
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@unblockingapi/mcp
Advanced tools
Official MCP server for UnblockingAPI — web unblocking + SERP for AI agents
Official Model Context Protocol server for UnblockingAPI. Gives AI agents (Claude, Cursor, OpenClaw, …) the ability to fetch bot-protected and JavaScript-heavy web pages and run structured Google searches — all through UnblockingAPI's anti-detection engine and rotating residential proxies.
| Tool | What it does |
|---|---|
unblock_fetch | Fetch any URL, bypassing anti-bot/CAPTCHA/geo-blocks. Optional headless-browser rendering for SPAs and dynamic pages. Returns HTML. |
google_search | Run a Google search and get structured organic results as JSON. |
idealista_property | Extract structured data from an idealista.com property listing (price, size, rooms, energy rating, features, photos, …) as JSON. |
More tools (e.g. Ahrefs website authority) will be added as additional API templates go live.
block_assetsWhen you set render: true, the page is rendered in a real browser and JavaScript
always executes — so SPAs and dynamic content come back fully rendered. By default
the renderer skips downloading CSS, images, fonts, and media (block_assets
defaults to true on renders) for speed and lower cost; this does not affect the
DOM/text you get back. Pass block_assets: false only when you actually need those
assets (e.g. image URLs or a visually complete page).
You need an UnblockingAPI key — get one at https://unblockingapi.com.
The server runs over stdio (launched with npx). Desktop/CLI clients that
spawn a local process (Claude Desktop, Claude Code, Cursor, …) use it directly.
Web clients that only accept a remote URL (ChatGPT) need it bridged to HTTP —
see the ChatGPT section.
Agentic clients that can run commands or edit their own config (Claude Code, Cursor's agent, Cline, etc.) can install the server when you just ask. Paste a prompt like:
"Install the
@unblockingapi/mcpMCP server. My API key issk_xxx. It runs over stdio vianpx -y @unblockingapi/mcpand needs the env varUNBLOCKINGAPI_KEY."
In Claude Code that's enough — it will run the right claude mcp add for you.
In Cursor / Cline the agent will add the entry to your mcp.json. After it
finishes, start a new chat (or reload MCP servers) so the tools load.
GUI apps without an agent that can edit config — Claude Desktop and ChatGPT — can't self-install from a prompt; use the manual steps below.
Edit claude_desktop_config.json (macOS:
~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then
restart Claude:
{
"mcpServers": {
"unblockingapi": {
"command": "npx",
"args": ["-y", "@unblockingapi/mcp"],
"env": { "UNBLOCKINGAPI_KEY": "your_api_key_here" }
}
}
}
claude mcp add unblockingapi \
-e UNBLOCKINGAPI_KEY=your_api_key_here \
-- npx -y @unblockingapi/mcp
Add to ~/.cursor/mcp.json (or a project .cursor/mcp.json) — same shape as the
Claude Desktop block above.
ChatGPT (Developer mode → Connectors) only accepts remote MCP servers
reachable over a public HTTPS URL — it can't spawn a local npx process. Bridge
this stdio server to HTTP with supergateway:
UNBLOCKINGAPI_KEY=your_api_key_here \
npx -y supergateway --stdio "npx -y @unblockingapi/mcp" --port 8000
# exposes an MCP endpoint at http://localhost:8000/sse
Then expose it publicly (ChatGPT can't reach localhost) with a tunnel, e.g.
cloudflared tunnel --url http://localhost:8000 or ngrok http 8000, and add the
resulting https://…./sse URL under Settings → Connectors in ChatGPT.
For production ChatGPT use you'll want a hosted HTTPS endpoint rather than a local tunnel. A first-class hosted/streamable-HTTP transport is on the roadmap.
| Var | Required | Default | Purpose |
|---|---|---|---|
UNBLOCKINGAPI_KEY | yes | — | Your API key. |
UNBLOCKINGAPI_BASE_URL | no | https://api.unblockingapi.com | Override the API base URL. |
UNBLOCKINGAPI_TIMEOUT_MS | no | 70000 | Per-request timeout. Rendered fetches can take up to ~65s. |
Once connected, ask your agent things like:
unblock_fetch(url, render: true, location: "de")google_search(q: "best running shoes", location: "us")idealista_property(url: "https://www.idealista.com/inmueble/111072490/")unblock_fetch parametersurl (required) — HTTP/HTTPS URL. Media/binary files are rejected.render — render with a headless browser (runs JS). Default false.location — 2-letter country code for the proxy (us, gb, de, …).wait — render-only. Comma-separated wait steps (max 5): a leading load event
(domcontentloaded|load|networkidle), then CSS selectors or
networkidle:<ms> / domstable:<ms> strategies. e.g. domcontentloaded,h3.block_assets — render-only. Defaults to true on renders (skips CSS/images/fonts/media
for speed; JS still runs). Pass false to also download those assets. See note above.remove_scripts / remove_stylesheets / remove_svgs — strip those tags from
the returned HTML.npm install
npm run dev # tsx watch
npm run typecheck # tsc --noEmit
npm run build # compile to dist/
MIT
FAQs
Official MCP server for UnblockingAPI — read any web page (bot-protected, JavaScript-heavy, geo-blocked) and parse it to JSON with templates
The npm package @unblockingapi/mcp receives a total of 0 weekly downloads. As such, @unblockingapi/mcp popularity was classified as not popular.
We found that @unblockingapi/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.