Skip to content

io.github.ZenRows/zenrows-mcp

by ZenRows · remote · local (npm) · no sign-in to list tools · v2.15.1 · published by GitHub user ZenRows

Zenrows MCP server: Fetch, Extract, Batch, and Browser Sessions for AI agents

Deletes · 9Changes · 28

62 tools: 9 can delete or cancel things, 28 change things and 25 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http zenrows https://mcp.zenrows.com/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn1 info
  • The input schema at properties.zenrows_params.anyOf[0].$ref contains a 50-character base64 string.

    Matched text

    inputSchema.properties.zenrows_params.anyOf[0].$ref: "#/properties/tasks/anyOf/0/items/properties/zenrows_params/anyOf/0"

    What this check looks for
  • The server marks "browser_generate_pdf" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "browser_generate_pdf" says "generate": a word for a change.

    What this check looks for
  • The description is 2,096 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...orts, CSV inputs and open jobs are available through the Batch API and SDKs only."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

62 tools

Deletes or cancels 9Claude Code: deny
  • batch_cancelStop a Batch job's current run for good.No findings

    Why it is in this group

    • The name "batch_cancel" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop a Batch job's current run for good. No task still waiting is started or billed; tasks already in flight finish (and bill). Results so far stay readable with batch_results. Tasks that never started stay pending: batch_rerun (default failed and pending) runs them later. Idempotent: a run that already ended answers with its final status and already_ended:true. To halt without ending the run, use batch_pause.

    Annotations the server declares

    • title: Cancel Batch Job
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • batch_deleteDelete a Batch job with all its runs and results, for good.No findings

    Why it is in this group

    • The name "batch_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a Batch job with all its runs and results, for good. A run in flight stops picking up tasks at once, and the job frees its active-job slot. The job reads as not found right away; storage is cleaned up in the background. Idempotent. To keep the results, use batch_cancel instead.

    Annotations the server declares

    • title: Delete Batch Job
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • browser_batchExecute a sequence of browser actions in a single call against an existing session.No findings

    Why it is in this group

    • The description's first verb is "execute": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Execute a sequence of browser actions in a single call against an existing session. Use this when you already know the full sequence of steps — it reduces round trips and is faster than calling each tool individually. Actions run sequentially and stop at the first failure unless stop_on_error is false. Each step result is returned in the results array at the same index. Note: screenshots in batch results are returned as base64 strings inside the JSON; browser_screenshot returns them as images. A batch can include evaluate, so it can change or delete page state the same way browser_evaluate can.

    Annotations the server declares

    • title: Run Batch of Browser Actions
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • browser_clear_cookiesClear all cookies for the current browser session.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Clear all cookies for the current browser session.

    Annotations the server declares

    • title: Clear Cookies
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • browser_clear_local_storageDelete every localStorage entry in the current page context.No findings

    Why it is in this group

    • The description's first verb is "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete every localStorage entry in the current page context.

    Annotations the server declares

    • title: Clear Local Storage
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • browser_evaluateExecute JavaScript in the browser context and return the result.No findings

    Why it is in this group

    • The name "browser_evaluate" says "evaluate": a word for a change.
    • The input takes a statement or command to run (input.script), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Execute JavaScript in the browser context and return the result. The script can change or delete the session's page state, such as cookies, storage and form data.

    Annotations the server declares

    • title: Evaluate JavaScript
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • browser_set_cookiesSet one or more cookies in the browser session.No findings

    Why it is in this group

    • The name "browser_set_cookies" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Set one or more cookies in the browser session. A cookie with the same name, domain and path replaces the existing one.

    Annotations the server declares

    • title: Set Cookies
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • browser_set_local_storageWrite one localStorage value in the current page context.No findings

    Why it is in this group

    • The name "browser_set_local_storage" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Write one localStorage value in the current page context. An existing value under the same key is replaced.

    Annotations the server declares

    • title: Set Local Storage Item
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • crawl_stopStop a running crawl.No findings

    Why it is in this group

    • The name "crawl_stop" says "stop": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop a running crawl. No page still waiting is fetched or billed; pages already in flight finish. The URLs kept so far stay readable with crawl_results. A stopped crawl cannot resume. Idempotent: a crawl that already ended answers with its final status. A 429, 502, 503 or 504 is retried up to 3 times, waiting at most 50 seconds in all; a 503 crawl_busy means the stop was not saved yet, and if it persists, CRAWL_BUSY says when to call again. Pages in flight still finish, so coverage and results can keep growing for up to 10 minutes after the stop; read them with crawl_get and crawl_results.

    Annotations the server declares

    • title: Stop Crawl
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 28Claude Code: ask
  • batch_createSubmit a Batch job: many URLs scraped asynchronously in the cloud (Zenrows Batch API).2 findings

    Why it is in this group

    • The name "batch_create" says "create": a word for a change.

    Findings

    • Warn

      The input schema at properties.zenrows_params.anyOf[0].$ref contains a 50-character base64 string.

      Matched text

      inputSchema.properties.zenrows_params.anyOf[0].$ref: "#/properties/tasks/anyOf/0/items/properties/zenrows_params/anyOf/0"

      What this check looks for
    • Info

      The description is 2,096 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...orts, CSV inputs and open jobs are available through the Batch API and SDKs only."

      What this check looks for
    Description, as the server wrote it
    Submit a Batch job: many URLs scraped asynchronously in the cloud (Zenrows Batch API). Suited to large URL lists; scrape and extract handle single pages. Not the same as browser_batch. Tasks use automatic mode (mode=auto) by default: Zenrows enables JS rendering and premium proxies only on the pages that need them. Pass just the URLs. Set js_render or premium_proxy (job-level, or per task) only to force a fixed configuration; that turns automatic mode off for those tasks. Cost: the same credits as the regular API, per successful task: 1 for a basic request, 5 with js_render, 10 with premium_proxy, 25 with both; mode=auto bills each task at the configuration that worked. Failed tasks are not billed, except target 404 and 410 answers, billed as on the regular API. Limits: up to 100,000 tasks per call; 3 active jobs per account by default, shared with Crawl (BATCH_QUOTA_EXCEEDED past that); a job frees its slot when its run ends. Creates a closed job with every task in this one call. Each task takes a url plus optional external_id, metadata, method/body (POST tasks) and scrape params. Every call sends an Idempotency-Key, so the bounded retries on network errors and 5xx never create a second job; an error reply carries the key to retry with. Returns job_id, status and stats at once; the job runs asynchronously. Then: batch_wait until it ends, batch_results to list rows (paged), batch_content to read one task's page. A run that ends failed (out of credits, inactive subscription, key cap) answers ok:false with error.code and server_code; batch_rerun recovers it. Submits of 10,000+ tasks keep writing tasks for a while (ingesting:true). Errors: BATCH_INVALID_REQUEST (400, server_code and invalid_tasks say what), BATCH_INSUFFICIENT_CREDITS (402), BATCH_KEY_CAP_REACHED (402, this key's cap), BATCH_QUOTA_EXCEEDED (429, job limit), AUTH_INVALID (401; server_code subscription_inactive means fix Billing), BATCH_ACCESS_DENIED (403, do not retry), BACKEND_UNAVAILABLE. Schedules, webhooks, exports, CSV inputs and open jobs are available through the Batch API and SDKs only.

    Annotations the server declares

    • title: Create Batch Job
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • batch_pausePause a Batch job's current run: it picks up no new tasks until batch_resume.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Pause a Batch job's current run: it picks up no new tasks until batch_resume. Tasks already in flight still finish and bill; for a hard cost stop use batch_cancel. A paused run still counts as an active job. Idempotent; a run that already ended answers with its final status and already_ended:true.

    Annotations the server declares

    • title: Pause Batch Job
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • batch_rerunStart a new run of a Batch job whose latest run ended (completed, stopped or failed).No findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.
    Description, as the server wrote it
    Start a new run of a Batch job whose latest run ended (completed, stopped or failed). By default it reruns only the tasks that failed or never started (status ["failed", "pending"]), and carries the others' results over: the recovery after a run that failed on credits or was cancelled. Pass status to pick other task statuses, or full:true to scrape every task again. Rerun tasks are billed like new ones. A rerun of only some tasks works up to 10 days after the run started (BATCH_RERUN_WINDOW_EXPIRED after that; full:true still works). BATCH_NO_MATCHING_TASKS: no task has those statuses. BATCH_RUN_NOT_FINISHED: the latest run is still in flight. Sends an Idempotency-Key, so a retry never starts two runs. Returns the new run at once (it writes its tasks first, ingesting:true); call batch_wait.

    Annotations the server declares

    • title: Rerun Batch Job
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • batch_resumeResume a paused Batch run: it picks up its remaining tasks again, billed as they finish.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Resume a paused Batch run: it picks up its remaining tasks again, billed as they finish. Idempotent on a run that is not paused; a run that already ended answers with its final status and already_ended:true. Needs credits: BATCH_INSUFFICIENT_CREDITS or BATCH_KEY_CAP_REACHED otherwise.

    Annotations the server declares

    • title: Resume Batch Job
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • browser_checkCheck a checkbox or radio button.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check a checkbox or radio button.

