AgentArmorHQ
Sign in

webclaw

MCP server · GitHub · ★ 2.4k · graded 2026-10-21Source linked

Fast, local-first web content extraction for LLMs. Scrape, crawl, extract structured data — all from Rust. CLI, REST API, and MCP server.

No outside reports on file

Webclaw can expose your system to malicious web content, legal issues around scraping, and data leaks if you extract pages with sensitive information or don't verify what sites you're crawling.

Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Webclaw helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachFetches arbitrary web URLsREVIEW
  • CredentialsNo API token requiredLOW
  • Package sourceGitHub (0xMassi/webclaw)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

No npm or PyPI package is listed. Install from source: github.com/0xMassi/webclaw ↗

All setup options ↓

Check this skillWatch it in my stackCompareREADME badgeView project

Everything known

We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.

0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30

Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-21.

Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.

Check a specific version →

About Webclaw

Webclaw is a tool written in Rust that pulls text and structured data from web pages. It can work as a command-line program, a REST API server, or as an MCP connector that lets AI assistants browse and extract information from websites quickly on your local computer.

Who it’s for

Developers and AI teams who need to scrape web content and feed it into language models. It's built for people who want fast, local-first extraction without sending data to external services.

Alternatives

  • Cheerio (Node.js library for HTML parsing)
  • Beautiful Soup (Python web scraping framework)
  • Playwright or Puppeteer (browser automation for JavaScript-heavy sites)
  • Firecrawl (similar web extraction service, though cloud-based)

Setup

Check these steps against the project’s own instructions before running anything.

Follow the project's README at https://github.com/0xMassi/webclaw (opens external site) for installation steps. The repository contains instructions for running as a CLI tool, REST API, or MCP server integration.

Why this grade

CC — Moderate risk signals

Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.

Popularity and upkeep

36/100
GitHub stars
2.4k
Listing last refreshed
2026-10-29

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Risks to watch for

  • Web scraping misuse: Can extract copyrighted content, bypass paywalls, or violate website terms of service if used without permission
  • Malicious page content: Websites may hide misleading HTML, fake data, or phishing content that the tool extracts and passes to your AI without filtering
  • Data leakage: Extracted web content (including personal info, API keys, or secrets accidentally published online) gets sent to your AI model and may be logged or cached
  • Network access: The tool makes outbound connections to any URL you ask it to crawl, potentially exposing your IP address or allowing attackers to redirect it to internal systems
  • Injection attacks: Carefully crafted web pages could include prompts or commands designed to manipulate your AI's behavior through the extracted text

How to lower the risk

Least-privilege permissions

  • Run the MCP server with minimal file system access
  • Don't give it write permissions unless absolutely needed

Network isolation

  • Restrict outbound connections to known, trusted domains only
  • Use a firewall or proxy to block unexpected requests

Monitoring

  • Log all URLs the tool attempts to crawl
  • Review extracted content before sending it to your AI

Red flags to watch for

  • Unexpected network requests to unfamiliar domains
  • Large or sudden increases in bandwidth usage
  • Extracted content containing code, credentials, or strange prompts

Questions

How do I install Webclaw?

Webclaw does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/0xMassi/webclaw.

Are there security reports about Webclaw?

No reports found for this package in our research (last checked 2026-10-30). Webclaw currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include web scraping misuse, malicious page content, data leakage.

Is Webclaw actively maintained?

Webclaw has 2.4k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/0xMassi/webclaw before pinning it in production.

What are alternatives to Webclaw?

Notable alternatives to Webclaw include Cheerio, Beautiful Soup, Playwright or Puppeteer, Firecrawl. You can also compare Webclaw side by side with other MCP servers in the Related tools section on this page.

README badge and team notes

Maintain or use Webclaw? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade C for Webclaw

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for Webclaw](https://agentarmorhq.com/api/badge/0xmassi-webclaw)](https://agentarmorhq.com/skills/0xmassi-webclaw)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/0xmassi-webclaw"><img src="https://agentarmorhq.com/api/badge/0xmassi-webclaw" alt="AgentArmorHQ Risk Grade for Webclaw" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "0xmassi-webclaw"

Share with your security lead

Need sign-off to use webclaw? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: webclaw
- **Listing URL:** https://agentarmorhq.com/skills/0xmassi-webclaw
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 2.4k GitHub stars

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** No API token required
- **Package source:** GitHub (0xMassi/webclaw)

#### Recommended Hardened Setup
- **Source Repo:** https://github.com/0xMassi/webclaw
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Publisher
0xMassi
Source code
github.com/0xMassi/webclaw
Est. context load
~700 tokens / turn (~4 tool schemas, 0.35% of 200k context)
Popularity
2.4k GitHub stars
Last updated
2026-10-29
Last graded
2026-10-21

Community

Discussions for Webclaw

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Webclaw helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude