Agent SearchBLOCK
Free-first Chinese and English web search MCP using zero-key sources and inspectable evidence.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Node.js MCP server and CLI for English and Chinese web search.
Agent Search MCP starts without an API key. It returns compact multi-source evidence, records provider failures, and bounds work with request and evidence budgets. Paid providers run only when policy and credentials allow.
[](https://www.npmjs.com/package/agent-search-mcp) [](https://www.npmjs.com/package/agent-search-mcp) [](https://github.com/lennney/agent-search-mcp/stargazers) [](https://github.com/lennney/agent-search-mcp/actions) [](LICENSE) [](https://glama.ai/mcp/servers/lennney/agent-search-mcp)
中文文档 · Product page · Benchmarks · Architecture · CHANGELOG
Install
npx -y agent-search-mcp
Requires Node.js >= 18.17. The default runtime does not require a browser, database, Python, or a search API account.
Connect an MCP client
Use this stdio configuration in MCP clients that accept mcpServers JSON, including Claude Desktop, Cursor, VS Code, and Windsurf:
{
"mcpServers": {
"agent-search": {
"command": "npx",
"args": ["-y", "agent-search-mcp"]
}
}
}Claude Code and Codex can register the same npx -y agent-search-mcp stdio command through their MCP settings.
Add the optional Agent Skill
After connecting the MCP server, Agent Skills-compatible clients can install the repository-owned routing guide
580c72dbdf01OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agent-search-mcp --env BRAVE_API_KEY=${BRAVE_API_KEY} --env TAVILY_API_KEY=${TAVILY_API_KEY} --env EXA_API_KEY=${EXA_API_KEY} --env YDC_API_KEY=${YDC_API_KEY} -- npx -y [email protected]Exposed tools (9)
9 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
fetch_csdn_article | read | |
fetch_github_readme | read | |
fetch_juejin_article | read | |
free_extract | read | |
free_search | read | |
free_search_advanced | read | |
routed_echo | read | |
search_quality_judgment | read | Pointwise relevance and citation-support judgment. |
search_with_synthesis | read |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (9 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (21)
'169.254.169.254', // AWS metadata
'metadata.google.internal', // GCP metadata
/exfiltrate|leak\s+(the|this|all)\s+(data|info)/i,
# - PROXY_URL=http://127.0.0.1:7890
console.log(`Token savings vs Normal (${tokenCounter}):`);new URL('../../docs/contracts/provider-families-v1.json', import.meta.url),const moduleUrl = new URL('../../../dist/tools/free-search.js', import.meta.url);const stableEntry = resolve(process.cwd(), '../../dist/index.js');
const PROJECT_ROOT = resolve(__dirname, '../../..');
opts.cmd = `node ${resolve(__dirname, '../../../dist/index.js')}`;it('should detect data exfiltration attempt', () => {- URL: http://169.254.169.254/latest/meta-data/ (AWS metadata)
['http://169.254.169.254/latest/meta-data/', 'AWS metadata'],
['http://metadata.google.internal/', 'GCP metadata'],
- URL: http://127.0.0.1:3000
- URL: http://169.254.169.254/latest/meta-data/ (AWS metadata)
- URL: https://10.0.0.1/admin
The default endpoint is `http://127.0.0.1:3100/mcp`. For a non-loopback
@modelcontextprotocol/sdk, pino, undici, yaml, zod, @eslint/js, @types/node, eslint
- `provider-catalog.ts` 拥有静态事实,并派生 ID、metadata、access group、credential、
- registry parity、9/7 access 分组、三段 waterfall、family JSON、credential、routing 和
Gates applied: no_behavioural_pass.
580c72dbdf01full audit observations/trust-audit/mcp-server/lennney__agent-search.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 580c72dbdf01 | BLOCK | D | 69 | first audit |
Questions
What is the Agent Search MCP server?
Free-first Chinese and English web search MCP using zero-key sources and inspectable evidence.
What tools does Agent Search expose?
9 in total: 9 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Agent Search safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Agent Search need?
It reads BOCHA_API_KEY, BRAVE_API_KEY, EXA_API_KEY, HTTP_ALLOW_UNAUTHENTICATED, HTTP_AUTH_TOKEN, LLM_JUDGE_API_KEY, OPENAI_API_KEY, OPENCODE_API_KEY, SERPER_API_KEY, TAVILY_API_KEY, TENCENT_WSA_API_KEY and YDC_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Agent Search run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as agent-search-mcp at 3.2.1.
How current is this page?
The grade is for one exact copy of the source (580c72dbdf01), read on 2026-10-07. The repository is watched and re-audited when it changes.