by lennney
Free-first web search MCP with zero-key English and Chinese sources and compact evidence.
# Add to your Claude Code skills
git clone https://github.com/lennney/agent-search-mcpGuides for using ai agents skills like agent-search-mcp.
Last scanned: 8/11/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
"severity": "high"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild allows arbitrary file read when running the development server on Windows",
"severity": "low"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to host confusion via backslash authority introducer",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass",
"severity": "high"
},
{
"type": "npm-audit",
"message": "nanoid: nanoid: non-secure generators can loop indefinitely with negative size",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-08-11T05:06:50.526Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}agent-search-mcp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by lennney. Free-first web search MCP with zero-key English and Chinese sources and compact evidence. It has 101 GitHub stars.
agent-search-mcp returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/lennney/agent-search-mcp" and add it to your Claude Code skills directory (see the Installation section above).
agent-search-mcp is primarily written in TypeScript. It is open-source under lennney on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh agent-search-mcp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
A lightweight, free-first MCP web search router with compact multi-source evidence.
Agent Search MCP is an open-source, self-hosted MCP server and CLI. It gives AI agents a free Tavily alternative or a local search path. The default path starts without an API key and searches English and Chinese sources. Request policy keeps optional paid providers explicit. Shared budgets cap provider calls, search time, admitted results, and evidence size.
中文文档 · Product page · Benchmarks · Architecture · CHANGELOG
npx -y agent-search-mcp
Requires Node.js >= 18.17. The default runtime does not require a browser, database, Python, or a search API account.
Use this stdio configuration in MCP clients that accept mcpServers JSON,
including Claude Desktop, Cursor, VS Code, and Windsurf:
{
"mcpServers": {
"agent-search": {
"command": "npx",
"args": ["-y", "agent-search-mcp"]
}
}
}
Claude Code and Codex can register the same npx -y agent-search-mcp stdio
command through their MCP settings.
After connecting the MCP server, Agent Skills-compatible clients can install the repository-owned routing guide:
npx skills add lennney/agent-search-mcp --skill agent-search
Invoke it with a request such as Use $agent-search to verify this claim with official sources. The Agent Search Skill
chooses one of four bounded paths: quick discovery, stricter verification,
Chinese-source search, or extraction of a selected URL. It checks that the
needed MCP tool exists and asks before any install or configuration change.
Installing the Skill does not start or configure the MCP server.
After building the local package, run a CLI query without adding a provider key:
npm run build
fasm search "MCP server without an API key" --json
The response contract keeps result evidence, meta.execution, and
partialFailures separate. A provider timeout or challenge remains visible to
the agent instead of being converted into an unexplained empty result. This is
a contract example, not a live availability or search-quality benchmark.
After a global install, check the local runtime without making a search request:
npm install -g agent-search-mcp
fasm doctor
| Need | Product behavior |
|---|---|
| Free web search | Zero-key sources work without an API account |
| Provider cost control | Paid providers run only under an explicit routing policy |
| Token cost control | Compact output and one evidence budget bound response size |
| Multi-source evidence | Results retain provenance, relevance, provider-family count, and partial failures |
| Chinese web search | Sogou and Baidu handle Chinese queries without a translation layer |
| Lightweight self-hosting | Pure Node.js runtime with stdio, Streamable HTTP, and CLI access |
| Plain multi-engine aggregation | Agent Search MCP |
|---|---|
| Returns N deduplicated results | Returns results plus the number of independent sources (provider families, not adapter names) |
| A provider failure quietly drops some results | Every failure stays in partialFailures (timeout, rate limit, challenge, permission, budget) |
| Stops when the result count looks sufficient | Stops only after a quality gate (count, relevance, confidence, source coverage) and returns the stop_reason |
| Fixed-size output | One shared evidence budget bounds response tokens; compact text keeps provenance |
| One adapter counts as one source | The same upstream through several adapters never inflates source_count |
The one-minute offline demo replays these differences through the production evidence scorer and formatter:
Each JSON response includes one Search Evidence Packet. It answers the routing questions an agent needs before it uses a result:
| Question | Response field |
|---|---|
| Which adapters ran? | meta.execution.searched_engines |
| Why did the router stop? | meta.execution.stop_reason and meta.execution.quality_gate |
| Did the request hit a work limit? | meta.execution.budget |
| Was evidence truncated? | meta.evidence_budget |
| Did an upstream provider fail? | partialFailures |
| Do multiple adapters represent independent sources? | results[].source_count counts provider families, not adapter names |
Run the one-minute offline contract demo:
npm run demo:evidence
npm run demo:evidence -- --json
It replays three synthetic scenarios through the production evidence scorer, formatter, and MCP output helper: same-family adapter overlap, visible fallback failure, and a bounded quality-gate stop. It makes no live availability or search-quality claim and performs no network request.
The default free_first policy never spends a configured API credential.
free_only blocks paid providers. quality_escalation can call one configured
paid provider after free evidence misses the quality gate, while paid_first
tries that provider before the free fallback.
Request budgets cap adapter attempts, elapsed time, and admitted results. The evidence budget caps query-relevant passages across the complete response. Compact mode keeps full detail for the first results and reduces later entries to source-preserving references.
The checked-in bilingual fixture measures formatting with a locked tokenizer:
| Output | Average tokens per query | Savings vs normal |
|---|---|---|
| Normal | 2311.0 | |
| Compact | 1655.8 | 28.4% |
| Compact+ | 1607.5 | 30.4% |
This fixture verifies output formatting and evidence-packet behavior. It does not measure live engine availability or search quality. See the benchmark method and limitations.
flowchart LR
A["AI agent"] --> M["MCP search tools"]
M --> P["Provider and request policy"]
P --> F["Zero-key sources"]
P --> O["Optional paid provider"]
F --> E["Deduplicate, rank, and preserve failures"]
O --> E
E --> B["Evidence and token budget"]
B --> R["Compact multi-source result"]
The router evaluates each search batch against separate result, relevance,
confidence, and provider-family gates. It stops after the evidence passes those
gates and exposes the decision in meta.execution. Provider failures stay
visible in partialFailures, so an empty result cannot hide an upstream error.
The competitive landscape (2026-08-07) maps the crowded baseline and the product gaps. It records source dates and fixed commits for facts that can change. The 2026-08-10 update adds competitor activity since then: direct local competitors are dormant, and token-efficient evidence is becoming an industry-explicit lever. The earlier source-level product comparison contains the architecture-specific evidence.
The runtime registers 16 adapters: 9 zero-key adapters and 7 optional API adapters.
| Engine | Access | Languages | Role |
|---|---|---|---|
| DuckDuckGo | Zero-key | en | General Web Search |
| Sogou Search | Zero-key | zh | Chinese Web Search |
| Bing | Zero-key | en, zh | Multilingual Web Search |
| Baidu | Zero-key | zh | Chinese Web Search |
| Wikipedia | Zero-key | en, zh, ja, de, fr, es, auto | Encyclopedic references |
| Startpage | Zero-key | en, auto | Privacy-oriented Web Search |
| Yandex | Zero-key | ru, en, auto | Russian and international Web Search |
| Mojeek | Zero-key | en, auto | Independent privacy-oriented index |
| Wiby | Zero-key | en | Independent small-Web index |
| Brave Search | BRAVE_API_KEY |
en, zh | Optional commercial Web Search |
| Tavily Search | TAVILY_API_KEY |
en, zh | Optional agent-oriented Search |
| Exa Search | EXA_API_KEY |
en, zh | Optional neural Search |
| You.com Search | YDC_API_KEY |
en, zh | Optional commercial Web Search |
| Tencent Web Search API | TENCENT_WSA_API_KEY |
zh | Optional official Chinese Web Search |
| Bocha Web Search | BOCHA_API_KEY |
zh, en | Optional Chinese-first AI Search |
| Serper Google Search | SERPER_API_KEY |
en, zh, auto | Optional Google SERP Search |
| Tool | Description | Best for |
|---|---|---|
free_search |
Multi-engine Web Search with bounded fallback | Quick facts and general discovery |
free_search_advanced |
Filtered waterfall search and optional enrichment | Domain policy and progressive verification |
free_extract |
Extract a URL as clean Markdown | Reading complete source pages |
fetch_github_readme |
Fetch a public GitHub repository README | Project documentation |
fetch_csdn_article |
Fetch |