io.github.Custodia-Admin/pagebolt
NPM · PAGEBOLT-MCP · SCANNED SEP 20
Screenshots, PDFs, OG images, page inspection, and narrated video recording for Claude and Cursor.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 45 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability71
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 4554 tokens (~379/item across 12 items; 11 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "run_sequence" implies "execute" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.Custodia-Admin/pagebolt MCP server?
io.github.Custodia-Admin/pagebolt runs locally as an npm package, launched with npx -y pagebolt-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · pagebolt-mcp
claude mcp add custodia-admin-pagebolt -- npx -y pagebolt-mcp
{
"mcpServers": {
"custodia-admin-pagebolt": {
"command": "npx",
"args": [
"-y",
"pagebolt-mcp"
]
}
}
} {
"servers": {
"custodia-admin-pagebolt": {
"command": "npx",
"args": [
"-y",
"pagebolt-mcp"
]
}
}
} codex mcp add custodia-admin-pagebolt -- npx -y pagebolt-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"custodia-admin-pagebolt": {
"type": "local",
"command": [
"npx",
"-y",
"pagebolt-mcp"
],
"enabled": true
}
}
} openclaw mcp add custodia-admin-pagebolt --command npx --arg -y --arg pagebolt-mcp
mcp_servers:
custodia-admin-pagebolt:
command: "npx"
args: ["-y", "pagebolt-mcp"] {
"McpServers": {
"custodia-admin-pagebolt": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"pagebolt-mcp"
]
}
}
} assistant mcp add custodia-admin-pagebolt -t stdio -c npx -a -y pagebolt-mcp
{
"mcpServers": {
"custodia-admin-pagebolt": {
"command": "npx",
"args": [
"-y",
"pagebolt-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 19 Sept 26 +1
- Security disclosure: fail → unverified ▼ functional
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 −3
- Stability: pass → 0.80 functional
- 14 Sept 26 +1
- Stability: 0.97 → pass security
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/pagebolt-mcp@1.8.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_usage ~19
Check your current PageBolt API usage and plan limits.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
create_og_image ~221
Generate an Open Graph / social card image. Returns an image using built-in templates or custom HTML.
| Name | Type | Req | Description |
|---|---|---|---|
| accentColor | string | – | Accent color as hex, e.g. "#6366f1" |
| bgColor | string | – | Background color as hex, e.g. "#0f172a" |
| bgImage | string | – | Background image URL |
| format | string | – | Image format (default: png) |
| height | integer | – | Image height in pixels (default: 630) |
| html | string | – | Custom HTML template (overrides template parameter, Growth plan+) |
| logo | string | – | Logo image URL |
| subtitle | string | – | Subtitle text |
| template | string | – | Built-in template name (default: "default") |
| textColor | string | – | Text color as hex, e.g. "#f8fafc" |
| title | string | – | Main title text (default: "Your Title Here") |
| width | integer | – | Image width in pixels (default: 1200) |
No output schema declared.
No examples provided.
create_session ~155
Create a persistent browser session (Starter+ plan required). The session keeps a live browser page open so you can reuse cookies, localStorage, and auth state across multiple take_screenshot or run_sequence calls. Pass the returned session_id to those tools. Sessions expire after 10 minutes of inactivity (hard cap: 30 minutes). Useful for AI agent workflows that log in once and then take multiple screenshots of authenticated pages.
| Name | Type | Req | Description |
|---|---|---|---|
| cookies | array | – | Cookies to pre-load into the session browser page |
| stealth | boolean | – | Launch this session with stealth mode (bypasses bot detection). Note: stealth sessions use a dedicated browser and consume more memory. |
| viewport | object | – | Viewport dimensions for the session browser page |
No output schema declared.
No examples provided.
destroy_session ~58
Explicitly destroy a persistent browser session before it expires. Frees the browser page immediately. Use this when you are done with a session to free up capacity.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | The session ID to destroy (returned by create_session) |
No output schema declared.
