Back to MCP Trust Indexm8ven
48
/ 100
1 month ago
glama

firecrawl-lite-mcp-server

Enables privacy-first web scraping and structured data extraction using a local headless browser and your own LLM key. Supports tools for scraping, batch scraping, data extraction with prompts or schemas, and screenshots.

→ ariangibson/firecrawl-lite-mcp-server· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 17 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: PROXY_SERVER_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies17 high13 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.17.3GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.17.3GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.17.3GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.11.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.11.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configENABLE_HTTP_STREAMABLE_ENDPOINT— true → exposes /mcp (Claude Code, modern remote MCP clients).
configENABLE_SSE_ENDPOINT— true → exposes /sse (Claude Desktop via mcp-proxy).
configFIRECRAWL_RETRY_BACKOFF_FACTOR
configFIRECRAWL_RETRY_INITIAL_DELAY
configFIRECRAWL_RETRY_MAX_ATTEMPTS
configFIRECRAWL_RETRY_MAX_DELAY
configPROXY_LLM_API
🔐 secretPROXY_SERVER_PASSWORD— your-password
configPROXY_SERVER_URL
configPROXY_SERVER_USERNAME— your-username
configSCRAPE_BATCH_DELAY_MAX— 5000 # max delay between batch requests (ms)
configSCRAPE_BATCH_DELAY_MIN— 2000 # min delay between batch requests (ms)
configSCRAPE_DELAY_MAX— 3000 # max delay before navigation (ms)
configSCRAPE_DELAY_MIN— 1000 # min delay before navigation (ms)
configSCRAPE_SETTLE_MAX_MS— 3000 # max wait for the DOM to stop changing after load (ms); raise for slow JS sites
configSCRAPE_USER_AGENT— accepts either a single string or a JSON array of strings to rotate through. When using a JSON array, keep it on a single line.
configSCRAPE_VIEWPORT_HEIGHT
configSCRAPE_VIEWPORT_WIDTH
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/ariangibson-firecrawl-lite-mcp-server-ml0l4p)](https://m8ven.ai/mcp/ariangibson-firecrawl-lite-mcp-server-ml0l4p)
commit: 3786fd27b067ebb01c89514ec0a461e2d4e291f9
code hash: 8e8c3218ddcf4e41191d928ba48c5904b834bf19722e5891c651c40fcf7eb3e6
verified: 6/22/2026, 12:36:16 PM
view raw JSON →