Name: Quanticdata
Author: QuantumProxies

Quanticdata MCP

Live web access for agents: scrape, SERP search, crawl/map, 100+ collectors, datasets, proxies.

Grade A Local · stdio API key 28 tools v0.11.4 · 1 Oct 2026

No reviews yet by QuantumProxiesnpm 1,911 Runs on your machine, nothing hosted

95/100

trust score

126

downloads a day

local

runs on your machine

966

downloads in 30d

What it does

Live web access for agents: scrape, SERP search, crawl/map, 74 collectors, datasets, proxies.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --env 'QUANTICDATA_API_KEY=${QUANTICDATA_API_KEY}' --transport stdio quanticdata-mcp '--' npx -y quanticdata-mcp

# 2 — ask your agent for something these tools do
#   scrape, unlock, generate_parser and 25 more

It needs QUANTICDATA_API_KEY: this reads it from your environment, so export it first.

Quanticdata costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

PublisherVerified · since 2026

QuantumProxies1 server

1 category · publishing since 2026

All 1 server

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Quanticdata as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads QUANTICDATA_API_KEY (API key from https://app.quanticdata.io/api-keys — $2 of free API usage every month, no card required) from your environment each time it starts the server, so the value stays out of its config: export it in your shell profile (macOS, Linux), or run setx QUANTICDATA_API_KEY … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user --env 'QUANTICDATA_API_KEY=${QUANTICDATA_API_KEY}' --transport stdio quanticdata-mcp '--' npx -y quanticdata-mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: QUANTICDATA_API_KEY — API key from https://app.quanticdata.io/api-keys — $2 of free API usage every month, no card required. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

28 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Use this when the user wants the content of one web page. Fetches the page from a residential IP and returns it as clean Markdown (or HTML/text). It tries a plain HTTP request with a Chrome-compatible TLS profile first and uses a headless browser only when the page needs JavaScript or the plain…

Parameter	Type	Required	Notes
url	string	no	The page URL to scrape (optional only when you pass html to convert)
format	string	no	Output format (default markdown)
formats	array	no	Additional formats to return together in payload.formats, e.g. ['markdown','text']
include_links	boolean	no	Return all de-duplicated absolute page links in payload.links
content_mode	string	no	smart (default): whole page minus nav/footer/cookie chrome. article: Readability main article only (news/blogs). full: entire body as-is.
engine	string	no	auto (default): plain HTTP first, headless browser when the page needs JavaScript or the HTTP request is refused. tls: plain HTTP only, never a browser — what a crawler without JavaScript sees, right
render	boolean	no	Force the headless browser (JS execution)
mode	string	no	summary: return only metadata (title, description, canonical, contentLength, status, engine, bytes) with no page content — use this when auditing pages instead of reading them
country	string	no	ISO country code for the proxy exit, e.g. 'us'
ai_prompt	string	no	Natural-language instruction — the LLM turns the page into structured JSON
ai_schema	object	no	JSON Schema for deterministic AI extraction; returned under payload.ai.data
extract	object	no	Structured-extraction schema: { field: "css selector" \| { selector, attr, all, fns } }. fns is a transform pipeline run on the value — e.g. { "price": { "selector": ".price", "fns": ["amount_from_st
app_state		no	Mine the page's own hydration state (Next.js __NEXT_DATA__, Nuxt, embedded JSON islands) into payload.metadata.appState. This is where SPAs keep the real data — prices behind a picker, stock, download
parser	object	no	Your own parsing rules, as CSS selector lists — use these when you know the page and don't want to rely on heuristics. include: keep ONLY these subtrees (targeted extraction, e.g. ['article.post']). e
reveal_hidden	boolean	no	Render tier only: before capturing, open <details>/accordions and click through every tab, appending each revealed panel to the page. Use it for tabbed code samples or spec accordions where a plain re
xhr	boolean	no	Record the page's XHR/fetch traffic (URL, method, status, response body) into payload.xhr. Forces a browser render. An SPA's own JSON API is usually far cleaner than its DOM — use this to DISCOVER the
fetch_resource	string	no	Regex matched against the page's network requests: the first matching response's BODY becomes the result instead of the page HTML (e.g. '/api/products' to get an SPA's JSON directly). Forces a render.
preset_id	string	no	Run a stored parser preset (see save_parser_preset) instead of passing extract selectors. Results land in payload.data exactly the same way, and the run is scored so the preset can detect decay and
actions	array	no	Ordered browser interactions before capture (forces a render). Each is one object: {"click":"#sel"}, {"clickText":"Accept"} (click by visible text — dismiss a consent wall without knowing its CSS), {"
frontmatter	boolean	no	Prepend YAML front-matter (title, url, canonical, description, author, date) so the markdown is self-contained for RAG/Obsidian pipelines

No parameter schema on file.