    Annotations the server declares

    • title: Check Checkbox
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_clickClick an element on the page using a CSS selector.No findings

    Why it is in this group

    • The name "browser_click" says "click": a word for a change.
    Description, as the server wrote it
    Click an element on the page using a CSS selector.

    Annotations the server declares

    • title: Click Element
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_closeClose a browser session and free all associated resources, including the concurrency slot it holds.No findings

    Why it is in this group

    • The name "browser_close" says "close": a word for a change.
    Description, as the server wrote it
    Close a browser session and free all associated resources, including the concurrency slot it holds.

    Annotations the server declares

    • title: Close Browser Session
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_dragDrag an element from its current position to a target element.No findings

    Why it is in this group

    • The name "browser_drag" says "drag": a word for a change.
    Description, as the server wrote it
    Drag an element from its current position to a target element.

    Annotations the server declares

    • title: Drag Element
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_fillClear an input field and set its value, replacing what was there (browser_type appends instead).No findings

    Why it is in this group

    • The name "browser_fill" says "fill": a word for a change.
    Description, as the server wrote it
    Clear an input field and set its value, replacing what was there (browser_type appends instead).

    Annotations the server declares

    • title: Fill Input
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_focusMove focus to an element, triggering focus-dependent UI changes.No findings

    Why it is in this group

    • The description's first verb is "move": a word for a change.
    Description, as the server wrote it
    Move focus to an element, triggering focus-dependent UI changes.

    Annotations the server declares

    • title: Focus Element
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_generate_pdfRender the current page as a PDF document.1 finding

    Why it is in this group

    • The name "browser_generate_pdf" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "browser_generate_pdf" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "browser_generate_pdf" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Render the current page as a PDF document.

    Annotations the server declares

    • title: Generate PDF
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_go_backNavigate back to the previous page in the browser history.No findings

    Why it is in this group

    • The description's first verb is "navigate": a word for a change.
    Description, as the server wrote it
    Navigate back to the previous page in the browser history.

    Annotations the server declares

    • title: Go Back
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_go_forwardNavigate forward to the next page in the browser history.No findings

    Why it is in this group

    • The description's first verb is "navigate": a word for a change.
    Description, as the server wrote it
    Navigate forward to the next page in the browser history.

    Annotations the server declares

    • title: Go Forward
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_hoverMove the mouse cursor over an element to trigger hover effects.No findings

    Why it is in this group

    • The name "browser_hover" says "hover": a word for a change.
    Description, as the server wrote it
    Move the mouse cursor over an element to trigger hover effects.

    Annotations the server declares

    • title: Hover Element
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_navigateOpen a Zenrows Browser Sessions session and navigate to a URL.No findings

    Why it is in this group

    • The name "browser_navigate" says "navigate": a word for a change.
    Description, as the server wrote it
    Open a Zenrows Browser Sessions session and navigate to a URL. This is the entry point for all browser automation. It creates a new session backed by Zenrows' hosted browser infrastructure and navigates to the given URL in one step. Returns a session_id that every other browser_* tool takes. The session holds one concurrency slot until browser_close closes it. When to use options: - proxy_country: geo-restricted content (ISO 3166-1 alpha-2, e.g. "US", "DE") - proxy_region: world region for geo-targeted proxy (eu, na, ap, sa, af, me)

    Annotations the server declares

    • title: Open Browser & Navigate
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_new_tabOpen a new browser tab.No findings

    Why it is in this group

    • The description's first verb is "open": a word for a change.
    Description, as the server wrote it
    Open a new browser tab. Returns a tab_id to use with browser_switch_tab.

    Annotations the server declares

    • title: Open New Tab
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_press_keyPress a keyboard key.No findings

    Why it is in this group

    • The name "browser_press_key" says "press": a word for a change.
    Description, as the server wrote it
    Press a keyboard key. Examples: "Enter", "Tab", "Escape", "ArrowDown", "Control+a".

    Annotations the server declares

    • title: Press Key
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_reloadReload the current page of a browser session.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Reload the current page of a browser session.

    Annotations the server declares

    • title: Reload Page
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_scrollScroll the page in a given direction.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Scroll the page in a given direction.

    Annotations the server declares

    • title: Scroll Page
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_select_optionSelect an option from a <select> dropdown element.No findings

    Why it is in this group

    • The name "browser_select_option" says "select": a word for a change.
    Description, as the server wrote it
    Select an option from a <select> dropdown element.

    Annotations the server declares

    • title: Select Option
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_switch_tabSwitch focus to a different browser tab.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Switch focus to a different browser tab.

    Annotations the server declares

    • title: Switch Tab
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_typeType text into an input element.No findings

    Why it is in this group

    • The name "browser_type" says "type": a word for a change.
    Description, as the server wrote it
    Type text into an input element. Appends to existing content unless clear_first is set.

    Annotations the server declares

    • title: Type Text
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • browser_uncheckUncheck a checkbox, found by CSS selector, in a browser session.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Uncheck a checkbox, found by CSS selector, in a browser session.

    Annotations the server declares

    • title: Uncheck Checkbox
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • crawl_createStart a crawl from one URL (Zenrows Crawl API).No findings

    Why it is in this group

    • The name "crawl_create" says "create": a word for a change.
    Description, as the server wrote it
    Start a crawl from one URL (Zenrows Crawl API). Crawl follows the links in each page's HTML up to depth hops (no depth limit when depth is omitted), keeps the URLs that match include_patterns / exclude_patterns, and stays on the start URL's registrable domain (subdomains count). Use crawl when you have one start page (a listing, category, blog index) and need the URLs behind it, optionally with each page's HTML. For a single page, use scrape. Each page fetched is billed as one scrape on this account; max_pages bounds the cost (default 100), max_items bounds how many URLs are kept (default 100). Without depth, the crawl keeps following links until max_pages or max_items stops it or nothing is left to open, so set max_pages to what you are willing to spend. The start page itself is never a result, but its fetch is billed: a crawl whose include_patterns / exclude_patterns match nothing still costs that one scrape. A crawl whose pages held nothing new to follow (no link, only links to other sites, or only links the patterns reject) ends completed with no results and no error. When patterns are set, check them against the URLs the start page links to. Set output_format "html" or "markdown" to also store each kept URL's page, then read it with crawl_content. Returns crawl_id, status and the crawl (with coverage) at once; the crawl runs asynchronously. Call crawl_wait, then crawl_results. Set idempotency_key to make a retry safe: the same key returns the crawl the first request created instead of starting another. CRAWL_NOT_ENABLED: Crawl is not enabled for this account; do not retry. CRAWL_TOO_MANY_CRAWLS: the account has reached its limit of active jobs (3 by default), shared with its Batch jobs; retry after retry_after seconds.

    Annotations the server declares

    • title: Create Crawl
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • crawl_downloadSave every result of a crawl to one local file, as JSON lines: url, content_status and, once fetched, content (the page).No findings

    Why it is in this group

    • The description's first verb is "save": a word for a change.
    Description, as the server wrote it
    Save every result of a crawl to one local file, as JSON lines: url, content_status and, once fetched, content (the page). Returns the file's path and line count, not the results, so a crawl of any size costs one small reply. Read the file with your own tools. The file goes to path when given (a relative path inside ~/.zenrows/crawls; an absolute path or one that leaves that folder fails with INVALID_PATH), else ~/.zenrows/crawls/<crawl_id>.jsonl. An existing file is kept and the call fails with FILE_EXISTS unless overwrite is true. On a running crawl the file holds only what was kept so far: download again once crawl_wait says it ended. After crawl_stop, pages in flight can still add lines for up to 10 minutes: the reply says so with partial: true. On the hosted server no file is written: the reply gives the download URL and a command to run where your API key is set.

    Annotations the server declares

    • title: Download Crawl
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • extractExtract structured data from a webpage via Zenrows.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Extract structured data from a webpage via Zenrows. Returns JSON fields (products, articles, listings) in "data" rather than a full page body. Set include_html to also get the page HTML. Modes: - auto (default): extract=auto, site-tailored Extract (currently free, billing may apply later). Works on any prepared domain, with any API key. Error REQS007 says why in "reason": - domain_not_prepared: call prepare_domain with the domain and 1 to 5 example URLs (a few minutes, no credits), poll prepared_domain_status about every 30 seconds until it says ready, then call extract again. - page_not_recognised: the domain is prepared, but this page is not one Extract extracts (a page with nothing to extract, such as a home page). Try a product, article or listing page instead; if this page should work, retry it once in a few minutes; otherwise use mode=css. Do not prepare the domain again. - domain_not_enabled: preparing does not help; use mode=css. - autoparse: deprecated general-purpose structured JSON on any domain; use only when asked for - css: css_extractor with an explicit selector map Requests use automatic mode (mode=auto) by default: Zenrows enables JS rendering and premium proxies only when the site needs them, and charges only for the configuration that succeeds. Pass just the URL. Set js_render or premium_proxy only to force a fixed configuration; that turns automatic mode off and bills every request at that configuration's cost. Check "empty" in the result: true means no field came back with a value. "noDataExtracted": true means Extract processed the page and found nothing to extract (not charged); retrying the same request returns the same answer. Full-page markdown, HTML and screenshots come from scrape.

    Annotations the server declares

    • title: Extract Structured Data
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • prepare_domainPrepare a domain so extract (mode=auto) works on it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Prepare a domain so extract (mode=auto) works on it. Use this when extract returns error REQS007 with reason domain_not_prepared. Send the domain (the host, e.g. shop.example.com; a leading www. is dropped, and each host is prepared separately) and 1 to 5 example URLs: real pages you want extracted, one per page kind (for example one product page and one listing page). It returns at once with status "preparing" and never waits; preparation takes a few minutes and costs no credits. Then call prepared_domain_status about every 30 seconds until status is "ready", and call extract again. Each new domain uses one slot of the account's monthly allowance (prepared_domain_status shows it). A domain already being prepared returns its current status; a domain already prepared returns "ready" at once with already_prepared: true and uses no slot. Do not call this for REQS007 with reason page_not_recognised: the domain is already prepared and preparing again does not change that answer.

    Annotations the server declares

    • title: Prepare a Domain for Extract
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • scrapeScrape any webpage and return its content using Zenrows (Fetch).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scrape any webpage and return its content using Zenrows (Fetch). Returns full-page content (markdown/HTML/PDF/screenshot). For structured JSON fields (products, articles, listings), the extract tool returns parsed fields instead of a full page body. By default the request uses automatic mode (mode=auto): Zenrows adds JS rendering or premium proxies per page only when a plain request does not return the page, and charges only for the configuration that succeeds. Pass just the URL. Set js_render or premium_proxy only to force a fixed configuration. Doing so switches off automatic mode, and every request is billed at that configuration's cost (premium_proxy with js_render is 25x a basic request). Examples: Default: { url: "https://example.com" } Geo: { url: "https://example.com", proxy_country: "US" } Forced: { url: "https://spa.com", js_render: true }

    Annotations the server declares

    • title: Scrape Webpage
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Only reads 25Claude Code: allow
  • account_usageRead the current plan's credit allowance and how much of it is spent.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read the current plan's credit allowance and how much of it is spent. Useful before a large batch, or after a 402 / AUTH004, to see whether the account has credits left and when the allowance renews. The call is free and does not use a concurrency slot. Credit costs per request: 1 basic, 5 js_render, 10 premium_proxy, 25 both. AUTH004 ("usage exceeded") means this allowance is spent until it renews at the end of the billing period (period_ends_at in this tool's response). Plans and credit options are described at https://www.zenrows.com/pricing. AUTH006 is the concurrency limit, not a credit limit. AUTH014 (Batch: api_key_cap_reached) means this API key hit one of its own credit caps while the account still has credits; other keys keep working. The response's api_key.caps lists the calling key's caps: window, credits, used_credits, remaining_credits, resets_at, and unavailable (usage could not be read). Caps are managed at https://app.zenrows.com/settings/api-keys.

    Annotations the server declares

    • title: Check Credit Usage
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • batch_contentRead one Batch task's stored result, by job_id and task_id (from batch_results).No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read one Batch task's stored result, by job_id and task_id (from batch_results). A text result (HTML, Markdown, plain text, JSON) comes back inline, cut to max_chars (default 20000); a final note says when it was cut. A binary result (a PDF) is not inlined: the reply gives its result_url, presigned for 2 hours. Finding that URL reads the run's results; on a large run one call may run out of time first and answer with lookup_cursor: call batch_content again with it to go on. BATCH_TASK_NOT_READY: the task has not finished; BATCH_TASK_FAILED: it failed (task_error holds its error); BATCH_RESULT_EXPIRED: past the job's retention (14 days by default); rerun to scrape it again.

    Annotations the server declares

    • title: Batch Task Content
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • batch_listList this account's Batch jobs, newest first, each with its latest run's status and stats.No findings

    Why it is in this group

    • The name "batch_list" says "list": a word for reading.
    Description, as the server wrote it
    List this account's Batch jobs, newest first, each with its latest run's status and stats. Filter by status (open or closed) and type (regular or scheduled). Pass next_cursor as cursor for the next page; a page can hold fewer than limit jobs while next_cursor is still set, so keep paging until it is null. Deleted jobs are not listed.

    Annotations the server declares

    • title: List Batch Jobs
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • batch_resultsList a Batch run's result rows, a page at a time: up to limit rows (default 100, max 1000) and next_cursor.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List a Batch run's result rows, a page at a time: up to limit rows (default 100, max 1000) and next_cursor. Pass next_cursor back as cursor to continue; it is null once every row was read. Each row has task_id, external_id, url, metadata, status (successful, failed, pending, processing, expired), type, result_url when successful, and error when failed. A result_url is presigned and expires after 2 hours: call batch_results again for a fresh one, or read the body with batch_content. Results are kept 14 days by default; after that a successful row reads as status "expired", with no result_url, and batch_content answers BATCH_RESULT_EXPIRED. Filter with status: all (default), successful, failed, or processing (not finished yet). A sparse filter can return fewer rows than limit with next_cursor still set: keep paging. While the run is still running or writing its tasks, the list is partial.

