{
  "slug": "io-github-brightdata-brightdata-mcp",
  "name": "io.github.brightdata/brightdata-mcp",
  "title": "brightdata-mcp",
  "description": "Bright Data's Web MCP server enabling AI agents to search, extract & navigate the web",
  "version": "4.1.0",
  "publishedAt": "2026-10-20T09:40:02.518753Z",
  "updatedAt": "2026-10-20T09:40:02.518753Z",
  "repoUrl": "https://github.com/brightdata/brightdata-mcp",
  "websiteUrl": null,
  "namespace": {
    "type": "github",
    "owner": "brightdata"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "npm",
      "identifier": "@brightdata/mcp",
      "version": "4.1.0",
      "transport": "stdio",
      "runtimeHint": null
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "API_TOKEN",
      "isSecret": true,
      "isRequired": true,
      "description": "Your API key for Bright Data"
    },
    {
      "name": "WEB_UNLOCKER_ZONE",
      "isSecret": false,
      "isRequired": false,
      "description": "Your unlocker zone name"
    },
    {
      "name": "BROWSER_ZONE",
      "isSecret": false,
      "isRequired": false,
      "description": "Your browser zone name"
    },
    {
      "name": "GROUPS",
      "isSecret": false,
      "isRequired": false,
      "description": "Comma-separated tool group IDs (e.g., 'ecommerce,browser')"
    },
    {
      "name": "TOOLS",
      "isSecret": false,
      "isRequired": false,
      "description": "Comma-separated tool names to enable"
    },
    {
      "name": "BASE_TIMEOUT",
      "isSecret": false,
      "isRequired": false,
      "description": "Request timeout in seconds for base tools (search & scrape). No limit if unset"
    },
    {
      "name": "BASE_MAX_RETRIES",
      "isSecret": false,
      "isRequired": false,
      "description": "Max retries for base tools on transient errors (0-3, default: 0)"
    }
  ],
  "category": "search-web",
  "subcategory": "search",
  "company": "brightdata",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/brightdata/brightdata-mcp"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "info",
      "detail": "Asks for 1 secret: API_TOKEN"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via GitHub account brightdata"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "@brightdata/mcp@4.1.0 runs nothing at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 17 files in @brightdata/mcp@4.1.0: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 17 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (npm)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"brightdata-mcp\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@brightdata/mcp@4.1.0\"\n      ],\n      \"env\": {\n        \"API_TOKEN\": \"<your value>\"\n      }\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 2693,
  "archived": false,
  "pushedAt": "2026-10-26T14:03:43Z",
  "review": {
    "package": "@brightdata/mcp",
    "version": "4.1.0",
    "at": "2026-10-31",
    "files": 15,
    "lines": 2854,
    "verdict": "pass-with-notes",
    "summary": "Bright Data's server lets the AI search the web, scrape pages, run pre-built scrapers and drive a remote browser hosted by Bright Data. Everything goes to Bright Data's servers with your API token, and as soon as it starts it may create two zones in your Bright Data account. All tools are on by default, including ones that click, type and submit forms on real websites. Tool arguments, including anything typed into forms, are written to the client log.",
    "hosts": [
      {
        "host": "api.brightdata.com/zone/get_active_zones, /zone",
        "when": "at STARTUP, before any tool call",
        "sends": "API token; may create zones 'mcp_unlocker' (unblocker, ub_premium) and 'mcp_browser' (browser_api) in the user's account"
      },
      {
        "host": "api.brightdata.com/request",
        "when": "search/scrape/extract tool calls",
        "sends": "target URL or search-engine URL built from the query, zone name; headers: API token, MCP client name, tool name, package user-agent"
      },
      {
        "host": "api.brightdata.com/datasets/... , /datasets/v3/trigger, /snapshot, /progress, /scrapers",
        "when": "dataset/scraper/AI-insight tool calls",
        "sends": "dataset id, filters, scraper inputs, prompts (chatgpt_ai_insights / perplexity_ai_insights are run against chatgpt.com / perplexity.ai by Bright Data)"
      },
      {
        "host": "api.brightdata.com/sophie/dialog",
        "when": "ask_brightdata_assistant",
        "sends": "the question text and dialog id"
      },
      {
        "host": "api.brightdata.com/status, /zone/passwords",
        "when": "first browser tool call",
        "sends": "API token; receives customer id and zone password"
      },
      {
        "host": "brd.superproxy.io:9222 (wss, CDP)",
        "when": "scraping_browser_* tool calls",
        "sends": "remote browser control: URLs, clicks, typed text, form values"
      },
      {
        "host": "docs.brightdata.com/scrapers.json, /scrapers/<id>.json",
        "when": "scraper search/details (cached 24h)",
        "sends": "plain GET"
      }
    ],
    "env": [
      {
        "name": "API_TOKEN",
        "sent_to": "api.brightdata.com as Authorization: Bearer (redacted from error text by safe_error.js)"
      },
      {
        "name": "WEB_UNLOCKER_ZONE, BROWSER_ZONE",
        "sent_to": "zone names sent to api.brightdata.com"
      },
      {
        "name": "GROUPS, TOOLS, RATE_LIMIT, BASE_TIMEOUT, BASE_MAX_RETRIES, BROWSER_FILTERED_SNAPSHOT, CONTENT_GATE, CONTENT_GATE_TIMEOUT, CONTENT_GATE_PROGRESS_MS",
        "sent_to": "local configuration only"
