AgentArmorHQ
Sign in

tavily-mcp

MCP server · npm · graded 2026-10-26Source linked

MCP server for advanced web search using Tavily

No outside reports on file

Keep your API key private, validate that search results make sense before trusting them, and monitor your Tavily usage to spot abuse or surprises.

Based on public adoption and transparency signals as of Oct 26, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Tavily MCP helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachLocal or standard API callsLOW
  • CredentialsRequires API key or tokenREVIEW
  • Package sourcenpm (tavily-mcp)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y tavily-mcp

All setup options ↓

Check this skillWatch it in my stackCompareAdd to allowlistREADME badgeView project

About Tavily MCP

This is an MCP server that lets AI systems search the web using Tavily's search API. It connects Claude and other AI tools to real-time web results so they can find current information online.

Who it’s for

Developers building AI assistants that need to search the web for answers. Teams using Claude Desktop or other MCP-compatible platforms who want web search built into their workflows.

Alternatives

  • SerpAPI: Alternative web search API with MCP support
  • Google Custom Search: Google's structured search with API limits
  • Perplexity API: AI-powered search engine with different rate limits
  • Built-in Claude web browsing: Claude's native web access (when available in your plan)

Setup

Check these steps against the project’s own instructions before running anything.

Install via npm: npm install tavily-mcp

For Claude Desktop, add to your claude_desktop_config.json:

json
"tavily-mcp": {
  "command": "npx",
  "args": ["tavily-mcp"]
}

You'll need a Tavily API key from their website. Follow the project's README for full configuration details.

Why this grade

DD — High risk signals

Signal-based grade (1/7 points): no public source code found. This reflects adoption and transparency, not a code review.

Popularity and upkeep

41/100
Weekly npm downloads
28.8k
Listing last refreshed
2026-10-29

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Security reports

No reports found for this package in our research (last checked 2026-10-29).

Check a specific version →

Risks to watch for

  • API key exposure: Your Tavily API key controls search quota and costs; if leaked, attackers can drain your balance or abuse your account
  • Unreliable web content: Search results include pages made by anyone; malicious sites can contain false information, code injection, or misleading data that fools the AI
  • Data sent to Tavily: Your search queries are sent to Tavily's servers; consider whether sensitive or private questions should go through third-party APIs
  • Prompt injection via search results: Web pages can contain specially crafted text designed to manipulate the AI's behavior or trick it into ignoring safety guidelines
  • Rate limiting and costs: Excessive searches can trigger rate limits or unexpected charges if an AI makes many queries

How to lower the risk

Least-privilege permissions

  • Use a dedicated Tavily account with spending limits if available
  • Rotate API keys regularly
  • Restrict which queries the AI can search for

Network isolation

  • Run on a machine with outbound HTTPS filtering where possible
  • Log all outgoing web requests to Tavily

Monitoring

  • Watch your Tavily dashboard for unusual query volume or costs
  • Review what queries the AI sends to search for patterns
  • Alert if API key is used from unexpected locations

Red flags to watch for

  • Sudden spike in search volume or API costs
  • Search results that look suspiciously perfect or malicious
  • AI starting to quote or act on unverified web content as fact

Questions

How do I install Tavily MCP?

Run npx -y tavily-mcp in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/tavily-ai/tavily-mcp.

Are there security reports about Tavily MCP?

No reports found for this package in our research (last checked 2026-10-29). Tavily MCP currently holds Grade D (High risk signals) based on public adoption and transparency signals. Key risk areas to watch include api key exposure, unreliable web content, data sent to tavily.

Is Tavily MCP actively maintained?

Tavily MCP has 28.8k weekly npm downloads, with its latest repository commit pushed on 2026-10-22. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/tavily-ai/tavily-mcp before pinning it in production.

What are alternatives to Tavily MCP?

Notable alternatives to Tavily MCP include SerpAPI (Alternative web search API with MCP support), Google Custom Search (Google's structured search with API limits), Perplexity API (AI-powered search engine with different rate limits), Built-in Claude web browsing (Claude's native web access (when available in your plan)). You can also compare Tavily MCP side by side with other MCP servers in the Related tools section on this page.

README badge and team notes

Maintain or use Tavily MCP? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade D for Tavily MCP

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for Tavily MCP](https://agentarmorhq.com/api/badge/tavily-ai-tavily-mcp)](https://agentarmorhq.com/skills/tavily-ai-tavily-mcp)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/tavily-ai-tavily-mcp"><img src="https://agentarmorhq.com/api/badge/tavily-ai-tavily-mcp" alt="AgentArmorHQ Risk Grade for Tavily MCP" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "tavily-ai-tavily-mcp"

Share with your security lead

Need sign-off to use tavily-mcp? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: tavily-mcp
- **Listing URL:** https://agentarmorhq.com/skills/tavily-ai-tavily-mcp
- **Type:** App connector
- **Risk Grade:** Grade D (High risk signals)
- **Outside Security Advisories on File:** 0

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** Requires API key or token
- **Package source:** npm (tavily-mcp)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts tavily-mcp`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 26, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Publisher
tavily-ai
Source code
github.com/tavily-ai/tavily-mcp
Install command
npm install tavily-mcp
Est. context load
~500 tokens / turn (~3 tool schemas, 0.25% of 200k context)
Popularity
28.8k weekly npm downloads
Last updated
2026-10-29
Last graded
2026-10-26

Community

Discussions for Tavily MCP

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Tavily MCP helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude