Is mcp-searxng@2.10.1 safe to install?

mcp-searxng@2.10.1

CAUTION

Publisher claims: "MCP server for SearXNG integration" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher ihor-sokoliuk · publishing for 579 daysInstalls 59,402Last detonated 3d ago

What would fix this Watch Dispute verdict

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

It will ask for: AUTH_PASSWORDAUTH_USERNAMEMCP_HTTP_AUTH_MODEMCP_HTTP_AUTH_TOKENMCP_HTTP_OAUTH_SCOPESConfiguration, not credentials: CACHE_MAX_ENTRIES, CACHE_TTL_MS, FETCH_TIMEOUT_MS, MCP_HTTP_ALLOW_PRIVATE_URLS, MCP_HTTP_ALLOWED_HOSTS, MCP_HTTP_ALLOWED_ORIGINS, MCP_HTTP_EXPOSE_FULL_CONFIG, MCP_HTTP_HARDEN, MCP_HTTP_HOST, MCP_HTTP_PORT, MCP_HTTP_SESSION_IDLE_TTL_MS, MCP_HTTP_SESSION_REQUEST_TIMEOUT_MS, MCP_HTTP_STATELESS, MCP_HTTP_TRUST_PROXY, NODE_EXTRA_CA_CERTS, SEARCH_CACHE_MAX_ENTRIES, SEARCH_CACHE_TTL_MS, SEARCH_HTTP_PROXY, SEARCH_HTTPS_PROXY, SEARCH_USER_AGENT, SEARXNG_DEFAULT_LANGUAGE, SEARXNG_DEFAULT_RESPONSE_FORMAT, SEARXNG_DEFAULT_SAFESEARCH, SEARXNG_FANOUT, SEARXNG_HEALTHCHECK_TIMEOUT_MS, SEARXNG_HTML_FALLBACK, SEARXNG_LITE_TOOLS, SEARXNG_MAX_RESPONSE_BYTES, SEARXNG_MAX_RESULT_CHARS, SEARXNG_MAX_RESULTS, SEARXNG_STARTUP_HEALTHCHECK, SEARXNG_TIMEOUT_MS, SEARXNG_URL, URL_READ_MAX_CHARS, URL_READ_MAX_CONTENT_LENGTH_BYTES
Where it talks to: no vendor host named in the code
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for AUTH_PASSWORD, AUTH_USERNAME, MCP_HTTP_AUTH_MODE, MCP_HTTP_AUTH_TOKEN, MCP_HTTP_OAUTH_SCOPES and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --net declared -- npx -y mcp-searxng

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-11 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Privileged sudo command; Collapsed <details> block carrying instructions. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 32 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

12sprocessdependency install exit 0

32sclaimed4 tools: searxng_web_search, searxng_search_suggestions, searxng_instance_info, web_url_read

32sprocessscript backend runs setup only

32sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathspackage.json:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"test:e2e": "node --env-file-if-exists=.env.e2e --import tsx __tests__/e2e/run-e2e.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Privileged sudo commanddist/error-handler.js:43 · Privileged sudo command — agent may execute with elevated privilegesreturn 'Run: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/ca.crt';Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Collapsed <details> block carrying instructionsREADME.md:79 · Collapsed <details> block carrying instructions

<summary>Capability comparison recorded on 2026-07-29</summary> As of 2026-07-29, the capability comparison below reflects the official [Brave MCP](https://gith

Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

HIGH

URL with embedded credentialsdist/proxy.js:299 · URL with embedded credentials — may be phishing or credential leaking"Please provide a valid URL (e.g., http://proxy:8080 or http://user:pass@proxy:8080)");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)dist/url-reader.js:447 · MCP server using network transport (SSE/HTTP) — data sent over networklogMessage(mcpServer, "info", `Processed cached URL: ${url} (${result.length} chars in ${duration}ms)`);Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

HIGH

Privileged sudo commanddist/error-handler.js:45 · Privileged sudo command — agent may execute with elevated privilegesreturn 'Run: sudo cp /path/to/ca.crt /usr/local/share/ca-certificates/ && sudo update-ca-certificates';Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

URL with embedded credentialsdist/resources.js:154 · URL with embedded credentials — may be phishing or credential leaking

…g., http://localhost:8080). For Basic Auth, embed credentials in the URL (e.g., https://user:[email protected]); percent-encode special characters in the username or passwo…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

Cost to the agent

Instructions loaded

≈44 tok

1 file · 68 in bundle

Tool list per prompt

≈1,751 tok

4 tools · 438 per tool

Handshake

805 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 539

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-searxng@2.10.1 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Unclaimed publisher≈ +8 on the totalClaim ihor-sokoliuk: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ihor-sokoliuk Propose a patch to the maintainer