Web Researcher MCP

v1.43.0 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 10d MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai ai-agent anti-hallucination bibliography citation-verification claude

+13 more

claude-code claude-desktop content-extraction cursor fact-checking go llm mcp mcp-server model-context-protocol research web-scraping web-search

Affected surfaces

auth

Summary

AI summary

Fixed scraper regression where cross‑origin iframes returned only wrapper text instead of real content.

Changes in this release

Type	Severity	Summary	CVE
Bugfix
Bugfix	Medium	Prevents thin non-shell iframe-bearing results from short‑circuiting tier escalation, restoring >100‑byte confidence floor. Prevents thin non-shell iframe-bearing results from short‑circuiting tier escalation, restoring >100‑byte confidence floor. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Medium	Fixes scraper regression where iframe-follow runs immediately upon detecting a shell instead of after loop completion. Fixes scraper regression where iframe-follow runs immediately upon detecting a shell instead of after loop completion. Source: llm_adapter@2026-07-17 Confidence: low	—
Bugfix	Low	Runs iframe-follow immediately when a shell is detected during tier processing. Runs iframe-follow immediately when a shell is detected during tier processing. Source: granite4.1:30b@2026-07-17-audit Confidence: low	—

Full changelog

What's Changed

Bug Fixes

Iframe-follow shell recovery fix (#399, implementation: #400)

Fixes a scraper regression: a server-rendered, cross-origin <iframe src> shell (e.g. HuggingFace Space wrappers, CodeSandbox, Stripe Checkout embeds) could return only the outer wrapper's near-empty text instead of the real content behind the iframe.

fix(scraper): trigger iframe-follow inline per-tier instead of post-loop (#399) — moves the iframe-follow trigger inline: the moment ANY tier's own result is flagged a shell by looksLikePartialShell, iframe-follow now runs immediately at that point in the loop, instead of only after the entire tier loop completes. This closes a live bug where a thin-but-passing Exa result (when EXA_API_KEY is configured) could short-circuit the loop before the old post-loop-only iframe-follow logic ever ran.
fix(scraper): don't treat a thin non-shell iframe-bearing result as complete — hardening found via GitHub Copilot's automated PR review, independently reproduced before fixing: a short, non-shell result that merely contains an unrelated iframe (e.g. an ad or chat widget) no longer short-circuits tier escalation. The pre-existing >100-byte confidence floor is restored for that case, while the relaxed gate still lets a genuine shell reach the iframe-follow logic it was designed for.

Verified via a new permanent regression test suite plus a live MCP scrape_page regression/progression sweep across the tool surface — no other regressions found.

Full changelog: https://github.com/zoharbabin/web-researcher-mcp/compare/v1.42.0...v1.43.0

Docker Images

# GitHub Container Registry
docker pull ghcr.io/zoharbabin/web-researcher-mcp:1.43.0

# Docker Hub
docker pull docker.io/zoharbabin/web-researcher-mcp:1.43.0

Homebrew

brew install zoharbabin/tap/web-researcher-mcp

Verify Checksums

sha256sum -c checksums.txt

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Web Researcher MCP

Get notified when new releases ship.

About Web Researcher MCP

All releases →