crawler-mcp-server

The server demonstrates good security awareness with explicit URL validation and sanitization, Playwright browser hardening (headless mode, no-sandbox), and clear statements on file system security (files saved only to specified paths, no arbitrary access). Input validation is performed for tool arguments, including URL length limits. There are no obvious 'eval' or hardcoded secrets. Potential risks include: 1) if the 'save_path' argument for crawl_web_page is sourced from untrusted input, it could lead to directory traversal in some edge cases if not properly handled by the calling system (though os.path.join provides some protection); 2) LLM integration with an 'instruction' parameter could be susceptible to prompt injection if the user input is not sanitized by the calling agent.