Look at a page ONCE with an LLM and get back CSS selectors that extract the fields you asked for. Pass the returned parser as the extract argument on every later scrape of that same layout and no AI runs again — it becomes a plain, deterministic extraction with no AI cost. Use this instead of…

Parameter	Type	Required	Notes
url	string	no	The page to learn the layout from
html	string	no	Markup you already have, instead of fetching a URL (no proxy bandwidth used)
fields	object	no	What to extract, as { field_name: "plain-English description" } — e.g. { "price": "the product price", "specs": "every spec bullet, as a list" }. Max 25.
prompt	string	no	Free-text alternative to fields — the model picks and names the fields itself
render	boolean	no	Learn from the browser-rendered DOM instead of the raw HTML (needed for SPA pages)
country	string	no	ISO country code for the proxy exit

Store a generated parser under a name so it can be reused by id. Scrape later with scrape's preset_id instead of repeating the selectors, and every run is scored per field — when the recent success rate decays (the site redesigned), the preset regenerates itself from source_url and bumps a…

Parameter	Type	Required	Notes
name	string	yes	A name you'll recognise, e.g. 'shop product page'
parser	object	yes	The parser to store — normally the parser object returned by generate_parser
source_url	string	no	Page to relearn from when the parser decays — required for self-healing
fields	object	no	The original field descriptions, so a self-heal regenerates the same shape
render	boolean	no	The page needs a browser render to show its content
auto_heal	boolean	no	Regenerate automatically on decay (default true when source_url is set)

List your stored parser presets with their version, health stats and changelog.

No parameter schema on file.

How well a stored parser is still working: success rate per field, mean coverage over the recent runs, and whether it now counts as decayed (i.e. the site probably changed).

Parameter	Type	Required	Notes
preset_id	string	yes	The preset id returned by save_parser_preset

Regenerate a preset's selectors now (the manual trigger for the automatic repair). Refetches the source page and adopts new selectors ONLY if they extract more than the current ones — a heal that finds nothing better leaves the preset untouched and is not billed.

Parameter	Type	Required	Notes
preset_id	string	yes	The preset id
force	boolean	no	Skip the cooldown between heals

Audit a URL's SEO in one call: fetches it twice — as a pure HTTP bot (no JS) and fully rendered — and returns both views (title, description, canonical, h1, word count) plus the diff (JS-only content, changed title/description, canonical missing without JS) and bot-facing meta (robots, Open Graph,…

Parameter	Type	Required	Notes
url	string	yes	The page URL to audit
country	string	no	ISO country code for the proxy exit, e.g. 'us'
no_render	boolean	no	Skip the rendered pass (cheaper — returns the no-JS view only, no diff)

Use this when the user asks whether AI assistants (ChatGPT, Claude, Perplexity, Google AI Overview, Bing Copilot) can find, read and cite a page; use seo_audit for classic Google indexing questions. On-page pass (always): the live robots.txt resolved for 24 AI crawlers per RFC 9309 with the…

Parameter	Type	Required	Notes
url	string	yes	The page URL to audit
queries	array	no	Questions to ask the AI engines (max 10). Omit for the on-page audit only — each (query × engine) pair is a billed engine call.
engines	array	no	Engines to ask (default: all). aio = Google AI Overview read from a live SERP, copilot = Bing's generative answer, openai/anthropic = the vendors' APIs with web search (an approximation of ChatGPT/Cla
competitors	array	no	Competitor domains to flag in the share of voice, e.g. ['example.com']
brand	string	no	Brand name to look for in the answer text ('mentioned' even when not cited). Defaults to the page's og:site_name / Organization name.
country	string	no	ISO country code for the proxy exit, e.g. 'us' — also the locale of the AI Overview / Copilot SERP
no_render	boolean	no	Skip the rendered pass (cheaper — the two JS-parity checks are reported as skipped)
no_bot_fetch	boolean	no	Skip the extra request sent with the GPTBot user-agent
no_retrieval	boolean	no	Skip the retrievability probe (2 SERPs: Google rank of the page for its own H1 question, and whether it is indexed). On by default; a page that is not indexed is reported as a blocker.
offsite	boolean	no	Also measure mentions of the brand off the page with five searches ("brand" site:youtube.com / reddit.com / wikipedia.org / linkedin.com / review sites). Adds an offsite pillar; billed as 5 SERP cal