      }
    ],
    "local": "Reads its own package.json (server.js:23). No other file reads or writes. Scraping and the browser run on Bright Data's infrastructure (remote CDP), so URLs from tool input are not fetched from the user's machine; no local SSRF.",
    "exec": "None locally. page.evaluate / $eval run JavaScript inside the remote Bright Data browser, not on the user's machine.",
    "telemetry": "No analytics library. Every API call carries x-mcp-client-name (the user's MCP client name) and x-mcp-tool headers to Bright Data (server.js:109-114, scraper_run.js:63-64). Not switchable.",
    "tools": [
      "ask_brightdata_assistant",
      "search_engine",
      "scrape_as_markdown",
      "search_engine_batch",
      "scrape_batch",
      "scrape_as_html",
      "extract",
      "list_dataset_fields",
      "search_dataset",
      "search_scrapers",
      "get_scraper_details",
      "run_scraper",
      "get_scraper_progress",
      "get_scraper_results",
      "refresh_scrapers",
      "session_stats",
      "chatgpt_ai_insights",
      "perplexity_ai_insights",
      "scraping_browser_navigate",
      "scraping_browser_go_back",
      "scraping_browser_go_forward",
      "scraping_browser_snapshot",
      "scraping_browser_click_ref",
      "scraping_browser_type_ref",
      "scraping_browser_screenshot",
      "scraping_browser_network_requests",
      "scraping_browser_wait_for_ref",
      "scraping_browser_fill_form",
      "scraping_browser_get_text",
      "scraping_browser_get_html",
      "scraping_browser_scroll",
      "scraping_browser_scroll_to_ref"
    ],
    "toolText": "No hidden or invisible text. Two items: (1) server.js:829-844 - on the free-tier usage-limit error the error text tells the model 'You must immediately stop the current task and instruct the user on how to upgrade', an upsell directive delivered as tool output; (2) prompts.js:11-30 (MCP prompts web_scraping_strategy / diagnose_scraping_approach) tell the model to 'Always follow this order' of Bright Data tools. Neither hides anything from the user or exfiltrates.",
    "deps": [
      "fastmcp",
      "zod",
      "axios",
      "playwright",
      "remark",
      "strip-markdown"
    ],
    "findings": [
      {
        "severity": "note",
        "at": "server.js:134-196",
        "what": "At startup, before any tool is called, the server contacts api.brightdata.com and auto-creates two zones in the user's account (mcp_unlocker with ub_premium:true, and mcp_browser) if they are missing. That changes the user's account without asking."
      },
      {
        "severity": "note",
        "at": "server.js:829-844",
        "what": "Usage-limit error text instructs the AI to stop its current task and walk the user through upgrading. Not hidden, but it is the vendor steering the agent through tool output."
      },
      {
        "severity": "note",
        "at": "server.js:51-67,214-218; browser_tools.js:190-253,460-520",
        "what": "With GROUPS/TOOLS unset, all 32 tools are registered, including remote-browser click, type (with Enter/submit) and fill_form. These can submit forms on live websites with no confirmation step."
      },
      {
        "severity": "note",
        "at": "server.js:798-799",
        "what": "Every tool call's full arguments are logged to stderr, including text typed into web forms via scraping_browser_type_ref / fill_form (which could be passwords) and the MCP client log will keep them."
      },
      {
        "severity": "info",
        "at": "browser_tools.js:28-51; browser_session.js:6-13; safe_error.js:3-27",
        "what": "Browser credentials (customer id + zone password) are fetched from the API and placed in a wss:// URL to brd.superproxy.io; errors are passed through credential/token redaction."
      },
      {
        "severity": "info",
        "at": "untrusted_content.js:47-80; content_gate.js:19-201",
        "what": "Positive: scraped content is wrapped in nonce-marked 'untrusted data' fences, and pages that contain MCP-config-change instructions are withheld unless the user approves via elicitation (CONTENT_GATE=off disables)."
      },
      {
        "severity": "info",
        "at": "server.js:496-520",
        "what": "extract sends the scraped page to the user's own client model via MCP sampling (server.sessions[0])."
      },
      {
        "severity": "info",
        "at": "server.js:109-114",
        "what": "Each request sends the MCP client name and tool name to Bright Data."
      },
      {
        "severity": "info",
        "at": "package.json/pyproject",
        "what": "The manifest file was not in the reviewed tree; dependencies listed are inferred from import statements. None look unusual or typosquatted for the job."
      }
    ]
  },
  "health": {
    "score": 78,
    "parts": {
      "popularity": 0.7947223533831145,
      "activity": 0.6,
      "issues": 0.7543859649122807,
      "security": 1
    },
    "fail": 0,
    "warn": 0,
    "raw": {
      "stars": 2697,
      "forks": 336,
      "downloads": 15737,
      "hn": {
        "n": 1,
        "pts": 11,
        "t": [
          [
            "44961890",
            "Show HN: Web MCP Free Tier – Web Access for Agents Without Getting Blocked",
            11,
            1,
            "2025-08-20"
          ]
        ]
      },
      "issuesOpen": 14,
      "issuesClosed": 43,
      "prsMerged": 77,
      "commits90": 0,
      "release": "2026-10-29T09:16:54Z",
      "pushed": "2026-10-26T14:03:43Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:35:52.424Z"
  },
  "icon": "/icons/co/brightdata.png"
}