Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.alterlab/mcp-server

REMOTE · MCP.ALTERLAB.IO · 2 COMPONENTS

Web scraping MCP server — scrape, extract structured data, screenshot any site with anti-bot bypass.

72 Trust /100

Last scanned (5 hours ago)

Scores higher than 58% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Web Scraping

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security91
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
  • HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
  • HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
  • DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
  • The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
Schema Quality & AI Usability56
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 3885 tokens (~259/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
  • Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage87
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 61% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 0
    • Stability: unverified → 0.03 ▲ functional
  • 4 Nov 26 +36
    • Transport: unverified → pass ▲ security
    • Injection markers: unverified → pass ▲ security
    • First check of Judged manipulation: pass security
    • Authorization: Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. security
    • MCP protocol: unverified → fail ▼ functional
    • Tool coverage: unverified → 100 ▲ functional
    • First check of Schema quality: good functional
    • First check of Tool coverage: 61 functional
    • First check of Schema quality: fail functional
    • First check of Destructive annotations: pass functional
    • First check of Schema quality: fail functional
  • 30 Oct 26 36

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://mcp.alterlab.io/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=alterlab.io CN=WE1,O=Google Trust Services,C=US 25 Oct 2026 23 Jan 2027 ECDSA 256 ECDSA-SHA256 1367475b8f8be44a13f7cbdd4e86ec07
SANs: alterlab.io, *.alterlab.io
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC secure

Validation of mcp.alterlab.io. — Secure

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
io. present 38690 8 Verified
alterlab.io. present 2371 13 Verified
mcp.alterlab.io. Verified address RRset verified with the apex keys
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer error_description="No OAuth support? Get a free API key with no signup: POST https://api.alterlab.io/api/v1/agent/trial with no body then send it here as the X-API-Key header.", resource_metadata="https://mcp.alterlab.io/.well-known/oauth-protected-resource"

Bearer error_description="No OAuth support? Get a free API key with no signup: POST https://api.alterlab.io/api/v1/agent/trial with no body then send it here as the X-API-Key header.", resource_metadata="https://mcp.alterlab.io/.well-known/oauth-protected-resource"
Header Value
x-content-type-options nosniff
x-frame-options SAMEORIGIN
referrer-policy strict-origin-when-cross-origin
permissions-policy geolocation=(self), microphone=(), camera=()

Protected resource metadata

Document https://mcp.alterlab.io/.well-known/oauth-protected-resource
Retrieved Yes
Resource https://mcp.alterlab.io/mcp
Authorisation server https://api.alterlab.io

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.alterlab.io/mcp Verified 200
http (plaintext) http://mcp.alterlab.io/mcp HTTPS enforced 301 https://mcp.alterlab.io/mcp
MCP tools · 15 exposed · ~3,847 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
alterlab_batch ~110

Start an asynchronous batch job for a large URL set (up to 100 per call) and poll for results later. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Each URL can have its own mode, formats and extraction_schema. Returns a batch_id immediately; results are available from GET /api/v1/batch/{batch_id}.

NameTypeReqDescription
urlsarrayyes–
webhook_urlstring––

No output schema declared.

No examples provided.

alterlab_batch_scrape ~173

Scrape 2-20 URLs in parallel and get every result back in one synchronous call, no polling required. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Failed URLs report their error; successful ones return content. For 20+ URLs use alterlab_batch.

NameTypeReqDescription
formatsarray–Output formats to return. Default: ["markdown"].
max_concurrentinteger–Max concurrent. Default: 3.
render_jsboolean–Render JavaScript with a headless browser. Default: false.
timeoutinteger–Timeout. Default: 90.
urlsarrayyes–
use_proxyboolean–Route through a premium proxy. Default: false.

No output schema declared.

No examples provided.

alterlab_crawl ~424

Crawl a whole website and return the content of every page, for RAG, indexing or site-wide export. Use when you need many pages from one domain; for one URL use alterlab_scrape, for a URL list only use alterlab_map. Works on JavaScript-heavy and protected sites, with anti-bot handling on every page. Returns a crawl_id immediately; results are available from GET /api/v1/crawl/{crawl_id}.