Run structured Google, Bing or DuckDuckGo searches through a residential proxy. Bing supports web, shopping, images, news, videos, places/maps and autocomplete over HTTP, including Copilot AI answers and citations when Bing returns them. Google web search also parses rich blocks directly from its…

Parameter	Type	Required	Notes
query	string	no	The search query (optional for place_details/product/flights/lens/reviews, which are ID/URL-addressed)
engine	string	no	Search engine (default google)
search_type	string	no	Vertical (default search). Bing supports shopping/images/news/videos/places/maps/autocomplete. Google additionally supports scholar/jobs/place_details/hotels/flights/events/product/lens/reviews; maps
country	string	no	ISO country code, e.g. 'us'
lang	string	no	Search UI language, e.g. 'en' or 'it'
render	boolean	no	Force browser rendering where supported; Google/Bing web search rich blocks are parsed over HTTP
device	string	no	SERP device shape (default desktop)
page	integer	no	Result page, 1-based (default 1). The response's pagination.available_pages lists which pages exist; use search_bulk to fetch many pages at once.
start	integer	no	Result offset alias (0, 10, 20…)
num	integer	no	How many organic results to aim for (default 10, max 100). Google serves ~10 per page, so a larger num is satisfied by fetching consecutive pages and merging them — it is NOT ignored. `search_metadata
location	string	no	Search from this location, e.g. 'Milan, Italy' (encoded to Google's uule server-side)
timeframe	string	no	Trends only: Google timeframe token — 'today 12-m' (default), 'now 7-d', or an explicit 'YYYY-MM-DD YYYY-MM-DD' range
uule	string	no	Geo token: encoded uule, or raw coordinates 'lat,lon' / 'lat,lon,radius_m' (encoded server-side)
safe	string	no	Google SafeSearch setting
nfpr	boolean	no	Disable Google spelling correction
wait_for	string	no	Rendered path: wait for this CSS selector before parsing late panels
browser	string	no	TLS/browser identity for the fetch path
google_params	object	no	Additional Google query parameters not modeled above
place_id	string	no	Google Maps place id for place_details — the hex '0x…:0x…' fid from maps/places results, a 'ChIJ…' place id or a numeric cid all work; served from Maps' place card over HTTP (name, address, phone, web
data_id	string	no	Maps data id, hex fid '0x…:0x…' (from maps/place_details results) — required for reviews

Search the live web, fetch the top organic pages as clean Markdown, and return citation-ready numbered sources plus one token-bounded context string ready for an AI prompt. Use this when the goal is answering/researching, and use search when raw SERP structure or a specialized vertical is…

Parameter	Type	Required	Notes
query	string	yes	The research/search query
engine	string	no	Search engine (default google)
country	string	no	ISO country code for search and proxy geo
lang	string	no	Search UI language, e.g. 'en' or 'it'
top_n	integer	no	Top organic pages to fetch (default 3, max 5)
max_tokens	integer	no	Maximum estimated tokens in the assembled context (default 8000)
fetch_content	boolean	no	False returns snippet-only context without fetching result pages

Discover a site's URLs fast (robots.txt sitemaps + /sitemap.xml + homepage links) without a full crawl. Returns up to limit URLs (default 100) plus the site-wide total and a per-section summary (e.g. '/blog': 1988) so you see the site's shape without the full list. Narrow with search…

Parameter	Type	Required	Notes
url	string	yes	The site URL to map
limit	integer	no	Max URLs returned (default 100). total/summary always cover the whole site.
search	string	no	Only return URLs containing this substring — use this to narrow before raising limit
group_by	string	no	path: return the path tree with per-prefix counts instead of the flat URL list
includeSubdomains	boolean	no	Include subdomains of the seed host

Start an asynchronous BFS crawl of a site from a seed URL, converting each page to Markdown. Returns a job id — poll with crawl_status.

