Atlas / MCP servers / just-every / Screenshot

ScreenshotSAFE

mcp/just-every/screenshot-5

Quickly screenshots webpages and converts to an LLM friendly size

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
4 4r · 0w · 0d
Transport
stdio
License
MIT
Stars
110
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Fast, efficient screenshot capture of web pages - optimized for CLI coding tools. Automatically tiles full pages into 1072x1072 chunks for optimal processing.

[](https://www.npmjs.com/package/@just-every/mcp-screenshot-website-fast) [](https://github.com/just-every/mcp-screenshot-website-fast/actions)

Overview

Built specifically for AI vision workflows, this tool captures high-quality screenshots with automatic resolution limiting and tiling for optimal processing by Claude Vision API and other AI models. It ensures screenshots are perfectly sized at 1072x1072 pixels (1.15 megapixels) for maximum compatibility.

Features

  • 📸 Fast screenshot capture using Puppeteer headless browser
  • 🎯 Claude Vision optimized with automatic resolution limiting (1072x1072 for optimal 1.15 megapixels)
  • 🔲 Automatic tiling - Full pages are automatically split into 1072x1072 tiles
  • 🎬 Screencast capture - Record series of screenshots over time with configurable intervals
  • 🔄 Always fresh content - No caching ensures up-to-date screenshots
  • 📱 Configurable viewports for responsive testing
  • ⏱️ Wait strategies for dynamic content (networkidle, custom delays)
  • 📄 Full page capture by default for complete page screenshots
  • 🎥 Animated WebP export - Save screencasts as high-quality animated WebP files
  • 💉 JavaScript injection - Execute custom JS before screencast capture
  • 📦 Minimal dependencies for fast npm installs
  • 🔌 MCP integration for seamless AI workflows
  • 🪟 **
Read from source at commit 7d9f0af55e5fOBSERVED · 2026-10-07
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mcp-screenshot-website-fast -- npx -y @just-every/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp-screenshot-website-fast": {
      "command": "npx",
      "args": [
        "-y",
        "@just-every/[email protected]"
      ]
    }
  }
}
03

Exposed tools (4)

4 read · 0 write · 0 destructive.

ToolRiskDescription
capture_consolereadCapture console output from a web page. Accepts a URL, optional JS command to run, and duration to wait (default 4 seconds). Returns all console messages during that time.
capture_selectorreadCapture a screenshot of a specific DOM element matched by a CSS selector. Use this when a full-page screenshot would send unnecessary pixels.
take_screencastreadCapture a series of screenshots of a web page over time, producing a screencast. Uses adaptive frame rates: 100ms intervals for ≤5s, 200ms for 5-10s, 500ms for >10s. PNG format: individual frames. WebP format: animated WebP with 4-second pause at end for looping.
take_screenshotreadFast, efficient screenshot capture of web pages - optimized for CLI coding tools. Use this after performing updates to web pages to ensure your changes are displayed correctly. Automatically tiles full pages into 1072x1072 chunks for optimal processing.
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (9)

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/serve.ts:330
const hash = createHash('sha1').update(buf).digest('hex');
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
test/url-security.test.ts:29
'http://169.254.169.254',
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
test/url-security.test.ts:75
url: 'http://169.254.169.254',
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/url-security.test.ts:25
'http://0.0.0.0',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/url-security.test.ts:26
'http://10.0.0.1',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/url-security.test.ts:27
'http://172.16.0.1',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/url-security.test.ts:28
'http://192.168.1.10',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/url-security.test.ts:29
'http://169.254.169.254',
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, commander, execa, puppeteer, sharp, @eslint/js, @types/node, @typescript-eslint/eslint-plugin
Why it matters. 22 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 7d9f0af55e5ffull audit observations/trust-audit/mcp-server/just-every__screenshot-5.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-077d9f0af55e5fSAFEB89first audit
06

Questions

What is the Screenshot MCP server?

Quickly screenshots webpages and converts to an LLM friendly size

What tools does Screenshot expose?

4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Screenshot safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Screenshot need?

No credential environment variables were found in its source, so it appears to need none.

How does Screenshot run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @just-every/mcp-screenshot-website-fast at 0.1.41.

How current is this page?

The grade is for one exact copy of the source (7d9f0af55e5f), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement