
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
veddata
Advanced tools
MCP server for AI agents: discover a web page's data sources — network APIs, embedded data, scripts — and drive the page to reach them
一个模型上下文协议(MCP)服务器:在网页上做数据源发现 —— 捕获网络请求、提取内嵌数据、分析脚本,并通过交互与监测点跟踪数据流向。
<script> 标签里的 JSON 与 window 全局变量css=、//(XPath)选择器定位一次性运行(无需安装,推荐):
{
"mcpServers": {
"veddata": {
"command": "uvx",
"args": ["veddata", "--response-dir", "E:\\path\\to\\out"]
}
}
}
或先安装再使用:uv tool install veddata(或 pip install veddata),然后
{
"mcpServers": {
"veddata": {
"command": "veddata",
"args": ["--response-dir", "E:\\path\\to\\out"]
}
}
}
从源码运行(开发用):
uv venv
uv pip install -e ".[dev]"
客户端配置(标准输入输出):
{
"mcpServers": {
"veddata": {
"command": "E:\\path\\to\\veddata\\.venv\\Scripts\\python.exe",
"args": ["-m", "veddata.server",
"--profile-dir", "E:\\path\\to\\profile",
"--response-dir", "E:\\path\\to\\out"]
}
}
}
| 参数 | 说明 |
|---|---|
--profile-dir <目录> | 浏览器配置目录(持久化,保留登录状态)。默认 <用户数据根>/veddata/profile |
--response-dir <目录> | ved_export、ved_screenshot 的落盘目录。未配置时这两个工具在写盘时报错 |
| 环境变量 | 说明 |
|---|---|
HEADLESS=true | 无窗口模式(默认为有窗口) |
BROWSER_PATH <路径> | 指定浏览器可执行文件(填 edge 表示使用 Edge) |
BROWSER_ADDRESS <地址> | 接管已在运行的浏览器(调试协议地址),而不是自行启动 |
input、click、select、scroll;可单步或链式;target 支持可见文本、css= 或 //ved_apis、ved_inspect、ved_watch(collect) 等按需获取。ved_status、ved_tabs 会重新建立观测。ved_close 关闭;通过 BROWSER_ADDRESS 接管的仅断开连接。以 svgrepo 为例(该站点没有公开接口文档,AI 只能自己侦察)。一条工具链跑完:
[
{"tool": "ved_open"},
{"tool": "ved_goto", "args": {"url": "https://www.svgrepo.com/vectors/arrow/"}},
{"tool": "ved_goto", "args": {"url": "https://www.svgrepo.com/svg/535197/arrow-u-up-left"}},
{"tool": "ved_act", "args": {"action": "click", "target": "css=a[href*='/download/']"}}
]
消息里直接给出事实(动作、因果、落盘位置):
[click] Clicked 'css=a[href*='/download/']' → +1 new APIs
GET https://www.svgrepo.com/_next/data/XJiZPe18H5paekHV…/tools.json
download: arrow-u-up-left-svgrepo-com.svg → E:\Downloads\arrow-u-up-left-svgrepo-com.svg (completed, 399 B)
pytest tests -q
python scripts/smoke.py
MIT License,详见 LICENSE。
本项目仅用于学习、研究、技术交流与合法合规的自动化测试,不得用于任何违法、侵权或违背公序良俗的用途。使用前请完整阅读本声明;下载、安装、运行或以任何方式使用本项目,即视为已阅读、理解并同意本声明的全部内容。如不同意,请立即停止使用并删除本项目。
robots.txt 与使用规则;所在国家或地区的法律法规(包括但不限于网络安全、数据安全、个人信息保护、著作权、反不正当竞争、计算机信息系统相关法律);以及任何适用的行业规范与合同约定。FAQs
MCP server for AI agents: discover a web page's data sources — network APIs, embedded data, scripts — and drive the page to reach them
The pypi package veddata receives a total of 310 weekly downloads. As such, veddata popularity was classified as not popular.
We found that veddata demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.