# io.alterlab/mcp-server (remote · mcp.alterlab.io)

Web scraping MCP server — scrape, extract structured data, screenshot any site with anti-bot bypass.

- Trust score: 72/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `mcp.alterlab.io`: 72/100 (this document), [markdown](https://verifymcp.io/servers/io-alterlab-mcp-server/mcp.md), [page](https://verifymcp.io/servers/io-alterlab-mcp-server/mcp)
- npm · `alterlab-mcp-server`: 44/100, [markdown](https://verifymcp.io/servers/io-alterlab-mcp-server/alterlab-mcp-server.md), [page](https://verifymcp.io/servers/io-alterlab-mcp-server/alterlab-mcp-server)

## Channel facts

- Endpoint: `https://mcp.alterlab.io/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.12.9`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 91/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 56/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3885 tokens (~259/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 87/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 61% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the io.alterlab/mcp-server server?

io.alterlab/mcp-server is a hosted endpoint at https://mcp.alterlab.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-alterlab-mcp-server 'https://mcp.alterlab.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-alterlab-mcp-server": {
      "url": "https://mcp.alterlab.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-alterlab-mcp-server": {
      "type": "http",
      "url": "https://mcp.alterlab.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-alterlab-mcp-server]
url = "https://mcp.alterlab.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-alterlab-mcp-server": {
      "type": "remote",
      "url": "https://mcp.alterlab.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-alterlab-mcp-server --url 'https://mcp.alterlab.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-alterlab-mcp-server:
    url: "https://mcp.alterlab.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-alterlab-mcp-server": {
      "Transport": "http",
      "Url": "https://mcp.alterlab.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-alterlab-mcp-server -t streamable-http -u 'https://mcp.alterlab.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-alterlab-mcp-server": {
      "type": "http",
      "url": "https://mcp.alterlab.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 72, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-11-04 (score 72, +36)

- [security improvement] Transport: unverified → pass
- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Authorization: Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 61
- [functional] First check of Schema quality: fail
- [functional] First check of Destructive annotations: pass
- [functional] First check of Schema quality: fail

### 2026-10-30 (score 36)

First indexed and scored.

## MCP tools (15)

### `alterlab_scrape` (~950 tokens)

Scrape URL

Fetch one URL and return its content as clean markdown, text, HTML, or JSON. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Website challenges and JavaScript-heavy pages are handled automatically by a 5-tier system that starts at the cheapest tier that works and escalates only when needed. Returns markdown by default, ready for LLM context. Supports GET and POST via method, structured extraction via extraction_schema or extraction_prompt, and cost caps via cost_controls. Supports browser actions via actions, plus screenshot and generate_pdf; the response includes action_results, one entry per action with index, type, success, error, result (evaluate) and screenshot_url (screenshot actions).

Input parameters:

- `actions` (array): Browser actions run in order after the page loads, before content extraction and any screenshot or PDF capture. Requires a rendered page; render_js defaults to true when actions are given. Selectors…
- `block_images` (boolean): Block images. Default: false.
- `body` (string): Request body for POST requests.
- `cache` (boolean): Allow a cached result.
- `cache_ttl` (number)
- `content_type` (string): Content-Type of body. Requires body.
- `cookies` (object)
- `cost_controls` (object): Cap spending, pin a tier, or trade off cost vs speed.
- `estimate_first` (boolean): Run a free cost estimate before scraping. Default: false.
- `evidence` (boolean): Return extraction evidence.
- `extraction_model` (string): LLM model override.
- `extraction_profile` (string): Built-in extraction profile (product, article, job_posting, ...).
- `extraction_prompt` (string): Natural language extraction instruction. LLM extraction needs your own LLM API key (OpenAI, Anthropic, OpenRouter, etc.) added in the dashboard BYOK settings; without one the request is rejected with…
- `extraction_provider` (string)
- `extraction_schema` (object): JSON schema for structured extraction. Fields matching this schema are extracted from the page. Example: { "title": "string", "price": "number" }. LLM extraction needs your own LLM API key (OpenAI, A…
- `fail_fast` (boolean)
- `filter_content` (boolean)
- `force_refresh` (boolean)
- `formats` (array): Output formats. 'markdown' is best for LLM consumption. Default: ["markdown"].
- `generate_pdf` (boolean): Generate a PDF of the rendered page after any actions (adds a small fee, uses a rendered page). The response includes pdf_url.
- `include_raw_html` (boolean): Include raw html. Default: false.
- `location` (object)
- `max_response_bytes` (integer)
- `method` (string): HTTP method. POST is for GraphQL, forms and REST APIs. Default: GET.
- `mode` (string): Scraping mode: auto (recommended), html, js (headless browser), pdf, or ocr Default: auto.
- `prefer_cost` (boolean)
- `prefer_speed` (boolean)
- `promote_schema_org` (boolean)
- `proxy_country` (string): Proxy country code.
- `remove_cookie_banners` (boolean): Remove cookie banners. Default: true.
- `render_js`: Render JavaScript with a headless browser. 'auto' renders only when needed. Default: false.
- `screenshot` (boolean): Capture a full-page screenshot after any actions (adds a small fee, uses a rendered page). The response includes screenshot_url.
- `scroll_count` (integer)
- `scroll_to_load` (boolean): Scroll to load. Default: false.
- `session_id` (string): Stored session (cookies) to scrape with.
- `template` (string): Extraction template name.
- `timeout` (number): Timeout. Default: 90.
- `url` (string, required): URL to scrape
- `use_proxy` (boolean): Route through a premium proxy. Default: false.
- `wait_for` (string): CSS selector to wait for.

