# io.github.77777R7/octocrawl (npm · @octocrawl/mcp) Web scraper for agents: blocked, empty and wrong pages reported as such, with an Evidence Record. - Trust score: 72/100 (medium) - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-10-16 ## Components - remote · `mcp.octocrawl.dev`: 70/100, [markdown](https://verifymcp.io/servers/77777r7-octocrawl/mcp.md), [page](https://verifymcp.io/servers/77777r7-octocrawl/mcp) - remote · `mcp.octocrawl.dev`: 37/100, [markdown](https://verifymcp.io/servers/77777r7-octocrawl/mcp-oauth.md), [page](https://verifymcp.io/servers/77777r7-octocrawl/mcp-oauth) - npm · `@octocrawl/mcp`: 72/100 (this document), [markdown](https://verifymcp.io/servers/77777r7-octocrawl/octocrawl-mcp.md), [page](https://verifymcp.io/servers/77777r7-octocrawl/octocrawl-mcp) ## Channel facts - Registry: `npm` - Package: `@octocrawl/mcp` - Version: `0.5.0` - Transport: `stdio` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-10-16. - **Supply Chain Security**: 98/100 - No malware found by supply-chain analysis. - No known CVEs affecting this package version or its production dependencies. - No install/post-install scripts declared. - 31 of 92 dependencies flagged as unhealthy. - **Provenance & Transparency**: 97/100 - Source repository is publicly reachable at the declared URL. - Cryptographically verified build provenance (signed, bound to 77777R7/Octocrawl). - Clear OSI-approved license (AGPL-3.0-only). - Actively maintained (last published 0 days ago). - Disclosure check failed: no security disclosure policy was found in the source repository. - **Schema Quality & AI Usability**: 39/100 - AI-judged instruction clarity (fair). - Context-footprint check failed: tool/resource definitions use about 12282 tokens (~323/item across 38 items; 38 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 7/100 - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 87/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 55% of tool parameters carry a description. - Structured output schemas are declared (3% of tools); any adoption earns full credit. - **Tool Safety**: 75/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "remove_login" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. - An AI judge read all 38 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28. ## Install ### How do I install the io.github.77777R7/octocrawl MCP server? io.github.77777R7/octocrawl runs locally as an npm package, launched with npx -y @octocrawl/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add 77777r7-octocrawl -- npx -y @octocrawl/mcp ``` ### Cursor ```json { "mcpServers": { "77777r7-octocrawl": { "command": "npx", "args": [ "-y", "@octocrawl/mcp" ] } } } ``` ### VS Code ```json { "servers": { "77777r7-octocrawl": { "command": "npx", "args": [ "-y", "@octocrawl/mcp" ] } } } ``` ### Codex ```bash codex mcp add 77777r7-octocrawl -- npx -y @octocrawl/mcp ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "77777r7-octocrawl": { "type": "local", "command": [ "npx", "-y", "@octocrawl/mcp" ], "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add 77777r7-octocrawl --command npx --arg -y --arg @octocrawl/mcp ``` ### Hermes ```yaml mcp_servers: 77777r7-octocrawl: command: "npx" args: ["-y", "@octocrawl/mcp"] ``` ### Netclaw ```json { "McpServers": { "77777r7-octocrawl": { "Transport": "stdio", "Command": "npx", "Arguments": [ "-y", "@octocrawl/mcp" ] } } } ``` ### Vellum ```bash assistant mcp add 77777r7-octocrawl -t stdio -c npx -a -y @octocrawl/mcp ``` ### Other ```json { "mcpServers": { "77777r7-octocrawl": { "command": "npx", "args": [ "-y", "@octocrawl/mcp" ] } } } ``` ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-10-16 (score 72, +1) - [security regression] Tool safety: pass → unverified - [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. - [functional regression] Tool coverage: 100 → unverified - [functional regression] Capabilities: pass → unverified - [functional improvement] Stability: unverified → 0.07 - [functional] Package version: 0.4.2 → 0.5.0 ### 2026-10-14 (score 71, +33) - [security improvement] Injection markers: unverified → pass - [security improvement] Known CVEs: unverified → pass - [security] First check of Judged manipulation: pass - [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). - [functional improvement] Tool coverage: unverified → 100 - [functional improvement] MCP protocol: unverified → pass - [functional improvement] Dependency health: unverified → 0.84 - [functional] First check of Schema quality: fail - [functional] First check of Schema quality: fair - [functional] First check of Tool coverage: 55 - [functional] First check of Schema quality: fail - [functional] First check of Destructive annotations: 0 - [functional] First check of Tool coverage: 3 ### 2026-10-13 (score 38, −11) - [security regression] Known CVEs: pass → unverified - [functional regression] Security disclosure: unverified → fail - [functional regression] Dependency health: 0.84 → unverified - [functional] Package version: 0.4.1 → 0.4.2 ### 2026-10-12 (score 49) First indexed and scored. ## MCP tools (38) ### `scrape_product` (~46 tokens) Get evidence-backed JSON for one anonymous