
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@tooltrace/mcp-server
Advanced tools
Web tools for AI agents: scrape pages to Markdown, audit SEO, detect tech stacks, check sitemaps
Give AI agents a complete web intelligence toolkit. This Model Context Protocol server connects Claude Code, Claude Desktop, Cursor, VS Code, Codex, Windsurf and any other MCP client to the ToolTrace API.
One tool per ToolTrace endpoint: scrape any page to clean Markdown, read metadata and JSON-LD, extract links, run on-page SEO audits, detect a site's tech stack, and check XML sitemaps. Free tier included, no card required.
Setup guide: tooltrace.io/mcp
| Tool | Description |
|---|---|
tooltrace_extract | Extract clean Markdown, text, metadata, links, JSON-LD, and sections from any webpage |
tooltrace_metadata | Get page title, description, canonical URL, Open Graph, and Twitter card fields |
tooltrace_links | Extract all internal and external links with anchor text |
tooltrace_schema | Extract JSON-LD structured data (Article, Product, FAQ, etc.) |
tooltrace_seo_audit | Run an SEO audit with scored checks and recommendations |
tooltrace_tech_stack | Detect CMS, frameworks, analytics, CDN, hosting, and more |
tooltrace_sitemap | Inspect and parse XML sitemaps |
Sign up at tooltrace.io/signup. The free plan includes 1,000 credits per month.
npm install -g @tooltrace/mcp-server
Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"tooltrace": {
"command": "tooltrace-mcp",
"env": {
"TOOLTRACE_API_KEY": "your-api-key"
}
}
}
}
Claude Code:
claude mcp add tooltrace tooltrace-mcp -e TOOLTRACE_API_KEY=your-api-key
Cursor (.cursor/mcp.json):
{
"mcpServers": {
"tooltrace": {
"command": "tooltrace-mcp",
"env": {
"TOOLTRACE_API_KEY": "your-api-key"
}
}
}
}
VS Code (.vscode/mcp.json):
{
"servers": {
"tooltrace": {
"command": "tooltrace-mcp",
"env": {
"TOOLTRACE_API_KEY": "your-api-key"
}
}
}
}
Codex (~/.codex/config.toml):
[mcp_servers.tooltrace]
command = "tooltrace-mcp"
env = { TOOLTRACE_API_KEY = "your-api-key" }
Windsurf (mcp_config.json):
{
"mcpServers": {
"tooltrace": {
"command": "tooltrace-mcp",
"env": {
"TOOLTRACE_API_KEY": "your-api-key"
}
}
}
}
Any other MCP client: run tooltrace-mcp over stdio and set the
TOOLTRACE_API_KEY environment variable. Full per-client setup guide at
tooltrace.io/mcp.
TOOLTRACE_API_KEY=your-api-key npx @tooltrace/mcp-server
Once connected, your AI agent can:
All tools support a render parameter:
never: Fast static fetch, 1 credit. Best for server-rendered pages.auto (default): Starts static, renders in browser if needed. 1 or 5 credits.always: Full browser rendering, 5 credits. For JavaScript-heavy SPAs.git clone https://github.com/ToolTrace-io/mcp-server.git
cd mcp-server
npm install
npm run build
TOOLTRACE_API_KEY=your-key node dist/index.js
MIT
FAQs
Web tools for AI agents: scrape pages to Markdown, audit SEO, detect tech stacks, check sitemaps
The npm package @tooltrace/mcp-server receives a total of 22 weekly downloads. As such, @tooltrace/mcp-server popularity was classified as not popular.
We found that @tooltrace/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.