Parameter	Type	Required	Notes
url	string	yes	Seed URL
limit	integer	no	Max pages (default 50)
depth	integer	no	Max link depth (default 3)
content_mode	string	no	Per-page content scope: smart (default) \| article \| full
include	array	no	URL substrings/globs to include
exclude	array	no	URL substrings/globs to exclude
country	string	no	ISO country code for the proxy exit

Poll a crawl job for progress and the pages crawled so far. Polls are incremental: pass the previous response's nextCursor as since to receive only the pages crawled since your last poll. Pages omit their content by default — set include_content true only when you actually need the text (a…

Parameter	Type	Required	Notes
jobId	string	yes	The crawl job id returned by crawl
since	integer	no	Page cursor from the previous poll's nextCursor — returns only newer pages
include_content	boolean	no	Include each page's full content (default false — metadata only)

Scrape many URLs asynchronously with shared options. Returns a job id — poll with batch_status. For SEO/status audits over many pages set mode 'summary': items carry metadata only (title, description, canonical, contentLength) instead of full page content.

Parameter	Type	Required	Notes
urls	array	yes	URLs to scrape
format	string	no	Output format (default markdown)
content_mode	string	no	Per-URL content scope: smart (default) \| article \| full
engine	string	no	Fetch engine (default auto)
mode	string	no	summary: per-URL metadata only, no page content — the light mode for audits
country	string	no	ISO country code for the proxy exit

Poll a batch job for progress and per-URL results. Polls are incremental: pass the previous response's nextCursor as since to receive only the items completed after your last poll. Items omit page content by default — set include_content true only when you actually need the text.

Parameter	Type	Required	Notes
jobId	string	yes	The batch job id returned by batch
since	integer	no	Item cursor from the previous poll's nextCursor — returns only newer items
include_content	boolean	no	Include each item's full page content (default false — metadata only)

Paginate ONE search query asynchronously and merge deduplicated organic results. Page-one AI Overview/PAA/Knowledge Graph/answer enrichments are retained; set render:true to request those Google JS blocks. Billed per page actually fetched, with unavailable pages refunded.

Parameter	Type	Required	Notes
query	string	yes	The search query to paginate
engine	string	no	Search engine (default google)
search_type	string	no	Vertical to paginate (default search)
max_pages	integer	no	Max pages to fetch (1-10, default 5). Stops early when Google has no more pages.
country	string	no	ISO country code, e.g. 'us'
lang	string	no	UI language, e.g. 'en'
render	boolean	no	Force rendering to capture page-one Google JS enrichments
device	string	no	SERP device shape
location	string	no	Search location, e.g. 'Milan, Italy'
uule	string	no	Encoded geo token or raw coordinates
safe	string	no	Google SafeSearch setting
nfpr	boolean	no	Disable Google spelling correction
wait_for	string	no	Rendered path CSS selector for late panels
browser	string	no	Fetch-path browser identity
google_params	object	no	Additional Google query parameters
webhook	string	no	Public URL to POST the finished job to

Poll a bulk search job for progress and merged organic results. Polls are incremental: pass the previous response's nextCursor as since to receive only the organic results gathered after your last poll.

Parameter	Type	Required	Notes
jobId	string	yes	The bulk search job id returned by search_bulk
since	integer	no	Organic cursor from the previous poll's nextCursor — returns only newer results

Build a structured dataset from a plain-language prompt. Quantic AI plans the search queries, searches Google/Bing/DuckDuckGo, maps the sites it finds and scrapes them into validated rows (CSV/JSON). Returns a job id — poll with dataset_status. Billed per delivered, validated record (email/phone…

Parameter	Type	Required	Notes
prompt	string	yes	What dataset you want, in plain language (e.g. 'coffee roasters in Portland with email and phone')
columns	array	no	Columns to extract; omit to let the planner infer them
country	string	no	ISO country code for the proxy exit geo
sources	object	no	Domain allow/deny lists
limits	object	no	—
webhook	string	no	Public URL to POST the finished dataset to

Poll a dataset job for progress, the collection trace (steps) and the rows so far. Polls are incremental: pass the previous response's nextCursor as since to receive only rows delivered after your last poll. Set mode 'summary' to omit rows and get only progress + steps (light poll). When…

Parameter	Type	Required	Notes
jobId	string	yes	The dataset job id returned by create_dataset
since	integer	no	Row cursor from the previous poll's nextCursor — returns only newer rows
mode	string	no	summary: progress + steps only, no rows

