Back to Browse

Obscura MCP Server

Developer ToolsUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

MCP server adapter for Obscura Rust headless browser — web scraping with anti-detection.

About

MCP server adapter for Obscura Rust headless browser — web scraping with anti-detection.

Security Report

4.2
Use Caution4.2High Risk

This MCP server provides web scraping and browser automation via the Obscura headless browser. The codebase is well-structured with proper URL validation, reasonable error handling, and appropriate use of the MCP SDK. However, there are several moderate security concerns: arbitrary JavaScript execution via browse_evaluate without sandboxing, unsafe use of pkill during startup, potential cookie handling vulnerabilities, and lack of request logging/auditing for sensitive operations. Permissions align with the server's purpose (network access, file I/O, process spawning), but the sensitive nature of the tools and lack of fine-grained access controls warrant caution. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 5 high severity). Package verification found 1 issue.

6 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

file_system

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

env_vars

Check that this permission is expected for this type of plugin.

process_spawn

Check that this permission is expected for this type of plugin.

system_info

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-metadrama-obscura-mcp": {
      "args": [
        "-y",
        "obscura-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

obscura-mcp — ARCHIVED

⚠️ Archived. Upstream ships native MCP since v0.1.4 (obscura mcp). npm package deprecated.

npm version License: MIT

An MCP server adapter for Obscura, a lightweight Rust headless browser for scraping and AI agent automation.

Exposes Obscura's native CDP capabilities through a clean MCP interface — no Chrome dependency, no heavyweight browser automation.

Installation

npm install -g obscura-mcp

The npm package itself is a small Node.js wrapper (~20 KB). The browser binary (~80 MB) is downloaded automatically on first use — no separate install step needed.

The binary is cached at ~/.obscura/bin/ and survives npm upgrades.

Pre-release builds are published under the dev tag:

npm install -g obscura-mcp@dev

To use a custom binary path:

export OBSCURA_PATH=/path/to/obscura

Quick Start

# Install
npm install -g obscura-mcp

# Verify
obscura-mcp --version

# Start MCP server (stdio — primary transport)
obscura-mcp --transport stdio

# Or with HTTP transport
obscura-mcp --transport streamable-http

Most MCP clients (Claude Desktop, Cline, Continue) connect via stdio. The streamable-http transport is also supported for custom integrations.

Tools

Four tools cover browsing, interacting, session persistence, and bulk scraping.

browse_page — one-shot page reading

Get content from any page in a single call. Combine output format with optional JavaScript evaluation.

ParameterTypeDefaultDescription
urlstringThe URL to visit
format"text" | "markdown" | "html" | "links" | "cookies" | "axtree" | "layout""text"Output format
evalstringJavaScript expression to evaluate (appended to output)
cookiesarrayCookies to inject [{name, value, domain?, path?, ...}]
user_agentstringOverride the browser user-agent string
headersobjectExtra HTTP headers {key: value, ...}
stealthbooleantrueAccepted for compatibility; stealth is controlled by the Obscura server

Examples:

browse_page(url: "https://example.com")
browse_page(url: "https://example.com", format: "markdown")
browse_page(url: "https://example.com", format: "axtree")
browse_page(url: "https://example.com", format: "layout")
browse_page(url: "https://example.com", user_agent: "TestBot/1.0")
formatWhat you get
"text"Plain text — stripped of HTML tags, scripts, styles
"markdown"Clean markdown — uses Obscura's native LP.getMarkdown CDP
"html"Raw HTML markup
"links"All href values — one per line
"cookies"Cookies with name, value, domain, path, expiry
"axtree"Accessibility tree — roles, names, values of all elements
"layout"Viewport metrics — dimensions, scroll offsets, device scale

When eval is provided, the JavaScript result is appended to the format output under a --- eval --- divider.


browse_interact — one-shot page actions

Click an element or type text into a page. For multi-step interactions (login → wait → extract), use browse_session instead.

ParameterTypeDefaultDescription
urlstringThe URL to visit
action"click" | "type"Action to perform
selectorstringCSS selector for the target element
textstringText to type (required when action is "type")
cookiesarrayCookies to inject [{name, value, ...}]
stealthbooleantrueAccepted for compatibility; stealth is controlled by the Obscura server

Examples:

browse_interact(url: "https://example.com", action: "click", selector: "a")
browse_interact(url: "https://duckduckgo.com", action: "type", selector: "input[name=q]", text: "search query")

Both actions create a fresh page, perform the action, and close. The page context does not persist — for sequential interactions (type into a form, then click submit), use browse_session instead.


browse_session — multi-step persistent sessions

Create a persistent browser session, interact with it across multiple calls, then close. Sessions auto-close after 5 minutes of inactivity. Multiple sessions can run simultaneously.

