SHAFT MCP

Web automation and testing server using SHAFT Engine (Selenium-based)

We cannot tell you that, and nobody scanning at this scale can. What we did in March 2026 was shallow-clone SHAFT MCP and run five keyword searches over its source: auth identifiers, CORS configuration, rate-limit identifiers, the dependency manifest against a hardcoded list of 18 known-vulnerable packages, and unguarded eval/exec calls. At least one matched — the specific finding is in the scan report on this page. A text search cannot follow a variable, judge intent, or tell you what a server does once it is running, so "nothing matched" is not "safe". What the scan does and does not cover is written out at /mcp/security.

Similar MCP servers include Scrapling MCP Server, Chrome DevTools MCP, Playwright MCP. Each serves a similar purpose but may differ in features, language, and compatibility.