B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Developer tools, Web & browsing
mcp-searxng
Private web search for AI assistants via SearXNG — supports Claude, Cursor, and any MCP client
Bottom line: Signal-based grade (5/7 points): well starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 67/100
- Rank
- Not ranked: outside the 500 most popular tools
- GitHub stars
- 1.3k
- Weekly downloads
- 10.3k
What it does
mcp-searxng enables AI assistants like Claude and Cursor to perform private web searches by connecting to a SearXNG instance, an open-source metasearch engine that doesn't track users. It acts as an MCP server that bridges your AI agent to web search capabilities while maintaining privacy.
Who it’s for
Builders integrating Claude or other MCP clients into workflows requiring real-time web data without exposure to commercial search tracking. Executives seeking privacy-respecting AI assistants for sensitive research or compliance-driven environments.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Install via npm:
npm install mcp-searxng
For Claude Desktop, add to claude_desktop_config.json:
{
"mcpServers": {
"searxng": {
"command": "npx",
"args": ["mcp-searxng"]
}
}
}
Verify against the repo README for environment variables (e.g., SEARXNG_URL) and any required SearXNG instance configuration.
Risks
- SearXNG instance trust: If using a public or third-party SearXNG instance, that operator sees all search queries—verify you control or fully trust the instance
- Prompt injection via search results: Malicious web content returned by searches could inject instructions into the AI model if not properly sanitized
- No built-in rate limiting: Connector may allow agents to spam searches, risking abuse of your SearXNG instance or IP blocking
- Supply chain via npm: Dependencies could be compromised; monitor updates and audit
package.jsontransitively - Credential exposure: If SearXNG instance requires authentication, ensure credentials are never logged or exposed in LLM context
How to stay secure
Least-privilege permissions
- Run the MCP connector in a dedicated user account with no sudo access or elevated privileges
- Restrict file system access to only the connector's config directory and logs; deny access to sensitive system files
- If using SearXNG authentication, store credentials in environment variables or a secrets file readable only by the connector process (mode 0600)
- Disable any connector features you don't use (e.g., if you only need web search, disable other query types if available)
Network isolation
- Self-host or use a trusted, private SearXNG instance you control; never route searches through public instances
- Configure your SearXNG instance to accept connections only from the MCP connector's IP address using firewall rules
- Use TLS/HTTPS for all communication between the connector and SearXNG; disable plaintext HTTP
- Implement egress filtering so the connector can only reach your SearXNG instance, not arbitrary external APIs
Monitoring
- Log all search queries and results at the connector level; review logs regularly for suspicious patterns or high-volume abuse
- Set rate limits on the SearXNG instance itself (e.g., max requests per IP per minute) to prevent agent-driven query spam
- Alert on failed authentication attempts or HTTP errors from the connector to your SearXNG instance
- Monitor the connector process for unusual memory, CPU, or network activity that could indicate exploitation
Red flags to watch for
- Search results containing code, shell commands, or system instructions that could be injected into LLM prompts
- Unusual spikes in query volume or repetitive searches targeting the same keywords
- Connector crashes or hanging requests that could indicate DoS or memory exhaustion attacks
- Unaudited npm dependency updates; pin versions in
package-lock.jsonand review changelogs before updating
Alternatives
- Perplexity API — Commercial search-augmented LLM with built-in privacy controls and citation tracking
- Brave Search API — Privacy-focused commercial search with MCP integration options
- Tavily Search MCP — Purpose-built research API for AI agents with relevance filtering
- Native Claude web search — Anthropic's built-in search (if enabled in your plan)