Amazon.sg /dp/{ASIN} product. No schema or model setup needed. Input parameters: - `debug` (boolean) - `url` (string, required) ### `batch_products` (~43 tokens) Queue 1-1000 distinct Amazon.sg product URLs with the reviewed JSON schema. Returns taskId; page results with get_batch_items. Input parameters: - `urls` (array, required) ### `scrape` (~2897 tokens) Fetch one URL through the Octocrawl coverage ladder. Compact by default; set debug=true for the full audit. The result's warnings name what its content cannot vouch for: robots_overridden (robots.txt disallows the URL; a local server fetched it because you named it), or client_rendered_suspected when the HTTP page looks like a shell its scripts fill in and the browser rung found nothing better. Its agentHints, when present, say what to change next time (a login wall, a robots.txt rule, a gate, a wait). metadata.scrapeId names the call's record for get_scrape. Input parameters: - `access` (string): How the pages are reached, as three plain choices; ask the person which they want when it matters. standard: Octocrawl's own fetching and its local browser, nothing that costs a third party. enhanced… - `actions` (array): Steps the local browser runs on the page after it loads and before it is read, in order (Firecrawl's actions): wait {milliseconds | selector}, click {selector, all?}, write {text} (into the focused e… - `allowlistedDomains` (array) - `blockAds` (boolean): Abort requests to a bundled list of ad-serving hosts on the browser lane and remove ad and cookie-banner elements before extraction. Default true; false keeps them. - `debug` (boolean): Include trace, ladderTrace, and full attempt audit. - `excludeTags` (array): CSS selectors removed, with everything inside them, from the main content, the whole page (onlyMainContent false) and an includeTags selection. The same selectors and limit as includeTags. - `fastMode` (boolean): http lane only, no browser escalation: a page that needs script execution returns the http lane's verdict (a shell is failed/empty_unverified, never rendered). Default false. - `formats` (array): What to return. html is the cleaned HTML the Markdown is written from (the main content, the whole page when onlyMainContent is false, or the includeTags selection). rawHtml is the page as received:… - `handoff`: On a server running on the person's machine: when Octocrawl is stopped at a captcha, a challenge or a login wall, open the page in the person's own Chrome (remote debugging on, they click Allow), wai… - `headers` (object): Extra request headers sent to the requested origin (the page, its same-origin hops and the files it loads from that origin) after Octocrawl's declared identity, and recorded in the trace: accept, acc… - `includeLinks` (boolean): Include outbound links. Defaults to false. - `includeTags` (array): CSS selectors naming the only elements to keep: the content is those elements in document order (a named navigation included), whatever onlyMainContent says. Nothing matching is an empty answer. Tag,… - `integration` (string): Your own label for the integration or workflow this request belongs to (1 to 100 printable characters, no spaces). Stored in Octocrawl's records (the scrape record, the task status), never sent to th… - `lane` (string): On a server running on the person's machine: read the page in the person's own Chrome instead of fetching it (lane my_browser, never cached). Chrome needs remote debugging on (chrome://inspect/#remot… - `lockdown` (boolean): Cache only: answer from a stored result and never fetch the page; one with none is failed with cache_miss. A crawl in lockdown needs sitemap "skip". - `maxAge` (integer): Reuse a stored result of this page fetched at most this many milliseconds ago with the same options, instead of fetching it. Default 0: nothing is reused, the page is fetched live. A reused result sa… - `maxFileBytes` (integer): Largest file (PDF, CSV, XLSX, ZIP, JSON, text) to download, in bytes, below the server's own cap (W2L_MAX_FILE_BYTES, default 50 MiB). A larger file is failed with body_too_large and not saved. - `minAge` (integer): Reuse only a stored result at least this many milliseconds old (at most maxAge; without maxAge, any age from this one on). - `mobile` (boolean): Fetch as a declared mobile Chrome identity (Android UA, mobile client hints, 412x915 viewport). Default false. - `mode` (string): authed reads the page with the login the person saved for its site (import_login), signed in as them: ask the person first, naming the site. Not with executeJavascript or a webhook: a script could re… - `onlyMainContent` (boolean): false returns the whole page (header, navigation and footer kept) instead of the main content. Default true. - `removeBase64Images` (boolean): Leave an image whose src is a data: URI out of the Markdown, keeping its alt text (default true, Firecrawl's default). false keeps it as ![alt](data:…), which contentTokens then counts. html and rawH… - `robotsOverride` (object): Your own reason for fetching this URL although its host robots.txt disallows it or could not be read. A local server fetches a URL you name anyway, recorded as user_named_url; with this field the rec… - `skipTlsVerification` (boolean): Local only: load a site with an invalid or self-signed certificate; recorded in the trace and a tls_unverified warning; refused in hosted mode. - `storeInCache` (boolean): Store this page's result for later reuse when it succeeds. Default true, except for a request with custom headers, which stores only with true (the stored trace keeps their values); mode authed never… - `timeout` (integer): Deadline in milliseconds for the whole scrape (per page for crawl and batch). When it fires the result is partial with the content so far, or failed/timeout. Default 300000. - `url` (string, required): http(s) URL - `verify` (object): A task contract: the configured checks, judged after the fetch into the answer's verification (passed, failed with the checks that failed and why, or not_requested); status stays the fetch's. markdow… - `waitFor` (integer): Milliseconds the browser waits after load before capture. Starts at the browser rung and counts toward timeout. Default 0. ### `get_scrape` (~99 tokens) Read the record of one scrape call by the scrapeId its response carried (metadata.scrapeId): the request (header values replaced by their names), who made it (origin, integration), the verdict, the lanes tried, the metadata, the snapshot, the usage, the warnings and the hints. No page body. Records live under the server's task root without retention. Input parameters: - `id` (string, required): metadata.scrapeId of a scrape response ### `map` (~871 tokens) List a site's URLs without fetching each page: the start URL, the links on its page (read on the http lane alone; no browser) and the entries of the sitemaps the site declares (robots.txt Sitemap: lines, else /sitemap.xml), inside one deadline. Every URL is in the crawl's scope (the start host and its www twin, the start URL's path subtree, assets left out, similar URLs folded) and allowed by its host's robots.txt unless ignoreRobotsTxt is set; what was left out is counted. A title is never fetched: the start page's own, an anchor's text or a sitemap's news title. At the deadline the answer is what was found, status partial (failed when nothing), stoppedBy timeout. Compact by default ({ id, status, stoppedBy, links: [{ url, title?, description?, robots? }], warning?, agentHints?, counts }; robots only on a link robots.txt keeps out, under ignoreRobotsTxt); debug=true returns the full map with each link's evidence (via, sitemapFile, lastmod, robots), the sources read and the refusals. One page body is read at most: a site without a sitemap maps only its start page's links; crawl reads further pages. Input parameters: - `crawlEntireDomain` (boolean): Admit URLs anywhere on the start host, not only in the start URL's path subtree. Default false. - `debug` (boolean): Return the full map response instead of the compact one. - `deduplicateSimilarURLs` (boolean): Fold /a and /a/, / and /index.html, www and apex, http and https into one URL. Default true. - `excludePaths` (array): Pathname regexes that leave a URL out; they win over includePaths. - `ignoreQueryParameters` (boolean): Fold URLs that differ only in their query string into the first one seen, returned without its query; each merge is counted (refused.collapsed, with samples under debug). Default false. - `ignoreRobotsTxt` (boolean): Also return the URLs robots.txt disallows or whose robots.txt could not be read, each with that verdict (robots disallowed or unreachable), and read the start page and sitemaps past it. robots.txt is… - `includePaths` (array): Pathname regexes a URL must match (as on crawl). - `includeSubdomains` (boolean): Admit every host under the start URL's apex (the host with one leading www. removed; no public-suffix list). Default false. Each new host's robots.txt is read, for at most 20 hosts. - `integration` (string): Your own label for the integration or workflow this request belongs to (1 to 100 printable characters, no spaces). Stored in Octocrawl's records (the scrape record, the task status), never sent to th… - `limit` (integer): Links returned at most. Default 5000; a hosted server takes up to 5000. Reaching it is status completed with stoppedBy limit. - `mode` (string): The declared identity robots.txt, the page and the sitemaps are read under. authed is not offered: a map reads public sitemaps and one public page. - `regexOnFullURL` (boolean): Match includePaths and excludePaths against the canonical URL instead of its pathname. Default false. - `search` (string): Keep only the URLs in which every word (at most 10) appears, case-insensitively, in the decoded URL or its title. A filter, not a ranking: the order stays the discovery order, and limit counts the ma… - `sitemap` (string): include (default): the start page's links and the sitemaps. skip: no sitemap is read. only: no page is read; the links are the sitemap entries in their listed order (the start URL only when a sitemap… - `timeout` (integer): Milliseconds for the whole map. Default 60000; a hosted server takes up to 60000. - `url` (string, required): http(s) URL of the start page Output parameters: - `agentHints` (array) - `counts` (object) - `id` (string): The map's record id (GET /v1/maps/:id on the REST API). - `links` (array) - `status` (string) - `stoppedBy` - `warning` (string): The warnings' messages, joined. ### `crawl` (~2945 tokens) Start a multi-page crawl. Returns { taskId } (HTTP 202 equivalent). By default it follows links in the start URL's path subtree on its host and www twin, folds similar URLs into one page, and reports every collapsed or refused link in get_crawl's discovery counters and each page's links_offered trace event (get_crawl_pages with debug). Input parameters: - `access` (string): How the pages are reached: standard is Octocrawl's own fetching and its local browser, nothing that costs a third party; enhanced also uses the paid providers the server's operator approved (an acces… - `allowExternalLinks` (boolean): Follow links to any host, each with its own robots.txt read; maxDepth and maxPages bound the walk. Default false. Cannot be combined with allowlistedDomains. - `allowSubdomains` (boolean): Follow links to every host under the start URL's apex (the host with one leading www. removed; no public-suffix list, so a seed on www.gov.uk admits every *.gov.uk host). Default false. Each new host… - `allowlistedDomains` (array) - `blockAds` (boolean): Abort requests to a bundled list of ad-serving hosts on the browser lane and remove ad and cookie-banner elements before extraction. Default true; false keeps them. - `crawlEntireDomain` (boolean): Follow links anywhere on the start URL's host. Default false: links on that host are followed only inside the start URL's path subtree (its directory, or the directory of the file it names); the rest… - `deduplicateSimilarURLs` (boolean): Treat /a and /a/, / and /index.html, www and apex, http and https as one page: the first variant seen is fetched, later ones are reported as collapsed. Default true. A page fetched and then found to… - `excludePaths` (array): Pathname regexes that skip a discovered link; they win over includePaths. - `excludeTags` (array): CSS selectors removed, with everything inside them, from the main content, the whole page (onlyMainContent false) and an includeTags selection. The same selectors and limit as includeTags. - `fastMode` (boolean): http lane only, no browser escalation: a page that needs script execution returns the http lane's verdict (a shell is failed/empty_unverified, never rendered). Default false. - `formats` (array): What to return. html is the cleaned HTML the Markdown is written from (the main content, the whole page when onlyMainContent is false, or the includeTags selection). rawHtml is the page as received:… - `headers` (object): Extra request headers sent to the requested origin (the page, its same-origin hops and the files it loads from that origin) after Octocrawl's declared identity, and recorded in the trace: accept, acc… - `idempotencyKey` (string): A client-chosen key (1 to 200 characters): a retried call with the same key and the same arguments returns the first call's taskId with replayed: true instead of starting a second job; the same key w… - `ignoreQueryParameters` (boolean): Treat URLs that differ only in their query string as one page: the first variant seen is fetched, later ones are reported as collapsed in the page's links_offered trace event and the report's discove… - `ignoreRobotsTxt` (boolean): Fetch the pages and sitemap files robots.txt disallows, or whose robots.txt could not be read. robots.txt is still read for every host and its verdict recorded, Crawl-delay applied; each page fetched… - `includeLinks` (boolean) - `includePaths` (array): Pathname regexes a discovered link must match; the start URL is always fetched. - `includeTags` (array): CSS selectors naming the only elements to keep: the content is those elements in document order (a named navigation included), whatever onlyMainContent says. Nothing matching is an empty answer. Tag,… - `integration` (string): Your own label for the integration or workflow this request belongs to (1 to 100 printable characters, no spaces). Stored in Octocrawl's records (the scrape record, the task status), never sent to th… - `lockdown` (boolean): Cache only: answer from a stored result and never fetch the page; one with none is failed with cache_miss. A crawl in lockdown needs sitemap "skip". - `maxAge` (integer): Reuse a stored result of this page fetched at most this many milliseconds ago with the same options, instead of fetching it. Default 0: nothing is reused, the page is fetched live. A reused result sa… - `maxConcurrency` (integer): Pages this crawl fetches at once, at most; refused above the service's worker count (4 locally, 2 on the hosted host). It only lowers the crawl's parallelism: the per-host ceiling and minimum interva… - `maxDepth` (number|null) - `maxFileBytes` (integer): Largest file (PDF, CSV, XLSX, ZIP, JSON, text) to download, in bytes, below the server's own cap (W2L_MAX_FILE_BYTES, default 50 MiB). A larger file is failed with body_too_large and not saved. - `maxPages` (number|null) - `minAge` (integer): Reuse only a stored result at least this many milliseconds old (at most maxAge; without maxAge, any age from this one on). - `mobile` (boolean): Fetch as a declared mobile Chrome identity (Android UA, mobile client hints, 412x915 viewport). Default false. - `mode` (string): authed is not offered: a crawl follows every link, and a sign-out link would end the user's session in Chrome too; send the pages as a batch in mode authed. - `onlyMainContent` (boolean): false returns the whole page (header, navigation and footer kept) instead of the main content. Default true. - `regexOnFullURL` (boolean): Match includePaths and excludePaths against each link's canonical URL (scheme, host, path and query) instead of its pathname. Default false. - `removeBase64Images` (boolean): Leave an image whose src is a data: URI out of the Markdown, keeping its alt text (default true, Firecrawl's default). false keeps it as ![alt](data:…), which contentTokens then counts. html and rawH… - `sitemap` (string): How the crawl uses the site's sitemap. include (default): the sitemaps the start URL's robots.txt names, or /sitemap.xml, are read with the crawl's identity and robots.txt verdict and their URLs queu… - `skipTlsVerification` (boolean): Local only: load a site with an invalid or self-signed certificate; recorded in the trace and a tls_unverified warning; refused in hosted mode. - `storeInCache` (boolean): Store this page's result for later reuse when it succeeds. Default true, except for a request with custom headers, which stores only with true (the stored trace keeps their values); mode authed never… - `timeout` (integer): Deadline in milliseconds for the whole scrape (per page for crawl and batch). When it fires the result is partial with the content so far, or failed/timeout. Default 300000. - `url` (string, required) - `useCached` (boolean) - `verify` (object): A task contract: the configured checks, judged after the fetch into the answer's verification (passed, failed with the checks that failed and why, or not_requested); status stays the fetch's. markdow… - `waitFor` (integer): Milliseconds the browser waits after load before capture. Starts at the browser rung and counts toward timeout. Default 0. - `webhook`: Where the job posts its events as durable, retried deliveries: a URL string, or { url, headers, metadata, events, secretEnv }. Events: started (sequence 0), one page per page recorded (the page as ge… ### `get_crawl` (~32 tokens) Read a crawl by task id. Returns a CrawlReport. Input parameters: - `id` (string, required): taskId from crawl ### `get_crawl_pages` (~219 tokens) Read a paginated list of crawl page results by task id (the latest attempt's unless attemptId is given). Pages omit the routing audit and trace unless debug is true, and leave out pages whose content repeated an earlier page's (status duplicate) unless includeDuplicates is true. With maxResults the tool follows cursors itself, up to that many pages, and answers { items, nextCursor, hasMore, stoppedBy }. Input parameters: - `attemptId` (string) - `cursor` (string) - `debug` (boolean) - `id` (string, required) - `includeDuplicates` (boolean): List the pages whose body repeated an earlier page's too (status duplicate, markdown null). Default false. - `limit` (number) - `maxResults` (integer): Follow cursors from cursor on and return up to this many pages in all, each request no larger than what is still wanted; nextCursor then continues exactly after the last page returned, and stoppedBy… ### `get_crawl_errors` (~51 tokens) Read a paginated list of crawl errors by task id. Input parameters: - `attemptId` (string) - `cursor` (string) - `id` (string, required) - `limit` (number) ### `cancel_crawl` (~27 tokens) Cancel a crawl task. Completed pages remain queryable. Input parameters: - `id` (string, required) ### `resume_crawl` (~40 tokens) Restart a paused or failed crawl with the options it was started with. Returns { taskId }; poll get_crawl. Input parameters: - `id` (string, required) ### `list_active_crawls` (~61 tokens) List the crawls the API process is running (those it started and those it resumed at startup; never a batch): each with its id, start URL, status, pages so far and the options it was started with. Empty when nothing runs. ### `batch_scrape` (~3108 tokens) Persist and run 1-1000 explicit URLs. Returns a taskId (with ignoreInvalidURLs also invalidURLs, the entries skipped); use get_batch_items for paginated results and get_batch_errors for the URLs that failed or that robots.txt refused. With appendToId the urls are added to that existing batch instead (the answer carries requested and appended); with idempotencyKey a retried call returns the first call's answer (replayed: true) instead of a second job. Input parameters: - `access` (string): How the pages are reached, as three plain choices; ask the person which they want when it matters. standard: Octocrawl's own fetching and its local browser, nothing that costs a third party. enhanced… - `actions` (array): Steps the local browser runs on the page after it loads and before it is read, in order (Firecrawl's actions): wait {milliseconds | selector}, click {selector, all?