mcp-web-engine 1.0.4 → 1.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -13
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -3,8 +3,8 @@
|
|
|
3
3
|
> **Privacy-First, Self-Hostable & SSRF-Hardened MCP Server & Web Engine for AI Agents**
|
|
4
4
|
> **MCP Specification 2026-07-28 Pure Stateless Core & Stdio / HTTP Dual Mode**
|
|
5
5
|
|
|
6
|
-
[](https://pypi.org/project/mcp-web-engine/)
|
|
7
|
+
[](https://www.npmjs.com/package/mcp-web-engine)
|
|
8
8
|
[](LICENSE)
|
|
9
9
|
|
|
10
10
|
---
|
|
@@ -14,7 +14,7 @@
|
|
|
14
14
|
AI agents (Claude Desktop, Cursor, Windsurf, TurboLLM, Hermes Agent) can run `mcp-web-engine` in an isolated ephemeral environment with **zero configuration**:
|
|
15
15
|
|
|
16
16
|
```bash
|
|
17
|
-
# Run stdio MCP server in an isolated environment (
|
|
17
|
+
# Run stdio MCP server in an isolated environment (10ms startup, 0% system contamination)
|
|
18
18
|
uvx mcp-web-engine
|
|
19
19
|
```
|
|
20
20
|
|
|
@@ -36,8 +36,9 @@ uvx --from git+https://github.com/Arbolencio/mcp-web-engine mcp-web-engine
|
|
|
36
36
|
- **Pure Stateless Core (Spec 2026-07-28):** Zero sessions, zero state, zero initialize handshake required. Every request is completely independent.
|
|
37
37
|
- **Protocol Methods:** Implements `server/discover`, `tools/list`, and `tools/call` with standard JSON-RPC 2.0.
|
|
38
38
|
- **Zero Third-Party Tracking:** Powered by an internal SearXNG meta-search engine aggregating 70+ sources with DuckDuckGo fallback.
|
|
39
|
+
- **Automatic URL Normalization:** Handled transparently by `normalize_searxng_url()` — any provided `SEARXNG_URL` variation (`http://127.0.0.1:8082`, `http://127.0.0.1:8082/`, `http://127.0.0.1:8082/search`) automatically appends `/search` if missing.
|
|
39
40
|
- **SSRF Hardened:** Pre-request DNS resolution checks prevent agents from accessing internal networks (`localhost`, `127.0.0.1`, `192.168.x.x`, `169.254.169.254`). Step-by-step HTTP 301/302 redirect re-validation.
|
|
40
|
-
- **
|
|
41
|
+
- **Zero `--break-system-packages`:** Executed 100% in sandboxed virtual environments created on-the-fly by `uv` or `venv`.
|
|
41
42
|
|
|
42
43
|
---
|
|
43
44
|
|
|
@@ -54,7 +55,7 @@ uvx --from git+https://github.com/Arbolencio/mcp-web-engine mcp-web-engine
|
|
|
54
55
|
uvx: true,
|
|
55
56
|
argNote: 'Requires a running SearXNG instance.',
|
|
56
57
|
envs: [
|
|
57
|
-
{ key: 'SEARXNG_URL', desc: 'SearXNG meta-search endpoint (default: http://127.0.0.1:8082/search)', required:
|
|
58
|
+
{ key: 'SEARXNG_URL', desc: 'SearXNG meta-search endpoint (default: http://127.0.0.1:8082/search)', required: true },
|
|
58
59
|
],
|
|
59
60
|
}
|
|
60
61
|
```
|
|
@@ -100,12 +101,12 @@ uvx --from git+https://github.com/Arbolencio/mcp-web-engine mcp-web-engine
|
|
|
100
101
|
|
|
101
102
|
## ⚙️ Configuration & Environment Variables
|
|
102
103
|
|
|
103
|
-
| Variable | Default | Description |
|
|
104
|
-
|
|
105
|
-
| `SEARXNG_URL` | `http://127.0.0.1:8082/search` | SearXNG meta-search endpoint |
|
|
106
|
-
| `PORT` | `5050` | HTTP/SSE server port (
|
|
107
|
-
| `HOST` | `0.0.0.0` | HTTP/SSE server binding host |
|
|
108
|
-
| `API_KEY` | `""` | Optional authentication key for HTTP endpoints |
|
|
104
|
+
| Variable | Required | Default | Description |
|
|
105
|
+
|---|---|---|---|
|
|
106
|
+
| `SEARXNG_URL` | **Yes** | `http://127.0.0.1:8082/search` | SearXNG meta-search endpoint (Auto-normalizes trailing slashes and missing `/search`) |
|
|
107
|
+
| `PORT` | No | `5050` | HTTP/SSE server port (Used only when running in `--serve` mode) |
|
|
108
|
+
| `HOST` | No | `0.0.0.0` | HTTP/SSE server binding host |
|
|
109
|
+
| `API_KEY` | No | `""` | Optional authentication key for HTTP endpoints |
|
|
109
110
|
|
|
110
111
|
---
|
|
111
112
|
|
|
@@ -128,10 +129,10 @@ uv run python -m mcp_web_engine.main --serve
|
|
|
128
129
|
|
|
129
130
|
---
|
|
130
131
|
|
|
131
|
-
## 🛡️ Security &
|
|
132
|
+
## 🛡️ Security & Environment Isolation
|
|
132
133
|
|
|
133
134
|
- **SSRF Hardening:** Blocks `localhost`, loopbacks, private subnets (`10.0.0.0/8`, `192.168.0.0/16`, `172.16.0.0/12`), percent-encoding bypasses (`%31%32%37...`), and re-validates `Location` headers on HTTP redirects step-by-step.
|
|
134
|
-
- **
|
|
135
|
+
- **Zero Package Pollution:** Execution via `uvx` or `bin/cli.js` never modifies global site-packages or uses dangerous flags like `--break-system-packages`.
|
|
135
136
|
|
|
136
137
|
---
|
|
137
138
|
|