@brightdata/mcp

Name: @brightdata/mcp
Author: Bright Data

MCPattested

v3.0.0Bright DataMITUpdated 1d agonpm GitHub

An MCP interface into the Bright Data toolset

Works in

ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build

A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.

13kDownloads/wk

3kGitHub stars

332Forks

1d agoLast update

Needs 1 credential before it runs

API_TOKENAPI keyrequired
Your API key for Bright Data

Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.

Package

AuthorBright Data

LicenseMIT

Version3.0.0

Sourcenpm+mcp-registry

npm@brightdata/mcp

GitHubbrightdata/brightdata-mcp

SBOMCycloneDX 1.6 ↓

Trust Status

65/100Good

✓Listed in Forge index+10/10

✓Identity verified · attested build+20/20

—Ed25519 publish signature+0/5

→ Included automatically when the publisher runs `forge publish`

—Domain verification+0/5

→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }

✓npm Trusted Publishing (Sigstore)+5/5

—npm maintainer match+0/5

→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)

✓CVE scan · clean+30/30

—Static analysis · clean+0/20

→ Suspicious install scripts or obfuscated code detected

Paste into Claude Code, Cursor, or any AI assistant to fix all gaps

StatusIdentity verified

PublisherUnverified

SignatureUnsigned

Domain—

Provenance✓ Sigstore-verified · 39cc2dc

Dependencies60 resolved · 1 with advisories

Tool surface26 tools · none privileged

Security scan⚠ Warnings (3)v3.0.0 · todayHow well does this scan work?

CHANGEdep-vulns-increasedVulnerable dependencies went from 0 to 1 since v2.11.0

HIGH@modelcontextprotocol/sdk@1.21.2@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse HIGH@modelcontextprotocol/sdk@1.21.2MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server HIGH@modelcontextprotocol/sdk@1.21.2Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

EvalsNone

IndexedJun 15, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

26 tools · none privileged

Statically extracted from the published packagev3.0.0 · 10h ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

Filter toolsPrivileged only

scraping_browser_navigateNavigate a scraping browser session to a new URL

Navigate a scraping browser session to a new URL

No input schema was published for this tool.

scraping_browser_go_backGo back to the previous page

Go back to the previous page

No input schema was published for this tool.

scraping_browser_go_forwardGo forward to the next page

Go forward to the next page

No input schema was published for this tool.

scraping_browser_snapshotNo description published

This tool published no description. Forge does not invent one.

scraping_browser_click_refNo description published

This tool published no description. Forge does not invent one.

scraping_browser_type_refNo description published

This tool published no description. Forge does not invent one.

scraping_browser_screenshotTake a screenshot of the current page

Take a screenshot of the current page

No input schema was published for this tool.

scraping_browser_get_htmlGet the HTML content of the current page. Avoid using this

Get the HTML content of the current page. Avoid using this

No input schema was published for this tool.

scraping_browser_get_textGet the text content of the current page

Get the text content of the current page

No input schema was published for this tool.

scraping_browser_scrollScroll to the bottom of the current page

Scroll to the bottom of the current page

No input schema was published for this tool.

scraping_browser_scroll_to_refNo description published

This tool published no description. Forge does not invent one.

scraping_browser_network_requestsNo description published

This tool published no description. Forge does not invent one.

scraping_browser_wait_for_refNo description published

This tool published no description. Forge does not invent one.

scraping_browser_fill_formNo description published

This tool published no description. Forge does not invent one.

web_scraping_strategyDecision tree for picking the right Bright Data tool.

Decision tree for picking the right Bright Data tool.

No input schema was published for this tool.

diagnose_scraping_approachRun a two-step diagnostic to discover the correct

Run a two-step diagnostic to discover the correct

No input schema was published for this tool.

search_engineNo description published

This tool published no description. Forge does not invent one.

scrape_as_markdownNo description published

This tool published no description. Forge does not invent one.

search_engine_batchNo description published

This tool published no description. Forge does not invent one.

scrape_batchNo description published

This tool published no description. Forge does not invent one.

scrape_as_htmlNo description published

This tool published no description. Forge does not invent one.

extractNo description published

This tool published no description. Forge does not invent one.

discoverNo description published

This tool published no description. Forge does not invent one.

list_dataset_fieldsNo description published

This tool published no description. Forge does not invent one.

search_datasetNo description published

This tool published no description. Forge does not invent one.

session_statsNo description published

This tool published no description. Forge does not invent one.

9 of 26 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

An MCP interface into the Bright Data toolset

Keywords

mcpbrightdata

Alternatives

Comparing tool surfaces…

Dependency tree

What one Forge scan resolved from npm metadata on 2026-10-12 — observed resolution, not a publisher declaration.

60 packages resolved · 7 direct · 1 carrying advisories Resolution stops at depth 4 and 60 packages.

zod3.25.76
axios1.20.04 dependencies
- form-data4.0.6+5 not drawn
- proxy-from-env2.1.0
- follow-redirects1.16.1
- https-proxy-agent5.0.1+2 not drawn
remark15.0.14 dependencies
- unified11.0.5+7 not drawn
- @types/mdast4.0.4+1 not drawn
- remark-parse11.0.0+2 not drawn2 dependencies
  - @types/mdast4.0.4shown above+1 not drawn
  - unified11.0.5shown above+7 not drawn
- remark-stringify11.0.0+1 not drawn2 dependencies
  - @types/mdast4.0.4shown above+1 not drawn
  - unified11.0.5shown above+7 not drawn
fastmcp3.35.0+5 not drawn9 dependencies
- zod4.6.7
- hono4.13.13
- execa9.6.1incomplete+2 not drawn
- yargs18.2.0incomplete
- undici7.30.0
- fuse.js7.5.0
- xsschema0.4.4
- file-type21.3.4incomplete
- mcp-proxy6.7.19incomplete
playwright1.64.0+1 not drawn
strip-markdown6.0.01 dependency
- @types/mdast4.0.4shown above+1 not drawn
@modelcontextprotocol/sdk1.21.2HIGH GHSA-345p-7cg4-v4c7 HIGH GHSA-6qxp-vccf-f47h HIGH GHSA-8r9q-7v3j-jr4g+12 not drawn1 dependency
- zod3.25.76shown above

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

119 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

package cap reached: 119

pretty-ms ^9.2.0 — required by execa@9.6.1package cap reached
get-stream ^9.0.0 — required by execa@9.6.1package cap reached
cross-spawn ^7.0.6 — required by execa@9.6.1package cap reached
signal-exit ^4.1.0 — required by execa@9.6.1package cap reached
yoctocolors ^2.1.1 — required by execa@9.6.1package cap reached
is-plain-obj ^4.1.0 — required by execa@9.6.1package cap reached
npm-run-path ^6.0.0 — required by execa@9.6.1package cap reached
human-signals ^8.0.1 — required by execa@9.6.1package cap reached
strip-final-newline ^4.0.0 — required by execa@9.6.1package cap reached
@sindresorhus/merge-streams ^4.0.0 — required by execa@9.6.1package cap reached
y18n ^5.0.5 — required by yargs@18.2.0package cap reached
cliui ^9.0.1 — required by yargs@18.2.0package cap reached

+107 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.

@brightdata/mcp

Tools

Tools exposed

Dependency tree

Declared but not resolved