registry / @tadmstr/searxng-mcp / 3.15.0

@tadmstr/searxng-mcp@3.15.0

MCP server for SearXNG — private web search for Claude Code

AI Security Review

scanned 9h ago · by lpm-firewall-ai

No malicious attack surface is confirmed. The package is an MCP search/fetch server with user-invoked outbound retrieval and opt-in operator-configured integrations.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Running the searxng-mcp bin and invoking MCP search, fetch, crawl, or configured telemetry features.

Impact

Retrieves requested public web content; configured integrations may receive normal request telemetry or service calls, with no hidden exfiltration chain found.

Mechanism

MCP web search/content retrieval with optional local services, NATS, and OTLP.

Rationale

Direct source inspection shows package-aligned MCP search/fetch behavior and explicitly configured integrations, not stealthy execution or data theft. The added llms-txt module fetches allowlisted public origins through the SSRF guard and caches results.

Evidence

package.jsonbuild/src/index.jsbuild/src/config.jsbuild/src/fetch-utils.jsbuild/src/llms-txt.jsbuild/src/events.jsbuild/src/observability.jsbuild/src/domain-snapshot.js

Network endpoints8

archive.org/wayback/availableweb.archive.org/api.github.com

@tadmstr/searxng-mcp@3.15.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code