}, write {text} (into the focused e… - `allowExternalLinks` (boolean): Accepted as false only, which already holds: a batch fetches the URLs given and follows no link. true is refused by name; a crawl takes allowExternalLinks, and extraction across links is the M5 multi… - `appendToId` (string): Add urls to this existing batch instead of starting a new job: the job keeps its mode, formats, includeLinks, maxConcurrency and page options (sending one is refused by name), and the answer carries… - `blockAds` (boolean): Abort requests to a bundled list of ad-serving hosts on the browser lane and remove ad and cookie-banner elements before extraction. Default true; false keeps them. - `excludeTags` (array): CSS selectors removed, with everything inside them, from the main content, the whole page (onlyMainContent false) and an includeTags selection. The same selectors and limit as includeTags. - `fastMode` (boolean): http lane only, no browser escalation: a page that needs script execution returns the http lane's verdict (a shell is failed/empty_unverified, never rendered). Default false. - `formats` (array): What to return. html is the cleaned HTML the Markdown is written from (the main content, the whole page when onlyMainContent is false, or the includeTags selection). rawHtml is the page as received:… - `headers` (object): Extra request headers sent to the requested origin (the page, its same-origin hops and the files it loads from that origin) after Octocrawl's declared identity, and recorded in the trace: accept, acc… - `idempotencyKey` (string): A client-chosen key (1 to 200 characters): a retried call with the same key and the same arguments returns the first call's taskId with replayed: true instead of starting a second job; the same key w… - `ignoreInvalidURLs` (boolean): Start with the entries of urls that are http(s) URLs and report the rest as invalidURLs (on the answer and on get_batch) instead of refusing the batch. Default false: an entry that is not a URL is re… - `includeLinks` (boolean) - `includeSubdomains` (boolean): Accepted as false only, which already holds: a batch fetches the URLs given and follows no link. true is refused by name; a crawl takes allowSubdomains. - `includeTags` (array): CSS selectors naming the only elements to keep: the content is those elements in document order (a named navigation included), whatever onlyMainContent says. Nothing matching is an empty answer. Tag,… - `integration` (string): Your own label for the integration or workflow this request belongs to (1 to 100 printable characters, no spaces). Stored in Octocrawl's records (the scrape record, the task status), never sent to th… - `lane` (string): On a server running on the person's machine: read every page in the person's own Chrome, one at a time, instead of fetching it (lane my_browser, never cached). The person clicks Allow in Chrome, then… - `lockdown` (boolean): Cache only: answer from a stored result and never fetch the page; one with none is failed with cache_miss. A crawl in lockdown needs sitemap "skip". - `maxAge` (integer): Reuse a stored result of this page fetched at most this many milliseconds ago with the same options, instead of fetching it. Default 0: nothing is reused, the page is fetched live. A reused result sa… - `maxConcurrency` (integer): Pages of this batch in flight at once; the per-host ceiling still applies. Only lowers the service's worker count; omitted takes it. - `maxFileBytes` (integer): Largest file (PDF, CSV, XLSX, ZIP, JSON, text) to download, in bytes, below the server's own cap (W2L_MAX_FILE_BYTES, default 50 MiB). A larger file is failed with body_too_large and not saved. - `minAge` (integer): Reuse only a stored result at least this many milliseconds old (at most maxAge; without maxAge, any age from this one on). - `mobile` (boolean): Fetch as a declared mobile Chrome identity (Android UA, mobile client hints, 412x915 viewport). Default false. - `mode` (string): authed reads the page with the login the person saved for its site (import_login), signed in as them: ask the person first, naming the site. Not with executeJavascript or a webhook: a script could re… - `onlyMainContent` (boolean): false returns the whole page (header, navigation and footer kept) instead of the main content. Default true. - `removeBase64Images` (boolean): Leave an image whose src is a data: URI out of the Markdown, keeping its alt text (default true, Firecrawl's default). false keeps it as ![alt](data:…), which contentTokens then counts. html and rawH… - `robotsOverrides` (array): Recorded robots overrides, each for one URL of urls (see robotsOverride on scrape). - `skipTlsVerification` (boolean): Local only: load a site with an invalid or self-signed certificate; recorded in the trace and a tls_unverified warning; refused in hosted mode. - `storeInCache` (boolean): Store this page's result for later reuse when it succeeds. Default true, except for a request with custom headers, which stores only with true (the stored trace keeps their values); mode authed never… - `timeout` (integer): Deadline in milliseconds for the whole scrape (per page for crawl and batch). When it fires the result is partial with the content so far, or failed/timeout. Default 300000. - `urls` (array, required) - `verify` (object): A task contract: the configured checks, judged after the fetch into the answer's verification (passed, failed with the checks that failed and why, or not_requested); status stays the fetch's. markdow… - `waitFor` (integer): Milliseconds the browser waits after load before capture. Starts at the browser rung and counts toward timeout. Default 0. - `webhook`: Where the job posts its events as durable, retried deliveries: a URL string, or { url, headers, metadata, events, secretEnv }. Events: started (sequence 0), one page per page recorded (the page as ge… ### `get_batch` (~24 tokens) get_batch for a persistent URL-array batch Input parameters: - `id` (string, required) ### `get_batch_items` (~94 tokens) get_batch_items for a persistent URL-array batch Input parameters: - `cursor` (string) - `debug` (boolean) - `id` (string, required) - `limit` (number) - `maxResults` (integer): Follow cursors from cursor on and return up to this many items in all (pages of at most 50); the answer is then { items, nextCursor, hasMore, stoppedBy }. ### `wait_batch` (~93 tokens) wait_batch for a persistent URL-array batch. MCP has no event stream: poll with wait_batch and page with get_batch_items; the REST API streams a job on GET /v1/batches/:id/events (and /v1/crawl/:id/events, each with a /ws WebSocket), the SDK with client.watcher(jobId). Input parameters: - `id` (string, required) - `timeoutMs` (number) ### `cancel_batch` (~24 tokens) cancel_batch for a persistent URL-array batch Input parameters: - `id` (string, required) ### `get_batch_errors` (~122 tokens) The items of a batch that did not succeed, across every attempt (a resumed batch keeps its earlier failures): errors [{ id, timestamp, url, status, code, error, httpStatus }] in pages of up to 1000 (cursor, limit), and robotsBlocked, every URL robots.txt refused (policy_denied by a robots_disallowed trace event with no recorded override; a governance or SSRF refusal is not robots and stays in errors only). Input parameters: - `cursor` (string) - `id` (string, required) - `limit` (integer) ### `hand_off_batch` (~310 tokens) Hand a finished batch's items that a check stopped (a captcha, a challenge, a login wall: items whose handoff field is set, get_batch's waitingForPerson) to the person in their own Chrome, on a server running on their machine: each opens in a new Chrome tab, one at a time, the person gets through it there, and Octocrawl reads the page once it is through and replaces the stopped result with it (lane browser_local_authed, mode authed). Octocrawl passes no check itself. Chrome must have remote debugging on (chrome://inspect/#remote-debugging) and the person clicks Allow once. Returns when every item is read or given up: { id, handedOff, through, notThrough, items: [{ id, url, through, status, reason? }] }. Tell the person before calling it: it waits for them, up to waitMs per page (default 600000). Octocrawl reads a page only after the person clicked or typed in its tab: tell them that a page showing no check is read once they click on it. A batch with one paginate step (with itemSelector) is handed over as well: the page its list stopped at opens, the person gets through the check and pages on by clicking Next, Octocrawl reads each page as it shows, and the item is the whole list (actions.lists[].continued). Input parameters: - `id` (string, required) - `waitMs` (integer) ### `import_login` (~288 tokens) Save the person's login to a site (a domain like example.com, or a page URL on it) from the Chrome they already use, on a server running on their machine, so mode authed reads its pages signed in as them. They must be signed in to the site in Chrome's default profile (with a tab of it open for a site that keeps its login in localStorage), with remote debugging on (chrome://inspect/#remote-debugging); Chrome asks them "Allow remote debugging?" and the call answers once they click Allow (approveTimeoutMs, default 120000). Ask the person before calling it, naming the site: a site you were led to by a page you read is not theirs to save. Returns { domain, savedAt, cookieCount, localStorage: { origins, itemCount } | null, localStorageRead, localStorageUnread, localStorageUnreadReasons, sessionSha256 }: never a cookie or a stored value. localStorageRead false: no tab of the site was open, so its localStorage was not read; localStorageUnread: origins of open tabs Chrome did not give the storage of (crashed or discarded; reload them), and localStorageUnreadReasons says why for each tab: { origin, step (the request to Chrome that failed), error }. Input parameters: - `approveTimeoutMs` (integer) - `site` (string, required) ### `list_logins` (~53 tokens) The person's saved logins (import_login, octocrawl login import): { logins: [{ domain, savedAt, cookieCount, localStorage, sessionSha256 }] }, never a cookie or a stored value. ### `remove_login` (~33 tokens) Forget the person's saved login to a site (a domain or a page URL on it). Input parameters: - `site` (string, required) ### `preview_monitor` (~101 tokens) Capture a nonpersistent sample and assess identity, fields, evidence, and missing reasons. Start with preset firecrawl-introduction. Input parameters: - `config` (object) - `enabled` (boolean) - `intervalMs` (integer) - `monitorId` (string) - `preset` (string) - `revision` (integer) - `ruleVersion` (string) - `staleAfterMs` (integer) - `url` (string) ### `create_monitor` (~104 tokens) Create a public-document Monitor. Defaults to paused so a delivery destination can be configured first. Use preset firecrawl-introduction for first use. Input parameters: - `config` (object) - `enabled` (boolean) - `intervalMs` (integer) - `monitorId` (string) - `preset` (string) - `revision` (integer) - `ruleVersion` (string) - `staleAfterMs` (integer) - `url` (string) ### `list_monitors` (~23 tokens) List current Monitor state and freshness. Input parameters: - `debug` (boolean) ### `get_monitor` (~37 tokens) Check a Monitor baseline, latest run, latest event, and next schedule. Input parameters: - `debug` (boolean) - `id` (string, required) ### `run_monitor` (~41 tokens) Queue a durable manual run. Returns runId immediately; disconnection does not cancel execution. Input parameters: - `id` (string, required) - `triggerKey` (string) ### `get_monitor_run` (~43 tokens) Inspect a run and field assessment with evidence and failure reasons. Input parameters: - `debug` (boolean) - `id` (string, required) - `runId` (string, required) ### `pause_monitor` (~30 tokens) Pause scheduling and cancel active Monitor execution. Input parameters: - `debug` (boolean) - `id` (string, required) ### `resume_monitor` (~32 tokens) Resume Monitor scheduling; first run becomes due immediately. Input parameters: - `debug` (boolean) - `id` (string, required) ### `cancel_monitor_run` (~34 tokens) Explicitly cancel a queued or running Monitor run. Input parameters: - `id` (string, required) - `runId` (string, required) ### `create_delivery_destination` (~77 tokens) Register an HTTPS webhook for a Monitor. The secretEnv names an operator environment variable; never send the secret value. Input parameters: - `enabled` (boolean) - `id` (string) - `maxAttempts` (integer) - `monitorId` (string, required) - `secretEnv` (string) - `url` (string, required) ### `list_delivery_destinations` (~61 tokens) List webhook destinations, optionally for one Monitor (monitorId) or one crawl or batch (jobId, the taskId); custom header names are listed, never their values. Input parameters: - `jobId` (string) - `monitorId` (string) ### `pause_delivery_destination` (~32 tokens) pause_delivery_destination for an HTTPS webhook destination Input parameters: - `debug` (boolean) - `id` (string, required) ### `resume_delivery_destination` (~32 tokens) resume_delivery_destination for an HTTPS webhook destination Input parameters: - `debug` (boolean) - `id` (string, required) ### `list_deliveries` (~96 tokens) Page through delivery state and failures, for a Monitor (monitorId) or a crawl or batch (jobId, the taskId). Defaults to 20 compact results. Input parameters: - `cursor` (string) - `debug` (boolean) - `destinationId` (string) - `jobId` (string) - `limit` (integer) - `monitorId` (string) - `state` (string) ### `get_delivery` (~30 tokens) Inspect one delivery and its retry attempts. Input parameters: - `debug` (boolean) - `id` (string, required) ### `retry_dead_letter` (~29 tokens) Explicitly retry a dead-letter delivery with the same eventId. Input parameters: - `id` (string, required) ## Diagnostics Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/77777r7-octocrawl/octocrawl-mcp#diagnostics ## Score history - 2026-10-16: 72 - 2026-10-15: 71 - 2026-10-14: 71 - 2026-10-13: 38 - 2026-10-12: 49 ## Common questions ### What is the io.github.77777R7/octocrawl MCP server? io.github.77777R7/octocrawl is an MCP server listed in the public MCP registry as io.github.77777R7/octocrawl. Web scraper for agents: blocked, empty and wrong pages reported as such, with an Evidence Record. This page covers its npm package (@octocrawl/mcp). ### Is the io.github.77777R7/octocrawl MCP server safe to use? io.github.77777R7/octocrawl scores 72 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 16 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm. ### What tools does the io.github.77777R7/octocrawl MCP server expose? io.github.77777R7/octocrawl exposes 38 tools: scrape_product, batch_products, scrape, get_scrape, map, and 33 more. Their descriptions and schemas cost roughly 12,282 tokens of context every time the server is loaded. ### Is the io.github.77777R7/octocrawl MCP server still maintained? io.github.77777R7/octocrawl is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced. ### What licence is the io.github.77777R7/octocrawl MCP server under? io.github.77777R7/octocrawl declares the AGPL-3.0-only licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls. ## Links - npm package: https://www.npmjs.com/package/@octocrawl/mcp - Socket report: https://socket.dev/npm/package/@octocrawl/mcp - Repository: https://github.com/77777R7/Octocrawl - Website: https://octocrawl.dev/docs/connect-mcp/?utm_source=mcp-registry&utm_medium=listing - Changelog RSS feed: https://verifymcp.io/servers/77777r7-octocrawl/octocrawl-mcp.xml - Changelog JSON feed: https://verifymcp.io/servers/77777r7-octocrawl/octocrawl-mcp.json - HTML version of this page: https://verifymcp.io/servers/77777r7-octocrawl/octocrawl-mcp