brightdata-mcp

Security Findings (190)

• HighAS-002

  ⚠️Excessive Permissions ×58

  tool declares network permission

  search_enginescrape_as_markdownsearch_engine_batchscrape_batchscrape_as_htmldiscoverweb_data_amazon_productweb_data_amazon_product_reviewsweb_data_amazon_product_searchweb_data_walmart_productweb_data_walmart_sellerweb_data_ebay_productweb_data_homedepot_productsweb_data_zara_productsweb_data_etsy_productsweb_data_bestbuy_productsweb_data_linkedin_people_searchweb_data_zoominfo_company_profileweb_data_instagram_profilesweb_data_instagram_postsweb_data_instagram_reelsweb_data_instagram_commentsweb_data_facebook_postsweb_data_facebook_marketplace_listingsweb_data_facebook_company_reviewsweb_data_facebook_eventsweb_data_tiktok_profilesweb_data_tiktok_postsweb_data_tiktok_shopweb_data_tiktok_commentsweb_data_google_maps_reviewsweb_data_google_shoppingweb_data_google_play_storeweb_data_apple_app_storeweb_data_reuter_newsweb_data_github_repository_fileweb_data_yahoo_finance_businessweb_data_x_postsweb_data_x_profile_postsweb_data_zillow_properties_listingweb_data_booking_hotel_listingsweb_data_youtube_profilesweb_data_youtube_commentsweb_data_youtube_videosweb_data_reddit_postsscraping_browser_navigatescraping_browser_go_backscraping_browser_go_forwardscraping_browser_snapshotscraping_browser_click_refscraping_browser_type_refscraping_browser_screenshotscraping_browser_network_requestsscraping_browser_wait_for_refscraping_browser_get_textscraping_browser_get_htmlscraping_browser_scrollscraping_browser_scroll_to_ref

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• MediumAS-002

  ⚠️Excessive Permissions ×8

  tool declares fs permission

  web_data_linkedin_person_profileweb_data_linkedin_company_profileweb_data_zoominfo_company_profileweb_data_instagram_profilesweb_data_tiktok_profilesweb_data_github_repository_fileweb_data_x_profile_postsweb_data_youtube_profiles

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×58

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  search_enginescrape_as_markdownsearch_engine_batchscrape_batchscrape_as_htmldiscoverweb_data_amazon_productweb_data_amazon_product_reviewsweb_data_amazon_product_searchweb_data_walmart_productweb_data_walmart_sellerweb_data_ebay_productweb_data_homedepot_productsweb_data_zara_productsweb_data_etsy_productsweb_data_bestbuy_productsweb_data_linkedin_people_searchweb_data_zoominfo_company_profileweb_data_instagram_profilesweb_data_instagram_postsweb_data_instagram_reelsweb_data_instagram_commentsweb_data_facebook_postsweb_data_facebook_marketplace_listingsweb_data_facebook_company_reviewsweb_data_facebook_eventsweb_data_tiktok_profilesweb_data_tiktok_postsweb_data_tiktok_shopweb_data_tiktok_commentsweb_data_google_maps_reviewsweb_data_google_shoppingweb_data_google_play_storeweb_data_apple_app_storeweb_data_reuter_newsweb_data_github_repository_fileweb_data_yahoo_finance_businessweb_data_x_postsweb_data_x_profile_postsweb_data_zillow_properties_listingweb_data_booking_hotel_listingsweb_data_youtube_profilesweb_data_youtube_commentsweb_data_youtube_videosweb_data_reddit_postsscraping_browser_navigatescraping_browser_go_backscraping_browser_go_forwardscraping_browser_snapshotscraping_browser_click_refscraping_browser_type_refscraping_browser_screenshotscraping_browser_network_requestsscraping_browser_wait_for_refscraping_browser_get_textscraping_browser_get_htmlscraping_browser_scrollscraping_browser_scroll_to_ref

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions

  scraping_browser_network_requests:tool declares http permission

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×65

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  search_enginescrape_as_markdownsearch_engine_batchscrape_batchscrape_as_htmlextractdiscoversession_statsweb_data_amazon_productweb_data_amazon_product_reviewsweb_data_amazon_product_searchweb_data_walmart_productweb_data_walmart_sellerweb_data_ebay_productweb_data_homedepot_productsweb_data_zara_productsweb_data_etsy_productsweb_data_bestbuy_productsweb_data_linkedin_person_profileweb_data_linkedin_company_profileweb_data_linkedin_job_listingsweb_data_linkedin_postsweb_data_linkedin_people_searchweb_data_crunchbase_companyweb_data_zoominfo_company_profileweb_data_instagram_profilesweb_data_instagram_postsweb_data_instagram_reelsweb_data_instagram_commentsweb_data_facebook_postsweb_data_facebook_marketplace_listingsweb_data_facebook_company_reviewsweb_data_facebook_eventsweb_data_tiktok_profilesweb_data_tiktok_postsweb_data_tiktok_shopweb_data_tiktok_commentsweb_data_google_maps_reviewsweb_data_google_shoppingweb_data_google_play_storeweb_data_apple_app_storeweb_data_reuter_newsweb_data_github_repository_fileweb_data_yahoo_finance_businessweb_data_x_postsweb_data_x_profile_postsweb_data_zillow_properties_listingweb_data_booking_hotel_listingsweb_data_youtube_profilesweb_data_youtube_commentsweb_data_youtube_videosweb_data_reddit_postsscraping_browser_navigatescraping_browser_go_backscraping_browser_go_forwardscraping_browser_snapshotscraping_browser_click_refscraping_browser_type_refscraping_browser_screenshotscraping_browser_network_requestsscraping_browser_wait_for_refscraping_browser_get_textscraping_browser_get_htmlscraping_browser_scrollscraping_browser_scroll_to_ref

  Fix: Review and remediate the identified issue.