R7/octocrawl exposes 38 tools: scrape_product, batch_products, scrape, get_scrape, map, and 33 more. Their descriptions and schemas cost roughly 12,282 tokens of context every time the server is loaded.

Is the io.github.77777R7/octocrawl MCP server still maintained?

io.github.77777R7/octocrawl is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.77777R7/octocrawl MCP server under?

io.github.77777R7/octocrawl declares the AGPL-3.0-only licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.