List the account's proxy services of every type — Residential Basic/Premium/Private, Mobile, Mobile V2, Datacenter (static or traffic-based), ISP, IPv6 — with plan type, bandwidth left, expiry, whitelisted IPs and the orderId to pass to generate_proxies. Passwords are not listed here:…

Parameter	Type	Required	Notes
active	boolean	no	true: only non-expired services (recommended). false: only expired. Omit for all.
planType	string	no	Only services of this plan type
limit	integer	no	Max services returned (default 50)
offset	integer	no	Pagination offset (default 0)

Generate ready-to-use proxy endpoint strings (credentials included) from one of the account's active proxy services — any type: residential, mobile, datacenter, ISP, IPv6. Supports geo targeting (country/state/city, ISP or ASN where the plan allows it), rotating or sticky sessions, HTTP or SOCKS5,…

Parameter	Type	Required	Notes
orderId	string	yes	The proxy service's orderId (from list_proxies)
protocol	string	no	Proxy protocol (default http)
format	string	no	Output string format (default user:pass@host:port)
quantity	integer	no	Number of proxy strings (default 10)
country	string	no	Country code for geo targeting, lowercase, e.g. 'us'
state	string	no	State/region (Residential Premium & Mobile V2: use the slug from proxy_locations; 'all' for any)
city	string	no	City (slug from proxy_locations where applicable; 'all' for any)
rotation	string	no	rotating (default): new IP per request. sticky: keep the IP for sessionTime. static: IPv6 only, fixed session with no TTL.
sessionTime	integer	no	Sticky session duration in minutes (default 10; Residential Basic/Datacenter minimum 3)
isp	string	no	ISP code for Residential Premium / Mobile V2 targeting (from proxy_locations tree, e.g. 'tmobile')
asn	string	no	ASN for Residential/Datacenter Basic targeting, e.g. 'AS12345'
strict	boolean	no	Residential/Datacenter Basic: true allows fallback to nearby locations when the exact target has no IPs
filter	string	no	Residential Premium / Mobile V2 pool filter (omit for the full pool)
ip	string	no	Mobile V2 only: a whitelisted IP (see whitelist_ip) to fetch the IP-auth proxy list instead of user:pass proxies
gateway	string	no	Mobile V2 region gateway (default ww)

Discover valid geo-targeting values for a proxy plan type before calling generate_proxies: countries, states, cities, ASNs, or the full location tree (countries → regions → cities → ISPs). Use level 'tree' for Residential Premium / Mobile V2 slugs and ISP codes, or for the static datacenter…

Parameter	Type	Required	Notes
planType	string	yes	The plan type to look up (same value as list_proxies planType)
level	string	no	countries (default) \| states (needs country) \| cities (needs country) \| asns \| tree (full location tree: residentialpremium, mobile/mobile_v2, datacenter)
country	string	no	Country code, required for states/cities, optional filter for asns
state	string	no	Cities only: filter by state

Manage IP-auth whitelisting on a proxy service (Residential Basic, Datacenter, ISP, IPv6, Mobile): add or remove an IP, or list the current entries. A whitelisted machine uses the proxies without username/password — required for the Mobile V2 IP-auth proxy list. Residential Premium/Private use…

Parameter	Type	Required	Notes
action	string	yes	What to do with the order's whitelist
orderId	string	yes	The proxy service's orderId (from list_proxies)
ip	string	no	The IP to add/remove (required for add and remove)
ports_count	integer	no	Mobile add: number of ports to allocate
protocol	string	no	Mobile add: protocol for the allocated ports
country	string	no	Mobile add: geo targeting for the ports, e.g. 'us'
region	string	no	Mobile add: region slug
city	string	no	Mobile add: city slug
isp	string	no	Mobile add: ISP code, e.g. 'tmobile'
sticky	boolean	no	Mobile add: keep the same IP per port
ttl	integer	no	Mobile add: sticky session TTL in seconds

Use this to find a ready-made Collector for a task before calling run_collector. Collectors are paid, versioned scrapers you run with a semantic input (keyword + location, place id, product id, domain…) instead of URLs, grouped in categories such as local businesses and maps, e-commerce, jobs,…

