Is Web Recon Agent MCP server safe?

No. It is blocked at the gateway.

F26/100grade F

Blocked at the gateway. A critical finding or a dead endpoint.

What to know before installing

Public scan report

scanner v0.1.10 · 2026-09-27 · same rubric, same numbers if you re-run it

2 high2 medium

Code scan222 source files scanned0/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancerepository not readable: repo not found3/15
Maintainer identityno repository or website to verify2/10

mediumNetwork call to a raw IP addressnet.raw-ip

dist/agents/active/ssrf.js: …S', severity: 'critical' }, { url: 'http://100.100.100.200/latest/meta-data/', label: 'Alibaba meta…

mediumeval / new Function usedexec.eval

dist/agents/browser-discovery.js: …turePageLinks(page) { return page.$$eval('a[href]', (anchors) => anchors …

highShell command built from a string (injection risk)exec.shell-concat

dist/agents/recon.js: …llenge pages const headersRaw = execSync(`curl -sI -m 10 --location --max-redirs 3 ${JSON.stringify(ctx.targetUrl)}`, { encod…

highNetwork call to a paste/tunnel/webhook hostnet.suspicious-host

dist/oast-receiver.js: …eiver-manifest.json] [--public-base-url https://oast.example.net] [--token secret] [--retenti…

Overall 26/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

agent-device
Let AI agents inspect, control, and debug real iOS, Android, desktop, and TV apps
not reviewed
Widely used
A
agent-device
MCP server for mobile app automation: verify, control, and debug iOS, Android, TV, and desktop apps
not reviewed
Widely used
A
Robin: AI-Powered Dark Web OSINT
Dark web OSINT over Tor: search onion engines, scrape pages, report with your own model.
not reviewed
Established
A