ModelsAtlas
Explore
Atlas / MCP servers / crawlora-org / crawlora-mcp

crawlora-mcpSAFE

mcp/crawlora-org/crawlora-mcp
MCP server by crawlora-org · ai agents · api · claude · Audited 2026-10-12
⚑ Report / re-scanSource ↗

Hosted MCP server for structured public web data: 3,631 tools across 471 platform groups (search, maps, e-commerce, social, finance, app stores), returning clean JSON. Works with Claude, Cursor, VS Code and any MCP client.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
3 3r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://crawlora.net/mcp?utmsource=github&utmmedium=referral&utmcampaign=crawlora-mcp) [](https://crawlora.net/docs?utmsource=github&utmmedium=referral&utmcampaign=crawlora-mcp) [](https://modelcontextprotocol.io) [](https://smithery.ai/servers/crawlora/crawlora) [](https://glama.ai/mcp/servers/Crawlora-org/crawlora-mcp)

Crawlora MCP is a hosted Model Context Protocol server that gives AI clients and agents 3631 structured public‐web‐data tools across 471 platform groups — search, maps, e‐commerce, social, finance, travel, app stores, media, and reviews — each returning clean, normalized JSON instead of HTML to parse.

Two ways to use it: connect any MCP client to the hosted endpoint (https://mcp.crawlora.net/mcp), or run the small open‐source local server in this repo (npx / Docker, stdio) — both expose the same tools and authenticate with your Crawlora API key. Start free with 2,000 credits/month (no card) at [crawlora.net](https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-mcp).

Connection

A missing or invalid API key returns 401.

Connect your client

Crawlora MCP work

Read from source at commit 3f355b849746OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add crawlora-mcp --env CRAWLORA_API_KEY=${CRAWLORA_API_KEY} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "crawlora-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "CRAWLORA_API_KEY": "${CRAWLORA_API_KEY}"
      }
    }
  }
}
03

Exposed tools (3)

3 read · 0 write · 0 destructive.

ToolRiskDescription
alpha_itemreadSecond tool.
alpha_searchreadFirst
betareadThird tool.
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (2 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (3)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOInventory / provenance · inv.oversize · CWE-1104
TOOLS.md
TOOLS.md
Why it matters. 1174118 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
tools.json
tools.json
Why it matters. 3079036 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 3f355b849746full audit observations/trust-audit/mcp-server/crawlora-org__crawlora-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-123f355b849746SAFEB89first audit
06

Questions

What is the crawlora-mcp MCP server?

Hosted MCP server for structured public web data: 3,631 tools across 471 platform groups (search, maps, e-commerce, social, finance, app stores), returning clean JSON. Works with Claude, Cursor, VS Code and any MCP client.

What tools does crawlora-mcp expose?

3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is crawlora-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does crawlora-mcp need?

It reads CRAWLORA_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does crawlora-mcp run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as crawlora-mcp at 1.17.11.

How current is this page?

The grade is for one exact copy of the source (3f355b849746), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement