Scrappa MCP

v0.1.0

Access Scrappa's MCP server for Google, YouTube, Amazon, LinkedIn, Trustpilot, flights, hotels, and more via Model Context Protocol

2· 2k·4 current·4 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (Scrappa MCP connector for many search/review/flight/hotel tools) matches the SKILL.md content: it is a bridge to scrappa.co/mcp exposing many tool endpoints. That capability legitimately needs an API key and an MCP server URL, so the overall purpose is coherent.
!
Instruction Scope
SKILL.md instructs the user to add a Scrappa server entry to mcporter configuration (examples show editing ~/clawd/config/mcporter.json and adding an X-API-KEY header) and to run 'clawdbot gateway restart'. Those are system-affecting operations and reference a specific config path, but the skill's registry metadata does not declare any required config paths or credentials. The instructions do not request unrelated files or secrets beyond the Scrappa API key, but they do direct storing that key in a local config file and restarting a system service — actions that should be clearly declared and understood before proceeding.
Install Mechanism
Instruction-only skill: there is no install spec and no code files. This is the lowest-risk install mechanism; nothing is being downloaded or written by the skill itself beyond guidance for manual configuration.
!
Credentials
The SKILL.md requires a Scrappa API key and shows adding it to mcporter config, but the registry metadata lists no required environment variables, no primary credential, and no required config paths. The skill should have declared the API key as the primary credential or at least a required config path. Storing an API key in ~/clawd/config/mcporter.json means the secret will live on disk and may be accessible to other processes or users — this is proportionate to the feature (a connector needs a key) but the omission in metadata and the storage location are concerning and deserve explicit attention.
Persistence & Privilege
always is false and model invocation is allowed (normal). The SKILL.md asks you to restart the Clawdbot gateway to register the MCP server — a reasonable operational step, but it requires local permission and affects the running agent. Because the skill can be invoked autonomously by models, combining that autonomy with an on-disk API key increases blast radius if the key is overly permissive or if scrappa.co is untrusted.
What to consider before installing
This skill appears to be a legitimate Scrappa MCP connector, but the SKILL.md and the registry metadata disagree. Before installing or configuring it: - Understand where the Scrappa API key will be stored (the docs show ~/clawd/config/mcporter.json) and who/what can read that file on your machine or environment; back it up and set restrictive file permissions if you proceed. - Verify you trust scrappa.co (check their docs, pricing, and privacy policy). The MCP server will handle queries across many services — anything you query will be sent to that provider. - Note that the skill requires restarting the Clawdbot gateway; ensure you have the rights to do that and that restarting won't disrupt other workloads. - Ask the publisher (or the registry) to update metadata to declare the API key as the primary credential and list the mcporter config path so the required permissions and persistence are explicit. - If you need tighter control, consider running Scrappa access in an isolated environment or using a limited API key (scoped/revocable) rather than long-lived credentials. Given the metadata omission and the on-disk storage of secrets, proceed with caution; the behavior is expected for a connector but the documentation/registry should be corrected before wide deployment.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f68x4yngsdqf4mdec1tkgjx7zwk0v

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments