AIHawk
PYPI · AIHAWK · SCANNED SEP 20
AI browser agent: browses, clicks, types, and reads real web pages from plain-English instructions.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 2 of 48 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 1 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3197 tokens (~199/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage84
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 44% of tool parameters carry a description.Partial
- Structured output schemas are declared (81% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the AIHawk MCP server?
AIHawk runs locally as a PyPI package, launched with uvx aihawk. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · aihawk
claude mcp add feder-cr-aihawk -- uvx aihawk
{
"mcpServers": {
"feder-cr-aihawk": {
"command": "uvx",
"args": [
"aihawk"
]
}
}
} {
"servers": {
"feder-cr-aihawk": {
"command": "uvx",
"args": [
"aihawk"
]
}
}
} codex mcp add feder-cr-aihawk -- uvx aihawk
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"feder-cr-aihawk": {
"type": "local",
"command": [
"uvx",
"aihawk"
],
"enabled": true
}
}
} openclaw mcp add feder-cr-aihawk --command uvx --arg aihawk
mcp_servers:
feder-cr-aihawk:
command: "uvx"
args: ["aihawk"] {
"McpServers": {
"feder-cr-aihawk": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"aihawk"
]
}
}
} assistant mcp add feder-cr-aihawk -t stdio -c uvx -a aihawk
{
"mcpServers": {
"feder-cr-aihawk": {
"command": "uvx",
"args": [
"aihawk"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 19 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- Security disclosure: fail → unverified ▼ functional
- 18 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.17 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.68.4 → 0.68.9 functional
- Package version: 0.68.4 → 0.68.8 functional
- Package version: 0.68.4 → 0.68.7 functional
- 17 Sept 26 +16
- Stability: 0.13 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.68.3 → 0.68.4 functional
- 16 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 0.68.0 → 0.68.3 functional
- Package version: 0.68.0 → 0.68.1 functional
- 15 Sept 26 0
- Stability: 0.07 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.64.0 → 0.68.0 functional
- Package version: 0.64.0 → 0.67.0 functional
- Package version: 0.64.0 → 0.66.0 functional
- 14 Sept 26 +16
- Stability: 0.03 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Tool coverage: 0% → 44% ▲ functional
- First check of Schema quality: unverified functional
- Schema quality: excellent → good functional
- Package version: 0.49.0 → 0.64.0 functional
- Package version: 0.49.0 → 0.63.0 functional
- Package version: 0.49.0 → 0.62.0 functional
- Package version: 0.49.0 → 0.58.0 functional
- Package version: 0.49.0 → 0.57.0 functional
- Package version: 0.49.0 → 0.54.0 functional
- Package version: 0.49.0 → 0.53.1 functional
- Package version: 0.49.0 → 0.52.0 functional
- Package version: 0.49.0 → 0.51.0 functional
- Package version: 0.49.0 → 0.50.0 functional
- 13 Sept 26 +12
- Malware scan: unverified → pass ▲ security
- Judged manipulation: unverified → pass ▲ security
- Schema quality: unverified → excellent ▲ functional
- Stability: unverified → 0.03 ▲ functional
- Package version: 0.43.0 → 0.49.0 functional
- Package version: 0.43.0 → 0.48.0 functional
- Package version: 0.43.0 → 0.47.0 functional
- Package version: 0.43.0 → 0.45.0 functional
- Package version: 0.43.0 → 0.44.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/aihawk@0.68.9
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 48 packages
| Packages resolved | 48 |
|---|---|
| Stale | 1 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
browser_click ~75
Click the first element matching a CSS selector. Scrolls it into view and waits for it to be clickable. When no selector can describe the target, use browser_click_at with coordinates from browser_snapshot.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| selector | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_click_at ~206
Click (or press-and-hold) a raw viewport coordinate instead of a selector - for targets a selector cannot reliably reach: a slider track, a canvas-drawn captcha, a precise point inside a wider element. Moves the pointer there first (no teleport), then down, then up, holding first if hold_seconds is set. Returns a screenshot taken right after release. Coordinates are relative to the VIEWPORT, not to the page, so the ones in a snapshot go stale the moment anything scrolls. Nothing raises when that happens: the click lands on whatever is at that spot now. Take a fresh snapshot after anything that could have moved the page, and prefer browser_click with the element's `selector` whenever it has one.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| hold_seconds | number | – | – |
| x | number | yes | – |
| y | number | yes | – |
No output schema declared.
No examples provided.
