Deep ResearchSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This repo is an experiment on agent coding. 95% of the code is written by LLM's
Open Deep Research MCP Server
An AI-powered research assistant that performs deep, iterative research on any topic. It combines search engines, web scraping, and AI to explore topics in depth and generate comprehensive reports. Available as a Model Context Protocol (MCP) tool or standalone CLI. Look at exampleout.md to see what a report might look like.
Quick Start
- Clone and install:
git clone https://github.com/Ozamatash/deep-research cd deep-research npm install
- Set up environment in
.env.local:
# Copy the example environment file cp .env.example .env.local
- Build:
# Build the server npm run build
- Run the cli version:
npm run start
- Test MCP Server with Claude Desktop:
Follow the guide thats at the bottom of server quickstart to add the server to Claude Desktop: https://modelcontextprotocol.io/quickstart/server
For remote servers: Streamable HTTP
npm run start:http
Server runs on http://localhost:3000/mcp without session management.
Features
- Performs deep, iterative research by generating targeted search queries
- Controls research scope with depth (how deep) and breadth (how wide) parameters
- Evaluates source reliability with detailed scoring (0-1) and reasoning
- Prioritizes high-reliability sources (≥0.7) and verifies less reliable information
- Generates follow-up questions to better understand research needs
- Produces detailed markdown reports with findings, sources, and reliability assessments
- Available as a Model Context Protocol (MCP) tool for AI agents
- For now MCP version doesn't ask follow up questions
- Natural-language source preferences (avoid listicles, forums, affiliate reviews, specific domains)
Model Selection (OpenAI, Anthropic, Google, xAI)
Pick a provider and model per run.
- CLI: you will be prompted for provider and model. Example: `
cacc25000826OBSERVED · 2026-10-03Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add open-deep-research --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GOOGLE_API_KEY=${GOOGLE_API_KEY} --env LANGFUSE_PUBLIC_KEY=${LANGFUSE_PUBLIC_KEY} --env LANGFUSE_SECRET_KEY=${LANGFUSE_SECRET_KEY} -- npx -y [email protected]{
"mcpServers": {
"open-deep-research": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"GOOGLE_API_KEY": "${GOOGLE_API_KEY}",
"LANGFUSE_PUBLIC_KEY": "${LANGFUSE_PUBLIC_KEY}",
"LANGFUSE_SECRET_KEY": "${LANGFUSE_SECRET_KEY}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
deep-research | read | Perform deep research on a topic using AI-powered web search |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (3)
console.log(`Token budget reached (${budget.usedTokens}/${budget.tokenBudget}). Generating final report...`);.prettierignore
@ai-sdk/anthropic, @ai-sdk/google, @ai-sdk/openai, @ai-sdk/xai, @mendable/firecrawl-js, @modelcontextprotocol/sdk, ai, dotenv
Gates applied: no_behavioural_pass.
cacc25000826full audit observations/trust-audit/mcp-server/ozamatash__deep-research-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-03 | cacc25000826 | SAFE | B | 89 | first audit |
Questions
What tools does Deep Research expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Deep Research safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Deep Research need?
It reads ANTHROPIC_API_KEY, GOOGLE_API_KEY, LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Deep Research run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as open-deep-research at 0.0.1.
How current is this page?
The grade is for one exact copy of the source (cacc25000826), read on 2026-10-03. The repository is watched and re-audited when it changes.