### `alterlab_extract` (~379 tokens)

Extract Structured Data

Extract structured data (prices, product info, contact details, custom fields) as JSON from HTML, text or markdown you already hold. Use when you have content and need specific fields. Does not fetch a URL: to fetch and extract in one step, use alterlab_scrape with extraction_schema. LLM extraction (extraction_prompt, extraction_schema) requires your own LLM API key (OpenAI, Anthropic, OpenRouter, etc.) added in the dashboard BYOK settings; without one it fails with byok_key_required.

Input parameters:

- `cache` (string): Cache behaviour. Default: auto.
- `cache_ttl` (integer)
- `content` (string, required)
- `content_type` (string): Format of the content you pass. Default: html.
- `evidence` (boolean): Return supporting evidence for each field. Default: false.
- `extraction_model` (string)
- `extraction_profile` (string)
- `extraction_prompt` (string): Natural language extraction instruction. LLM extraction needs your own LLM API key (OpenAI, Anthropic, OpenRouter, etc.) added in the dashboard BYOK settings; without one the request is rejected with…
- `extraction_provider` (string)
- `extraction_schema` (object): JSON schema for structured extraction. Fields matching this schema are extracted from the page. Example: { "title": "string", "price": "number" }. LLM extraction needs your own LLM API key (OpenAI, A…
- `extraction_template` (string)
- `formats` (array): Output formats to return. Default: ["json"].
- `source_url` (string)

### `alterlab_screenshot` (~236 tokens)

Capture Screenshot

Capture a full-page PNG screenshot of one URL, an image rather than text content. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Works on anti-bot-protected sites, rendered in a real headless browser. Use wait_for to wait for an element and wait_until to control load timing. Pass actions (for example dismiss_consent or evaluate) to prepare the page; the screenshot is captured after they run and action_results is returned.

Input parameters:

- `actions` (array): Browser actions run in order after the page loads, before content extraction and any screenshot or PDF capture. Requires a rendered page; render_js defaults to true when actions are given. Selectors…
- `url` (string, required)
- `wait_for` (string): CSS selector to wait for.
- `wait_until` (string): Wait until. Default: networkidle.

### `alterlab_crawl` (~424 tokens)

Crawl Website

Crawl a whole website and return the content of every page, for RAG, indexing or site-wide export. Use when you need many pages from one domain; for one URL use alterlab_scrape, for a URL list only use alterlab_map. Works on JavaScript-heavy and protected sites, with anti-bot handling on every page. Returns a crawl_id immediately; results are available from GET /api/v1/crawl/{crawl_id}.

Input parameters:

- `cost_controls` (object)
- `exclude_patterns` (array)
- `extraction_model` (string)
- `extraction_profile` (string)
- `extraction_schema` (object): JSON schema for structured extraction. Fields matching this schema are extracted from the page. Example: { "title": "string", "price": "number" }. LLM extraction needs your own LLM API key (OpenAI, A…
- `formats` (array)
- `headers` (object)
- `include_patterns` (array)
- `include_subdomains` (boolean): Include subdomains of the site. Default: false.
- `max_concurrency` (integer): Maximum parallel page fetches. Default: 10.
- `max_depth` (integer): Maximum link depth from the start URL. Default: 3.
- `max_pages` (integer): Maximum number of pages. Default: 50.
- `render_js`: Render JavaScript with a headless browser. 'auto' renders only when needed. Default: false.
- `respect_robots` (boolean): Obey robots.txt. Default: true.
- `sitemap` (string): Sitemap handling. Default: include.
- `sitemap_path` (string)
- `timeout` (number)
- `url` (string, required)
- `use_proxy` (boolean): Route through a premium proxy. Default: false.
- `wait_for` (string)
- `webhook_url` (string)

### `alterlab_search` (~262 tokens)

Search the Web

Search the web and get structured results (URLs, titles, snippets). Use when you have a question or topic but no URL yet; follow up with alterlab_scrape to read a page, or set scrape_results=true to read every result in one call. Use domain to restrict to one site and time_range to filter by recency.

