Free-first Chinese and English web search MCP using zero-key sources and inspectable evidence.
Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
lennney
Source: github_topic · also listed on Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
ALLOWED_ENGINES/ DENIED_ENGINES all / none Engine execution allowlist and denylist; deny winsALLOWED_ORIGINSmatch . See the [HTTP deployment guide](./docs/http-deployment.md)BOCHA_API_KEYBocha Web Search zh, en Optional Chinese-first AI SearchBRAVE_API_KEYBrave Search en, zh Optional commercial Web SearchCORS_ORIGINDEDUP_MODELDEDUP_THRESHOLDEnable optional semantic processing SEMANTIC_DEDUP, SEMANTIC_RERANK, , RERANK_TOP_KDEFAULT_ENGINEDENIED_ENGINESALLOWED_ENGINES / all / none Engine execution allowlist and denylist; deny winsDISABLED_TOOLSENABLED_TOOLS / all / none Tool registration allowlist and denylist; deny winsENABLED_TOOLS/ DISABLED_TOOLS all / none Tool registration allowlist and denylist; deny winsENABLE_CORSEXA_API_KEYExa Search en, zh Optional neural SearchHTTP_ALLOW_UNAUTHENTICATEDtrue. Browser requests with an Origin header mustHTTP_AUTH_TOKENHTTP mode requires unless you setLIVE_E2ELLM_JUDGE_API_KEYLLM_JUDGE_BASE_URLLLM_JUDGE_MODELLOG_LEVELMAX_FULL_RESULTSReduce response tokens OUTPUT_STYLE=compact, , SNIPPET_LENGTH, EVIDENCE_BUDGET_CHARSMIN_CONFIDENCEMIN_SOURCE_COUNTMODEHTTP_AUTH_TOKEN=change-me =http npx agent-search-mcpOPENAI_API_KEYOPENCODE_API_KEYOUTPUT_STYLEReduce response tokens =compact, MAX_FULL_RESULTS, SNIPPET_LENGTH, EVIDENCE_BUDGET_CHARSPAID_ENGINE_ORDERbrave,exa,tavily,youcom,tencent_wsa,bocha,serper Selects the first configured optional provider; not a quality claimPROVIDER_COOLDOWN_STORE_PATHPROXY_URLUse an explicit proxy DUCKDUCKGO_PROXY_URL, SOGOU_PROXY_URL, or USE_PROXY=true withRERANK_MODELRERANK_TOP_KEnable optional semantic processing SEMANTIC_DEDUP, SEMANTIC_RERANK, DEDUP_THRESHOLD,SEARCH_CACHE_DIRECTORYPersist the exact-result cache , SEARCH_CACHE_TTL_MS, SEARCH_CACHE_MAX_ENTRIESSEARCH_PROVIDER_MODEfree_first Default routing: free_first, quality_escalation, paid_first, or free_onlySEMANTIC_DEDUPEnable optional semantic processing , SEMANTIC_RERANK, DEDUP_THRESHOLD, RERANK_TOP_KSEMANTIC_RERANKEnable optional semantic processing SEMANTIC_DEDUP, , DEDUP_THRESHOLD, RERANK_TOP_KSERPER_API_KEYSerper Google Search en, zh, auto Optional Google SERP SearchSNIPPET_LENGTHReduce response tokens OUTPUT_STYLE=compact, MAX_FULL_RESULTS, , EVIDENCE_BUDGET_CHARSTAVILY_API_KEYTavily Search en, zh Optional agent-oriented SearchTENCENT_WSA_API_KEYTencent Web Search API zh Optional official Chinese Web SearchUSE_PROXYUse an explicit proxy DUCKDUCKGO_PROXY_URL, SOGOU_PROXY_URL, or =true with PROXY_URLYDC_API_KEYYou.com Search en, zh Optional commercial Web SearchPORTAll four hints declared on every tool
8/8 tools missing one or more hints — free_search (missing: destructiveHint); fetch_github_readme (missing: destructiveHint, openWorldHint); fetch_csdn_article (missing: destructiveHint, openWorldHint), +5 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 2/8 tools referenced in tests (25%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
7 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Domain consistency
npm scope @agent-search-mcp doesn't match GitHub owner lennney
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/lennney-agent-search-mcp-l9ovvi)?variant=verified to the badge URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check