Skip to content
anlyon.devby Anlyon

io.alterlab/mcp-server

io.alterlab/mcp-serveralterlab.iostreamable-httpv1.12.2Scanned

Web scraping MCP server — scrape, extract structured data, screenshot any site with anti-bot bypass.

15 tools: 1 do something that can't be undone, 8 change things and 6 only read.

Tools: 0 delete, 1 irreversible, 8 write, 6 read.
  • Reads private data · 0
  • Reads text others write · 8
  • Can send data out · 9
  • 1 finding

Sign-in required, OAuth metadata published. Remote posture

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

15 tools

Can't be undone 1Claude Code: ask
  • alterlab_screenshotCapture a full-page PNG screenshot of one URL, an image rather than text content.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "alterlab_screenshot" says "screenshot": a word for reading.
    • The description's first verb is "capture": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "capture" and "url": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "alterlab_screenshot" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "alterlab_screenshot" says "screenshot": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Capture a full-page PNG screenshot of one URL, an image rather than text content. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Works on anti-bot-protected sites, rendered in a real headless browser. Use wait_for to wait for an element and wait_until to control load timing. Pass actions (for example dismiss_consent or evaluate) to prepare the page; the screenshot is captured after they run and action_results is returned.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 8Claude Code: ask
  • alterlab_batchStart an asynchronous batch job for a large URL set (up to 100 per call) and poll for results later.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.urls): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Start an asynchronous batch job for a large URL set (up to 100 per call) and poll for results later. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Each URL can have its own mode, formats and extraction_schema. Returns a batch_id immediately; results are available from GET /api/v1/batch/{batch_id}.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • alterlab_batch_scrapeScrape 2-20 URLs in parallel and get every result back in one synchronous call, no polling required.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "alterlab_batch_scrape" says "scrape": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "scrape": it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.urls): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Scrape 2-20 URLs in parallel and get every result back in one synchronous call, no polling required. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Failed URLs report their error; successful ones return content. For 20+ URLs use alterlab_batch.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • alterlab_crawlCrawl a whole website and return the content of every page, for RAG, indexing or site-wide export.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "alterlab_crawl" says "crawl": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "crawl": it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Crawl a whole website and return the content of every page, for RAG, indexing or site-wide export. Use when you need many pages from one domain; for one URL use alterlab_scrape, for a URL list only use alterlab_map. Works on JavaScript-heavy and protected sites, with anti-bot handling on every page. Returns a crawl_id immediately; results are available from GET /api/v1/crawl/{crawl_id}.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • alterlab_create_accountCreate an AlterLab account and API key for your user.No findings

    Why it is in this group

    • The name "alterlab_create_account" says "create": a word for a change.
    Description, as the server wrote it
    Create an AlterLab account and API key for your user. Use only when no ALTERLAB_API_KEY exists yet; skip it if a key is already configured. Signup is on behalf of your user (agent signup with human approval). Nothing is created until the human approves: they get an email (and you get a verification_url and user_code to show them) describing what the agent can do. After approval you receive a scoped API key labeled with agent_name, with a default daily spend cap, revocable from the dashboard. No extra free credit is granted; the usual welcome rules apply to the human's account. If the human has not approved yet, the result contains the signup_id, verification_url and user_code; poll GET /api/v1/agent/signup/{signup_id} or call this tool again.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • alterlab_create_api_keyCreate one scoped, spend-capped API key (ALTERLAB_API_KEY) for the SDK and REST API on this machine.No findings

    Why it is in this group

    • The name "alterlab_create_api_key" says "create": a word for a change.
    Description, as the server wrote it
    Create one scoped, spend-capped API key (ALTERLAB_API_KEY) for the SDK and REST API on this machine. Works only when the user ticked "Also create an API key for this machine" on the OAuth approval screen, so no second approval is needed. Skip it if a key is already configured. The key is labeled with your client name, carries the same read/write permissions and daily spend cap as this connection (never billing), and is revocable from the dashboard. The plaintext is returned once: store it in the environment immediately without printing it. A repeat call returns key metadata only. If it fails with a permission error, the box was not ticked: use alterlab_create_account instead.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • alterlab_estimate_costEstimate the credit cost of scraping a URL before you run it.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Estimate the credit cost of scraping a URL before you run it. Use when cost matters or before a large job; no credits are charged. Returns the predicted tier, estimated cost and confidence. Full machine-readable price list: GET https://alterlab.io/api/v1/pricing (public, no auth).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • alterlab_extractExtract structured data (prices, product info, contact details, custom fields) as JSON from HTML, text or markdown you already hold.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Extract structured data (prices, product info, contact details, custom fields) as JSON from HTML, text or markdown you already hold. Use when you have content and need specific fields. Does not fetch a URL: to fetch and extract in one step, use alterlab_scrape with extraction_schema. LLM extraction (extraction_prompt, extraction_schema) requires your own LLM API key (OpenAI, Anthropic, OpenRouter, etc.) added in the dashboard BYOK settings; without one it fails with byok_key_required.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • alterlab_feedbackTell AlterLab when something is hard.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Tell AlterLab when something is hard. Call this when something blocks you, a result is wrong, or a step is confusing, slow or priced unexpectedly. Describe what you tried, what happened and what you expected. Do not include secrets, API keys, passwords or customer data; use a job_id or hostname instead of page content. Works without an API key (rate limited per IP); with a key the report is also linked privately to your organization for follow-up. Returns a cluster_key and a status_url to check progress.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 6Show 6 read-only tools
  • alterlab_mapList every URL on a site via sitemap parsing and link extraction, without fetching page content.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "url": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    List every URL on a site via sitemap parsing and link extraction, without fetching page content. Use before alterlab_crawl or alterlab_batch to choose pages; to read the content itself use alterlab_crawl. Works on JavaScript-heavy and protected sites.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • alterlab_pricingGet AlterLab's machine-readable price list: per-tier cost, bring-your-own-proxy discount, cache-hit discount, add-ons, search and SERP prices, and the free allowance.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get AlterLab's machine-readable price list: per-tier cost, bring-your-own-proxy discount, cache-hit discount, add-ons, search and SERP prices, and the free allowance. Use when deciding whether AlterLab fits a budget, before any account exists. Free and keyless; nothing is scraped or charged.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • alterlab_scrapeFetch one URL and return its content as clean markdown, text, HTML, or JSON.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "alterlab_scrape" says "scrape": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "fetch" and "url": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Fetch one URL and return its content as clean markdown, text, HTML, or JSON. Use when a normal fetch returns 403/429, a bot-protection challenge page, a CAPTCHA, or an empty JavaScript shell. Website challenges and JavaScript-heavy pages are handled automatically by a 5-tier system that starts at the cheapest tier that works and escalates only when needed. Returns markdown by default, ready for LLM context. Supports GET and POST via method, structured extraction via extraction_schema or extraction_prompt, and cost caps via cost_controls. Supports browser actions via actions, plus screenshot and generate_pdf; the response includes action_results, one entry per action with index, type, success, error, result (evaluate) and screenshot_url (screenshot actions).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • read_alterlab_pageUse this after search_alterlab to read the full text of one AlterLab page as markdown, so you can follow the documented steps instead of guessing.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "read_alterlab_page" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Use this after search_alterlab to read the full text of one AlterLab page as markdown, so you can follow the documented steps instead of guessing. Pass the url of a search result. Only pages on alterlab.io that search_alterlab can return are readable. Free: needs no API key and never uses credits.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_alterlabUse this to look up how to do something with AlterLab (API parameters, SDKs, MCP setup, pricing, error codes, migration from Firecrawl/ScrapingBee/Apify) or to find a guide for scr…No findings