ParameterTypeRequired forDescription
action"create" | "close" | "list" | "goto" | "wait" | "extract" | "click" | "type"AllWhat to do
session_idstringAll except create, listSession ID from create
urlstringcreate, gotoURL to navigate to
selectorstringwait, click, typeCSS selector
expressionstringwait (if no selector), extractJavaScript expression
textstringtypeText to type
timeoutnumberwait (optional)Max wait in ms (default 30000, max 120000)
user_agentstringcreate, gotoOverride user-agent string for navigation
headersobjectcreate, gotoExtra HTTP headers {key: value, ...}
clear_cookiesbooleancreateClear all browser cookies on session creation

Session lifecycle:

actionWhat it doesReturns
createOpens a new browser tab. Optionally clears cookies.Session ID
closeReleases the tab and all its resources. Idempotent.Confirmation
listShows all active sessions with timestamps.Session list
gotoNavigates to a new URL. Page stays alive.Confirmation
waitPolls until a CSS selector exists or a JS expression returns true.Confirmation
extractEvaluates JavaScript and returns the result.Eval result
clickClicks an element by CSS selector.Coordinates
typeTypes text into an input field.Confirmation

Login flow example:

browse_session(action: "create", url: "https://example.com/login")
  → "Created session: session_1"

browse_session(action: "type", session_id: "session_1", selector: "#username", text: "user")
browse_session(action: "type", session_id: "session_1", selector: "#password", text: "pass")
browse_session(action: "click", session_id: "session_1", selector: "#login-btn")

browse_session(action: "wait", session_id: "session_1", selector: ".dashboard", timeout: 10000)
browse_session(action: "extract", session_id: "session_1", expression: "document.title")

browse_session(action: "close", session_id: "session_1")

Multi-article browsing example:

browse_session(action: "create")
browse_session(action: "goto", session_id: "session_1", url: "https://en.wikipedia.org/wiki/JavaScript")
browse_session(action: "extract", session_id: "session_1", expression: "document.title")
browse_session(action: "goto", session_id: "session_1", url: "https://en.wikipedia.org/wiki/Python")
browse_session(action: "extract", session_id: "session_1", expression: "document.title")
browse_session(action: "close", session_id: "session_1")

browse_scrape — parallel bulk scraping

Scrape multiple URLs simultaneously using isolated worker processes. Each URL gets its own headless browser worker — built on top of Obscura's native scrape command with obscura-worker.

ParameterTypeDefaultMaxDescription
urlsstring[]1000URLs to scrape in parallel
evalstringJavaScript expression to evaluate per page
concurrencynumber10100Number of parallel worker processes
timeoutnumber60300Per-worker timeout in seconds

Example:

browse_scrape(urls: ["https://news.ycombinator.com", "https://example.com"], eval: "document.title", concurrency: 25)

Output format (JSON):

{
  "total_urls": 2,
  "concurrency": 25,
  "total_time_ms": 1250,
  "avg_time_ms": 625.0,
  "results": [
    {
      "url": "https://news.ycombinator.com",
      "title": "Hacker News",
      "eval": "Hacker News",
      "time_ms": 612,
      "worker": 0
    },
    {
      "url": "https://example.com",
      "eval": "Example Domain",
      "time_ms": 638,
      "worker": 1
    }
  ]
}

On errors (timeout, network failure, etc.), the per-URL result includes an "error" field instead of "eval":

{
  "url": "https://slow-site.com",
  "error": "timeout",
  "time_ms": 60000
}

This is the tool that directly leverages Obscura's core advantage over headless Chrome: lightweight parallel scraping with built-in stealth. The ~30 MB per-worker memory footprint means 100 concurrent workers use less memory than a single Chrome instance.

Configuration

Claude Desktop / Cline / Continue / Any MCP client

{
  "mcpServers": {
    "obscura-mcp": {
      "command": "obscura-mcp",
      "args": ["--transport", "stdio"]
    }
  }
}

VS Code (Cline extension)

{
  "servers": {
    "obscura-mcp": {
      "command": "obscura-mcp",
      "args": ["--transport", "stdio"]
    }
  }
}

After global npm install, obscura-mcp is on your PATH — no absolute paths needed.

Environment Variables

VariableDefaultDescription
OBSCURA_PATHPath to custom Obscura binary
OBSCURA_STEALTHEnable stealth mode (anti-detection)
OBSCURA_PROXYProxy URL for all traffic
OBSCURA_USER_AGENTDefault user-agent override
MCP_HTTP_HOST127.0.0.1HTTP transport host
MCP_HTTP_PORT3000HTTP transport port
MCP_TRANSPORTstdioTransport mode: stdio or streamable-http
OBSCURA_STARTUP_TIMEOUT_MS15000Milliseconds to wait for Obscura CDP to start
OBSCURA_NAVIGATION_WAIT_MS3000Milliseconds to wait after page navigation
CDP_REQUEST_TIMEOUT_MS10000Milliseconds to wait for CDP response

Development

Built with TypeScript, compiled to dist/, tested with Vitest.

git clone https://github.com/Metadrama/obscura-mcp
cd obscura-mcp
npm install
npm run build
npm test

All 36 integration tests run against a real Obscura binary (auto-downloaded on first run). Tests use StdioClientTransport and cover every tool, format, and action.

Why Obscura?

  • No Chrome — pure Rust, no 200 MB browser bundle
  • CDP-native — exposes Chrome DevTools Protocol directly
  • Anti-detection — built-in stealth for scraping-resistant sites
  • Tiny footprint — ~15 MB binary, starts in milliseconds

License

MIT

Reviews

No reviews yet

Be the first to review this server!