Litescrape
NPM · LITESCRAPE-MCP-SERVER · 2 COMPONENTS
Google, Bing, DuckDuckGo and Google Maps search results, free without an API key.
Available components
Last scanned (4 hours ago)
Scores higher than 87% of npm servers
Category Search and Retrieval
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to litescrape/litescrape-mcp-server). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 16 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability57
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3445 tokens (~382/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 97% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Nov 26 −2
- Stability: pass → 0.83 functional
- 29 Oct 26 0
- Stability: 0.97 → pass security
- 28 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −6
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 22 Oct 26 +1
- Stability: 0.97 → pass security
- 21 Oct 26 −1
- Stability: pass → 0.97 functional
- 17 Oct 26 +3
- Stability: 0.80 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/litescrape-mcp-server@0.2.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | litescrape/litescrape-mcp-server |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/litescrape/litescrape-mcp-server/.github/workflows/publish.yml@refs/tags/0.2.0 |
| Rekor log index | 2849496528 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:af792060182b5cc34d179ae6e33b4f4be7ad4fe4953d34ed777d115b3ef3d3ec2d618e01355dedc5574329694d2504db1727af0e7fba723bdc4ba8b26 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bing_search Bing Search ~241
Fetch a Bing web search results page as JSON: organic_results plus the modules Bing served (answer_box, knowledge_graph, copilot_answer, ads, related_questions, inline_videos, top_stories and more). Free without an API key: 50 calls per network per day.
| Name | Type | Req | Description |
|---|---|---|---|
| cc | string | – | Two-letter country code; conflicts with mkt |
| device | string | – | Layout to request; default desktop |
| filters | string | – | Native Bing display or date filters |
| first | integer | – | One-based organic result offset for pagination; default 1 |
| lat | number | – | Latitude; supply together with lon |
| location | string | – | City-level search origin |
| lon | number | – | Longitude; supply together with lat |
| mkt | string | – | Market such as en-US; conflicts with cc |
| q | string | yes | Search query; Bing operators are preserved |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| safeSearch | string | – | Default moderate |
No output schema declared.
No examples provided.
duckduckgo_search DuckDuckGo Search ~204
Fetch ranked DuckDuckGo web results (organic_results with title, link, snippet) with region, safety and date controls. Free without an API key: 50 calls per network per day.
| Name | Type | Req | Description |
|---|---|---|---|
| df | string | – | Date filter: d, w, m, y, or YYYY-MM-DD..YYYY-MM-DD |
| kl | string | – | Region and language token such as us-en |
| m | integer | – | Result count 1-50; cannot be combined with search_assist |
| q | string | yes | Search query |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| safe | string | – | 1 strict, -1 moderate (default), -2 off |
| search_assist | boolean | – | Default true; cannot be combined with m |
| start | integer | – | Result offset |
No output schema declared.
No examples provided.
google_ai_mode Google AI Mode ~318
Ask Google AI Mode a question and return its generated answer (ordered text_blocks: paragraphs, headings, lists, tables, code) with the sources it cited (references). Set continuable to get a token for follow-up questions; image_url adds a picture to the prompt. Slow: answers are generated per request. Requires an API key.
| Name | Type | Req | Description |
|---|---|---|---|
| continuable | boolean | – | Return a subsequent_request_token so the conversation can continue |
| device | string | – | Layout to request; default desktop |
| gl | string | – | Two-letter country for localization, e.g. "us" |
| google_domain | string | – | Google domain such as google.co.uk; default google.com |
| hl | string | – | Language code such as "en" or "en-GB"; default en |
| image_url | string | – | Public http(s) image to include in the prompt; cannot combine with a token |
| location | string | – | Named search origin such as "Austin, Texas"; conflicts with uule and lat/lon |
| q | string | yes | The question to ask |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| subsequent_request_token | string | – | Token from a previous continuable answer; send with a new q. Expires after 30 minutes; cannot combine with image_url |
| uule | string | – | Pre-encoded Google location token; conflicts with location |
No output schema declared.
No examples provided.
google_ai_overview Google AI Overview ~502
Return only the AI Overview Google generates for a search (ai_overview with ordered text_blocks and cited references), or null when Google shows none. Accepts the google_search parameters. Requires an API key.
