Week 45, updated 2 Nov 2026

Research & web data Crawl4AI

Is Crawl4AI safe?

Short answer: Caution. StackGrade's weekly scan of unclecode/crawl4ai gives it a Caution label for 29 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 169 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Crawl4AI is exploitable in your setup. Automated scan of commit 888299f on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Open-source crawler that turns any website into clean, LLM-ready Markdown.

  • 86,744 stars
  • pushed 1 Nov
  • Apache-2.0
  • Python

github.com/unclecode/crawl4ai · crawl4ai.com

52score out of 100

#26of 52 overall#4in Research & web data▲ 6 vs Week 44

  • Maintenance 30%37
  • Adoption 30%56
  • Docs 20%69
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 52, 52, 46, 52.

Caution

29 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 1 Nov 2026. Last 10 GitHub releases within 98 days (about 2.8 per 30 days), latest release 14 Oct 2026. Median 305.6 h to close an issue (10 closed issues).
  • Adoption: 86,744 stars (70%), 9,039 forks (30%).
  • Docs: README 26,994 characters, 25 headings, 18 code blocks, install section: yes.

Methodology

#4 of 6 in Research & web data

Ranked by score. The yellow row is this tool.

Research & web data, Week 45score 0–100, safety
  1. 1Firecrawl#1 overall78No issues found
  2. 2Browser Use#15 overall62Caution
  3. 3MarkItDown#22 overall54No dependencies scanned
  4. 4Crawl4AI#26 overall52Caution
  5. 5GPT Researcher#46 overall31Caution
  6. 6STORM#49 overall26Caution

Safety scan, 2 Nov 2026

Automated scan of commit 888299f, 754 files. Not a manual audit.

Caution

  • 29Critical dependency advisories169 high, 129 medium, 19 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 2Agent files checked0 phrases flagged for review.
  • 0curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 29 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 29 critical, 169 high, 129 medium, 19 low, 2 unrated

  • pyjwt@2.10.1 (PYSEC-2026-4145) in deploy/docker/requirements.txt
  • anyio@4.9.0 (PYSEC-2026-4025) in deploy/docker/requirements.txt
  • certifi@2026.7.22 (PYSEC-2026-4320) in deploy/docker/requirements.txt
  • nltk@3.9.4 (PYSEC-2026-3734) in requirements.txt
  • nltk@3.9.4 (PYSEC-2026-3735) in requirements.txt

Also found (informational, does not change the label):

  • 169 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Critical advisories counted once per package: 83 matches across 4 lockfiles

Notes:

  • 4 affected packages only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: mixpanel, amplitude

Automated scan of commit 888299f on 2 Nov 2026, not a manual audit. 754 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 6Releases, 90 daysLatest v0.9.5, 14 Oct
  • 13dMedian issue closeOver 10 closed issues
  • 86.7kStars+469 since 26 Oct
  • 9kForks309 open issues
  • 2024Repo created9 May 2024
30 days ago2 Nov
2 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

2 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about Crawl4AI

Answers use this week's StackGrade data.

Is Crawl4AI safe to use?

Caution. StackGrade's weekly scan of unclecode/crawl4ai gives it a Caution label for 29 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 169 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Crawl4AI is exploitable in your setup. Automated scan of commit 888299f on 2 Nov 2026, not a manual audit.

How does StackGrade score Crawl4AI?

Crawl4AI scores 52 out of 100 in Week 45: #26 of 52 tracked tools overall and #4 in Research & web data. The score combines maintenance (37), adoption (56) and docs (69) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to Crawl4AI?

The highest-scored other tools in Research & web data this week: Firecrawl (78, No issues found), Browser Use (62, Caution), MarkItDown (54, No dependencies scanned), GPT Researcher (31, Caution). StackGrade has not tested them hands-on.

What licence does Crawl4AI use?

The licence listed for unclecode/crawl4ai is Apache-2.0. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
AI tool
License
Apache-2.0
Language
Python
Created
9 May 2024
Owner
unclecode (User)
Forks
9,039
Homepage
crawl4ai.com

GitHub description: “Open-source web crawler and scraper for LLMs and AI agents: any website into clean, LLM-ready Markdown. Run it yourself, or use Crawl4AI Cloud with one key. Join our Discord https://discord.gg/VuxzM8mtf”

Sources: github.com/unclecode/crawl4ai, api.github.com/repos/unclecode/crawl4ai, raw.githubusercontent.com/unclecode/crawl4ai/main/README.md. Fetched 2 Nov 2026.

Know when Crawl4AI changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.