browser_close ~85
Close one browser and free what it was holding. The page it had is gone with it. The other browser is not touched. Who it was is kept: browser_open with no arguments brings the same person back. To be somebody else, pass a seed, a proxy or a profile.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_evaluate ~220
READ from the page with JavaScript and get the result as JSON. For what the other tools cannot see: a computed style, a value held in a framework's state, the length of a list. Acting on the page is refused, and the refusal names the tool to use. Assigning to `value`, `checked` or `selected`, or calling `click()`, `dispatchEvent()`, `submit()` or `requestSubmit()`, changes the page without a real keystroke or pointer, and a page can tell. Use browser_click, browser_type or browser_select_option instead; they do the same thing through the pointer and the keyboard. Reading any of those properties is fine. The refusal catches the obvious spellings, not every possible one. A script that slips past it is still the wrong way to do the thing: report it in your answer rather than using it.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| expression | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_list ~150
Which of the two browsers are open, where each one is, and which one you are working in. Answers JSON: `focus`, the browser your last command acted in, or "" when none is open; `note`, which says how many are open and that a command naming no browser goes to `main`; and `browsers` - each row `id`, `url` (the page it is on) and `urls` (every page it holds, which is more than one only when a site opened one). Only open browsers are listed, so every row is one you can act on. Starts nothing: it reports what is open, so asking is free.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_navigate ~189
Go to a url in this browser's page, opening it if none exists. Answers with the HTTP status the server gave and the url actually landed on, which is not always the one asked for: a redirect to a login wall or a regional domain shows up here. Read the status before trusting the page - a 404 or a 403 still has a document, and reading it as content is the mistake this reply exists to prevent. wait_until is "domcontentloaded" by default, which returns as soon as the markup is parsed. Use "load" when the page needs its images and stylesheets, or "networkidle" for a single-page app that fetches its content after load.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| url | string | yes | – |
| wait_until | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_open ~270
Open `main` or `support`, or reopen one as somebody else. `support` is yours to manage: open it when the task needs a second identity, and close it with browser_close as soon as the task no longer needs it, before you answer. It is not saved. Called on a browser that is already up, this REOPENS it with the settings given, and what it held is gone. seed the identity; same seed, same fingerprint. Left out, one is drawn. profile a directory keeping cookies, logins and the seed between opens; "" means none. It keeps the SEED too, so a login does not come back on different hardware every visit. proxy the exit, `http://user:pass@host:port` or `socks5://host:port`; "" means this machine's own address; left out for `support`, it shares the exit `main` has. A profile does NOT pin its exit, and a login arriving from a new country is as visible as one arriving on new hardware.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| profile | – | – | – |
| proxy | – | – | – |
| seed | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_press_key ~64
Press a key on whatever has focus: "Enter", "Tab", "Escape", "ArrowDown", "Control+a", or a single character.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| key | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_read_html ~201
The page's HTML, cleaned down to what is worth reading. Use this when the STRUCTURE matters - a form and its labels, a table, what a control is wired to. `browser_snapshot` gives a flat inventory of things to click; this keeps the markup and the relationships inside it. mode="form" keeps the interactive surface and the text explaining it, mode="text" returns the prose alone, mode="full" keeps the structure with the noise and the attribute soup removed. Unlike browser_read_text this is NOT capped: it returns the whole reduced page, tens of thousands of characters on a large one. Cutting markup in the middle leaves tags that mean nothing, so it is not cut - but the answer can be long. Reach for browser_snapshot when you only need something to click.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| mode | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_read_text ~131
The visible text of an element, with the markup gone. The cheapest way to read a page. Narrow the selector when you know where the answer is; use browser_read_html instead when the structure matters, or browser_snapshot when you need something to click. Long text is cut at max_chars (6000 by default) and the cut is marked in what comes back, so text that ends without that marker is the whole thing.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| max_chars | integer | – | – |
| selector | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_select_option ~108
Choose an option in a dropdown (`<select>`), by its visible label or by its value. Use this rather than clicking the dropdown and pressing arrow keys: a click plus arrows cannot tell you which row it landed on, and setting the value through browser_evaluate changes it without the page seeing a real interaction.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| selector | string | yes | – |
| value | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_snapshot ~192
Title, url, and the interactive elements that are actually visible. Each element carries a `selector` when one can reach it: pass that string to browser_click or browser_type VERBATIM rather than writing your own. It is built to match exactly ONE element, which the obvious selector often does not, and the driver acts on the first match - so a caller aiming at the third of five identical links would silently hit the first and be told it succeeded. Elements with no `selector` carry `at`, the centre coordinates, for browser_click_at. It lists what a caller can act on, and it is not the accessibility tree: one country `<select>` would otherwise fill the answer with its options before the form you were looking for appears.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| max_chars | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_status ~121
Who is browsing right now: the identity, the exit, the profile and the page. Ask whenever you need to know which person the browser currently is, or from where its traffic leaves. The seed is what you would pass to `browser_open` to become this person again, so this is also how you record an identity worth repeating. It starts nothing: a browser that is not open, or gone, is answered with the sentence that says which.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_take_screenshot ~39
One screenshot of this browser's page, on demand.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
No output schema declared.
No examples provided.
browser_type ~89
Fill a field, replacing whatever it holds. This sets the value rather than typing key by key, so it will not fire the per-keystroke handlers an autocomplete needs. For those, click the field and use browser_press_key.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
| selector | string | yes | – |
| text | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
browser_watch ~145
The whole browser window as a person at the machine sees it: tab strip, address bar, the page and the pointer, from a live capture kept running on that page. For watching the work, not for acting on it: the picture is window pixels, so do not feed its coordinates to browser_click_at; use browser_take_screenshot for that. Starts nothing. A browser that is not open has no window, so this answers the sentence that says so, and the live panes - which call this many times a second - read that sentence as the idle pane.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | – | – | Defaults to `main`; `support` is the helper beside it. |
No output schema declared.
No examples provided.
What is the AIHawk MCP server?
AIHawk is an MCP server listed in the public MCP registry as io.github.feder-cr/aihawk. AI browser agent: browses, clicks, types, and reads real web pages from plain-English instructions. This page covers its PyPI package (aihawk).
Is the AIHawk MCP server safe to use?
AIHawk scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AIHawk MCP server expose?
AIHawk exposes 16 tools: browser_open, browser_close, browser_list, browser_status, browser_navigate, and 11 more. Their descriptions and schemas cost roughly 2,285 tokens of context every time the server is loaded.
Is the AIHawk MCP server still maintained?
AIHawk is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.