Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

Deep Research MCP server

by u14app/deep-researchMIT licenceAudited 21 Sep 2026 · source ecca09b0af1d

npm deep-research 0.11.1ssestreamable-http★ 4,689
✕BLOCKGrade F · 56/100 · 21 Sep 2026 · ecca09b
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (56/100). It exposes 5 tools: 3 read, 2 write and 0 destructive. The audit recorded 18 findings (1 critical, 5 high, 3 medium, 8 low). Maintainer's description: Use any LLMs (Large Language Models) for Deep Research. Support SSE API and MCP server.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Deep Research MCP server (u14app/deep-research)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/u14app/deep-research-8

Why this is BLOCK. The audit found 1 critical and 5 high findings; the most severe is Hard-coded secrets at src/utils/vertexAuth.ts:30. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

5 MCP servers are called Deep Research. You are viewing u14app/deep-research. Compare all 5 →

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score56/100✕BLOCK F
1 critical5 high3 medium8 low1 info

18 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared1 observation
  • NetworkDeclared8 observations
  • ShellNone observedNothing seen in the source
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (18)

Sorted by severity

CRITICALHard-coded secretssecret.private_key · src/utils/vertexAuth.ts:30
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
HIGHPrompt injectionprompt.zero_width · README.md:233
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// AI provider, Possible values include: google, openai, anthropic, deepseek, atlascloud, xai, mistral, azure, openrouter, openaicompatible, pollinations, ollama
Why
invisible characters in instruction text
Fix
strip non-printing characters
HIGHPrompt injectionprompt.zero_width · README.md:239
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// Search provider, Possible values include: model, tavily, firecrawl, crw, exa, bocha, searxng
Why
invisible characters in instruction text
Fix
strip non-printing characters
HIGHPrompt injectionprompt.zero_width · README.md:327
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
# Possible values include: google, openai, anthropic, deepseek, atlascloud, xai, mistral, azure, openrouter, openaicompatible, pollinations, ollama
Why
invisible characters in instruction text
Fix
strip non-printing characters
HIGHPrompt injectionprompt.zero_width · README.md:330
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
# Possible values include: model, tavily, firecrawl, crw, exa, bocha, searxng
Why
invisible characters in instruction text
Fix
strip non-printing characters
HIGHPrompt injectionprompt.zero_width · docs/deep-research-api-doc.md:39
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// AI provider, Possible values include: google, openai, anthropic, deepseek, xai, mistral, azure, openrouter, openaicompatible, pollinations, ollama
Why
invisible characters in instruction text
Fix
strip non-printing characters
MEDIUMNetwork egressnet.raw_ip · env.tpl:73
F-04 Network egressCWE-200 · CWE-319Layer L1
# (Optional) Server-side Ollama API Proxy URL. Default, `http://0.0.0.0:11434`
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · env.tpl:106
F-04 Network egressCWE-200 · CWE-319Layer L1
# (Optional) Server-side Searxng API Proxy URL. Default, `http://0.0.0.0:8080`
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · next.config.ts:33
F-04 Network egressCWE-200 · CWE-319Layer L1
process.env.OLLAMA_API_BASE_URL || "http://0.0.0.0:11434";
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .node-version
F-13 Inventory / provenanceCWE-1104Layer L0
.node-version
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWFilesystem / pathfs.traversal · src/app/api/sse/live/route.ts:10
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
} from "../../utils";
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:296
F-04 Network egressCWE-200 · CWE-319Layer L1
"url": "http://127.0.0.1:3000/api/mcp",
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:312
F-04 Network egressCWE-200 · CWE-319Layer L1
"url": "http://127.0.0.1:3000/api/mcp",
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@ai-sdk/anthropic, @ai-sdk/azure, @ai-sdk/deepseek, @ai-sdk/google, @ai-sdk/google-vertex, @ai-sdk/mistral, @ai-sdk/openai, @ai-sdk/openai-compatible
Why
85 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWPrompt injectionprompt.credential_read · README.md:257
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// If you set an access password
Why
asks the agent to read credentials
Fix
—
LOWPrompt injectionprompt.credential_read · docs/deep-research-api-doc.md:79
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// If you set an access password
Why
asks the agent to read credentials
Fix
—
LOWPrompt injectionprompt.credential_read · docs/deep-research-api-doc.md:312
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// If you set an access password
Why
asks the agent to read credentials
Fix
—
INFOInventory / provenanceinv.oversize · public/scripts/pdf.worker.min.mjs
F-13 Inventory / provenanceCWE-1104Layer L0
public/scripts/pdf.worker.min.mjs
Why
1032428 bytes not read
Fix
—

Tools it exposes

5 declared in source · 0 destructive

3 read2 write0 destructive
ToolWhat it doesRisk
write-final-reportNo description in the sourcewrite
write-research-planNo description in the sourcewrite
deep-researchNo description in the sourceread
generate-SERP-queryNo description in the sourceread
search-taskNo description in the sourceread

Safer alternatives

All web search servers →
GPT Researcher✓SAFE

assafelovic/gptr-mcp

MCP server for enabling LLM applications to perform deep research via the MCP protocol

1 writeGrade B
Deep Research Assistant✓SAFE

ssdeanx/deep-research

The Deep Research Assistant is meticulously crafted on Mastra's modular, scalable architecture, designed for intelligent orchestration and seamless human-AI interaction. It's built to tackle complex research challenges autonomously.

2 writeGrade B
Deep Research✓SAFE

pinkpixel-dev/deep-research-mcp

A Model Context Protocol (MCP) compliant server designed for comprehensive web research. It uses Tavily's Search and Crawl APIs to gather detailed information on a given topic, then structures this data in a format perfect for LLMs to create high-quality markdown documents.

1 writeGrade B

Audit history

  1. ✕BLOCK F 56 / 100

    Score 57 -> 56 · ecca09b0af1d

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Deep Research MCP server

What is the Deep Research MCP server?
Use any LLMs (Large Language Models) for Deep Research. Support SSE API and MCP server.
What tools does Deep Research expose?
5 in total: 3 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Deep Research safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (56/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Deep Research need?
It reads ACCESS_PASSWORD, ANTHROPIC_API_KEY, ATLASCLOUD_API_KEY, AZURE_API_KEY, BOCHA_API_KEY, CRW_API_KEY, DEEPSEEK_API_KEY, EXA_API_KEY, FIRECRAWL_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY, GOOGLE_PRIVATE_KEY and GOOGLE_PRIVATE_KEY_ID from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Deep Research run?
It speaks sse and streamable-http, so it runs as a service you connect to over the network. It is published on npm as deep-research at 0.11.1.
How current is this page?
The grade is for one exact copy of the source (ecca09b0af1d), read on 2026-09-21. The repository is watched and re-audited when it changes.
Which Deep Research MCP server is the right one?
pinkpixel-dev/deep-research-mcp. 5 servers share the name; see the side-by-side comparison.
I already installed Deep Research. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • u14app/deep-research on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit ecca09b0af1dObserved · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.