| Name | Type | Req | Description |
|---|---|---|---|
| as_qdr | string | – | Date range: d, w, m or y with an optional count, e.g. d7 for the past week |
| as_sitesearch | string | – | Restrict results to this hostname |
| cr | string | – | Country restrict such as countryUS|countryCA |
| device | string | – | Layout to request; default desktop |
| filter | string | – | 0 disables duplicate-content filtering |
| gl | string | – | Two-letter country for localization, e.g. "us" |
| google_domain | string | – | Google domain such as google.co.uk; default google.com |
| hl | string | – | Language code such as "en" or "en-GB"; default en |
| kgmid | string | – | Knowledge Graph machine ID such as /m/0k8z |
| lat | number | – | Latitude; supply together with lon |
| location | string | – | Named search origin such as "Austin, Texas"; conflicts with uule and lat/lon |
| lon | number | – | Longitude; supply together with lat |
| lr | string | – | Language restrict such as lang_en|lang_fr |
| ludocid | string | – | Google CID of a local entity, for a targeted lookup |
| nfpr | string | – | 1 disables spelling auto-correction |
| num | integer | – | Requested result count, 1-100; Google may return fewer |
| q | string | – | Search query; required unless ludocid or kgmid is supplied |
| radius | number | – | Radius in meters around the location or coordinates |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| safe | string | – | SafeSearch |
| start | integer | – | Result offset for pagination |
| tbm | string | – | Vertical: lcl local, vid videos, nws news, shop shopping, pts patents |
| tbs | string | – | Google search-filter string, e.g. qdr:w for the past week |
| uule | string | – | Pre-encoded Google location token; conflicts with location |
No output schema declared.
No examples provided.
google_maps Google Maps ~489
Search Google Maps for places (local_results with name, address, rating, reviews, hours, phone, website, coordinates) or fetch one exact place (place_results) by place_id, data_cid or data sequence. Filter by price, rating and opening hours. Free without an API key: 50 calls per network per day.
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | – | Exact place by Google Maps data sequence |
| data_cid | string | – | Exact place by decimal Google CID |
| gl | string | – | Two-letter country for localization, e.g. "us" |
| google_domain | string | – | Google domain such as google.co.uk; default google.com |
| hl | string | – | Language code such as "en" or "en-GB"; default en |
| lat | number | – | Latitude; supply together with lon |
| ll | string | – | Viewport as @lat,lon,14z or @lat,lon,5000m |
| location | string | – | Named search origin such as "Austin, Texas"; conflicts with uule and lat/lon |
| lon | number | – | Longitude; supply together with lat |
| m | number | – | Radius in meters; use with location or lat/lon |
| max_price | integer | – | Price level upper bound |
| min_price | integer | – | Price level lower bound |
| min_rating | string | – | Minimum rating preference |
| nearby | boolean | – | Restrict results to places near the viewport |
| open_at_hour | integer | – | Hour 0-23; requires open_on_day |
| open_on_day | string | – | – |
| open_state | string | – | Open now, or open 24 hours; cannot combine with open_on_day |
| place_id | string | – | Exact place by Google place ID |
| q | string | – | Search text; required for type=search |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| start | integer | – | Native Maps result offset |
| type | string | – | search (default) for a query, or place for one exact place identified by place_id, data_cid or data |
| z | number | – | Zoom 3-30; use with location or lat/lon |
No output schema declared.
No examples provided.
google_reviews Google Reviews ~347
Return the Google Maps reviews of one place (reviews with rating, snippet, author, date, likes, owner response, guided details and dining subratings) plus place_info. Identify the place by place_id or data_id from a google_maps result. Sort, filter by topic or text, and follow pagination.next_page_token for more. Requires an API key.
| Name | Type | Req | Description |
|---|---|---|---|
| data_id | string | – | Google data ID such as 0x89c2...:0x...; exactly one of place_id and data_id |
| gl | string | – | Two-letter country for localization, e.g. "us" |
| hl | string | – | Language code such as "en" or "en-GB"; default en |
| next_page_token | string | – | pagination.next_page_token from the previous response; keep the same place, sort and filters |
| num | integer | – | Reviews to return: 1-100 on a first unfiltered request (default 8), 1-20 with topic_id, query or next_page_token (default 10) |
| place_id | string | – | Google place ID such as ChIJ...; exactly one of place_id and data_id |
| query | string | – | Keep reviews mentioning this text; conflicts with topic_id |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| sort_by | string | – | Order: qualityScore (most relevant, default), newestFirst, ratingHigh, ratingLow |
| topic_id | string | – | Keep reviews on one Google review topic; conflicts with query |
No output schema declared.
No examples provided.
google_search Google Search ~577
Fetch a first-party Google Search results page as JSON: organic_results plus whichever modules Google served (knowledge_graph, answer_box, ai_overview, ads, related_questions, related_searches, local_results, top_stories, inline_videos and more). Supports localization, verticals (news, videos, local, shopping, patents), date filters and site restriction. Free without an API key: 25 calls per network per day.
| Name | Type | Req | Description |
|---|---|---|---|
| as_qdr | string | – | Date range: d, w, m or y with an optional count, e.g. d7 for the past week |
| as_sitesearch | string | – | Restrict results to this hostname |
| cr | string | – | Country restrict such as countryUS|countryCA |
| device | string | – | Layout to request; default desktop |
| fast_mode | boolean | – | true returns only organic_results (faster and smaller); skips AI Overview, Knowledge Graph, ads and every other module |
| filter | string | – | 0 disables duplicate-content filtering |
| gl | string | – | Two-letter country for localization, e.g. "us" |
| google_domain | string | – | Google domain such as google.co.uk; default google.com |
| hl | string | – | Language code such as "en" or "en-GB"; default en |
| kgmid | string | – | Knowledge Graph machine ID such as /m/0k8z |
| lat | number | – | Latitude; supply together with lon |
| location | string | – | Named search origin such as "Austin, Texas"; conflicts with uule and lat/lon |
| lon | number | – | Longitude; supply together with lat |
| lr | string | – | Language restrict such as lang_en|lang_fr |
| ludocid | string | – | Google CID of a local entity, for a targeted lookup |
| nfpr | string | – | 1 disables spelling auto-correction |
| num | integer | – | Requested result count, 1-100; Google may return fewer |
| q | string | – | Search query; required unless ludocid or kgmid is supplied |
| radius | number | – | Radius in meters around the location or coordinates |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| safe | string | – | SafeSearch |
| start | integer | – | Result offset for pagination |
| tbm | string | – | Vertical: lcl local, vid videos, nws news, shop shopping, pts patents |
| tbs | string | – | Google search-filter string, e.g. qdr:w for the past week |
| uule | string | – | Pre-encoded Google location token; conflicts with location |
No output schema declared.
No examples provided.
google_shopping Google Shopping ~357
Search Google Shopping and return the product grid (shopping_results with title, price, source, rating, thumbnail), category blocks, sponsored listings and the refinement chips Google renders (filters). Price bounds, sale, shipping and small business refinements are mutually exclusive; sort_by combines with one of them. Requires an API key.
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Layout to request; default desktop |
| free_shipping | boolean | – | – |
| gl | string | – | Two-letter country for localization, e.g. "us" |
| google_domain | string | – | Google domain such as google.co.uk; default google.com |
| hl | string | – | Language code such as "en" or "en-GB"; default en |
| location | string | – | Named search origin such as "Austin, Texas"; conflicts with uule and lat/lon |
| max_price | number | – | Upper price bound |
| min_price | number | – | Lower price bound |
| num | integer | – | Product count, 1-100 |
| on_sale | boolean | – | – |
| q | string | – | Product query; required unless shoprs is supplied |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| shoprs | string | – | Refinement token from a previous response's filters |
| small_business | boolean | – | – |
| sort_by | string | – | 1 price low to high, 2 price high to low, 3 rating, 4 relevance |
| start | integer | – | Result offset |
| uule | string | – | Pre-encoded Google location token; conflicts with location |
No output schema declared.
No examples provided.
search Web search ~205
Search the web through Google and return ranked organic results (title, link, snippet) as JSON. Fast mode: no Knowledge Graph, ads or AI modules; use google_search for the full results page. Free without an API key (shares the google_search allowance).
| Name | Type | Req | Description |
|---|---|---|---|
| gl | string | – | Two-letter country for localization, e.g. "us" |
| hl | string | – | Language code such as "en" or "en-GB"; default en |
| location | string | – | Named search origin such as "Austin, Texas"; conflicts with uule and lat/lon |
| num | integer | – | Requested result count, 1-100; Google may return fewer |
| q | string | yes | What to search for |
| result_groups | array | – | Return only these top-level result groups, e.g. ["organic_results", "knowledge_graph"]; omit for the complete response. search_metadata is always kept |
| start | integer | – | Result offset for pagination |
No output schema declared.
No examples provided.
How do I install the Litescrape MCP server?
Litescrape runs locally as an npm package, launched with npx -y litescrape-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · litescrape-mcp-server
claude mcp add com-litescrape-litescrape-mcp-server -- npx -y litescrape-mcp-server
What is the Litescrape MCP server?
Litescrape is an MCP server listed in the public MCP registry as com.litescrape/litescrape-mcp-server. Google, Bing, DuckDuckGo and Google Maps search results, free without an API key. This page covers its npm package (litescrape-mcp-server).
Is the Litescrape MCP server safe to use?
Litescrape scores 85 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Litescrape MCP server expose?
Litescrape exposes 9 tools: search, google_search, bing_search, duckduckgo_search, google_maps, and 4 more. Their descriptions and schemas cost roughly 3,240 tokens of context every time the server is loaded.
Is the Litescrape MCP server still maintained?
Litescrape is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Litescrape MCP server under?
Litescrape declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.