Atlas / MCP servers / yatotm / Tavily Load Balancer

Tavily Load BalancerCAUTION

Name: Tavily Load Balancer
Author: yatotm

mcp/yatotm/tavily-load-balancer

MCP server by yatotm · Audited 2026-10-07

⚑ Report / re-scan Source ↗

Load-balanced Tavily MCP server with API key pool management

Verdict

CAUTION

Grade

Trust score

89 /100

Exposed tools

3 3r · 0w · 0d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://hub.docker.com/r/yatotm1994/tavily-mcp-loadbalancer) [](https://hub.docker.com/r/yatotm1994/tavily-mcp-loadbalancer) [](https://opensource.org/licenses/MIT)

Language / 语言: English | 中文

一个支持多 API 密钥负载均衡的 Tavily MCP 服务器,提供 SSE 和 streamableHTTP 接口,自动轮询多个 API 密钥以实现高可用性。

更新日志

v3.1.0 (2026-07-24)

低频配额队列:所有 /usage 请求统一排队、去重并遵守 Tavily 独立限流
双同步入口:支持同步过期 Key 和后台同步全部 Key
异步 Key 测试:勾选测试进入高优先级队列,成功后同时更新额度
额度显示修复:免费账户正确同步 1000 上限,未知额度不再显示为无限

v3.0.0 (2025-01-06)

官方 MCP 对齐:完整适配 tavily-mcp v0.2.12 工具参数与行为
智能错误处理:精细区分配额耗尽、速率限制与网络问题
持久化存储:SQLite 存储 API Key、配额与请求日志
Web 管理后台:可视化管理 Key、统计、日志与设置
自动配额刷新:UTC 自然月自动更新配额状态

v2.2.0 (2025-08-15)

多架构镜像:linux/amd64 与 linux/arm64

v2.1.0 (2025-08-14)

streamableHTTP 支持:HTTP POST /mcp 端点
多协议兼容:SSE + streamableHTTP

v2.0.0 (2025-08-12)

架构重构:原生 SSE 实现
工具更新:新增 tavily-crawl 和 tavily-map
安全改进:响应数据清理和字符编码处理

v1.0.0 (2025-08-05)

初始版本:多 API 密钥负载均衡

功能特性

智能负载均衡 — 轮询 + 权重调度,多 Key 高可用
错误分级处理 — 速率限制 / 配额耗尽 / 鉴权错误精确识别
多协议支持 — MCP stdio / SSE / streamableHTTP 全覆盖
数据持久化 — SQLite 存储 Key、配额与日志
Web 管理后台 — Dashboard、Key 管理、统计、日志、设置
实时更新 — WebSocket 推送统计刷新
数据安全 — Key 加密存储 + 脱敏展示

快速开始

Docker 部署(推荐)

docker run -d \
--name tavily-mcp-lb \
-p 60002:60002 \
-e DATABASE_ENCRYPTION_KEY="your-32-byte-random-key" \
-e ADMIN_PASSWORD="optional-admin-password" \
-e TAVILY_API_KEYS="your-key1,your-key2,your-key3" \
yatotm1994/tavily-mcp-loadbalancer:latest

镜像支持 amd64 / arm64,Docker 会自动匹配本机架构。

本地开发

Read from source at commit fcdd1dfa3ba5OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add tavily-web-ui --env ADMIN_PASSWORD=${ADMIN_PASSWORD} --env DATABASE_ENCRYPTION_KEY=${DATABASE_ENCRYPTION_KEY} --env MAX_KEY_ERRORS=${MAX_KEY_ERRORS} --env TAVILY_API_KEY=${TAVILY_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "tavily-web-ui": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ADMIN_PASSWORD": "${ADMIN_PASSWORD}",
        "DATABASE_ENCRYPTION_KEY": "${DATABASE_ENCRYPTION_KEY}",
        "MAX_KEY_ERRORS": "${MAX_KEY_ERRORS}",
        "TAVILY_API_KEY": "${TAVILY_API_KEY}"
      }
    }
  }
}

Exposed tools (3)

3 read · 0 write · 0 destructive.

Tool	Risk	Description
`tavily-crawl`	read	A powerful web crawler that initiates a structured web crawl starting from a specified base URL. The crawler expands from that point like a graph, following internal links across pages. You can control how deep and wide it goes, and guide it to focus on specific sections of the site.
`tavily-extract`	read	A powerful web content extraction tool that retrieves and processes raw content from specified URLs, ideal for data collection, content analysis, and research tasks.
`tavily-map`	read	A powerful web mapping tool that creates a structured map of website URLs, allowing you to discover and analyze site structure, content organization, and navigation paths. Perfect for site audits, content discovery, and understanding website architecture.

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (5 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (8)

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

<listing:description>:1

Manages and load-balances multiple Tavily API keys to enhance availability and increase request throughput for Tavily services.

Why it matters. asks the agent to read credentials