ModelsAtlas
Explore
Atlas / MCP servers / kagisearch / Kagi

KagiSAFE

mcp/kagisearch/kagi
MCP server by kagisearch · Audited 2026-09-30
⚑ Report / re-scanSource ↗

The Official Model Context Protocol (MCP) server for Kagi Search & other tools.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
1 1r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
528
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

An MCP server backed by the Kagi API. It exposes search and extraction tools to MCP-compatible clients.

Tools

  • `kagi_search_fetch` - web, news, videos, podcasts, and image search with optional page extracts, filters, and Kagi lenses.
  • `kagi_extract` - fetch a page's full content as markdown.
Note: The previous kagi_fastgpt and kagi_summarizer tools have been removed. Both are planned to return in a future release.

Hosted Server

We run a hosted MCP server at `https://mcp.kagi.com/mcp` — no install required. Point any HTTP-capable MCP client at it and authenticate with your Kagi API key.

OAuth2 isn't supported yet (it's on our roadmap), so for now grab your API key from the dashboard and pass it via Bearer HTTP authentication.

Example with Claude Code:

claude mcp add kagi https://mcp.kagi.com/mcp --transport http --header "Authorization: Bearer $(read -sp 'API key: ' k; echo $k)" --scope user

Prefer to run it yourself? See Client Setup for the local uvx install, or Self-Hosting to host the HTTP server on your own infrastructure.

Requirements

  • A Kagi API key in KAGI_API_KEY.
  • `uv` for the recommended uvx install path.

Install uv:

curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Client Setup

Codex CLI

codex mcp add kagi --env KAGI_API_KEY= -- uvx kagimcp

Codex writes MCP configuration to ~/.codex/config.toml.

Claude Desktop

Install uv first.

MacOS/Linux:

curl -LsSf https://astral.sh/uv/install.sh | sh

Windows:

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Then in your Claude Desktop config (found through Settings ->

Read from source at commit b5ff88619e6bOBSERVED · 2026-09-30
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add kagimcp --env KAGI_API_KEY=${KAGI_API_KEY} -- uvx kagimcp
claude-desktop
{
  "mcpServers": {
    "kagimcp": {
      "command": "uvx",
      "args": [
        "kagimcp"
      ],
      "env": {
        "KAGI_API_KEY": "${KAGI_API_KEY}"
      }
    }
  }
}
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
kagi_extractreadExtract the content of a web page as markdown using the Kagi Extract API. Use this to read the full content of a page when needed.
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (4)

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:184
curl -sL http://127.0.0.1:8000/mcp -X POST \
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
README.md:21
claude mcp add kagi https://mcp.kagi.com/mcp --transport http --header "Authorization: Bearer $(read -sp 'API key: ' k; echo $k)" --scope user
Why it matters. asks the agent to read credentials
LOWSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
README.md:34
curl -LsSf https://astral.sh/uv/install.sh | sh
LOWSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
README.md:59
curl -LsSf https://astral.sh/uv/install.sh | sh

Gates applied: no_behavioural_pass.

Audited 2026-09-30 · audit v0.4.1 · source sha b5ff88619e6bfull audit observations/trust-audit/mcp-server/kagisearch__kagi.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-09-30b5ff88619e6bSAFEB89first audit
06

Questions

What is the Kagi MCP server?

The Official Model Context Protocol (MCP) server for Kagi Search & other tools.

What tools does Kagi expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Kagi safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Kagi need?

It reads KAGI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Kagi run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as kagimcp.

How current is this page?

The grade is for one exact copy of the source (b5ff88619e6b), read on 2026-09-30. The repository is watched and re-audited when it changes.

Advertisement