Deep ResearchSAFE
A Model Context Protocol (MCP) compliant server designed for comprehensive web research. It uses Tavily's Search and Crawl APIs to gather detailed information on a given topic, then structures this data in a format perfect for LLMs to create high-quality markdown documents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Deep Research MCP Server
The Deep Research MCP Server is a Model Context Protocol (MCP) compliant server designed to perform comprehensive web research. It leverages Tavily's powerful Search and new Crawl APIs to gather extensive, up-to-date information on a given topic. The server then aggregates this data along with documentation generation instructions into a structured JSON output, perfectly tailored for Large Language Models (LLMs) to create detailed and high-quality markdown documents.
Features
- Multi-Step Research: Combines Tavily's AI-powered web search with deep content crawling for thorough information gathering.
- Structured JSON Output: Provides well-organized data (original query, search summary, detailed findings per source, and documentation instructions) optimized for LLM consumption.
- Configurable Documentation Prompt: Includes a comprehensive default prompt for generating high-quality technical documentation. This prompt can be:
- Overridden by setting the
DOCUMENTATION_PROMPTenvironment variable. - Further overridden by passing a
documentation_promptargument directly to the tool. - Configurable Output Path: Specify where research documents and images should be saved through:
- Environment variable configuration
- JSON configuration
- Direct parameter in tool calls
- Granular Control: Offers a wi
d908b1067ad3OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add deep-research-mcp --env TAVILY_API_KEY=${TAVILY_API_KEY} -- npx -y @pinkpixel/[email protected]{
"mcpServers": {
"deep-research-mcp": {
"command": "npx",
"args": [
"-y",
"@pinkpixel/[email protected]"
],
"env": {
"TAVILY_API_KEY": "${TAVILY_API_KEY}"
}
}
}
}Exposed tools (1)
0 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
write-research-file | write | Write research content to a file. This tool allows you to save research findings, documentation, or any text content to a specified file path. SECURITY: File writing is controlled by environment variables: - FILE_WRITE_ENABLED must be set to |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, @tavily/core, dotenv, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, nodemon
Gates applied: no_behavioural_pass.
d908b1067ad3full audit observations/trust-audit/mcp-server/pinkpixel-dev__deep-research-6.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | d908b1067ad3 | SAFE | B | 89 | first audit |
Questions
What is the Deep Research MCP server?
A Model Context Protocol (MCP) compliant server designed for comprehensive web research. It uses Tavily's Search and Crawl APIs to gather detailed information on a given topic, then structures this data in a format perfect for LLMs to create high-quality markdown documents.
What tools does Deep Research expose?
1 in total: 0 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Deep Research safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Deep Research need?
It reads TAVILY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Deep Research run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @pinkpixel/deep-research-mcp at 1.3.3.
How current is this page?
The grade is for one exact copy of the source (d908b1067ad3), read on 2026-10-08. The repository is watched and re-audited when it changes.