Parameter	Type	Required	Notes
category	string	no	Optional category filter (e.g. 'local', 'ecommerce', 'jobs', 'news', 'travel', 'leads', 'finance', 'dev', 'gaming', 'osint', 'research', 'classifieds', 'knowledge')
slug	string	no	Return ONE collector's full definition (input and output schema, example input, price, health) instead of the compact catalog

Run a Collector by slug with a semantic input (see list_collectors for each collector's inputSchema and example). Short runs return the rows inline; long runs return 202 with a run_id + statusUrl — poll with collector_run_status. Results are billed per delivered row (never for failures). Set…

Parameter	Type	Required	Notes
slug	string	yes	Collector slug from list_collectors, e.g. 'google_maps_places'
input	object	yes	Input fields matching the collector's inputSchema (e.g. { keyword: 'dentist', location: 'Austin, TX', max_results: 20 })
async	boolean	no	Force background execution and return a run_id to poll

Fetch a Collector run by run_id: status (queued|running|done|failed), result count, cost, partial flag and the result rows. Use after run_collector returned 202/async. Pass format 'csv' to get the rows as CSV text.

Parameter	Type	Required	Notes
run_id	string	yes	The run id returned by run_collector
format	string	no	Return rows as JSON (default) or CSV text

Send feedback to the QuanticData team: a bug (a result that is wrong or empty after a retry, a broken parser, a blocked page that should work), a missing tool, site, option or collector, or a question about behaviour or pricing. Use it when the user asks to report something. When a tool here…

Parameter	Type	Required	Notes
kind	string	yes	bug: something returned wrong/empty/errored. feature: a missing tool, option, site or collector. question: unclear behaviour or pricing. other: anything else.
message	string	yes	What happened or what is missing, in plain words. Include the URL/query/collector involved when there is one.
tool	string	no	Name of the tool involved, e.g. 'scrape' or 'run_collector' (omit for general feedback)
expected	string	no	What the user needed to get back
actual	string	no	What actually came back (error text, empty payload, wrong fields…). Trim page content; a short excerpt is enough.
tool_input	object	no	The arguments passed to the failing tool, so the team can reproduce it. Leave out cookies, credentials and anything private.
contact	string	no	Optional email or handle to follow up on — ask the user before sending it; never send it unasked.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Quanticdata or to call it, at any volume.

ATrust score 95 / 100

Release 0.11.4 · scanned 14 Oct 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score95

Findings1 threat · 1 capability

Capabilitymoderate

Coveragesource

Verificationnone

Surface digest6e62861b01b928ee6a378190634dc8edbd7f47fc9109b444095405be2cea39cc

Score vectorthreat 100 → client 95

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
verification-discount	none	publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read	−2
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (28 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
scrape	untrusted-inputexternal-sink	untrusted-input: keyword "scrape"; external-sink: keyword "http_request", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
unlock	no tags
generate_parser	untrusted-input	untrusted-input: keyword "scrape", declares openWorldHint: true (interacts with entities outside the server)
save_parser_preset	untrusted-inputstate-write	untrusted-input: keyword "scrape"; state-write: declares readOnlyHint: false
list_parser_presets	no tags
parser_preset_stats	no tags
heal_parser_preset	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
seo_audit	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
ai_visibility	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
search	untrusted-input	untrusted-input: keyword "web_search", declares openWorldHint: true (interacts with entities outside the server)
search_and_read	untrusted-input	untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server)
map	untrusted-input	untrusted-input: keyword "crawl", declares openWorldHint: true (interacts with entities outside the server)
crawl	untrusted-inputexternal-sink	untrusted-input: keyword "crawl"; external-sink: declares readOnlyHint: false, openWorldHint: true
crawl_status	untrusted-input	untrusted-input: keyword "crawl"
batch	untrusted-inputexternal-sink	untrusted-input: keyword "scrape"; external-sink: declares readOnlyHint: false, openWorldHint: true
batch_status	no tags
search_bulk	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
search_bulk_status	no tags
create_dataset	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
dataset_status	untrusted-input	untrusted-input: keyword "download"
list_proxies	no tags
generate_proxies	external-sinkstate-write	external-sink: keyword "curl"; state-write: declares readOnlyHint: false
proxy_locations	no tags
whitelist_ip	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_collectors	no tags
run_collector	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
collector_run_status	untrusted-input	untrusted-input: keyword "fetch"
report	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true, handler sends an HTTP POST (fetch(url) at dist/server.js:438

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digest6e62861b01b928ee

Scanned2026-10-14

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.