github JavaScript re-analysis due

fouradata/mcp

github

MCP server for the FourA web scraping API - four tools, six prompts, one API key.

maintainer: fouradata
licence: MIT
first seen: 2026-07-01
last seen: 2026-09-17
releases · 30d: 3
short id

Drift inferred · capture-to-capture

tool count over time

07-01 06:22 now

2026-07-01 0t

2026-08-12 4t

capabilities 4 tools

transport stdio · streamable-http · http counts 4 tools · 0 res · 0 prompts permission surface via code analysis

tools

foura_auto
foura_browser
foura_proxy
foura_single

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 77dbc25 · analyzer v33 · 2d ago

skills & prompt files 2

agent-rules fouradata-mcp-77dbc25/AGENTS.md
agent-rules fouradata-mcp-77dbc25/CLAUDE.md

danger signals7

suspicious endpoint 172.32.0.0 fouradata-mcp-77dbc25/tests/helpers/sites.mjs :48 just_outside_172: "http://172.32.0.0", // public, must NOT block
suspicious endpoint 169.254.169.254 (cloud metadata) fouradata-mcp-77dbc25/tests/helpers/sites.mjs :51 aws_metadata: "http://169.254.169.254/latest/meta-data/",
suspicious endpoint 1.1.1.1 fouradata-mcp-77dbc25/tests/integration-stdio/browser-profile-contract.test.mjs :55 const target = { method: "GET", url: "https://1.1.1.1/" };
suspicious endpoint 1.1.1.1 fouradata-mcp-77dbc25/tests/integration-stdio/proxy-exit-country-contract.test.mjs :56 const target = { method: "GET", url: "https://1.1.1.1/" };
suspicious endpoint 1.1.1.1 fouradata-mcp-77dbc25/tests/unit/safe-target.test.mjs :18 test("2. 1.1.1.1 (Cloudflare)", async () => assert.equal(await isBlocked("https://1.1.1.1"), false));
suspicious endpoint 8.8.8.8 fouradata-mcp-77dbc25/tests/unit/safe-target.test.mjs :19 test("3. 8.8.8.8 (Google DNS)", async () => assert.equal(await isBlocked("https://8.8.8.8"), false));
suspicious endpoint 1.2.3.4 fouradata-mcp-77dbc25/tests/unit/schema/proxy-input.test.mjs :66 ignoreProxies: ["http://1.2.3.4:8080", "socks5://5.6.7.8:1080"],

code evidence vv0.6.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 65

filesystem 20

fs (weak) fouradata-mcp-77dbc25/scripts/bump.mjs :13 import { readFileSync, writeFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/scripts/check-test-syntax.mjs :3 import { readdirSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/scripts/publish-github-release.mjs :3 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/scripts/verify-release-tag.mjs :3 import { readFileSync } from "node:fs";
fs fouradata-mcp-77dbc25/src/resources.ts :1 import { mkdir, writeFile, readFile } from "node:fs/promises";
fs (weak) fouradata-mcp-77dbc25/tests/docs-compliance/github-release.test.mjs :3 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/docs-compliance/install-scripts-policy.test.mjs :3 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/docs-compliance/public-copy.test.mjs :3 import { readFileSync, readdirSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/docs-compliance/readme-configs.test.mjs :3 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/docs-compliance/version-on-surfaces.test.mjs :3 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/integration-http/healthz.test.mjs :4 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/integration-stdio/browser-profile-contract.test.mjs :4 import { mkdtemp, rm } from "node:fs/promises";

show 8 more

fs (weak) fouradata-mcp-77dbc25/tests/integration-stdio/proxy-exit-country-contract.test.mjs :4 import { mkdtemp, rm } from "node:fs/promises";
fs (weak) fouradata-mcp-77dbc25/tests/integration-stdio/resources-offload.test.mjs :5 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/integration-stdio/tenant-isolation.test.mjs :6 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/unit/resources.test.mjs :3 import { mkdtempSync, rmSync, readFileSync, existsSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/unit/schema/browser-output.test.mjs :3 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/unit/schema/proxy-output.test.mjs :3 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/unit/schema/single-output.test.mjs :3 import { readFileSync } from "node:fs";
fs (weak) fouradata-mcp-77dbc25/tests/unit/version-anchors.test.mjs :3 import { readFileSync } from "node:fs";

shell / exec 7

shell (weak) fouradata-mcp-77dbc25/scripts/audit-package.mjs :3 import { execFileSync } from "node:child_process";
shell (weak) fouradata-mcp-77dbc25/scripts/audit-tokens.mjs :7 import { spawn } from "node:child_process";
shell (weak) fouradata-mcp-77dbc25/scripts/bump.mjs :14 import { execSync } from "node:child_process";
shell (weak) fouradata-mcp-77dbc25/scripts/check-test-syntax.mjs :4 import { spawnSync } from "node:child_process";
shell (weak) fouradata-mcp-77dbc25/tests/helpers/stdio-client.mjs :5 import { spawn } from "node:child_process";
shell (weak) fouradata-mcp-77dbc25/tests/integration-http/_local-server.mjs :5 import { spawn } from "node:child_process";
shell (weak) fouradata-mcp-77dbc25/tests/smoke.mjs :5 import { spawn } from "node:child_process";

