← MCP servers · exa-labs

Exa

SAFEgrade B · trust 89/100

Exa MCP for web search and web crawling!

code searchcodesearchcrawlingmcpmcp servermodel context protocolweb searchwebsearch

Overview

From the repository's own README, as read at the audited commit.

<h1 align="center">  <img src="assets/Exa.svg" alt="Exa" width="64" />  <br>  Exa MCP Server</h1><p align="center">Connect AI agents to Exa for web search, content fetching, and multi-step research.</p><p align="center">  <a href="https://cursor.com/en/install-mcp?name=exa&config=eyJ1cmwiOiJodHRwczovL21jcC5leGEuYWkvbWNwIn0="><img src="https://custom-icon-badges.demolab.com/badge/Install_in_Cursor-000000?style=for-the-badge&logo=cursor-ai-white" alt="Install in Cursor" /></a>  <a href="https://vscode.dev/redirect/mcp/install?name=exa&config=%7B%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fmcp.exa.ai%2Fmcp%22%7D"><img src="https://custom-icon-badges.demolab.com/badge/Install_in_VS_Code-007ACC?style=for-the-badge&logo=vsc&logoColor=white" alt="Install in VS Code" /></a>  <a href="https://claude.com/plugins/exa"><img src="https://img.shields.io/badge/Claude_Plugin-C66140?style=for-the-badge&logo=claude&logoColor=white" alt="Install Claude Plugin" /></a>  <a href="https://chatgpt.com/plugins/exa?open_in_app"><img src="https://img.shields.io/badge/Codex%2FChatGPT_Plugin-4A5BFE?style=for-the-badge&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0id2hpdGUiPjxwYXRoIGQ9Ik0yMi4yODE5IDkuODIxMWE1Ljk4NDcgNS45ODQ3IDAgMCAwLS41MTU3LTQuOTEwOCA2LjA0NjIgNi4wNDYyIDAgMCAwLTYuNTA5OC0yLjlBNi4wNjUxIDYuMDY1MSAwIDAgMCA0Ljk4MDcgNC4xODE4YTUuOTg0NyA1Ljk4NDcgMCAwIDAtMy45OTc3IDIuOSA2LjA0NjIgNi4wNDYyIDAgMCAwIC43NDI3IDcuMDk2NiA1Ljk4IDUuOTggMCAwIDAgLjUxMSA0LjkxMDcgNi4wNTEgNi4wNTEgMCAwIDAgNi41MTQ2IDIuOTAwMUE1Ljk4NDcgNS45ODQ3IDAgMCAwIDEzLjI1OTkgMjRhNi4wNTU3IDYuMDU1NyAwIDAgMCA1Ljc3MTgtNC4yMDU4IDUuOTg5NCA1Ljk4OTQgMCAwIDAgMy45OTc3LTIuOTAwMSA2LjA1NTcgNi4wNTU3IDAgMCAwLS43NDc1LTcuMDcyOXptLTkuMDIyIDEyLjYwODFhNC40NzU1IDQuNDc1NSAwIDAgMS0yLjg3NjQtMS4wNDA4bC4xNDE5LS4wODA0IDQuNzc4My0yLjc1ODJhLjc5NDguNzk0OCAwIDAgMCAuMzkyNy0uNjgxM3YtNi43MzY5bDIuMDIgMS4xNjg2YS4wNzEuMDcxIDAgMCAxIC4wMzguMDUydjUuNTgyNmE0LjUwNCA0LjUwNCAwIDAgMS00LjQ5NDUgNC40OTQ0

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add exa-mcp-server -- npx -y [email protected]

Exposed tools (9) 7 read · 2 write · 0 destructive

ToolRiskDescription
agent_runwriteStart or resume an Exa Agent run; runs may take several minutes. Retain the returned run ID and resume with runId when the tool reports the run is still running. An interrupted tool call is not an explicit cancellation request.
company_research_exaread[Deprecated: Use web_search_advanced_exa instead] Research any company to get business information, news, and insights.Best for: Learning about a company
deep_researcher_checkread[Deprecated] Check status and get results from a deep research task.Best for: Getting the research report after calling deep_researcher_start.Returns: Research report when complete, or status update if still running.Important: Keep calling with the same research ID until status is
deep_researcher_startwrite
deep_search_exaread
get_code_context_exareadFind code examples, documentation, and programming solutions. Best for: Any programming question - API usage, library examples, code snippets, debugging help.Returns: Relevant code and documentation.Query tips: describe what you
linkedin_search_exaread⚠️ DEPRECATED: This tool is deprecated. Please use
people_search_exaread[Deprecated: Use web_search_advanced_exa instead] Find people and their professional profiles.Best for: Finding professionals, executives, or anyone with a public profile.Returns: Profile information and links.
web_search_advanced_exaread

Details

Source
exa-labs/exa-mcp-server
npm
exa-mcp-server@3.4.1
Transports
sse · stdio
Credentials it reads
EXA_API_KEYEXA_API_KEY_BYPASSKV_REST_API_TOKENOAUTH_AUDIENCEOAUTH_ISSUEROAUTH_USER_AGENTSOPENAI_APPS_CHALLENGE_TOKENRATE_LIMIT_BYPASSUPSTASH_REDIS_REST_TOKEN
License
MIT
Stars
4,997 · pushed 23d ago

Trust audit

Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (12)

LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierrc.json
.prettierrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.vercelignore
.vercelignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/fixtures/exaResponses.ts:2
import type { ExaContentsResponse, ExaSearchResponse } from "../../src/types.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/unit/api/mcp.test.ts:78
vi.mock("../../../src/mcp-handler.js", () => ({
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/unit/api/mcp.test.ts:82
vi.mock("../../../src/utils/auth.js", () => ({
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/unit/api/mcp.test.ts:112
const { handleRequest } = await import("../../../api/mcp.js");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/unit/api/mcp.test.ts:776
const { handleOptions } = await import("../../../api/mcp.js");
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
README.md:13
<a href="https://chatgpt.com/plugins/exa?open_in_app"><img src="https://img.shields.io/badge/Codex%2FChatGPT_Plugin-4A5BFE?style=for-the-badge&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, agnost, exa-js, jose, mcp-handler, zod, @types/node, @upstash/ratelimit
Why it matters. 13 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
README.md:128
The hosted MCP server works anonymously with rate limits. For higher limits and access to Exa Agent, use either OAuth or an API key.
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:132
If you prefer, you can get an API key from the [dashboard](https://dashboard.exa.ai/api-keys) and pass it on the URL as `?exaApiKey=...`. You can also send it as a `Authorization: Bearer ...` header o
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha 001822c68ddc · full audit: observations/trust-audit/mcp-server/exa-labs__exa.json · Report an issue or request a re-scan

Audit history

DateSourceVerdictGradeScoreChange
2026-09-13001822c68ddcSAFEB89first audit

Alternatives

Other servers in the same categories, safer ones first.

Questions

What is the Exa MCP server?

Exa MCP for web search and web crawling!

What tools does Exa expose?

9 in total: 7 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Exa safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Exa need?

It reads EXA_API_KEY, EXA_API_KEY_BYPASS, KV_REST_API_TOKEN, OAUTH_AUDIENCE, OAUTH_ISSUER, OAUTH_USER_AGENTS, OPENAI_APPS_CHALLENGE_TOKEN, RATE_LIMIT_BYPASS and UPSTASH_REDIS_REST_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Exa run?

It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as exa-mcp-server at 3.4.1.

How current is this page?

The grade is for one exact copy of the source (001822c68ddc), read on 2026-09-13. The repository is watched and re-audited when it changes.

Provenance: OBSERVED · read 2026-09-13 · job trust-audit-2026-09-13