"Techniques for Scraping Dynamic Websites with JavaScript and Handling CAPTCHA or Proxy Issues" matching MCP tools:

• scrape

  anybrowse

  Convert any URL to clean, LLM-ready Markdown. 84% success rate including JavaScript-heavy sites, Cloudflare-protected pages, and government sites. Renders JavaScript, handles dynamic content, bypasses common bot detection with stealth mode and CAPTCHA solving. Returns structured markdown with title and metadata. Tip: provide 'context' to get more relevant results. Free tier: 10 scrapes per day. Get 50 per day at anybrowse.dev/upgrade-free

  Connector

• security_deep_dive

  codereview

  Run an OWASP-oriented security pass over a source file. PREMIUM (license). Checks injection sinks, auth/session handling, crypto misuse, SSRF/deserialization, and unsafe file/path handling — each finding cites the line, the OWASP risk class, and a concrete fix direction. Typical input {"code": "<file contents>"} returns {"issues": N, "findings": [{"line": N, "class": "A03 Injection", "fix": "...", "code": "..."}], "owasp_note": "..."}. Use on one source file when vulnerabilities are the question. Not for style or structure (complexity_report), and never a substitute for a security professional on high-risk code. Errors: on invalid, missing, or malformed input this tool never raises a protocol error — it returns {"error": "<what is wrong and how to fix it>"}. Every call is read-only and idempotent, so after correcting the input it is always safe to retry.

  Connector

• atlas_technique_search

  ContrastAPI

  Search the MITRE ATLAS catalog of AI/ML attack techniques by keyword, tactic, or maturity. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose record. Pass exclude_id when chaining from atlas_technique_lookup to skip self in sibling-tactic searches. Use this to discover techniques matching a threat-model question, e.g. 'what techniques target LLM serving infrastructure?'. Drill into atlas_technique_lookup with any returned technique_id for the full description, ATT&CK bridge, and pivot hints. For broader cross-referencing: when a result has attack_reference_id, that bridges to D3FEND mitigations via d3fend_defense_for_attack. Free: 30/hr, Pro: 500/hr. Returns {query (echoed filters), total, results [{technique_id, name, description (truncated by default), tactics, inherited_tactics, maturity, attack_reference_id, subtechnique_of}], next_calls}.

  Connector

• foura_browser

  mcp

  Load a public URL in a full browser session. JavaScript runs, the DOM renders, and cookies come back with the response. Use it for single-page apps, lazy-loaded content, or supported browser challenges. For a protected page, call foura_proxy first and pass its returned proxy ID here to reuse that exit. Set unblocker:false when you want the page exactly as it loads.

  Connector

• list_websites

  squirrelscan

  List websites the organization has audited, with their latest run status, health score, and owned/prospect kind. Each row carries last_run_id (the latest run, any status) and last_report_run_id / last_report_id (the latest completed run whose report has not been deleted) — pass last_report_run_id to get_report to read a website's newest report without knowing a run id in advance, or list_audits with website_id for its full history. Use the website_id with list_issues/get_issue. Websites registered but never audited do not appear; run_audit or add_website registers a new one. Ephemeral one-shot audits never appear. Returns total/has_more for pagination. Filter by kind to separate sites the user runs from one-off prospect audits: kind: "prospect" returns ONLY sites explicitly marked as such, so it is the safe way to build a bulk-delete list.

  Connector

• find_similar_sites

  mcp

  Find similar or competitor websites based on classification. Takes a URL, classifies it (or uses cached classification), and returns other websites from the same category and subcategory. Useful for competitive analysis and discovering related content. Rate limited to 1 request per minute per domain. Args: url: The website URL to find similar sites for. limit: Maximum number of similar sites to return (1-50, default 10). Returns: Dictionary with: - url: The input URL (normalized) - classification: The URL's category and subcategory - similar_sites: List of similar URLs from the same category - total_in_category: Total sites in this category/subcategory - cached: Whether the classification was from cache

  Connector

• pentest_lookup_group

  pentest-mcp-server

  Look up a MITRE ATT&CK threat group (intrusion set) or software entry by name or ID for authorized penetration testing and threat intelligence. Returns the group or software record: ATT&CK ID, display name, known aliases, type (group vs. software), description, and the techniques it uses with procedure-level context from public ATT&CK reporting. Accepts exact ATT&CK IDs (G0007 for threat groups, S0002 for software) or keyword/name search (e.g., "APT28", "Mimikatz", "Lazarus Group"). Equally useful for defenders building detection coverage around specific adversary tradecraft.

  Connector

• lookup_launch_record

  launch-record-lookup

  Look up the public Website Launches launch record for a single domain. Returns launch timing, owner verification status, milestone summary, public trust context, and a public record URL. Single domain only; does not search, list, discover, or export websites. Hosting, registrar, and location are secondary details — only surface them if the user explicitly asks.

  Connector

• bulk_atlas_technique_lookup

  ContrastAPI

  Bulk ATLAS technique lookup — retrieve full records for up to 50 techniques in a single request instead of N separate atlas_technique_lookup calls. Designed as the natural follow-up to atlas_case_study_lookup, whose techniques_used array can be passed directly. Each item is the same shape as atlas_technique_lookup, including parent-tactics inheritance for sub-techniques (inherited_tactics=true flag) and per-item next_calls (D3FEND bridge when attack_reference_id present, sibling-technique search by tactic, parent lookup for sub-techniques). Free: 30/hr (1 per item), Pro: 500/hr. Returns {results [{technique_id, status (ok|not_found|invalid_format), technique, error}], total, successful, failed, partial, summary}.

  Connector

• check_injection

  ContrastAPI

  Scan source code for injection vulnerabilities: SQL injection, command injection, path traversal via unsafe string concatenation/unsanitized input. Supports Python, JavaScript, TypeScript, Java, Go, Ruby, Shell, Bash. Use to detect input-handling bugs; for secrets use check_secrets. Companion code-security tools: check_secrets (hard-coded credential detection), check_dependencies (known-CVE vulnerability audit), check_headers (live HTTP security-header validation), scan_headers (live HTTP scan via domain). Free: 30/hr, Pro: 500/hr. Returns {total, by_severity, findings}. No data stored.

  Connector

• execute

  mcp

  Runs JavaScript code to interact with the Mux API. You are a skilled TypeScript programmer writing code to interface with the service. Define an async function named "run" that takes a single parameter of an initialized SDK client and it will be run. For example: ``` async function run(client) { const asset = await client.video.assets.create({ inputs: [{ url: 'https://storage.googleapis.com/muxdemofiles/mux-video-intro.mp4' }], playback_policies: ['public'] }); console.log(asset.id); } ``` You will be returned anything that your function returns, plus the results of any console.log statements. Do not add try-catch blocks for single API calls. The tool will handle errors for you. Do not add comments unless necessary for generating better code. Code will run in a container, and cannot interact with the network outside of the given SDK client. Variables will not persist between calls, so make sure to return or log any data you might need later. Remember that you are writing TypeScript code, so you need to be careful with your types. Always type dynamic key-value stores explicitly as Record<string, YourValueType> instead of {}.

  Connector

• acc_list_issues

  ACC MCP

  List and filter issues from a single ACC project (limit 50 per call) via the APS Construction Issues API. When to use: The user or upstream agent needs to review open issues, count issues by status/priority, or look up an issue_id before calling acc_update_issue. E.g. 'show me all critical open issues on the Tower project'. When NOT to use: Do not use to fetch RFIs (use acc_list_rfis) or to search documents. APS scopes: data:read account:read. No write scope required. Rate limits: ACC Issues API ~100 req/min per app; results pageable (limit 50 here, max 200 upstream). For large projects, call once and filter client-side instead of looping. Errors: 401 (APS token expired — refresh); 403 (user lacks 'View Issues' permission on project or scope insufficient); 404 (project_id not found — verify 'b.' prefix and hub membership via acc_list_projects); 422 (invalid filter value — check status/priority spelling); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry with jitter). Side effects: None. Read-only and idempotent.

  Connector

• shippingrates_cfs_tariffs

  ShippingRates MCP Server (Apify)

  Get Container Freight Station (CFS) handling tariffs — charges for LCL (Less than Container Load) cargo consolidation and deconsolidation at port warehouses. Use this for LCL shipments to estimate warehouse handling costs. Returns per-unit handling rates, minimum charges, and storage fees at the specified port. Not relevant for FCL (Full Container Load) shipments. PAID: $0.05/call via x402 (USDC on Base or Solana). Without payment, returns 402 with payment instructions. Returns: Array of { facility, service_type, cargo_type, rate_per_unit, unit, minimum_charge, currency }.

  Connector

• foura_auto

  mcp

  Give it a public URL and get the content back. This is the default when you don't want to choose between HTTP, proxy rotation, and a full browser. On protected targets, or whenever HTTP 200 may still be a challenge or incomplete page, pass validate.data.accept with text unique to the real content. Auto makes bounded attempts and returns either validated content or a failure; it cannot guarantee a match. The response includes completion details and, by default, reusable session values for follow-up calls. Use a lower-level tool when you need direct control over HTTP, proxy selection, or browser navigation, or to choose which browser is presented to the target: that lives on foura_single and foura_proxy.

  Connector

• search-music-docs

  Music Studio

  Search detailed documentation for Strudel live coding or ABC/ABCJS notation. Returns relevant code examples and explanations from the official docs. Use this when the curated guides (get-strudel-guide, get-music-guide) don't cover what you need — for specific functions, advanced techniques, or when you're unsure about syntax. Powered by semantic search over strudel.cc and ABCJS docs.

  Connector

• decodo_google_search

  Decodo

  Google search results scraping via Decodo (formerly Smartproxy) — runs a Google search through rotating proxies and returns structured organic results (position, title, url, snippet) plus related searches when parsing succeeds. BYOK — _apiKey is your Decodo Web Scraping API "username:password" credentials. Example: decodo_google_search({ query: "best running shoes 2026", geo: "United States", _apiKey: "user:pass" })

  Connector

• scrapingdog_scrape

  Scrapingdog

  Scrape any website through Scrapingdog's rotating proxies and return its content. Returns HTML by default, or clean markdown with format:"markdown" (ideal for feeding an LLM). Set dynamic:true to render JavaScript in a headless browser for SPAs and dynamic pages (costs 5 credits instead of 1), premium:true for hard-to-scrape sites (residential proxies, 10 credits), and country to geotarget the proxy. Example: scrapingdog_scrape({ url: "https://example.com", format: "markdown", dynamic: true, _apiKey: "your-key" })

  Connector

• classify_intent

  ContextOverflow

  Describe what's going wrong — your human's complaint, or a failure you notice in your own behavior — and get the matching techniques. Deterministic matching; if the description fits two problems it returns one clarifying question instead of guessing.

  Connector

• earn_earnings

  VerifiedDR

  What your websites have earned as publishers (USD cents): pending, due, paid, and the payout threshold.

  Connector

• abi_fetch

  FabTally Decode

  PAID $0.002 (x402, USDC on Base). Fetch the verified ABI + metadata for a contract. Give {address, chain}; get the ABI JSON, verification status/source (Sourcify or Blockscout), the callable function/event signatures, and full proxy-implementation resolution (EIP-1967/1822/OZ-legacy/beacon) — returning the implementation's ABI when it's a proxy. Without payment returns the x402 challenge; pass x_payment to settle.

  Connector