Atlas / MCP servers / jayniebingyu-cyber / goaimoat-web-scrape-mcp

goaimoat-web-scrape-mcpSAFE

mcp/jayniebingyu-cyber/goaimoat-web-scrape-mcp

URL to clean Markdown for AI agents. 2 tools: scrape_url (one page) and crawl_website (whole site). Blocked or paywalled pages are reported honestly, never invented. Hosted endpoint at scrape.mcp.goaimoat.com/mcp, free 3 calls per email, no card. A cheaper Firecrawl alternative; also runs locally vi

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
2 2r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Turn any URL into clean, LLM-ready Markdown — or crawl a site and get Markdown per page.

Built for AI agents that need to actually read a page: full-text reading, research, and RAG ingestion. Output is honestly labelled — when a page is blocked, paywalled or needs a login, you get that error back instead of invented text. Unknown pages are reported as unreachable, never fabricated.

  • Hosted (no install): https://scrape.mcp.goaimoat.com/mcp
  • Registry name: com.goaimoat/web-scrape
  • Free: 3 calls per email. Then a $29/yr license.
  • Public web only. This is a scraping utility, not a proxy or network-circumvention

tool — it does not unblock restricted content for any region.

Tools

Both accept optional email (records free quota) and license_key.

Use the hosted endpoint

Add to Claude Desktop / Cursor / Cline (streamable-http):

{
"mcpServers": {
"web-scrape": {
"type": "streamable-http",
"url": "https://scrape.mcp.goaimoat.com/mcp"
}
}
}

Then just call scrape_url with your email — no key, no signup for the first 3 calls.

Run it yourself

Requires a MONID_API_KEY (the upstream data provider). Get one at monid.ai.

Docker

docker build -t goaimoat-web-scrape-mcp .
docker run --rm -i -e MONID_API_KEY=your_key goaimoat-web-scrape-mcp

The container runs on stdio by default, which is what directory scanners (Glama and similar) use for introspection.

Local

pip install -r requirements.txt
MONID_API_KEY=your_key python server.py                                  # stdio
MCP_TRANSPORT=streamable-http MCP_PORT=8026 MONID_API_KEY=... python server.py

Without MONID_API_KEY the server still starts and answers introspection, but tool calls return a

Read from source at commit ffd03c6c6e30OBSERVED · 2026-10-11
02

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
crawl_websitereadCrawl a website and return clean Markdown for each page.
scrape_urlreadScrape a URL into clean, LLM-ready Markdown.
03

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (1)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements.txt
fastmcp
Why it matters. 1 requirement(s) not pinned with ==
Fix. pin exact versions

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha ffd03c6c6e30full audit observations/trust-audit/mcp-server/jayniebingyu-cyber__goaimoat-web-scrape-mcp.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11ffd03c6c6e30SAFEB89first audit
05

Questions

What is the goaimoat-web-scrape-mcp MCP server?

URL to clean Markdown for AI agents. 2 tools: scrape_url (one page) and crawl_website (whole site). Blocked or paywalled pages are reported honestly, never invented. Hosted endpoint at scrape.mcp.goaimoat.com/mcp, free 3 calls per email, no card. A cheaper Firecrawl alternative; also runs locally vi

What tools does goaimoat-web-scrape-mcp expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is goaimoat-web-scrape-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does goaimoat-web-scrape-mcp need?

It reads MONID_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does goaimoat-web-scrape-mcp run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (ffd03c6c6e30), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement