mcp-searxng 1.2.1 → 1.3.1

package/README.md

@@ -10,6 +10,7 @@
 [![Docker Pulls](https://img.shields.io/docker/pulls/isokoliuk/mcp-searxng?style=flat-square&logo=docker)](https://hub.docker.com/r/isokoliuk/mcp-searxng)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue?style=flat-square)](LICENSE)
 [![mcp-searxng MCP server](https://glama.ai/mcp/servers/ihor-sokoliuk/mcp-searxng/badges/score.svg)](https://glama.ai/mcp/servers/ihor-sokoliuk/mcp-searxng)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ihor-sokoliuk/mcp-searxng/badge)](https://scorecard.dev/viewer/?uri=github.com/ihor-sokoliuk/mcp-searxng)
 
 An [MCP server](https://modelcontextprotocol.io/introduction) that integrates the [SearXNG](https://docs.searxng.org) API, giving AI assistants web search capabilities.
 
@@ -46,6 +47,17 @@ Replace `YOUR_SEARXNG_INSTANCE_URL` with the URL of your SearXNG instance (e.g.
 - **Safe Search**: Control content filtering level for search results.
 - **Relevance Filtering**: Filter out low-scoring search results with `min_score`.
 
+## Why mcp-searxng?
+
+| | Brave MCP | Exa MCP | Firecrawl MCP | **mcp-searxng** |
+|--|:---------:|:-------:|:-------------:|:---------------:|
+| Web Search | ✓ | ✓ | ✓ | ✓ |
+| Read URL | ✗ | ✓ | ✓ | ✓ |
+| Pagination | ✗ | ✗ | ✓ | ✓ |
+| Self-hosted | ✗ | ✗ | Partial | ✓ |
+| Privacy | ✗ | ✗ | ✗ | ✓ |
+| Free / No API key | ✗ | ✗ | ✗ | ✓ |
+
 ## How It Works
 
 `mcp-searxng` is a standalone MCP server — a separate Node.js process that your AI assistant connects to for web search. It queries any SearXNG instance via its HTTP JSON API.
@@ -240,6 +252,16 @@ See also: [SearXNG settings docs](https://docs.searxng.org/admin/settings/settin
 
 See [CONTRIBUTING.md](CONTRIBUTING.md)
 
+## Star History
+
+<a href="https://www.star-history.com/?repos=ihor-sokoliuk%2Fmcp-searxng&type=date&legend=top-left">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=ihor-sokoliuk/mcp-searxng&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=ihor-sokoliuk/mcp-searxng&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=ihor-sokoliuk/mcp-searxng&type=date&legend=top-left" />
+ </picture>
+</a>
+
 ## License
 
 MIT — see [LICENSE](LICENSE) for details.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { main } from "./index.js";
+process.on('uncaughtException', (error) => {
+    console.error('Uncaught Exception:', error);
+    process.exit(1);
+});
+process.on('unhandledRejection', (reason, promise) => {
+    console.error('Unhandled Rejection at:', promise, 'reason:', reason);
+    process.exit(1);
+});
+main().catch((error) => {
+    console.error("Failed to start server:", error);
+    process.exit(1);
+});

package/dist/http-server.d.ts

@@ -2,7 +2,8 @@ import express from "express";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 /**
  * Resolves the bind host from the MCP_HTTP_HOST environment variable.
- * Falls back to "0.0.0.0" (all interfaces) when the variable is absent or whitespace-only.
+ * Falls back to "127.0.0.1" (localhost only) when the variable is absent or whitespace-only.
+ * Set MCP_HTTP_HOST=0.0.0.0 to expose on all interfaces (e.g. Docker, remote access).
  */
 export declare function resolveBindHost(envValue: string | undefined): string;
 export declare function createHttpServer(createMcpServer: () => McpServer): Promise<express.Application>;

package/dist/http-server.js

@@ -1,5 +1,6 @@
 import express from "express";
 import cors from "cors";
+import rateLimit from "express-rate-limit";
 import { randomUUID } from "crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -8,15 +9,48 @@ import { packageVersion } from "./index.js";
 import { getHttpSecurityConfig, isOriginAllowed, isRequestAuthorized, validateHttpSecurityConfig, } from "./http-security.js";
 /**
  * Resolves the bind host from the MCP_HTTP_HOST environment variable.
- * Falls back to "0.0.0.0" (all interfaces) when the variable is absent or whitespace-only.
+ * Falls back to "127.0.0.1" (localhost only) when the variable is absent or whitespace-only.
+ * Set MCP_HTTP_HOST=0.0.0.0 to expose on all interfaces (e.g. Docker, remote access).
  */
 export function resolveBindHost(envValue) {
     const trimmed = envValue?.trim();
     if (!trimmed) {
-        return "0.0.0.0";
+        return "127.0.0.1";
     }
     return trimmed;
 }
+function makeRateLimiters() {
+    const windowMs = parseInt(process.env.MCP_RATE_WINDOW_MS ?? "60000", 10);
+    const initLimiter = rateLimit({
+        windowMs,
+        max: parseInt(process.env.MCP_RATE_INIT_MAX ?? "20", 10),
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: {
+            jsonrpc: "2.0",
+            error: { code: -32029, message: "Too many requests" },
+            id: null,
+        },
+    });
+    const sessionLimiter = rateLimit({
+        windowMs,
+        max: parseInt(process.env.MCP_RATE_SESSION_MAX ?? "300", 10),
+        standardHeaders: true,
+        legacyHeaders: false,
+        message: {
+            jsonrpc: "2.0",
+            error: { code: -32029, message: "Too many requests" },
+            id: null,
+        },
+    });
+    const healthLimiter = rateLimit({
+        windowMs: 60000,
+        max: 60,
+        standardHeaders: true,
+        legacyHeaders: false,
+    });
+    return { initLimiter, sessionLimiter, healthLimiter };
+}
 export async function createHttpServer(createMcpServer) {
     const app = express();
     const security = getHttpSecurityConfig();
@@ -44,10 +78,11 @@ export async function createHttpServer(createMcpServer) {
             id: null,
         });
     }
+    const { initLimiter, sessionLimiter, healthLimiter } = makeRateLimiters();
     // Map to store sessions by session ID
     const sessions = new Map();
     // Handle POST requests for client-to-server communication
-    app.post('/mcp', async (req, res) => {
+    app.post('/mcp', initLimiter, sessionLimiter, async (req, res) => {
         if (!isRequestAuthorized(req.headers.authorization, security)) {
             rejectUnauthorized(res);
             return;
@@ -123,7 +158,7 @@ export async function createHttpServer(createMcpServer) {
         }
     });
     // Handle GET requests for server-to-client notifications via SSE
-    app.get('/mcp', async (req, res) => {
+    app.get('/mcp', sessionLimiter, async (req, res) => {
         if (!isRequestAuthorized(req.headers.authorization, security)) {
             rejectUnauthorized(res);
             return;
@@ -152,7 +187,7 @@ export async function createHttpServer(createMcpServer) {
         }
     });
     // Handle DELETE requests for session termination
-    app.delete('/mcp', async (req, res) => {
+    app.delete('/mcp', sessionLimiter, async (req, res) => {
         if (!isRequestAuthorized(req.headers.authorization, security)) {
             rejectUnauthorized(res);
             return;
@@ -184,7 +219,7 @@ export async function createHttpServer(createMcpServer) {
         }
     });
     // Health check endpoint
-    app.get('/health', (_req, res) => {
+    app.get('/health', healthLimiter, (_req, res) => {
         res.json({
             status: 'healthy',
             server: 'ihor-sokoliuk/mcp-searxng',

package/dist/index.d.ts

@@ -1,6 +1,5 @@
-#!/usr/bin/env node
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-declare const packageVersion = "1.2.1";
+declare const packageVersion = "1.3.1";
 export { packageVersion };
 export declare function isWebUrlReadArgs(args: unknown): args is {
     url: string;
@@ -15,3 +14,4 @@ export declare function isWebUrlReadArgs(args: unknown): args is {
  * Called once per HTTP session, or once for STDIO mode.
  */
 export declare function createMcpServer(): McpServer;
+export declare function main(): Promise<void>;

package/dist/index.js

@@ -1,6 +1,3 @@
-#!/usr/bin/env node
-import { fileURLToPath } from "node:url";
-import { realpathSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, SetLevelRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ReadResourceRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
@@ -12,17 +9,7 @@ import { fetchAndConvertToMarkdown } from "./url-reader.js";
 import { createConfigResource, createHelpResource } from "./resources.js";
 import { createHttpServer, resolveBindHost } from "./http-server.js";
 // Use a static version string that will be updated by the version script
-const packageVersion = "1.2.1";
-const isMainModule = (() => {
-    if (process.argv[1] === undefined)
-        return false;
-    try {
-        return fileURLToPath(import.meta.url) === realpathSync(process.argv[1]);
-    }
-    catch {
-        return false;
-    }
-})();
+const packageVersion = "1.3.1";
 // Export the version for use in other modules
 export { packageVersion };
 // Type guard for URL reading args
@@ -198,7 +185,7 @@ export function createMcpServer() {
     return mcpServer;
 }
 // Main function
-async function main() {
+export async function main() {
     // Check for HTTP transport mode
     const httpPort = process.env.MCP_HTTP_PORT;
     if (httpPort) {
@@ -250,18 +237,3 @@ async function main() {
         logMessage(mcpServer, "info", `SearXNG URL: ${process.env.SEARXNG_URL || 'not configured'}`);
     }
 }
-if (isMainModule) {
-    // Handle uncaught errors for the CLI entrypoint.
-    process.on('uncaughtException', (error) => {
-        console.error('Uncaught Exception:', error);
-        process.exit(1);
-    });
-    process.on('unhandledRejection', (reason, promise) => {
-        console.error('Unhandled Rejection at:', promise, 'reason:', reason);
-        process.exit(1);
-    });
-    main().catch((error) => {
-        console.error("Failed to start server:", error);
-        process.exit(1);
-    });
-}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mcp-searxng",
-    "version": "1.2.1",
+    "version": "1.3.1",
     "mcpName": "io.github.ihor-sokoliuk/mcp-searxng",
     "description": "MCP server for SearXNG integration",
     "license": "MIT",
@@ -25,7 +25,7 @@
     ],
     "type": "module",
     "bin": {
-        "mcp-searxng": "dist/index.js"
+        "mcp-searxng": "dist/cli.js"
     },
     "main": "dist/index.js",
     "files": [
@@ -38,9 +38,9 @@
         "build": "tsc && shx chmod +x dist/*.js",
         "watch": "tsc --watch",
         "test": "cross-env SEARXNG_URL=https://test-searx.example.com tsx __tests__/run-all.ts",
-        "test:coverage": "cross-env SEARXNG_URL=https://test-searx.example.com c8 --reporter=text tsx __tests__/run-all.ts",
+        "test:coverage": "cross-env SEARXNG_URL=https://test-searx.example.com c8 --reporter=text --exclude 'dist/**' tsx __tests__/run-all.ts",
         "bootstrap": "npm install && npm run build",
-        "inspector": "DANGEROUSLY_OMIT_AUTH=true npx @modelcontextprotocol/inspector node dist/index.js",
+        "inspector": "DANGEROUSLY_OMIT_AUTH=true npx @modelcontextprotocol/inspector node dist/cli.js",
         "lint": "eslint src __tests__",
         "audit:deps": "npm audit --audit-level=moderate",
         "security": "npm run lint && npm run audit:deps",
@@ -52,6 +52,7 @@
         "@types/express": "^5.0.6",
         "cors": "^2.8.6",
         "express": "^5.2.1",
+        "express-rate-limit": "^8.5.2",
         "node-html-markdown": "^2.0.0",
         "undici": "^7.24.0"
     },