74
/ 100
2 days ago
github_topic

agent-search-mcp

Free-first web search MCP with zero-key English and Chinese sources and compact evidence.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: BRAVE_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🚨
Known vulnerabilities in dependencies: 1 critical
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 11 credentials: BOCHA_API_KEY, BRAVE_API_KEY, EXA_API_KEY, HTTP_AUTH_TOKEN, LLM_JUDGE_API_KEY, OPENAI_API_KEY, OPENCODE_API_KEY, SERPER_API_KEY, TAVILY_API_KEY, TENCENT_WSA_API_KEY, YDC_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.1.3GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

lowyaml@2.7.1GHSA-48c2-rrv3-qjmp

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configALLOWED_ENGINES/ DENIED_ENGINES all / none Engine execution allowlist and denylist; deny wins
configALLOWED_ORIGINSmatch . See the [HTTP deployment guide](./docs/http-deployment.md)
🔐 secretBOCHA_API_KEYBocha Web Search zh, en Optional Chinese-first AI Search
🔐 secretBRAVE_API_KEYBrave Search en, zh Optional commercial Web Search
configCORS_ORIGIN
configDEDUP_MODEL
configDEDUP_THRESHOLDEnable optional semantic processing SEMANTIC_DEDUP, SEMANTIC_RERANK, , RERANK_TOP_K
configDEFAULT_ENGINE
configDENIED_ENGINESALLOWED_ENGINES / all / none Engine execution allowlist and denylist; deny wins
configDISABLED_TOOLSENABLED_TOOLS / all / none Tool registration allowlist and denylist; deny wins
configENABLED_TOOLS/ DISABLED_TOOLS all / none Tool registration allowlist and denylist; deny wins
configENABLE_CORS
🔐 secretEXA_API_KEYExa Search en, zh Optional neural Search
configHTTP_ALLOW_UNAUTHENTICATEDtrue. Browser requests with an Origin header must
🔐 secretHTTP_AUTH_TOKENHTTP mode requires unless you set
configLIVE_E2E
🔐 secretLLM_JUDGE_API_KEY
configLLM_JUDGE_BASE_URL
configLLM_JUDGE_MODEL
configLOG_LEVEL
configMAX_FULL_RESULTSReduce response tokens OUTPUT_STYLE=compact, , SNIPPET_LENGTH, EVIDENCE_BUDGET_CHARS
configMIN_CONFIDENCE
configMIN_SOURCE_COUNT
configMODEHTTP_AUTH_TOKEN=change-me =http npx agent-search-mcp
🔐 secretOPENAI_API_KEY
🔐 secretOPENCODE_API_KEY
configOUTPUT_STYLEReduce response tokens =compact, MAX_FULL_RESULTS, SNIPPET_LENGTH, EVIDENCE_BUDGET_CHARS
configPAID_ENGINE_ORDERbrave,exa,tavily,youcom,tencent_wsa,bocha,serper Selects the first configured optional provider; not a quality claim
configPORT
configPROVIDER_COOLDOWN_STORE_PATH
configPROXY_URLUse an explicit proxy DUCKDUCKGO_PROXY_URL, SOGOU_PROXY_URL, or USE_PROXY=true with
configRERANK_MODEL
configRERANK_TOP_KEnable optional semantic processing SEMANTIC_DEDUP, SEMANTIC_RERANK, DEDUP_THRESHOLD,
configSEARCH_CACHE_DIRECTORYPersist the exact-result cache , SEARCH_CACHE_TTL_MS, SEARCH_CACHE_MAX_ENTRIES
configSEARCH_PROVIDER_MODEfree_first Default routing: free_first, quality_escalation, paid_first, or free_only
configSEMANTIC_DEDUPEnable optional semantic processing , SEMANTIC_RERANK, DEDUP_THRESHOLD, RERANK_TOP_K
configSEMANTIC_RERANKEnable optional semantic processing SEMANTIC_DEDUP, , DEDUP_THRESHOLD, RERANK_TOP_K
🔐 secretSERPER_API_KEYSerper Google Search en, zh, auto Optional Google SERP Search
configSNIPPET_LENGTHReduce response tokens OUTPUT_STYLE=compact, MAX_FULL_RESULTS, , EVIDENCE_BUDGET_CHARS
🔐 secretTAVILY_API_KEYTavily Search en, zh Optional agent-oriented Search
🔐 secretTENCENT_WSA_API_KEYTencent Web Search API zh Optional official Chinese Web Search
configUSE_PROXYUse an explicit proxy DUCKDUCKGO_PROXY_URL, SOGOU_PROXY_URL, or =true with PROXY_URL
🔐 secretYDC_API_KEYYou.com Search en, zh Optional commercial Web Search
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/lennney-agent-search-mcp-10e1yq)](https://m8ven.ai/mcp/lennney-agent-search-mcp-10e1yq)
commit: 0221691c157cfe2d42a4cbc70e50d1259f953ec5
code hash: 23c2034ab5fdd51a5e2951e538453369015d39332c554f12f73c1f46cc0faead
verified: 7/29/2026, 9:19:29 AM
view raw JSON →