Input parameters:

- `country` (string)
- `domain` (string)
- `extraction_schema` (object): JSON schema for structured extraction. Fields matching this schema are extracted from the page. Example: { "title": "string", "price": "number" }. LLM extraction needs your own LLM API key (OpenAI, A…
- `formats` (array)
- `language` (string)
- `num_results` (integer): Number of results to return. Default: 10.
- `page` (integer): Results page number. Default: 1.
- `query` (string, required)
- `safe_search` (boolean)
- `scrape_results` (boolean): Also scrape each result page. Default: false.
- `time_range` (string)

### `alterlab_map` (~202 tokens)

Map Website URLs

List every URL on a site via sitemap parsing and link extraction, without fetching page content. Use before alterlab_crawl or alterlab_batch to choose pages; to read the content itself use alterlab_crawl. Works on JavaScript-heavy and protected sites.

Input parameters:

- `exclude_patterns` (array)
- `include_metadata` (boolean): Include per-URL metadata. Default: false.
- `include_patterns` (array)
- `include_subdomains` (boolean): Include subdomains of the site. Default: false.
- `max_depth` (integer): Maximum link depth from the start URL. Default: 3.
- `max_pages` (integer): Maximum number of pages. Default: 500.
- `respect_robots` (boolean): Obey robots.txt. Default: true.
- `search` (string)
- `sitemap` (string): Sitemap handling. Default: include.
- `sitemap_path` (string)
- `url` (string, required)

### `alterlab_batch_scrape` (~173 tokens)

Scrape Multiple URLs

Scrape 2-20 URLs in parallel and get every result back in one synchronous call, no polling required. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Failed URLs report their error; successful ones return content. For 20+ URLs use alterlab_batch.

Input parameters:

- `formats` (array): Output formats to return. Default: ["markdown"].
- `max_concurrent` (integer): Max concurrent. Default: 3.
- `render_js` (boolean): Render JavaScript with a headless browser. Default: false.
- `timeout` (integer): Timeout. Default: 90.
- `urls` (array, required)
- `use_proxy` (boolean): Route through a premium proxy. Default: false.

### `alterlab_batch` (~110 tokens)

Start Batch Job

Start an asynchronous batch job for a large URL set (up to 100 per call) and poll for results later. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Each URL can have its own mode, formats and extraction_schema. Returns a batch_id immediately; results are available from GET /api/v1/batch/{batch_id}.

Input parameters:

- `urls` (array, required)
- `webhook_url` (string)

### `alterlab_estimate_cost` (~154 tokens)

Estimate Scrape Cost

Estimate the credit cost of scraping a URL before you run it. Use when cost matters or before a large job; no credits are charged. Returns the predicted tier, estimated cost and confidence. Full machine-readable price list: GET https://alterlab.io/api/v1/pricing (public, no auth).

Input parameters:

- `formats` (array)
- `mode` (string): Scraping mode: auto (recommended), html, js (headless browser), pdf, or ocr Default: auto.
- `render_js` (boolean): Render JavaScript with a headless browser. Default: false.
- `url` (string, required)
- `use_proxy` (boolean): Route through a premium proxy. Default: false.

### `alterlab_pricing` (~74 tokens)

Get Pricing

Get AlterLab's machine-readable price list: per-tier cost, bring-your-own-proxy discount, cache-hit discount, add-ons, search and SERP prices, and the free allowance. Use when deciding whether AlterLab fits a budget, before any account exists. Free and keyless; nothing is scraped or charged.

### `alterlab_feedback` (~205 tokens)

Send Feedback

Tell AlterLab when something is hard. Call this when something blocks you, a result is wrong, or a step is confusing, slow or priced unexpectedly. Describe what you tried, what happened and what you expected. Do not include secrets, API keys, passwords or customer data; use a job_id or hostname instead of page content. Works without an API key (rate limited per IP); with a key the report is also linked privately to your organization for follow-up. Returns a cluster_key and a status_url to check progress.