network 14

net fouradata-mcp-77dbc25/src/safe-target.ts :3 import { isIPv4, isIPv6 } from "node:net";
net fouradata-mcp-77dbc25/src/tools/auto.ts :1 import { request } from "undici";
net fouradata-mcp-77dbc25/src/tools/browser.ts :1 import { request } from "undici";
net fouradata-mcp-77dbc25/src/tools/proxy.ts :1 import { request } from "undici";
net fouradata-mcp-77dbc25/src/tools/single.ts :1 import { request } from "undici";
net (weak) fouradata-mcp-77dbc25/tests/docs-compliance/version-on-surfaces.test.mjs :6 import { request } from "undici";
net (weak) fouradata-mcp-77dbc25/tests/helpers/http-client.mjs :4 import { request } from "undici";
net (weak) fouradata-mcp-77dbc25/tests/integration-http/_local-server.mjs :7 import net from "node:net";
net (weak) fouradata-mcp-77dbc25/tests/integration-http/audit-hardening.test.mjs :8 import { request } from "undici";
net (weak) fouradata-mcp-77dbc25/tests/integration-http/healthz.test.mjs :3 import { request } from "undici";
net (weak) fouradata-mcp-77dbc25/tests/integration-http/transport.test.mjs :4 import { request } from "undici";
net (weak) fouradata-mcp-77dbc25/tests/integration-stdio/browser-profile-contract.test.mjs :3 import { createServer } from "node:http";

show 2 more

net (weak) fouradata-mcp-77dbc25/tests/integration-stdio/output-validation-guard.test.mjs :8 import { createServer } from "node:http";
net (weak) fouradata-mcp-77dbc25/tests/integration-stdio/proxy-exit-country-contract.test.mjs :3 import { createServer } from "node:http";

secrets 12

secrets (weak) fouradata-mcp-77dbc25/scripts/publish-github-release.mjs :139 token: process.env.GITHUB_TOKEN,
secrets fouradata-mcp-77dbc25/src/auth.ts :22 const fromEnv = process.env.FOURA_API_KEY;
secrets (weak) fouradata-mcp-77dbc25/tests/helpers/http-client.mjs :11 this.apiKey = apiKey ?? process.env.FOURA_API_KEY ?? process.env.DW_TEST_API_KEY;
secrets (weak) fouradata-mcp-77dbc25/tests/helpers/stdio-client.mjs :119 FOURA_API_KEY: process.env.FOURA_API_KEY ?? process.env.DW_TEST_API_KEY ?? "",
secrets (weak) fouradata-mcp-77dbc25/tests/integration-http/audit-hardening.test.mjs :12 const TEST_KEY = process.env.FOURA_API_KEY
secrets (weak) fouradata-mcp-77dbc25/tests/integration-http/prompts-list.test.mjs :5 const TEST_KEY = process.env.FOURA_API_KEY
secrets (weak) fouradata-mcp-77dbc25/tests/integration-http/tools-call-smoke.test.mjs :5 const TEST_KEY = process.env.FOURA_API_KEY
secrets (weak) fouradata-mcp-77dbc25/tests/integration-http/tools-list.test.mjs :5 const TEST_KEY = process.env.FOURA_API_KEY
secrets (weak) fouradata-mcp-77dbc25/tests/integration-http/transport.test.mjs :6 const TEST_KEY = process.env.FOURA_API_KEY
secrets (weak) fouradata-mcp-77dbc25/tests/integration-stdio/_common.mjs :4 export const TEST_KEY = process.env.FOURA_API_KEY
secrets (weak) fouradata-mcp-77dbc25/tests/unit/auth.test.mjs :13 before(() => { savedEnv = process.env.FOURA_API_KEY; });
secrets (weak) fouradata-mcp-77dbc25/tests/unit/resources.test.mjs :12 process.env.FOURA_API_KEY = "pk_live_unit_test_default_key";

tool registrations 4

foura_auto fouradata-mcp-77dbc25/src/tools/auto.ts :252
foura_browser fouradata-mcp-77dbc25/src/tools/browser.ts :180
foura_proxy fouradata-mcp-77dbc25/src/tools/proxy.ts :293
foura_single fouradata-mcp-77dbc25/src/tools/single.ts :253

install hooks 1

prepublishOnly fouradata-mcp-77dbc25/package.json :38 npm run test:ci

declared dependencies 8

@modelcontextprotocol/sdk@^1.30.0
express@^5.2.1
undici@^8.9.0
zod@^4.4.3
@types/express@^5.0.6
@types/node@^24.13.2
tsx@^4.23.5
typescript@^7.0.2

transport_posture 1

binds all interfaces (0.0.0.0) fouradata-mcp-77dbc25/src/http.ts :183 const server = app.listen(PORT, "0.0.0.0", () => {