No examples provided.
generate_pdf ~316
Generate a PDF from a URL or HTML content. Supports custom margins, headers/footers, page ranges, and scaling. Saves the PDF to disk and returns the file path.
| Name | Type | Req | Description |
|---|---|---|---|
| delay | integer | – | Milliseconds to wait before rendering (default: 0) |
| displayHeaderFooter | boolean | – | Show header and footer (default: false) |
| footerTemplate | string | – | HTML template for page footer |
| format | string | – | Paper format: A4, Letter, Legal, Tabloid, A3, A5 (default: A4) |
| headerTemplate | string | – | HTML template for page header (uses Chromium templating) |
| html | string | – | Raw HTML to render as PDF (required if no url) |
| landscape | boolean | – | Landscape orientation (default: false) |
| margin | – | – | CSS margin — string for all sides (e.g. "1cm") or object { top, right, bottom, left } |
| pageRanges | string | – | Page ranges to include, e.g. "1-5, 8" |
| printBackground | boolean | – | Include CSS backgrounds (default: true) |
| saveTo | string | – | Output file path (default: ./output.pdf) |
| scale | number | – | Rendering scale 0.1-2 (default: 1) |
| url | string | – | URL to render as PDF (required if no html) |
| width | string | – | Page width (overrides format) — CSS value like "8.5in" |
No output schema declared.
No examples provided.
inspect_page ~570
Inspect a web page and get a structured map of all interactive elements, headings, forms, links, and images — each with a unique CSS selector. Use this BEFORE run_sequence or record_video to discover what elements exist on the page and get reliable selectors. Returns text (not an image), so it is fast and cheap. Costs 1 API request.
| Name | Type | Req | Description |
|---|---|---|---|
| authorization | string | – | Authorization header value (e.g. "Bearer <token>") |
| blockAds | boolean | – | Block advertisements on the page |
| blockBanners | boolean | – | Hide cookie consent banners (default: false) |
| blockChats | boolean | – | Block live chat widgets |
| blockRequests | array | – | URL patterns to block |
| blockResources | array | – | Resource types to block |
| blockTrackers | boolean | – | Block tracking scripts |
| bypassCSP | boolean | – | Bypass Content-Security-Policy on the page |
| cookies | array | – | Cookies to set — array of "name=value" strings or { name, value, domain? } objects |
| darkMode | boolean | – | Emulate dark color scheme (default: false) |
| deviceScaleFactor | number | – | Device pixel ratio (default: 1) |
| geolocation | object | – | Emulate geolocation |
| headers | object | – | Extra HTTP headers to send with the request |
| height | integer | – | Viewport height in pixels (default: 720) |
| hideSelectors | array | – | Array of CSS selectors to hide before inspecting |
| html | string | – | Raw HTML to inspect (required if no url) |
| injectCss | string | – | Custom CSS to inject before inspecting |
| injectJs | string | – | Custom JavaScript to execute before inspecting |
| mediaType | string | – | Emulate CSS media type |
| navigationTimeout | integer | – | Navigation timeout in ms (default: 25000) |
| reducedMotion | boolean | – | Emulate prefers-reduced-motion |
| timeZone | string | – | Override browser timezone |
| url | string | – | URL to inspect (required if no html) |
| userAgent | string | – | Override the browser User-Agent string |
| viewportDevice | string | – | Device preset for viewport emulation (e.g. "iphone_14_pro"). Use list_devices to see all presets. |
| viewportHasTouch | boolean | – | Enable touch event emulation |
| viewportLandscape | boolean | – | Landscape orientation |
| viewportMobile | boolean | – | Enable mobile meta viewport emulation |
| waitForSelector | string | – | Wait for this CSS selector to appear before inspecting |
| waitUntil | string | – | When to consider navigation finished (default: networkidle2) |
| width | integer | – | Viewport width in pixels (default: 1280) |
No output schema declared.
No examples provided.
list_devices ~47
List all available device presets for viewport emulation (e.g. iphone_14_pro, macbook_pro_14). Use the returned device names with the viewportDevice parameter in take_screenshot.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_sessions ~43
List all active persistent browser sessions for your API key. Returns session IDs, creation times, and expiry times. Useful for checking which sessions are still alive before reusing them.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
record_video ~619
Record a professional demo video of a multi-step browser automation sequence. Produces MP4/WebM/GIF with cursor highlighting, click effects, smooth movement, step notes, browser frame (macOS/Windows), gradient/glass backgrounds, and more. Costs 3 API requests. Saves to disk. BEST PRACTICE: Keep videos concise (5-15 action steps). Do NOT add wait steps between every action — the pace parameter handles timing. Only use wait for page loads or narration holds. Do NOT use zoom unless the user explicitly asks for it.
| Name | Type | Req | Description |
|---|---|---|---|
| audioGuide | object | – | Audio Guide TTS settings. Two modes: (1) Per-step — add "narration" to individual steps. (2) Script — provide "script" with {{N}} markers for continuous narration synchronized to steps. |
| autoZoom | boolean | – | Enable auto-zoom on all clicks (default: false). Only use when user explicitly requests zoom. |
| background | object | – | Styled background behind the video. Adds gradient/solid background with padding and rounded corners — creates a "floating window" effect. |
| blockAds | boolean | – | Block advertisements on the page |
| blockBanners | boolean | – | Hide cookie consent banners (default: true for videos) |
| blockChats | boolean | – | Block live chat widgets |
| blockTrackers | boolean | – | Block tracking scripts |
| clickEffect | object | – | Visual click effect settings |
| cursor | object | – | Cursor appearance settings |
| darkMode | boolean | – | Emulate dark color scheme (default: false) |
| deviceScaleFactor | number | – | Device pixel ratio (default: 1) |
| format | string | – | Video format (default: mp4). webm/gif require Starter+ plan. |
| frame | object | – | Browser chrome frame around the video. Adds a macOS/Windows-style title bar. |
| framerate | integer | – | Frames per second: 24, 30, or 60 (default: 30) |
| pace | – | – | Controls how deliberate the video feels. Number (0.25–6.0, higher = slower) or preset: "fast" (0.5×), "normal" (1×), "slow" (2×), "dramatic" (3×), "cinematic" (4.5×). Default: "normal". |
| saveTo | string | – | Output file path (default: ./recording.mp4) |
| steps | array | yes | Array of action steps to record. Keep concise: 5-15 steps is ideal. Do NOT pad with wait steps — pace handles timing. |
| variables | object | – | Key-value map for variable substitution in step URLs/values. E.g. { "base_url": "https://example.com" } replaces {{base_url}} in steps. |
| viewport | object | – | Browser viewport size |
| zoom | object | – | Global zoom settings. Only use when the user explicitly requests zoom. Do NOT enable by default. |
No output schema declared.
No examples provided.
run_sequence ~228
Execute a multi-step browser automation sequence. Navigate pages, interact with elements (click, fill, select), and capture multiple screenshots/PDFs in a single browser session. Each output counts as 1 API request.
| Name | Type | Req | Description |
|---|---|---|---|
| blockAds | boolean | – | Block advertisements on the page |
| blockBanners | boolean | – | Hide cookie consent banners (default: false) |
| blockChats | boolean | – | Block live chat widgets |
| blockTrackers | boolean | – | Block tracking scripts |
| darkMode | boolean | – | Emulate dark color scheme (default: false) |
| deviceScaleFactor | number | – | Device pixel ratio (default: 1) |
| session_id | string | – | Persistent session ID (Starter+ only). Reuse a live browser page created with create_session — browser state (cookies, localStorage, auth) carries over from previous requests in this session. |
| steps | array | yes | Array of steps to execute in order. Must include at least one screenshot or pdf step. Max 20 steps, max 5 outputs. |
| viewport | object | – | Browser viewport size |
No output schema declared.
No examples provided.
take_screenshot ~963
Capture a screenshot of a URL, HTML, or Markdown content. Supports device emulation, ad/chat/tracker blocking, metadata extraction, geolocation, timezone, styling (macOS/Windows frames, gradient/glass backgrounds, shadows), and more. Returns an image (PNG, JPEG, or WebP).
| Name | Type | Req | Description |
|---|---|---|---|
| authorization | string | – | Authorization header value (e.g. "Bearer <token>") |
| blockAds | boolean | – | Block advertisements on the page |
| blockBanners | boolean | – | Hide cookie consent banners (default: false) |
| blockChats | boolean | – | Block live chat widgets on the page |
| blockRequests | array | – | URL patterns to block (array of strings) |
| blockResources | array | – | Resource types to block (e.g. ["image", "font"]) |
| blockTrackers | boolean | – | Block tracking scripts on the page |
| bypassCSP | boolean | – | Bypass Content-Security-Policy on the page |
| click | string | – | CSS selector to click before capturing the screenshot |
| clip | object | – | Crop region { x, y, width, height } in pixels |
| cookies | array | – | Cookies to set — array of "name=value" strings or { name, value, domain? } objects |
| darkMode | boolean | – | Emulate dark color scheme (default: false) |
| delay | integer | – | Milliseconds to wait before capture (default: 0) |
| deviceScaleFactor | number | – | Device pixel ratio, use 2 for retina (default: 1) |
| extractMetadata | boolean | – | Extract page metadata (title, description, OG tags) alongside the screenshot |
| format | string | – | Image format (default: png) |
| fullPage | boolean | – | Capture the full scrollable page (default: false) |
| fullPageMaxHeight | integer | – | Maximum pixel height cap for full-page captures |
| fullPageScroll | boolean | – | Auto-scroll page before capture to trigger lazy-loaded images |
| fullPageScrollBy | integer | – | Pixels to scroll per step (default: viewport height) |
| fullPageScrollDelay | integer | – | Delay between scroll steps in ms (default: 400) |
| geolocation | object | – | Emulate geolocation { latitude, longitude, accuracy? } |
| headers | object | – | Extra HTTP headers to send with the request |
| height | integer | – | Viewport height in pixels (default: 720) |
| hideSelectors | array | – | Array of CSS selectors to hide before capture |
| html | string | – | Raw HTML to render (required if no url/markdown) |
| injectCss | string | – | Custom CSS to inject before capturing (max 50KB) |
| injectJs | string | – | Custom JavaScript to execute before capturing (max 50KB) |
| markdown | string | – | Render Markdown content as a screenshot |
| mediaType | string | – | Emulate CSS media type |
| navigationTimeout | integer | – | Navigation timeout in ms (default: 25000) |
| omitBackground | boolean | – | Transparent background (PNG/WebP only) |
| quality | integer | – | JPEG/WebP quality 1-100 (default: 80) |
| reducedMotion | boolean | – | Emulate prefers-reduced-motion to disable animations |
| selector | string | – | CSS selector to capture a specific element |
| session_id | string | – | Persistent session ID (Starter+ only). Reuse a live browser page created with create_session — browser state (cookies, localStorage, auth) carries over from previous requests in this session. |
| style | object | – | Screenshot styling options — add a macOS/Windows frame, gradient/glass background, shadow, and rounded corners. Use the "theme" shortcut for one-click presets, or customize individual properties. |
| timeZone | string | – | Override browser timezone (e.g. "America/New_York") |
| url | string | – | URL to capture (required if no html/markdown) |
| userAgent | string | – | Override the browser User-Agent string |
| viewportDevice | string | – | Device preset for viewport emulation (e.g. "iphone_14_pro", "macbook_pro_14"). Use list_devices to see all presets. |
| viewportHasTouch | boolean | – | Enable touch event emulation |
| viewportLandscape | boolean | – | Landscape orientation |
| viewportMobile | boolean | – | Enable mobile meta viewport emulation |
| waitForSelector | string | – | Wait for this CSS selector to appear before capturing |
| waitUntil | string | – | When to consider navigation finished (default: networkidle2) |
| width | integer | – | Viewport width in pixels (default: 1280) |
No output schema declared.
No examples provided.
What is the io.github.Custodia-Admin/pagebolt MCP server?
io.github.Custodia-Admin/pagebolt is an MCP server listed in the public MCP registry as io.github.Custodia-Admin/pagebolt. Screenshots, PDFs, OG images, page inspection, and narrated video recording for Claude and Cursor. This page covers its npm package (pagebolt-mcp).
Is the io.github.Custodia-Admin/pagebolt MCP server safe to use?
io.github.Custodia-Admin/pagebolt scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Custodia-Admin/pagebolt MCP server expose?
io.github.Custodia-Admin/pagebolt exposes 11 tools: take_screenshot, generate_pdf, create_og_image, run_sequence, record_video, and 6 more. Their descriptions and schemas cost roughly 3,239 tokens of context every time the server is loaded.
Is the io.github.Custodia-Admin/pagebolt MCP server still maintained?
io.github.Custodia-Admin/pagebolt is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.Custodia-Admin/pagebolt MCP server under?
io.github.Custodia-Admin/pagebolt declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.