Atlas / MCP servers / octoparse / octoparse

octoparseSAFE

Name: octoparse
Author: octoparse

mcp/octoparse/octoparse-mcp

MCP server by octoparse · ai agent · data extraction · mcp · Audited 2026-10-10

⚑ Report / re-scan Source ↗

Official Octoparse MCP server for AI-powered web scraping workflows.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

14 13r · 1w · 0d

Transport

streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.octoparse.com/) [](https://openapi.octoparse.com/octoparse-mcp-guide.html)

English | 日本語

Octoparse MCP Server connects MCP-compatible AI clients to Octoparse so users can discover scraping templates, create cloud tasks from Octoparse preset templates, manage existing tasks, and export structured data.

Hosted Server

Use the hosted Streamable HTTP endpoint:

https://mcp.octoparse.com

Configure this as an MCP server endpoint, not as a REST API tool.

Authentication

The hosted server officially supports both OAuth and API key authentication:

OAuth: the default option when the MCP client can open a browser authorization flow.
API key: an optional authentication method for clients that can send custom HTTP headers.

For API key mode, send the key in the x-api-key header. Do not place real keys in source control, issue reports, screenshots, or shared logs.

Quick Start

Generic HTTP MCP configuration:

{
"mcpServers": {
"octoparse": {
"type": "http",
"url": "https://mcp.octoparse.com"
}
}
}

Claude OAuth / default authentication:

claude mcp add --transport http octoparse https://mcp.octoparse.com

Claude with API key:

claude mcp add --transport http octoparse https://mcp.octoparse.com --header "x-api-key: YOUR_API_KEY"

Codex CLI:

codex mcp add octoparse --url https://mcp.octoparse.com

Gemini CLI example configuration:

{
"mcpServers": {
"octoparse": {
"httpUrl": "https://mcp.octoparse.com",
"oauth": {
"clientId": "Octoparse",
"enabled": true
}
}
}
}

After adding the server, complete authorization in the browser if your client pro

Read from source at commit 365d21c26528OBSERVED · 2026-10-10

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp-web-widget --env EXECUTION_TASK_CREDENTIAL_HANDLE_TTL_SECONDS=${EXECUTION_TASK_CREDENTIAL_HANDLE_TTL_SECONDS} --env REDIS_KEY_PREFIX=${REDIS_KEY_PREFIX} --env REDIS_PASSWORD=${REDIS_PASSWORD} -- npx -y @octoparse/[email protected]

claude-desktop

{
  "mcpServers": {
    "mcp-web-widget": {
      "command": "npx",
      "args": [
        "-y",
        "@octoparse/[email protected]"
      ],
      "env": {
        "EXECUTION_TASK_CREDENTIAL_HANDLE_TTL_SECONDS": "${EXECUTION_TASK_CREDENTIAL_HANDLE_TTL_SECONDS}",
        "REDIS_KEY_PREFIX": "${REDIS_KEY_PREFIX}",
        "REDIS_PASSWORD": "${REDIS_PASSWORD}"
      }
    }
  }
}

Exposed tools (14)

13 read · 1 write · 0 destructive.

Tool	Risk	Description
`auth_task_tool`	read	Requires auth
`demo_logging_tool`	read	Returns a demo payload
`direct_logging_failure_tool`	read	Fails through the direct execution path
`execute_task`	write	Executes task
`export_data`	read	Logs through request context
`failing_logging_tool`	read	Throws a demo error
`no_sink_tool`	read	Executes without explicit logging configuration
`result_task_tool`	read	Returns result through task wrapper
`search_templates`	read	Searches templates
`standard_tool`	read	Regular registration path
`status_task_tool`	read	Reads task status through wrapper
`task_tool`	read	Task registration path
`validated_task_tool`	read	Uses SDK task input validation
`widget_tool`	read	Returns a widget result

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (2 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (11)

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/middleware/request-logger.ts:15

return createHash('sha1').update(fullKey, 'utf8').digest('hex');

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/utils/api-key-utils.ts:11

return createHash('sha1').update(apiKey, 'utf8').digest('hex');