Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-24 · high
Version 0.4.15 locks HTTP access behind localhost and adds a markdown output that strips hidden prompt-injection content before it reaches your index.
Why now: Scrapling shipped this in its August 24 release.
Scrapling's v0.4.15 release locks the project's MCP server HTTP transport behind authentication and binds it to localhost by default. It's a breaking change, and it's an unusually cautious default for an MCP server, a category where I keep seeing tools ship wide open until something goes wrong.
That matters because MCP servers sit between a model and the open web, fetching whatever a page hands back. An HTTP transport with no auth and no bind restriction is reachable by anything on the network that finds it, not just the agent it was built for. Scrapling's own changelog frames this as the fix.
The release also splits fetch tools into two kinds. One-shot tools (fetch, bulk_fetch, stealthy_fetch) grab a page and forget it. Session-based variants keep cookies and browser fingerprints across calls, which is the difference between scraping one page and scraping a site that expects you to stay logged in.
The part I'd actually build on is Response.markdown(). It strips scripts, styles, and hidden content before the text reaches an index, which is a direct answer to prompt injection buried in scraped pages, a problem most scraping tools still hand off to whatever reads the output. If you're feeding scraped HTML into a model's context, that's the layer that's been missing.
I don't have numbers on how many Scrapling deployments were running the old open-HTTP default, or whether any got hit before this release. The changelog doesn't say.
Each link below shares sources, entities, or timing with this story.
Scrapling supports Cloudflare Turnstile / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Scrapling supports Cloudflare Turnstile); both cover D4Vinci, GitHub, MCP, Scrapling; reported by the same outlet (github.com).
Linked by a graph relationship (Scrapling supports Cloudflare Turnstile); both cover D4Vinci, GitHub, MCP, Scrapling; reported by the same outlet (github.com).
Scrapling uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Scrapling uses MCP); both cover HTTP, MCP; reported by the same outlet (github.com).
Linked by a graph relationship (Scrapling uses MCP); both cover HTTP, MCP; reported by the same outlet (github.com).
Scrapling uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Scrapling uses MCP); both cover GitHub, MCP, Response; reported by the same outlet (github.com).
Scrapling partners with Claude / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Scrapling partners with Claude); both cover D4Vinci, MCP, Scrapling; reported by the same outlet (github.com).
Scrapling uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Scrapling uses MCP); both cover GitHub, HTTP, MCP; reported by the same outlet (github.com).
Scrapling uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Scrapling uses MCP); both cover GitHub, MCP; reported by the same outlet (github.com).