    Annotations the server declares

    • title: Batch Job Results
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • batch_statusGet a Batch job's latest run: job_id, run_id, status (pending, running, completed, stopped, failed), stats (total, completed, successful, failed) and the job.No findings

    Why it is in this group

    • The name "batch_status" says "status": a word for reading.
    Description, as the server wrote it
    Get a Batch job's latest run: job_id, run_id, status (pending, running, completed, stopped, failed), stats (total, completed, successful, failed) and the job. A failed run answers ok:false with error.code BATCH_INSUFFICIENT_CREDITS, BATCH_KEY_CAP_REACHED, AUTH_INVALID (subscription_inactive) or BATCH_RUN_FAILED, error.server_code (the failure_reason) and failure_detail; batch_rerun recovers it once fixed. A paused run has paused:true; one still writing its tasks has ingesting:true.

    Annotations the server declares

    • title: Batch Job Status
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • batch_waitPoll a Batch job until its run ends (completed, stopped or failed) or pauses, and return its status and stats like batch_status.No findings

    Why it is in this group

    • The name "batch_wait" says "wait": a word for reading.
    Description, as the server wrote it
    Poll a Batch job until its run ends (completed, stopped or failed) or pauses, and return its status and stats like batch_status. If the wait runs out first, it returns the current state with ok:true, timed_out:true and a note: call batch_wait again. A paused run returns at once with paused:true (it does not move until batch_resume). A failed run answers ok:false with error.code and server_code (insufficient_credits, subscription_inactive or api_key_cap_reached). Transient poll errors are retried. A call that carries a progressToken gets a progress notification after each poll.

    Annotations the server declares

    • title: Wait for Batch Job
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_get_accessibility_treeGet the ARIA accessibility tree of the current page as readable text.No findings

    Why it is in this group

    • The name "browser_get_accessibility_tree" says "get": a word for reading.
    Description, as the server wrote it
    Get the ARIA accessibility tree of the current page as readable text. Shows the page structure and the selectors needed to interact with elements, in fewer tokens than a screenshot. The tree shows all interactive elements (buttons, inputs, links) with their roles, labels, and states — everything needed to drive browser interactions.

    Annotations the server declares

    • title: Get Accessibility Tree
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_get_attributeGet the value of a specific attribute on an element.No findings

    Why it is in this group

    • The name "browser_get_attribute" says "get": a word for reading.
    Description, as the server wrote it
    Get the value of a specific attribute on an element.

    Annotations the server declares

    • title: Get Element Attribute
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_get_cookiesGet all cookies for the current page.No findings

    Why it is in this group

    • The name "browser_get_cookies" says "get": a word for reading.
    Description, as the server wrote it
    Get all cookies for the current page.

    Annotations the server declares

    • title: Get Cookies
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_get_htmlGet the HTML source of an element or the full page.No findings

    Why it is in this group

    • The name "browser_get_html" says "get": a word for reading.
    Description, as the server wrote it
    Get the HTML source of an element or the full page.

    Annotations the server declares

    • title: Get HTML
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_get_local_storageRead one localStorage value in the current page context.No findings

    Why it is in this group

    • The name "browser_get_local_storage" says "get": a word for reading.
    Description, as the server wrote it
    Read one localStorage value in the current page context.

    Annotations the server declares

    • title: Get Local Storage Item
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_get_textGet the visible text content of an element or the entire page body.No findings

    Why it is in this group

    • The name "browser_get_text" says "get": a word for reading.
    Description, as the server wrote it
    Get the visible text content of an element or the entire page body.

    Annotations the server declares

    • title: Get Text Content
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_get_titleGet the title of the current page.No findings

    Why it is in this group

    • The name "browser_get_title" says "get": a word for reading.
    Description, as the server wrote it
    Get the title of the current page.

    Annotations the server declares

    • title: Get Page Title
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_get_urlGet the current URL of the browser session.No findings

    Why it is in this group

    • The name "browser_get_url" says "get": a word for reading.
    Description, as the server wrote it
    Get the current URL of the browser session.

    Annotations the server declares

    • title: Get Current URL
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_query_selector_allFind all elements matching a CSS selector and return their text, HTML, and attributes.No findings

    Why it is in this group

    • The name "browser_query_selector_all" says "query": a word for reading.
    Description, as the server wrote it
    Find all elements matching a CSS selector and return their text, HTML, and attributes.

