# Reported issues for mcp-server

Pod holds 10 of 10 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [mcp-server](/mcp/mcp-server-2).

## Most discussed

### fix: balance warning not surfaced in error-path tool responses (review finding — PR #381)

## Problem

When a scrape/extract/screenshot/crawl API call returns a 4xx error (e.g., 402 Insufficient Balance), the balance warning suffix is not appended to the error response. The `X-AlterLab-Balance-Warning` header IS parsed on error responses, but `formatErrorResult()` is called directly without appending `formatBalanceWarning(client.getLastBalanceWarning())`.

**Source**: PR #381 — Feat: proactive balance warnings (#28)
**Agent**: Security + Billing (dual finding)
**Confidence**: POSSIBLE

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/382) · 2026-07-07 · closed · outside contributor · 15 comments

### fix: remove dead code in waitForKeypressOrTimeout() finally block (review finding — PR #377)

## Problem

The `finally` block in `waitForKeypressOrTimeout()` in `src/auth.ts` contains an empty `if` body that is dead code.

**Source**: PR #377 — feat(auth): add 5-second countdown with keypress opt-out to first-run flow
**Agent**: General Security (domain: quality)
**Confidence**: POSSIBLE
**Severity**: LOW

## Pattern Metadata

**Pattern**: dead-code-finally
**Files**: `src/auth.ts`
**Root cause**: The finally block was added as a belt-and-suspenders guard but the actual cleanup is handle

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/378) · 2026-07-07 · closed · outside contributor · 13 comments

### fix: shell injection via exec() in openBrowser() (review finding — PR #371)

## Problem

`openBrowser()` in `src/auth.ts:120` was constructing a shell command string (`exec(cmd)`) using a URL returned by the device authorization server. On Linux and macOS, a malicious or compromised device server could return a URL containing shell metacharacters (e.g., backtick subshell `$(id)`, semicolon, pipe) that escape the double-quote boundary and execute arbitrary shell commands on the user's machine.

**Source**: PR #371 — feat(auth): Add OAuth device flow for seamless CLI authe

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/374) · 2026-07-07 · closed · outside contributor · 11 comments

### Bug: only 5 of 23 tools returned by tools/list — search, map, crawl, batch, sessions missing

## Problem

`alterlab-mcp-server@1.7.0` registers 23 tools via `server.tool()` (confirmed by monkey-patching `McpServer.prototype.tool` — all 23 return OK), but `tools/list` only returns 5:

1. `alterlab_scrape`
2. `alterlab_extract`
3. `alterlab_screenshot`
4. `alterlab_estimate_cost`
5. `alterlab_check_balance`

**Missing tools** (18): `alterlab_search`, `alterlab_map`, `alterlab_crawl`, `alterlab_crawl_status`, `alterlab_crawl_cancel`, `alterlab_batch`, `alterlab_batch_status`, `alterlab_list

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/367) · 2026-07-07 · closed · outside contributor · 7 comments

### fix: estimate tool formats description overstates cost prediction impact (review finding — PR #236)

## Problem

The `estimate` tool's `formats` parameter description states it `Affects cost prediction accuracy` (`src/tools/estimate.ts:24`), but the `/api/v1/scrape/estimate` endpoint currently ignores the `formats` field in its cost calculation — it only uses `url`, `cost_controls`, and URL-pattern heuristics.

**Source**: PR #236 — Fix: add formats parameter to estimate tool (json_v2, rag, raw)
**Agent**: General Security (security)
**Confidence**: POSSIBLE
**Severity**: LOW
**Review comment**

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/237) · 2026-06-03 · closed · outside contributor · 15 comments

### Sync: CostEstimateRequest formats expanded — json_v2, rag, raw added (from #19982)

## Ecosystem Sync

**Source**: [RapierCraftStudios/AlterLab](https://github.com/RapierCraftStudios/AlterLab) @ \`staging\`
**PR**: RapierCraftStudios/AlterLab#19982
**Merged**: 2026-06-03

## What changed

PR #19982 expanded the \`formats\` enum in \`CostEstimateRequest\` to include \`json_v2\`, \`rag\`, and \`raw\` (previously only \`text\`, \`json\`, \`html\`, \`markdown\`, \`content\`).

The MCP server's \`estimate\` tool (\`src/tools/estimate.ts\`) should accept these additional format value

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/234) · 2026-06-03 · closed · outside contributor · 9 comments

### Sync: Add extraction_model parameter to scrape, extract, and crawl tools (from #19988)

## Ecosystem Sync

**Source**: [RapierCraftStudios/AlterLab](https://github.com/RapierCraftStudios/AlterLab) @ \`staging\`
**PR**: RapierCraftStudios/AlterLab#19988
**Merged**: 2026-06-03

## What changed

PR #19988 added \`extraction_model\` to \`ScrapeRequest\`, \`ExtractRequest\`, and \`CrawlRequest\` in the Node SDK. The MCP server's \`scrape\`, \`extract\`, and \`crawl\` tools need the same parameter.

## Required changes

**\`src/tools/scrape.ts\`** — add to schema:
\`\`\`ts
extraction_mod

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/232) · 2026-06-03 · closed · outside contributor · 8 comments

### feat(sync): comprehensive API parity — all missing params, response fields, and endpoints

## Problem

The MCP server tool schemas are significantly behind the AlterLab API surface. ~30 scrape params, ~16 crawl params, and 16+ API endpoints have no MCP tool coverage. This single issue supersedes all individual sync issues (#102–#211).

## Scope

### Scrape Tool — Missing Input Params

**cost_controls** (entire object):
- `cost_controls.force_tier` (1/2/3/3.5/4) — bypass tier escalation
- `cost_controls.max_tier` (1/2/3/3.5/4) — cap maximum tier
- `cost_controls.max_credits` (float) — 

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/213) · 2026-05-29 · closed · outside contributor · 15 comments

## Most recent

### feat(sync): add block_images param and crawl export tool

## Problem

The MCP server is missing two API capabilities that are live in production:

1. **`block_images` parameter** — available on scrape, crawl, and extract endpoints since SDK v2.3.1. Skips image downloads during browser rendering to reduce proxy bandwidth and speed up scrapes. Not exposed in the MCP scrape/crawl/extract tool schemas.

2. **`GET /crawl/{id}/export`** — new endpoint (PR #21189, deployed June 18). Exports crawl results as CSV/JSON/NDJSON. No corresponding MCP tool exists.

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/296) · 2026-06-22 · closed · outside contributor · 0 comments

### Sync: Add beta feature management tools — list, enable, disable (from #19977)

## Ecosystem Sync

**Source**: [RapierCraftStudios/AlterLab](https://github.com/RapierCraftStudios/AlterLab) @ \`staging\`
**PR**: RapierCraftStudios/AlterLab#19977
**Merged**: 2026-06-03

## What changed

PR #19977 added beta feature management methods to both the Node SDK and Python SDK:
- \`listBetaFeatures()\` — GET /api/v1/beta-features
- \`listMyBetaFeatures()\` — GET /api/v1/beta-features/my
- \`enableBetaFeature(slug)\` — POST /api/v1/beta-features/{slug}/enable
- \`disableBetaFeature(sl

[Read the thread](https://github.com/RapierCraft/alterlab-mcp-server/issues/233) · 2026-06-03 · closed · outside contributor · 7 comments

The remaining reports are on [the project's issue tracker](https://github.com/RapierCraft/alterlab-mcp-server/issues).