Scrapling's MCP server now requires auth by default

Scrapling's v0.4.15 release locks the project's MCP server HTTP transport behind authentication and binds it to localhost by default. It's a breaking change, and it's an unusually cautious default for an MCP server, a category where I keep seeing tools ship wide open until something goes wrong.

That matters because MCP servers sit between a model and the open web, fetching whatever a page hands back. An HTTP transport with no auth and no bind restriction is reachable by anything on the network that finds it, not just the agent it was built for. Scrapling's own changelog frames this as the fix.

The release also splits fetch tools into two kinds. One-shot tools (fetch, bulk_fetch, stealthy_fetch) grab a page and forget it. Session-based variants keep cookies and browser fingerprints across calls, which is the difference between scraping one page and scraping a site that expects you to stay logged in.

The part I'd actually build on is Response.markdown(). It strips scripts, styles, and hidden content before the text reaches an index, which is a direct answer to prompt injection buried in scraped pages, a problem most scraping tools still hand off to whatever reads the output. If you're feeding scraped HTML into a model's context, that's the layer that's been missing.

I don't have numbers on how many Scrapling deployments were running the old open-HTTP default, or whether any got hit before this release. The changelog doesn't say.