HTML Comment Extractor — find hidden notes & leaks in any URL

Extract the HTML comments (<!-- ... -->) from a page and flag sensitive ones — TODO/FIXME/HACK notes, passwords, API keys, tokens, internal/staging/debug references, and "remove before deploy" markers. Common framework/build markers are filtered out unless they look suspicious. Built for security review, red-team recon, and code-hygiene audits. Single URL or bulk.

$0.001 per page. Failed fetches are recorded free.

What you get

• comments — each { text, length, suspicious } (text capped at 2000 chars).
• suspiciousCount — comments matching sensitive patterns.
• commentCount — total kept comments (empty and framework-only markers filtered).
• Fail-soft: an unreachable URL returns {ok:false, error} and is never charged.

Input

{ "url": "https://www.wikipedia.org", "urls": ["https://example.com"], "maxUrls": 25 }

Output (real run, 2026-08-07)

{
  "ok": true,
  "url": "https://www.wikipedia.org/",
  "status": 200,
  "commentCount": 45,
  "suspiciousCount": 0,
  "comments": [
    { "text": "#1. en.wikipedia.org - 1,502,942,000 views/day", "length": 46, "suspicious": false }
  ]
}

A comment like <!-- TODO: remove test API key before launch --> comes back with suspicious: true.

Pricing — $0.001 per page

Priced at roughly 5× our measured compute cost per page. No directly comparable HTML-comment extractor was found on the Apify Store on 2026-08-07 (the "comments" listings are social-media comment scrapers, a different problem), so there is no competitor price to quote.

Limits (honest ones)

• Reads the server HTML; comments injected by JavaScript after load are not seen.
• suspicious is a keyword/pattern heuristic — it flags candidates for review, it is not a verdict that a secret is real.
• Comment text is truncated to 2000 characters per comment.
• maxUrls capped at 100 per run.

FAQ

• What counts as "suspicious"? Comments matching patterns like TODO/FIXME, password/secret/api-key/token, internal/staging/debug, localhost, or "remove before deploy".
• Why are some comments missing? Empty comments and pure framework/build markers (e.g. IE conditionals, ad markers) are filtered unless they look suspicious.
• Does it run JavaScript? No — server HTML only.
• What about a dead URL? You get an {ok:false, error} record, uncharged.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~webpage-comment-extractor/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"url":"https://www.wikipedia.org"}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com).

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/webpage-comment-extractor
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~webpage-comment-extractor/run-sync-get-dataset-items
• Pay with x402, without an Apify account. This Actor is whitelisted for agentic payments, so an agent holding USDC on Base can buy a prepaid token and spend it here. The minimum purchase is $1, the token balance is an absolute spending cap, and it expires 14 days after purchase.
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.