Olostep MCP Server
NPM · OLOSTEP-MCP · SCANNED SEP 20
Search, scrape, and crawl the web for AI agents. Batch scraping and answers with citations.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 35 of 103 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (ISC).Pass
- Actively maintained (last published 79 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1838 tokens (~183/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Olostep MCP Server server?
Olostep MCP Server runs locally as an npm package, launched with npx -y olostep-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · olostep-mcp
claude mcp add olostep-olostep-mcp-server -- npx -y olostep-mcp
{
"mcpServers": {
"olostep-olostep-mcp-server": {
"command": "npx",
"args": [
"-y",
"olostep-mcp"
]
}
}
} {
"servers": {
"olostep-olostep-mcp-server": {
"command": "npx",
"args": [
"-y",
"olostep-mcp"
]
}
}
} codex mcp add olostep-olostep-mcp-server -- npx -y olostep-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"olostep-olostep-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"olostep-mcp"
],
"enabled": true
}
}
} openclaw mcp add olostep-olostep-mcp-server --command npx --arg -y --arg olostep-mcp
mcp_servers:
olostep-olostep-mcp-server:
command: "npx"
args: ["-y", "olostep-mcp"] {
"McpServers": {
"olostep-olostep-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"olostep-mcp"
]
}
}
} assistant mcp add olostep-olostep-mcp-server -t stdio -c npx -a -y olostep-mcp
{
"mcpServers": {
"olostep-olostep-mcp-server": {
"command": "npx",
"args": [
"-y",
"olostep-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 18 Sept 26 +1
- Security disclosure: fail → unverified ▼ functional
- 16 Sept 26 −2
- Security disclosure: unverified → fail ▼ functional
- Stability: pass → 0.80 functional
- 15 Sept 26 0
- Stability: 0.97 → pass security
- Security disclosure: fail → unverified ▼ functional
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 12 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/olostep-mcp@1.0.17
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 103 packages
| Packages resolved | 103 |
|---|---|
| Deprecated | 1 |
| Stale | 34 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
answers ~168
Answer a factual question using web search, optionally shaped into a flat JSON object of fields (returned with sources and citations). Best for a bounded, factual answer (e.g. a company's founding year, a product's current price). It is NOT reliable for enumerating a live list from a page (e.g. 'the latest N blog posts with titles and dates'). For that, use create_map or get_webpage_content on the page and read the results instead.
| Name | Type | Req | Description |
|---|---|---|---|
| json | – | – | Optional shape for the answer: a flat JSON object of the fields you want. Example: { "book_title": "", "author": "", "release_date": "" }. Keep it flat. Deeply nested shapes or long lists are unrelia… |
| task | string | yes | Question or task to answer using web data. |
No output schema declared.
No examples provided.
batch_scrape_urls ~334
Scrape a SPECIFIC, KNOWN list of URLs (typically from different domains). **Do NOT use this for crawling a website** - if the user wants to scrape a whole site or 'crawl' a domain, use `create_crawl` instead. Use this only when you already have an explicit list of URLs to scrape (e.g., user provides a CSV of URLs, or you need to scrape unrelated pages). Returns a batch_id immediately. Use `get_batch_results` with the batch_id to fetch the scraped content once the batch completes (~5–8 min). Set `wait_for_completion_seconds` to poll automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Optional country code for location-specific scraping. |
| output_format | string | – | Choose format for all URLs. Default: "markdown". |
| parser | string | – | Optional parser ID for specialized extraction (e.g. @olostep/google-search). |
| urls | array | – | Array of URLs to scrape — plain URL strings, or objects with "url" and optional "custom_id". |
| urls_to_scrape | array | – | Alias for `urls`. |
| wait_before_scraping | integer | – | Wait time in milliseconds before scraping each URL. |
| wait_for_completion_seconds | integer | – | Seconds to wait for batch completion. If >0, polls every 10s until done or timeout, then returns status. Use 0 to return immediately with batch_id (then call get_batch_results later). Recommended: 60… |
No output schema declared.
No examples provided.
create_crawl ~270
**PREFERRED tool for crawling a website.** Use this whenever the user says 'crawl', 'scrape the whole site', 'get all pages from a site', or wants multiple pages from a single domain. This is the CORRECT tool for any whole-site scraping task. **Do NOT use `batch_scrape_urls` for crawling** - that tool is only for when you already have a specific list of unrelated URLs from different domains. Starts an ASYNC crawl that autonomously discovers and scrapes pages by following links from a start URL. Returns a crawl_id - the crawl runs in the background. You MUST then call `get_crawl_results` with the returned crawl_id to poll status and retrieve the scraped pages. Do NOT call `get_batch_results` with a crawl_id - crawls and batches are separate resources.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Optional country code for location-specific crawling. |
| max_pages | integer | – | Maximum number of pages to crawl. Set to 1 to scrape only the start URL. |
| output_format | string | – | Format for scraped content. Default: "markdown". |
| parser | string | – | Optional parser ID for specialized content extraction. |
| start_url | string | – | Alias for `url`. |
| url | string | – | Starting URL for the crawl. |
No output schema declared.
No examples provided.
create_map ~206
Get a LIST of URLs on a website (URL discovery only — does NOT scrape content). Use when the user wants a list of links: 'show me all URLs on this site', 'map this website', or when you want to surface candidate URLs to the user before scraping a subset. Prefer `create_crawl` if the goal is to scrape the whole site — it discovers AND scrapes in one workflow. Use this only when the URL list itself is the deliverable.
| Name | Type | Req | Description |
|---|---|---|---|
| exclude_url_patterns | array | – | Optional glob patterns to exclude (e.g., "/admin/**"). |
| include_url_patterns | array | – | Optional glob patterns to include (e.g., "/blog/**"). |
| search_query | string | – | Optional search query to filter URLs (e.g., "blog"). |
| top_n | integer | – | Optional limit for number of URLs returned. |
| url | string | – | Website URL to extract links from. |
| website_url | string | – | Alias for `url`. |
No output schema declared.
No examples provided.
get_batch_results ~126
Retrieve the status and scraped content for a batch job. Pass the batch_id returned by batch_scrape_urls. If the batch is completed, returns the scraped content for each URL. If still in_progress, returns the current status so you can call again later.
| Name | Type | Req | Description |
|---|---|---|---|
| batch_id | string | yes | The batch_id (or id) returned from batch_scrape_urls. |
| formats | array | – | Content formats to retrieve per URL. Default: ["markdown"]. |
| items_limit | integer | – | Max number of items to retrieve content for (1-100). Default: 20. |
No output schema declared.
No examples provided.
get_crawl_results ~207
Retrieve the status and scraped pages for a crawl job. Pass the crawl_id returned by create_crawl. If the crawl is still in_progress, returns the current status so you can call again later (poll every ~10 seconds). Once completed, returns the list of discovered pages with their scraped content in the requested formats. This is the REQUIRED companion to create_crawl — create_crawl only kicks off the async job, this tool is how you actually get the content.
| Name | Type | Req | Description |
|---|---|---|---|
| crawl_id | string | yes | The crawl_id (or id) returned from create_crawl. |
| cursor | integer | – | Pagination cursor for list-pages. Default: 0 (first page). |
| formats | array | – | Content formats to retrieve per page. Default: ["markdown"]. |
| items_limit | integer | – | Max number of pages to retrieve content for (1-100). Default: 20. |
| search_query | string | – | Optional filter to rank/select pages by relevance to a query. |
No output schema declared.
No examples provided.
get_webpage_content ~90
Retrieve content of a webpage in markdown
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Residential country to load the request from (e.g., US, CA, GB). Optional. |
| url | string | – | The URL of the webpage to scrape. |
| url_to_scrape | string | – | Alias for `url`. |
| wait_before_scraping | integer | – | Time to wait in milliseconds before starting the scrape. |
No output schema declared.
No examples provided.
get_website_urls ~107
Search and retrieve relevant URLs from a website (URL discovery only - does NOT scrape content). Use this only when the user wants a *filtered list of links* matching a search query. **Do NOT use this as a precursor to scraping** - if the user wants to scrape/crawl a site, use `create_crawl` directly.
| Name | Type | Req | Description |
|---|---|---|---|
| search_query | string | yes | The search query to sort URLs by. |
| url | string | yes | The URL of the website to map. |
No output schema declared.
No examples provided.
scrape_website ~274
Extract content from a single URL. Supports multiple formats and JavaScript rendering.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Optional country code (e.g., US, GB, CA) for location-specific scraping. |
| llm_extract | object | – | Defines what to pull when output_format is "json". Provide a `schema` (a JSON-schema object of the fields you want, e.g. { "type": "object", "properties": { "title": { "type": "string" } } }) and/or… |
| output_format | string | – | Output format. "markdown" (default), "html", and "text" need no extra config. "json" returns STRUCTURED data and requires either a `parser` OR an `llm_extract` schema describing the fields to pull. D… |
| parser | string | – | Optional parser ID for specialized extraction (e.g., "@olostep/amazon-product"). |
| url | string | – | The URL of the website you want to scrape. |
| url_to_scrape | string | – | Alias for `url`. |
| wait_before_scraping | integer | – | Wait time in milliseconds before scraping (0-10000). Useful for dynamic content. |
No output schema declared.
No examples provided.
search_web ~56
Search the web for a given query and return structured results (non-AI, parser-based).
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Optional country code for localized results (e.g., US, GB). |
| query | string | yes | Search query |
No output schema declared.
No examples provided.
What is the Olostep MCP Server server?
Olostep MCP Server is listed in the public MCP registry as io.github.olostep/olostep-mcp-server. Search, scrape, and crawl the web for AI agents. Batch scraping and answers with citations. This page covers its npm package (olostep-mcp).
Is the Olostep MCP Server server safe to use?
Olostep MCP Server scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Olostep MCP Server server expose?
Olostep MCP Server exposes 10 tools: create_map, create_crawl, get_crawl_results, batch_scrape_urls, get_batch_results, and 5 more. Their descriptions and schemas cost roughly 1,838 tokens of context every time the server is loaded.
Is the Olostep MCP Server server still maintained?
Olostep MCP Server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Olostep MCP Server server under?
Olostep MCP Server declares the ISC licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.