Input parameters:

- `category` (string, required): Kind of friction
- `expected` (string, required): What you expected instead
- `happened` (string, required): What went wrong
- `job_id` (string): Job the report is about
- `tool_name` (string): Tool or endpoint the report is about
- `tried` (string, required): What you attempted (tool, parameters, retries)
- `url` (string): Target URL; only its hostname is kept

### `alterlab_create_account` (~223 tokens)

Create Account

Create an AlterLab account and API key for your user. Use only when no ALTERLAB_API_KEY exists yet; skip it if a key is already configured. Signup is on behalf of your user (agent signup with human approval). Nothing is created until the human approves: they get an email (and you get a verification_url and user_code to show them) describing what the agent can do. After approval you receive a scoped API key labeled with agent_name, with a default daily spend cap, revocable from the dashboard. No extra free credit is granted; the usual welcome rules apply to the human's account. If the human has not approved yet, the result contains the signup_id, verification_url and user_code; poll GET /api/v1/agent/signup/{signup_id} or call this tool again.

Input parameters:

- `agent_name` (string): Name of this agent, shown to the human and used to label the API key. Default: MCP client.
- `email` (string, required): Email address of the human who will own the account and approve the request.

### `alterlab_create_api_key` (~155 tokens)

Create API Key

Create one scoped, spend-capped API key (ALTERLAB_API_KEY) for the SDK and REST API on this machine. Works only when the user ticked "Also create an API key for this machine" on the OAuth approval screen, so no second approval is needed. Skip it if a key is already configured. The key is labeled with your client name, carries the same read/write permissions and daily spend cap as this connection (never billing), and is revocable from the dashboard. The plaintext is returned once: store it in the environment immediately without printing it. A repeat call returns key metadata only. If it fails with a permission error, the box was not ticked: use alterlab_create_account instead.

### `search_alterlab` (~198 tokens)

Search AlterLab Docs

Use this to look up how to do something with AlterLab (API parameters, SDKs, MCP setup, pricing, error codes, migration from Firecrawl/ScrapingBee/Apify) or to find a guide for scraping a specific site. Searches the docs, blog, glossary, comparisons, scrape guides and changelog. Free: needs no API key and never uses credits. Returns the best matches as title, short snippet, url and markdown_url; pass a url to read_alterlab_page to read the full page as markdown.

Input parameters:

- `limit` (integer): Maximum number of results. Default: 8.
- `q` (string, required): What you want to know, in plain words (for example: how to scrape amazon product data).
- `type` (string): Optional content type filter: docs, blog, how-to, scrape, comparison, glossary, answers, changelog or pricing. Omit to search everything.

### `read_alterlab_page` (~102 tokens)

Read AlterLab Page

Use this after search_alterlab to read the full text of one AlterLab page as markdown, so you can follow the documented steps instead of guessing. Pass the url of a search result. Only pages on alterlab.io that search_alterlab can return are readable. Free: needs no API key and never uses credits.

Input parameters:

- `url` (string, required): An alterlab.io page URL taken from the url field of a search_alterlab result.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-alterlab-mcp-server/mcp#diagnostics

## Score history

- 2026-11-05: 72
- 2026-11-04: 72
- 2026-11-03: 36
- 2026-11-02: 36
- 2026-11-01: 36
- 2026-10-31: 36
- 2026-10-30: 36

## Common questions

### What is the io.alterlab/mcp-server server?

io.alterlab/mcp-server is listed in the public MCP registry as io.alterlab/mcp-server. Web scraping MCP server, scrape, extract structured data, screenshot any site with anti-bot bypass. This page covers its hosted endpoint (https://mcp.alterlab.io/mcp).

### Is the io.alterlab/mcp-server server safe to use?

io.alterlab/mcp-server scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.alterlab/mcp-server server expose?

io.alterlab/mcp-server exposes 15 tools: alterlab_scrape, alterlab_extract, alterlab_screenshot, alterlab_crawl, alterlab_search, and 10 more. Their descriptions and schemas cost roughly 3,847 tokens of context every time the server is loaded.

### Does the io.alterlab/mcp-server server require authentication?

Yes. io.alterlab/mcp-server asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the io.alterlab/mcp-server server still maintained?

io.alterlab/mcp-server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.alterlab.io/mcp
- Repository: https://github.com/RapierCraft/alterlab-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/io-alterlab-mcp-server/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-alterlab-mcp-server/mcp.json
- HTML version of this page: https://verifymcp.io/servers/io-alterlab-mcp-server/mcp