anysearch-cliBLOCK
Vertical-domain information-specialist agent CLI — search + research + memory + knowledge with domain allowlists, abstain-first answers, and a fail-open MCP server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English | 简体中文
This document is canonical; README.zh-CN.md is the derived translation.
[](https://www.npmjs.com/package/@anysearch-cli/cli) [](https://github.com/Xxx91n/anysearch-cli/actions/workflows/ci.yml) [](LICENSE)
A vertical-domain information-specialist CLI: search + research + memory + knowledge in one agent — FTS5 recall, multi-source RRF fusion, an MCP server that auto-indexes results, and a domain allowlist that actually gates what comes back.
Status: published on npm — npm i -g @anysearch-cli/cli (npm OIDC trusted publishing with sigstore provenance since 0.0.4; 0.0.1/0.0.2 were revoked over a workspace:* peer escape — see CHANGELOG).
What a gated search looks like — every returned URL sits inside the domain's urlAllowlist; an empty gated result is a first-class abstain:
$ ANS_DOMAIN=docs ans search "model context protocol" 1. [tavily] What is the Model Context Protocol (MCP)? - Model Context Protocol modelcontextprotocol.io/ 2. [exa] modelcontextprotocol.io/specification/2026-07-28/basic 3. [exa] modelcontextprotocol.io/specification/2026%2D07%2D28 ... # when the gate leaves zero results — a first-class abstain, not an error: abstain: no results within allowed cold domain(s) (pre-filtered 0, post-filtered 0, gate pre)
Requirements
- Node.js >= 22 (Node 24 verified)
- pnpm 11.24.0 exactly (pinned; corepack reads
packageManagerautomatically) - At least one provider API key for real searches:
EXA_API_KEY— Exa (supports domain filtering)TAVILY_API_KEY— Tavi
c6ad5081db21OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add store --env ANS_LLM_API_KEY=${ANS_LLM_API_KEY} --env ANS_MCP_KEY=${ANS_MCP_KEY} --env ANS_SERVER_TOKEN=${ANS_SERVER_TOKEN} --env ANYSEARCH_API_KEY=${ANYSEARCH_API_KEY} -- npx -y @anysearch-cli/[email protected]{
"mcpServers": {
"store": {
"command": "npx",
"args": [
"-y",
"@anysearch-cli/[email protected]"
],
"env": {
"ANS_LLM_API_KEY": "${ANS_LLM_API_KEY}",
"ANS_MCP_KEY": "${ANS_MCP_KEY}",
"ANS_SERVER_TOKEN": "${ANS_SERVER_TOKEN}",
"ANYSEARCH_API_KEY": "${ANYSEARCH_API_KEY}"
}
}
}
}Exposed tools (8)
7 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ans_chat | read | |
bash | write | run shell |
fetch | read | fetch url |
query_knowledge | read | |
recall_memory | read | |
research_web | read | |
search | read | search query |
search_web | read |
Trust audit
BLOCKgrade F · trust 34/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
{ op: "adjudicate", stage: "adjudicate", items: [km("https://ex.com/leak3", "certdump pasted material", "certdump pasted material -----BEGIN RSA PRIVATE KEY----- inline", 0, "certdump", "user")], expe{ op: "seed", stage: "store", items: [km("https://ex.com/sb3", "stealthxc seed row", 'stealthxc embeds -----begin rsa private key----- lowercase', 0.9, "stealthx-c")] },- Anthropic prompt injection defenses and jailbreak mitigation - anthropic.com/research + platform.claude.com
anysearch-cli-embedding-0.0.3.tgz
anysearch-cli-plugin-0.0.3.tgz
anysearch-cli-plugin-0.0.3.tgz
anysearch-cli-embedding-0.0.4.tgz
anysearch-cli-plugin-0.0.4.tgz
[anysearch] Plugin server listening on http://127.0.0.1:33333
- 三果谓词:reaffirm=|ΔarmHostHit|≳0.4 实测为负∧标的实存(垂域三 ADR 在案)∧存在≥1 可控复活条件(原判据废止留理由);revise=判据不等价/欠上游契约可测面∧存在可归因且近程修复路径(活查 cn_code/dsh 版本轴有实质变化迹象——没有=空转);retire=标的实存性弱(论证面塌陷或被 supersede)∨复活仅剩不可控外部信号
- 复活条件集(可控性分类,每条须挂 owner 或可机检信号,皆无则删):1dsh stable 晋升=半可控可机检 2上游补垂域参数词表=纯外部标 retire 侧(单独不足立案需叠加45)3cn_code 契约补齐=半可控有 owner=revise 主锚 4新评测矩阵修订版读数=唯一纯可控锚=reaffirm 主锚 5|ΔarmHostHit| 显著转正并入4(手段 vs 读数)6判据等价
- 新事实归档:|ΔarmHostHit| 两读数序列(R85 indeterminate-instrument-down / R86 direction-negative P=0.0378 净 −0.125 装置洁净)/重开条件出处=ADR-0087 D4(已知负读数下立的未来反转门槛)/atomcode 混淆修正(armHostHit 尺活——delta runner 实测;死的是 L3b s
- **|ΔarmHostHit| 序列两读数**:R85(ADR-0086)indeterminate—instrument down(anysearch 臂 41/41 格 providersFailed,env 双重缺陷);R86(ADR-0087)同指纹 57 格 paired 40/41 装置失败 ∅→matrix@2 终读 **direction-negative(P=0.0378、净
- **重开条件出处**:ADR-0087 D4——R86 负读数后 registry prefer-capable 条目才附「|ΔarmHostHit|≳0.4」具名重开条件(已知负读数下立的未来反转门槛,非未测项)。
assert.equal(containsSecret("-----BEGIN RSA PRIVATE KEY-----"), true, "PEM upper");assert.equal(containsSecret("-----begin ec private key-----"), true, "PEM lower (i flag)");t1-c2-red.md
name: memory-eval (golden, path-filtered ADR-0029 D5)
- name: memory eval (golden gate, ADR-0027/0028)
return createHash("sha1").update(value).digest("hex").slice(0, 16);return createHash("sha1").update(canon).digest("hex").slice(0, 16);return createHash("sha1").update(value).digest("hex").slice(0, 16);{ op: "adjudicate", stage: "adjudicate", items: [km("https://ex.com/rc4", "relcycle version four", "relcycle is version four", 0.9, "relcycle")], expect: ["supersede"] },export const JUDGE_RUBRIC_HASH = createHash("sha1").update(RUBRIC).digest("hex").slice(0, 12);assert.equal(detectSurfacedSkips("/etc/foo multi-seg").length, 0);Gates applied: critical_finding, instruction_override, no_behavioural_pass.
c6ad5081db21full audit observations/trust-audit/mcp-server/xxx91n__anysearch-cli.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | c6ad5081db21 | BLOCK | F | 34 | first audit |
Questions
What is the anysearch-cli MCP server?
Vertical-domain information-specialist agent CLI — search + research + memory + knowledge with domain allowlists, abstain-first answers, and a fail-open MCP server
What tools does anysearch-cli expose?
8 in total: 7 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is anysearch-cli safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (34/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does anysearch-cli need?
It reads ANS_LLM_API_KEY, ANS_MCP_KEY, ANS_SERVER_TOKEN, ANYSEARCH_API_KEY, DEEPSEEK_API_KEY, EXA_API_KEY, JUDGE_API_KEY, PROBE_KEY and TAVILY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does anysearch-cli run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @anysearch-cli/store at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (c6ad5081db21), read on 2026-10-11. The repository is watched and re-audited when it changes.