    Annotations the server declares

    • title: Query All Matching Elements
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_screenshotTake a screenshot of the current page or a specific element.No findings

    Why it is in this group

    • The name "browser_screenshot" says "screenshot": a word for reading.
    Description, as the server wrote it
    Take a screenshot of the current page or a specific element. Use for visual verification or when the accessibility tree is not sufficient.

    Annotations the server declares

    • title: Take Screenshot
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_waitWait for a fixed duration.No findings

    Why it is in this group

    • The name "browser_wait" says "wait": a word for reading.
    Description, as the server wrote it
    Wait for a fixed duration. browser_wait_for_selector waits only until an element appears.

    Annotations the server declares

    • title: Wait
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_wait_for_navigationWait for the page to navigate to a new URL.No findings

    Why it is in this group

    • The name "browser_wait_for_navigation" says "wait": a word for reading.
    Description, as the server wrote it
    Wait for the page to navigate to a new URL. It waits for the next navigation event, so a navigation that already finished is not seen and the call waits until timeout_ms. Pages that update without changing URL (AJAX/SPA) fire no navigation event. Optional timeout_ms (default 30000ms).

    Annotations the server declares

    • title: Wait for Navigation
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • browser_wait_for_selectorWait until an element matching the CSS selector is stable in the DOM.No findings

    Why it is in this group

    • The name "browser_wait_for_selector" says "wait": a word for reading.
    Description, as the server wrote it
    Wait until an element matching the CSS selector is stable in the DOM. Set visible=true to also require the element to be visible (not hidden).

    Annotations the server declares

    • title: Wait for Element
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • crawl_contentRead the stored page of one URL a crawl kept, in the crawl's output_format.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read the stored page of one URL a crawl kept, in the crawl's output_format. Works only for crawls created with an output_format, and only for results whose content_status is fetched. Pass crawl_id and content_id: a content id, or content_url from a crawl_results row. Returns the page as stored — raw HTML for output_format "html", Markdown for "markdown" — cut to max_chars (default 20000); a final note says when it was cut. To read a page the crawl did not store, use scrape on its URL instead.

    Annotations the server declares

    • title: Crawl Page Content
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • crawl_getGet a crawl and one page of the URLs it kept: crawl_id, status (running, completed, stopped, failed), the crawl (with coverage: pages_fetched, pages_failed, items_found), results a…No findings

    Why it is in this group

    • The name "crawl_get" says "get": a word for reading.
    Description, as the server wrote it
    Get a crawl and one page of the URLs it kept: crawl_id, status (running, completed, stopped, failed), the crawl (with coverage: pages_fetched, pages_failed, items_found), results and next_cursor. completed with stop_reason max_items / max_pages means a limit ended it; stopped with stop_reason user means crawl_stop ended it; stopped with no stop_reason and error.code insufficient_credits or api_key_cap_reached means the account ran out of credits or the API key hit a credit cap (the URLs kept before that stay readable); completed with no results and no error means the crawl's pages held nothing new to follow; when include_patterns / exclude_patterns are set, check them against the URLs the start page links to. failed carries error.code and error.detail: seed_unreachable means the start URL could not be fetched or returned an empty page; no_items_found means the crawl read the start page but found no data it could use, so it had nothing to follow; start from a listing or product page. A failed crawl, and a stopped one with an error, answer ok: false: error.code is CRAWL_INSUFFICIENT_CREDITS or CRAWL_KEY_CAP_REACHED (the codes crawl_create gets on a 402) when credits ended it, failed or stopped, else CRAWL_FAILED; error.server_code is the crawl's error.code. Pass next_cursor as cursor for the next page; while the crawl runs, next_cursor is never null. To read many pages at once, use crawl_results.

    Annotations the server declares

    • title: Get Crawl
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • crawl_listList this account's crawls, newest first, with status and coverage (no results).No findings

    Why it is in this group

    • The name "crawl_list" says "list": a word for reading.
    Description, as the server wrote it
    List this account's crawls, newest first, with status and coverage (no results). Pass next_cursor as cursor for the next page; next_cursor is absent on the last page.

    Annotations the server declares

    • title: List Crawls
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • crawl_resultsList the URLs a crawl kept, in the order it kept them, following the API's pages up to limit.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the URLs a crawl kept, in the order it kept them, following the API's pages up to limit. Each result has url and, when the crawl has output_format, content_status (pending, fetched, failed) and, once fetched, content_url: pass it to crawl_content as content. While the crawl runs the list is partial (partial=true): call again later with the returned next_cursor to get only the URLs kept since. A stopped crawl can still add URLs from pages fetched before the stop for up to 10 minutes, so next_cursor stays set during that window: call again later. next_cursor is null once the crawl ended and every URL was read.

    Annotations the server declares

    • title: Crawl Results
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • crawl_waitPoll a crawl until it ends (completed, stopped, or failed) and return its status, its counts and the first 20 URLs (first_urls).No findings

    Why it is in this group

    • The name "crawl_wait" says "wait": a word for reading.
    Description, as the server wrote it
    Poll a crawl until it ends (completed, stopped, or failed) and return its status, its counts and the first 20 URLs (first_urls). For every result, call crawl_download (one file) or crawl_results (pages). A crawl that ends completed with no results and no error finished; it is not a failure (see crawl_get). If the wait runs out first, it returns the crawl with status running and a note: call crawl_wait again. A call that carries a progressToken gets a progress notification after each poll, with the status and counts.

    Annotations the server declares

    • title: Wait for Crawl
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • prepared_domain_statusCheck a domain submitted with prepare_domain, and the account's monthly allowance.No findings

    Why it is in this group

    • The name "prepared_domain_status" says "status": a word for reading.
    Description, as the server wrote it
    Check a domain submitted with prepare_domain, and the account's monthly allowance. Returns status (preparing, ready or failed), state (the current step), roles (one per page kind), a failure code and detail when it failed, the allowance (used, limit, remaining) and "next": what to do now. Poll about every 30 seconds; preparation takes a few minutes. Call extract again once status is "ready". Costs no credits.

    Annotations the server declares

    • title: Prepared Domain Status
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 2.15.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http zenrows https://mcp.zenrows.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__zenrows__prepared_domain_status",
      "mcp__zenrows__batch_status",
      "mcp__zenrows__batch_wait",
      "mcp__zenrows__batch_results",
      "mcp__zenrows__batch_content",
      "mcp__zenrows__batch_list",
      "mcp__zenrows__crawl_get",
      "mcp__zenrows__crawl_results",
      "mcp__zenrows__crawl_content",
      "mcp__zenrows__crawl_list",
      "mcp__zenrows__crawl_wait",
      "mcp__zenrows__account_usage",
      "mcp__zenrows__browser_get_accessibility_tree",
      "mcp__zenrows__browser_get_url",
      "mcp__zenrows__browser_get_title",
      "mcp__zenrows__browser_get_text",
      "mcp__zenrows__browser_get_attribute",
      "mcp__zenrows__browser_get_html",
      "mcp__zenrows__browser_query_selector_all",
      "mcp__zenrows__browser_screenshot",
      "mcp__zenrows__browser_wait_for_selector",
      "mcp__zenrows__browser_wait_for_navigation",
      "mcp__zenrows__browser_wait",
      "mcp__zenrows__browser_get_cookies",
      "mcp__zenrows__browser_get_local_storage"
    ],
    "ask": [
      "mcp__zenrows__scrape",
      "mcp__zenrows__extract",
      "mcp__zenrows__prepare_domain",
      "mcp__zenrows__batch_create",
      "mcp__zenrows__batch_pause",
      "mcp__zenrows__batch_resume",
      "mcp__zenrows__batch_rerun",
      "mcp__zenrows__crawl_create",
      "mcp__zenrows__crawl_download",
      "mcp__zenrows__browser_navigate",
      "mcp__zenrows__browser_close",
      "mcp__zenrows__browser_go_back",
      "mcp__zenrows__browser_go_forward",
      "mcp__zenrows__browser_reload",
      "mcp__zenrows__browser_click",
      "mcp__zenrows__browser_hover",
      "mcp__zenrows__browser_type",
      "mcp__zenrows__browser_fill",
      "mcp__zenrows__browser_select_option",
      "mcp__zenrows__browser_check",
      "mcp__zenrows__browser_uncheck",
      "mcp__zenrows__browser_focus",
      "mcp__zenrows__browser_press_key",
      "mcp__zenrows__browser_scroll",
      "mcp__zenrows__browser_drag",
      "mcp__zenrows__browser_generate_pdf",
      "mcp__zenrows__browser_new_tab",
      "mcp__zenrows__browser_switch_tab"
    ],
    "deny": [
      "mcp__zenrows__batch_cancel",
      "mcp__zenrows__batch_delete",
      "mcp__zenrows__crawl_stop",
      "mcp__zenrows__browser_evaluate",
      "mcp__zenrows__browser_set_cookies",
      "mcp__zenrows__browser_clear_cookies",
      "mcp__zenrows__browser_set_local_storage",
      "mcp__zenrows__browser_clear_local_storage",
      "mcp__zenrows__browser_batch"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as zenrows. Review it before you use it.