web scraping
Scrapling is a web scraping framework that handles requests ranging from single page fetches to large-scale crawls. It includes adaptive parsing that relocates elements when websites change, multiple fetcher types to bypass anti-bot systems, and a spider framework for concurrent crawling with proxy rotation and pause/resume capabilities.
Fetch individual web pages with stealth mode and anti-bot bypass built-in Parse and extract data with adaptive selectors that survive website design changes Build large-scale crawlers using the Spider framework with concurrent multi-session support Rotate proxies automatically and handle pause/resume for long-running scraping jobs Access scraping capabilities through CLI, Python API, or MCP server integration 3 CRITICAL✓ 2 HIGH✓ 5 MEDIUM 19 LOW 2 INFO
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 5 likely real (100%)
Findings by checker · 3 high-signal
CHK-108 3 findings 3 likely
0% FP CHK-129 1 finding 1 likely
0% FP CHK-047 1 finding 1 likely
0% FP 31 findings click to expand
CHK-108 Credentials embedded in URL: scrapling/core/ai.py
scrapling/core/ai.py
AI: likely real likely ▼
CHK-108 Credentials embedded in URL: scrapling/cli.py
scrapling/cli.py
AI: likely real likely ▼
CHK-108 Credentials embedded in URL: scrapling/engines/static.py
scrapling/engines/static.py
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — "password"
scrapling/core/_types.py
AI: likely real likely ▼
CHK-047 Potential SSRF — user-controlled URL passed to HTTP client in scrapling/spiders/engine.py
scrapling/spiders/engine.py
AI: likely real likely ▼
CHK-125a shutil.rmtree() — recursive directory deletion — no scope constraint in cleanup.py
cleanup.py
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
scrapling/core/storage.py
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in .bandit.yml
.bandit.yml
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in scrapling/cli.py
scrapling/cli.py
possible ▼
CHK-027 Outbound network call in skill — external network call (verify direction — could be benign API fetch)
agent-skill/Scrapling-Skill/SKILL.md
possible ▼
CHK-108 Credentials embedded in URL: docs/fetching/stealthy.md [docs context — verify manually]
docs/fetching/stealthy.md
possible ▼
CHK-108 Credentials embedded in URL: agent-skill/Scrapling-Skill/references/fetching/dynamic.md [docs context — verify manually]
agent-skill/Scrapling-Skill/references/fetching/dynamic.md
possible ▼
CHK-108 Credentials embedded in URL: agent-skill/Scrapling-Skill/references/fetching/static.md [docs context — verify manually]
agent-skill/Scrapling-Skill/references/fetching/static.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://scrapling.readthedocs.io/en/latest/donate.html
agent-skill/Scrapling-Skill/SKILL.md
likely ▼
CHK-125c fetch() with hardcoded URL — potential exfil — no scope constraint in README.md
README.md
possible ▼
CHK-108 Credentials embedded in URL: docs/overview.md [docs context — verify manually]
docs/overview.md
possible ▼
CHK-108 Credentials embedded in URL: docs/fetching/dynamic.md [docs context — verify manually]
docs/fetching/dynamic.md
possible ▼
CHK-108 Credentials embedded in URL: agent-skill/Scrapling-Skill/references/fetching/stealthy.md [docs context — verify manually]
agent-skill/Scrapling-Skill/references/fetching/stealthy.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in benchmarks.py
benchmarks.py
possible ▼
CHK-125c fetch() with hardcoded URL — potential exfil — no scope constraint in Scrapling-Skill/SKILL.md
agent-skill/Scrapling-Skill/SKILL.md
possible ▼
CHK-125c requests.* — unconstrained HTTP — no scope constraint in references/migrating_from_beautifulsoup.md
agent-skill/Scrapling-Skill/references/migrating_from_beautifulsoup.md
possible ▼
CHK-125c fetch() with hardcoded URL — potential exfil — no scope constraint in fetching/dynamic.md
agent-skill/Scrapling-Skill/references/fetching/dynamic.md
possible ▼
CHK-125c fetch() with hardcoded URL — potential exfil — no scope constraint in fetching/stealthy.md
agent-skill/Scrapling-Skill/references/fetching/stealthy.md
possible ▼
CHK-125c fetch() with hardcoded URL — potential exfil — no scope constraint in fetching/choosing.md
agent-skill/Scrapling-Skill/references/fetching/choosing.md
possible ▼
CHK-108 Credentials embedded in URL: agent-skill/Scrapling-Skill/SKILL.md [docs context — verify manually]
agent-skill/Scrapling-Skill/SKILL.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://scrapling.readthedocs.io/en/latest/index.html
agent-skill/Scrapling-Skill/SKILL.md
likely ▼
CHK-025 Hardcoded endpoint in skill: https://blog.example.com
agent-skill/Scrapling-Skill/SKILL.md
likely ▼
CHK-108 Credentials embedded in URL: docs/cli/extract-commands.md [docs context — verify manually]
docs/cli/extract-commands.md
possible ▼
CHK-108 Credentials embedded in URL: docs/fetching/static.md [docs context — verify manually]
docs/fetching/static.md
possible ▼
CHK-133 Real secret in example output block — Password value in example output [low-entropy — likely placeholder, verify manually]
agent-skill/Scrapling-Skill/references/fetching/static.md
possible ▼
CHK-133 Real secret in example output block — Password value in example output [low-entropy — likely placeholder, verify manually]
docs/fetching/static.md
possible ▼
Last scanned: Jul 12, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.