NameTypeReqDescription
cost_controlsobject––
exclude_patternsarray––
extraction_modelstring––
extraction_profilestring––
extraction_schemaobject–JSON schema for structured extraction. Fields matching this schema are extracted from the page. Example: { "title": "string", "price": "number" }. LLM extraction needs your own LLM API key (OpenAI, A…
formatsarray––
headersobject––
include_patternsarray––
include_subdomainsboolean–Include subdomains of the site. Default: false.
max_concurrencyinteger–Maximum parallel page fetches. Default: 10.
max_depthinteger–Maximum link depth from the start URL. Default: 3.
max_pagesinteger–Maximum number of pages. Default: 50.
render_js––Render JavaScript with a headless browser. 'auto' renders only when needed. Default: false.
respect_robotsboolean–Obey robots.txt. Default: true.
sitemapstring–Sitemap handling. Default: include.
sitemap_pathstring––
timeoutnumber––
urlstringyes–
use_proxyboolean–Route through a premium proxy. Default: false.
wait_forstring––
webhook_urlstring––

No output schema declared.

No examples provided.

alterlab_create_account ~223

Create an AlterLab account and API key for your user. Use only when no ALTERLAB_API_KEY exists yet; skip it if a key is already configured. Signup is on behalf of your user (agent signup with human approval). Nothing is created until the human approves: they get an email (and you get a verification_url and user_code to show them) describing what the agent can do. After approval you receive a scoped API key labeled with agent_name, with a default daily spend cap, revocable from the dashboard. No extra free credit is granted; the usual welcome rules apply to the human's account. If the human has not approved yet, the result contains the signup_id, verification_url and user_code; poll GET /api/v1/agent/signup/{signup_id} or call this tool again.

NameTypeReqDescription
agent_namestring–Name of this agent, shown to the human and used to label the API key. Default: MCP client.
emailstringyesEmail address of the human who will own the account and approve the request.

No output schema declared.

No examples provided.

alterlab_create_api_key ~155

Create one scoped, spend-capped API key (ALTERLAB_API_KEY) for the SDK and REST API on this machine. Works only when the user ticked "Also create an API key for this machine" on the OAuth approval screen, so no second approval is needed. Skip it if a key is already configured. The key is labeled with your client name, carries the same read/write permissions and daily spend cap as this connection (never billing), and is revocable from the dashboard. The plaintext is returned once: store it in the environment immediately without printing it. A repeat call returns key metadata only. If it fails with a permission error, the box was not ticked: use alterlab_create_account instead.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

alterlab_estimate_cost ~154

Estimate the credit cost of scraping a URL before you run it. Use when cost matters or before a large job; no credits are charged. Returns the predicted tier, estimated cost and confidence. Full machine-readable price list: GET https://alterlab.io/api/v1/pricing (public, no auth).

NameTypeReqDescription
formatsarray––
modestring–Scraping mode: auto (recommended), html, js (headless browser), pdf, or ocr Default: auto.
render_jsboolean–Render JavaScript with a headless browser. Default: false.
urlstringyes–
use_proxyboolean–Route through a premium proxy. Default: false.

No output schema declared.

No examples provided.

alterlab_extract ~379

Extract structured data (prices, product info, contact details, custom fields) as JSON from HTML, text or markdown you already hold. Use when you have content and need specific fields. Does not fetch a URL: to fetch and extract in one step, use alterlab_scrape with extraction_schema. LLM extraction (extraction_prompt, extraction_schema) requires your own LLM API key (OpenAI, Anthropic, OpenRouter, etc.) added in the dashboard BYOK settings; without one it fails with byok_key_required.

NameTypeReqDescription
cachestring–Cache behaviour. Default: auto.
cache_ttlinteger––
contentstringyes–
content_typestring–Format of the content you pass. Default: html.
evidenceboolean–Return supporting evidence for each field. Default: false.
extraction_modelstring––
extraction_profilestring––
extraction_promptstring–Natural language extraction instruction. LLM extraction needs your own LLM API key (OpenAI, Anthropic, OpenRouter, etc.) added in the dashboard BYOK settings; without one the request is rejected with…
extraction_providerstring––
extraction_schemaobject–JSON schema for structured extraction. Fields matching this schema are extracted from the page. Example: { "title": "string", "price": "number" }. LLM extraction needs your own LLM API key (OpenAI, A…
extraction_templatestring––
formatsarray–Output formats to return. Default: ["json"].
source_urlstring––

No output schema declared.

No examples provided.

alterlab_feedback ~205

Tell AlterLab when something is hard. Call this when something blocks you, a result is wrong, or a step is confusing, slow or priced unexpectedly. Describe what you tried, what happened and what you expected. Do not include secrets, API keys, passwords or customer data; use a job_id or hostname instead of page content. Works without an API key (rate limited per IP); with a key the report is also linked privately to your organization for follow-up. Returns a cluster_key and a status_url to check progress.

NameTypeReqDescription
categorystringyesKind of friction
expectedstringyesWhat you expected instead
happenedstringyesWhat went wrong
job_idstring–Job the report is about
tool_namestring–Tool or endpoint the report is about
triedstringyesWhat you attempted (tool, parameters, retries)
urlstring–Target URL; only its hostname is kept

No output schema declared.

No examples provided.

alterlab_map ~202

List every URL on a site via sitemap parsing and link extraction, without fetching page content. Use before alterlab_crawl or alterlab_batch to choose pages; to read the content itself use alterlab_crawl. Works on JavaScript-heavy and protected sites.

NameTypeReqDescription
exclude_patternsarray––
include_metadataboolean–Include per-URL metadata. Default: false.
include_patternsarray––
include_subdomainsboolean–Include subdomains of the site. Default: false.
max_depthinteger–Maximum link depth from the start URL. Default: 3.
max_pagesinteger–Maximum number of pages. Default: 500.
respect_robotsboolean–Obey robots.txt. Default: true.
searchstring––
sitemapstring–Sitemap handling. Default: include.
sitemap_pathstring––
urlstringyes–

No output schema declared.

No examples provided.

alterlab_pricing ~74

Get AlterLab's machine-readable price list: per-tier cost, bring-your-own-proxy discount, cache-hit discount, add-ons, search and SERP prices, and the free allowance. Use when deciding whether AlterLab fits a budget, before any account exists. Free and keyless; nothing is scraped or charged.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

alterlab_scrape ~950

Fetch one URL and return its content as clean markdown, text, HTML, or JSON. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Website challenges and JavaScript-heavy pages are handled automatically by a 5-tier system that starts at the cheapest tier that works and escalates only when needed. Returns markdown by default, ready for LLM context. Supports GET and POST via method, structured extraction via extraction_schema or extraction_prompt, and cost caps via cost_controls. Supports browser actions via actions, plus screenshot and generate_pdf; the response includes action_results, one entry per action with index, type, success, error, result (evaluate) and screenshot_url (screenshot actions).

NameTypeReqDescription
actionsarray–Browser actions run in order after the page loads, before content extraction and any screenshot or PDF capture. Requires a rendered page; render_js defaults to true when actions are given. Selectors…
block_imagesboolean–Block images. Default: false.
bodystring–Request body for POST requests.
cacheboolean–Allow a cached result.
cache_ttlnumber––
content_typestring–Content-Type of body. Requires body.
cookiesobject––
cost_controlsobject–Cap spending, pin a tier, or trade off cost vs speed.
estimate_firstboolean–Run a free cost estimate before scraping. Default: false.
evidenceboolean–Return extraction evidence.
extraction_modelstring–LLM model override.
extraction_profilestring–Built-in extraction profile (product, article, job_posting, ...).
extraction_promptstring–Natural language extraction instruction. LLM extraction needs your own LLM API key (OpenAI, Anthropic, OpenRouter, etc.) added in the dashboard BYOK settings; without one the request is rejected with…
extraction_providerstring––
extraction_schemaobject–JSON schema for structured extraction. Fields matching this schema are extracted from the page. Example: { "title": "string", "price": "number" }. LLM extraction needs your own LLM API key (OpenAI, A…
fail_fastboolean––
filter_contentboolean––
force_refreshboolean––
formatsarray–Output formats. 'markdown' is best for LLM consumption. Default: ["markdown"].
generate_pdfboolean–Generate a PDF of the rendered page after any actions (adds a small fee, uses a rendered page). The response includes pdf_url.
include_raw_htmlboolean–Include raw html. Default: false.
locationobject––
max_response_bytesinteger––
methodstring–HTTP method. POST is for GraphQL, forms and REST APIs. Default: GET.
modestring–Scraping mode: auto (recommended), html, js (headless browser), pdf, or ocr Default: auto.
prefer_costboolean––
prefer_speedboolean––
promote_schema_orgboolean––
proxy_countrystring–Proxy country code.
remove_cookie_bannersboolean–Remove cookie banners. Default: true.
render_js––Render JavaScript with a headless browser. 'auto' renders only when needed. Default: false.
screenshotboolean–Capture a full-page screenshot after any actions (adds a small fee, uses a rendered page). The response includes screenshot_url.
scroll_countinteger––
scroll_to_loadboolean–Scroll to load. Default: false.
session_idstring–Stored session (cookies) to scrape with.
templatestring–Extraction template name.
timeoutnumber–Timeout. Default: 90.
urlstringyesURL to scrape
use_proxyboolean–Route through a premium proxy. Default: false.
wait_forstring–CSS selector to wait for.

No output schema declared.

No examples provided.

alterlab_screenshot ~236

Capture a full-page PNG screenshot of one URL, an image rather than text content. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Works on anti-bot-protected sites, rendered in a real headless browser. Use wait_for to wait for an element and wait_until to control load timing. Pass actions (for example dismiss_consent or evaluate) to prepare the page; the screenshot is captured after they run and action_results is returned.

NameTypeReqDescription
actionsarray–Browser actions run in order after the page loads, before content extraction and any screenshot or PDF capture. Requires a rendered page; render_js defaults to true when actions are given. Selectors…
urlstringyes–
wait_forstring–CSS selector to wait for.
wait_untilstring–Wait until. Default: networkidle.

No output schema declared.

No examples provided.

alterlab_search ~262

Search the web and get structured results (URLs, titles, snippets). Use when you have a question or topic but no URL yet; follow up with alterlab_scrape to read a page, or set scrape_results=true to read every result in one call. Use domain to restrict to one site and time_range to filter by recency.

NameTypeReqDescription
countrystring––
domainstring––
extraction_schemaobject–JSON schema for structured extraction. Fields matching this schema are extracted from the page. Example: { "title": "string", "price": "number" }. LLM extraction needs your own LLM API key (OpenAI, A…
formatsarray––
languagestring––
num_resultsinteger–Number of results to return. Default: 10.
pageinteger–Results page number. Default: 1.
querystringyes–
safe_searchboolean––
scrape_resultsboolean–Also scrape each result page. Default: false.
time_rangestring––

No output schema declared.

No examples provided.

read_alterlab_page ~102

Use this after search_alterlab to read the full text of one AlterLab page as markdown, so you can follow the documented steps instead of guessing. Pass the url of a search result. Only pages on alterlab.io that search_alterlab can return are readable. Free: needs no API key and never uses credits.

NameTypeReqDescription
urlstringyesAn alterlab.io page URL taken from the url field of a search_alterlab result.

No output schema declared.

No examples provided.

search_alterlab ~198

Use this to look up how to do something with AlterLab (API parameters, SDKs, MCP setup, pricing, error codes, migration from Firecrawl/ScrapingBee/Apify) or to find a guide for scraping a specific site. Searches the docs, blog, glossary, comparisons, scrape guides and changelog. Free: needs no API key and never uses credits. Returns the best matches as title, short snippet, url and markdown_url; pass a url to read_alterlab_page to read the full page as markdown.

NameTypeReqDescription
limitinteger–Maximum number of results. Default: 8.
qstringyesWhat you want to know, in plain words (for example: how to scrape amazon product data).
typestring–Optional content type filter: docs, blog, how-to, scrape, comparison, glossary, answers, changelog or pricing. Omit to search everything.

No output schema declared.

No examples provided.

Install

How do I install the io.alterlab/mcp-server server?

io.alterlab/mcp-server is a hosted endpoint at https://mcp.alterlab.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.alterlab.io

# add to Claude Code
claude mcp add --transport http io-alterlab-mcp-server 'https://mcp.alterlab.io/mcp'
Common questions

What is the io.alterlab/mcp-server server?

io.alterlab/mcp-server is listed in the public MCP registry as io.alterlab/mcp-server. Web scraping MCP server, scrape, extract structured data, screenshot any site with anti-bot bypass. This page covers its hosted endpoint (https://mcp.alterlab.io/mcp).

Is the io.alterlab/mcp-server server safe to use?

io.alterlab/mcp-server scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.alterlab/mcp-server server expose?

io.alterlab/mcp-server exposes 15 tools: alterlab_scrape, alterlab_extract, alterlab_screenshot, alterlab_crawl, alterlab_search, and 10 more. Their descriptions and schemas cost roughly 3,847 tokens of context every time the server is loaded.

Does the io.alterlab/mcp-server server require authentication?

Yes. io.alterlab/mcp-server asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the io.alterlab/mcp-server server still maintained?

io.alterlab/mcp-server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.