mcp-scraper 0.83.0 → 0.83.1

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.83.1] - 2026-09-01
+
+### Fixed
+
+- Allowed the X-Ray Pixel to authenticate normal same-origin runtime-manifest and health requests from their approved `Referer` hostname when browsers omit the `Origin` header, while preserving approved-domain enforcement and failing closed when neither header identifies an HTTP origin.
+
 ## [0.83.0] - 2026-09-01
 
 ### Added
@@ -1579,7 +1585,8 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.81.0...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.1...HEAD
+[0.83.1]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.0...v0.83.1
 [0.83.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.82.0...v0.83.0
 [0.82.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.81.0...v0.82.0
 [0.81.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.80.0...v0.81.0

package/README.md

@@ -175,7 +175,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.83.0`, SHA-256 `5f4fb86ff0dd4b7ae2b757037334b815e491cff6bd678e2d57b9240a3d9dde36`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.83.1`, SHA-256 `57e9dfb6d83aa729cf90ca4654f72a4c8b16f219cbdbde737f72f23f36f3b46c`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 

package/dist/bin/api-server.js

@@ -17,7 +17,7 @@ loadDotEnv();
 async function main() {
   const [{ serve }, { app, personalAssistantProductionStartup }, { startWorker }, { migrate }] = await Promise.all([
     import("@hono/node-server"),
-    import("../server-ICMRDYI4.js"),
+    import("../server-XBUOLGZ3.js"),
     import("../worker-FM3ZRDY4.js"),
     import("../db-Z34LPZNR.js")
   ]);

package/dist/bin/mcp-scraper-cli.js

@@ -19,7 +19,7 @@ import {
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-FUG2IRKP.js";
+} from "../chunk-62ROBG4P.js";
 
 // src/cli/human-cli.ts
 import { Command } from "commander";

package/dist/bin/mcp-scraper-core.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-AIVNZZO3.js";
-import "../chunk-QSZXAA5F.js";
+} from "../chunk-J2CRSYL3.js";
+import "../chunk-W54QRM7I.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
@@ -13,7 +13,7 @@ import "../chunk-OPQIGAFB.js";
 import "../chunk-UXVT7FWW.js";
 import "../chunk-BGD7U3AE.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-FUG2IRKP.js";
+import "../chunk-62ROBG4P.js";
 import "../chunk-YXNDOQXN.js";
 
 // src/mcp/thorbit-restricted-tool-surface.ts

package/dist/bin/mcp-scraper-install.js

@@ -4,7 +4,7 @@ import {
 } from "../chunk-UXVT7FWW.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-FUG2IRKP.js";
+} from "../chunk-62ROBG4P.js";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-stdio-server.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-AIVNZZO3.js";
-import "../chunk-QSZXAA5F.js";
+} from "../chunk-J2CRSYL3.js";
+import "../chunk-W54QRM7I.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
@@ -13,7 +13,7 @@ import "../chunk-OPQIGAFB.js";
 import "../chunk-UXVT7FWW.js";
 import "../chunk-BGD7U3AE.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-FUG2IRKP.js";
+import "../chunk-62ROBG4P.js";
 import "../chunk-YXNDOQXN.js";
 
 // bin/mcp-stdio-server.ts

package/dist/{chunk-FUG2IRKP.js → chunk-62ROBG4P.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var PACKAGE_VERSION = "0.83.0";
+var PACKAGE_VERSION = "0.83.1";
 
 export {
   PACKAGE_VERSION

package/dist/{chunk-AIVNZZO3.js → chunk-J2CRSYL3.js}

@@ -12,13 +12,13 @@ import {
   registerScheduledResultsMcpTools,
   registerSerpIntelligenceCaptureTools,
   resolveDeploymentProfile
-} from "./chunk-QSZXAA5F.js";
+} from "./chunk-W54QRM7I.js";
 import {
   renderInstallTerminal
 } from "./chunk-UXVT7FWW.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-FUG2IRKP.js";
+} from "./chunk-62ROBG4P.js";
 
 // src/mcp/stdio-runtime.ts
 import { readFileSync } from "fs";

package/dist/{chunk-QSZXAA5F.js → chunk-W54QRM7I.js}

@@ -50,7 +50,7 @@ import {
 } from "./chunk-BGD7U3AE.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-FUG2IRKP.js";
+} from "./chunk-62ROBG4P.js";
 import {
   PUBLIC_ERROR_CODES,
   buildPublicErrorEnvelope,

package/dist/{server-ICMRDYI4.js → server-XBUOLGZ3.js}

@@ -373,7 +373,7 @@ import {
   resolveLocalSourcebookSchemaType,
   transcribeMediaUrl,
   transitionAnalyticsExperiment
-} from "./chunk-QSZXAA5F.js";
+} from "./chunk-W54QRM7I.js";
 import {
   auditImageUrls,
   auditImages,
@@ -494,7 +494,7 @@ import {
 } from "./chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-FUG2IRKP.js";
+} from "./chunk-62ROBG4P.js";
 import {
   CaptchaError,
   MapsSearchIncompletePageError,
@@ -53841,6 +53841,9 @@ function safeOrigin(origin) {
     return null;
   }
 }
+function resolveAnalyticsPublicRequestOrigin(input) {
+  return safeOrigin(input.origin) ?? safeOrigin(input.referer);
+}
 function dashboardOriginAllowed(origin) {
   if (origin === "https://mcpscraper.dev" || origin === "https://www.mcpscraper.dev")
     return true;
@@ -54198,7 +54201,10 @@ async function publicRuntimeContext(c) {
   const result3 = await getPublicAnalyticsEventDefinitions(publicPixelId);
   if (!result3.ownerUserId || !result3.siteId) return { error: c.json({ ok: false, error: "Pixel not found." }, 404) };
   if (!await analyticsOwnerHasCurrentEntitlement(result3.ownerUserId)) return { error: c.json({ ok: false, error: "X-Ray subscription required." }, 402) };
-  const origin = safeOrigin(c.req.header("origin"));
+  const origin = resolveAnalyticsPublicRequestOrigin({
+    origin: c.req.header("origin"),
+    referer: c.req.header("referer")
+  });
   const hostname = origin ? normalizeAnalyticsHostname(new URL(origin).hostname) : "";
   if (!hostname) return { error: c.json({ ok: false, error: "Approved Pixel hostname required." }, 403) };
   const approved = await getAnalyticsPool().query(
@@ -54238,7 +54244,7 @@ analyticsApp.get("/v1/pixels/:publicPixelId/runtime-manifest", async (c) => {
   });
   return c.json({ ok: true, hostname: context.hostname, manifest }, 200, {
     "Cache-Control": "public, max-age=60, stale-while-revalidate=300",
-    "Vary": "Origin"
+    "Vary": "Origin, Referer"
   });
 });
 var AnalyticsRuntimeHealthSchema = z44.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-scraper",
-  "version": "0.83.0",
+  "version": "0.83.1",
   "description": "MCP server for MCP Scraper web intelligence tools",
   "type": "module",
   "main": "./dist/index.cjs",