    Why it is in this group

    • The name "search_alterlab" says "search": a word for reading.
    Description, as the server wrote it
    Use this to look up how to do something with AlterLab (API parameters, SDKs, MCP setup, pricing, error codes, migration from Firecrawl/ScrapingBee/Apify) or to find a guide for scraping a specific site. Searches the docs, blog, glossary, comparisons, scrape guides and changelog. Free: needs no API key and never uses credits. Returns the best matches as title, short snippet, url and markdown_url; pass a url to read_alterlab_page to read the full page as markdown.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write8
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out9
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Sign-in required, OAuth metadata published

Looked at Oct 30, 2026, 22:19 UTC, unchanged since Oct 30, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
401
tools/list served without credentials
no
Tools that change things, listed without credentials
0
Protocol version
not observed
WWW-Authenticate on 401
yes
resource_metadata in WWW-Authenticate
https://mcp.alterlab.io/.well-known/oauth-protected-resource
RFC 9728 protected resource metadata
https://mcp.alterlab.io/.well-known/oauth-protected-resource
Authorization servers
https://api.alterlab.io
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnalterlab_screenshot

    The server marks "alterlab_screenshot" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "alterlab_screenshot" says "screenshot": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.12.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http alterlab https://mcp.alterlab.io/mcp
claude mcp add --transport http alterlab https://mcp.alterlab.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__alterlab__alterlab_search",
      "mcp__alterlab__alterlab_pricing",
      "mcp__alterlab__search_alterlab"
    ],
    "ask": [
      "mcp__alterlab__alterlab_scrape",
      "mcp__alterlab__alterlab_extract",
      "mcp__alterlab__alterlab_screenshot",
      "mcp__alterlab__alterlab_crawl",
      "mcp__alterlab__alterlab_map",
      "mcp__alterlab__alterlab_batch_scrape",
      "mcp__alterlab__alterlab_batch",
      "mcp__alterlab__alterlab_estimate_cost",
      "mcp__alterlab__alterlab_feedback",
      "mcp__alterlab__alterlab_create_account",
      "mcp__alterlab__alterlab_create_api_key",
      "mcp__alterlab__read_alterlab_page"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as alterlab. Review it before you use it.

Capability tags behind 10 rules
  • mcp__alterlab__alterlab_scrape untrusted-input, outbound
  • mcp__alterlab__alterlab_screenshot untrusted-input, outbound
  • mcp__alterlab__alterlab_crawl untrusted-input, outbound
  • mcp__alterlab__alterlab_search untrusted-input
  • mcp__alterlab__alterlab_map untrusted-input, outbound
  • mcp__alterlab__alterlab_batch_scrape untrusted-input, outbound
  • mcp__alterlab__alterlab_batch untrusted-input, outbound
  • mcp__alterlab__alterlab_estimate_cost outbound
  • mcp__alterlab__alterlab_feedback outbound
  • mcp__alterlab__read_alterlab_page untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.alterlab/mcp-server/verify?hash=1f980dc0ec37d55e9cebb6aedb514924625b552961a8f76848337504e866856b" | jq -e '.changed == false'

Pinned hash 1f980dc0ec37, from Nov 4, 2026, 08:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.alterlab/mcp-server/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.alterlab/mcp-server
[![anlyon.dev](https://anlyon.dev/badge/io.alterlab/mcp-server.svg)](https://anlyon.dev/servers/io.alterlab/mcp-server)

Source: MCP Registry · repository. Synced Nov 4, 2026, 08:17 UTC.