New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details
Socket
Book a DemoSign in
Socket

@zhafron/mcp-web-search

Package Overview
Dependencies
Maintainers
1
Versions
8
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@zhafron/mcp-web-search

MCP server: Multi-provider web search (DuckDuckGo, Bing, SearXNG) with automatic fallback, and URL content extraction — no API keys required.

latest
Source
npmnpm
Version
1.2.3
Version published
Weekly downloads
224
-25.08%
Maintainers
1
Weekly downloads
 
Created
Source

npm version npm downloads license

MCP server: web search and URL content extraction. No API keys required.

Features

  • search_web - Multi-provider web search with automatic fallback (DuckDuckGo, Bing, SearXNG)
  • fetch_url - Extract content from URLs with semantic truncation

Providers

ProviderAPI Key RequiredDescription
DuckDuckGoNoHTML scraping, fast and simple
BingNoPuppeteer-based search (requires Chrome)
SearXNGNoSelf-hosted meta-search, unlimited usage

Requirements

  • Node.js 18+
  • Chrome/Chromium (for Bing provider)

MCP Configuration

Claude Code

{
  "mcpServers": {
    "web-search": {
      "command": "npx",
      "args": ["-y", "@zhafron/mcp-web-search"]
    }
  }
}

OpenCode

{
  "mcp": {
    "web-search": {
      "type": "local",
      "command": ["npx", "@zhafron/mcp-web-search"]
    }
  }
}

With Custom Configuration

{
  "mcpServers": {
    "web-search": {
      "command": "npx",
      "args": ["-y", "@zhafron/mcp-web-search"],
      "env": {
        "DEFAULT_SEARCH_PROVIDER": "duckduckgo",
        "SEARXNG_URL": "http://localhost:8099"
      }
    }
  }
}

Environment Variables

VariableDefaultDescription
DEFAULT_SEARCH_PROVIDERduckduckgoDefault search provider (duckduckgo, bing, searxng)
SEARXNG_URLhttp://localhost:8099SearXNG instance URL
HTTP_TIMEOUT15000Request timeout (ms)
MCP_COMPAT_MODEunsetSet to legacy to simplify tools/list schemas for MCP clients with weak discovery parsers

Legacy Discovery Compatibility

If your MCP client fails during discovery on array-valued JSON Schema nodes such as enum or required, set:

export MCP_COMPAT_MODE=legacy

This keeps tool execution unchanged, but advertises a simplified tools/list schema that removes array-valued schema nodes from tool metadata.

Anti-Bot Detection

This package uses realistic, rotating user agents to minimize bot detection:

  • Random user agents from real browsers (Chrome, Firefox, Safari, Edge)
  • Always up-to-date browser versions
  • Desktop device category for consistency
  • Different user agent per request

Chrome Setup (for Bing Provider)

OSCommand
Ubuntu/Debiansudo apt install chromium-browser
Fedorasudo dnf install chromium
Archsudo pacman -S chromium
macOSbrew install --cask google-chrome

Custom path: export CHROME_PATH=/path/to/chrome

Tools

search_web

Input: { q: string, limit?: number, lang?: string, provider?: "duckduckgo"|"bing"|"searxng" }

Output: { items: Array<{ title, url, snippet?, source }>, providerUsed, fallbackUsed, triedProviders }

Automatic Fallback:

  • If default provider fails, automatically tries other providers
  • Fallback order: DuckDuckGo → SearXNG → Bing (or vice versa based on default)

fetch_url

Input: { url: string, mode?: "compact"|"standard"|"full", max_length?: number, format?: "markdown"|"text"|"html" }

ModeCharactersTokens
compact~3000~750
standard~8000~2000
fullunlimited-

Output: { markdown?, text?, format, url, title?, truncated?, original_length? }

SearXNG Setup

SearXNG is a free, self-hosted meta-search engine. Quick setup with Docker:

mkdir -p ~/docker/searxng && echo 'use_default_settings: true
search:
  safe_search: 0
  formats:
    - html
    - json
server:
  secret_key: "your_secret_key_here"
  limiter: false
  image_proxy: true
outgoing:
  request_timeout: 10.0
  max_request_timeout: 15.0' > ~/docker/searxng/settings.yml && docker run -d --name searxng -p 8099:8080 -v ~/docker/searxng/settings.yml:/etc/searxng/settings.yml:ro searxng/searxng:latest

SSRF Protection

Blocks localhost, 127.0.0.1, ::1, .local domains.

Troubleshooting

IssueSolution
Chrome not foundInstall Chrome or set CHROME_PATH
SearXNG 403Enable JSON API in settings.yml
TimeoutIncrease HTTP_TIMEOUT
MCP discovery error: 'list' object has no attribute 'get'Set MCP_COMPAT_MODE=legacy to enable simplified discovery schemas

License

MIT

Keywords

mcp

FAQs

Package last updated on 11 Mar 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts