searxng-mcp-bridge
Health Warn
- License — License: MIT
- Description — Repository has a description
- Active repo — Last push 0 days ago
- Low visibility — Only 7 GitHub stars
Code Fail
- network request — Outbound network request in package-lock.json
- fs module — File system access in package.json
- network request — Outbound network request in package.json
- execSync — Synchronous shell command execution in scripts/release.js
- process.env — Environment variable access in src/index.ts
- network request — Outbound network request in src/index.ts
Permissions Pass
- Permissions — No dangerous permissions requested
This tool is a Model Context Protocol (MCP) server that bridges AI clients to a SearXNG search instance. It allows you to perform web searches via SearxNG directly from your AI tools using either STDIO or HTTP transports.
Security Assessment
Overall risk is Low to Medium. The server makes outbound network requests, but this is its primary function (connecting to your SearxNG instance). It accesses the file system and reads environment variables to fetch necessary configurations like host, port, and API URLs, which is standard. No dangerous OS permissions are requested, and no hardcoded secrets were found. However, the codebase includes synchronous shell command execution (`execSync`) within the release script. While this is likely an automated build/deploy mechanism rather than a runtime threat, developers should be aware of it.
Quality Assessment
The project is licensed under the permissive MIT license and is actively maintained, with its last push occurring today. The primary drawback is its extremely low community visibility. Having only 7 GitHub stars means the codebase has undergone very little public scrutiny, so you are trusting the author directly rather than a vetted community.
Verdict
Use with caution: the tool does exactly what it promises, but its low community adoption and strict trust in the author mean you should review the source code before deploying it in sensitive environments.
Model-Context Protocol server that acts as a bridge to a SearxNG instance
SearXNG MCP Bridge Server
This is a Model Context Protocol (MCP) server that acts as a bridge to a SearXNG instance. It allows compatible clients to perform searches using a configured SearXNG instance via MCP tools.
Quick Start (Using from npm)
Set up a SearXNG instance:
# Using Docker docker run -d -p 8888:8080 --name searxng searxng/searxngInstall and run the MCP bridge
Default (STDIO, unchanged):
# Run directly with npx (default - stdio transport) npx -y @nitish-raj/searxng-mcp-bridgeOptional: Run as an HTTP server (new, opt-in)
# Using env variables (recommended) TRANSPORT=http PORT=3002 HOST=127.0.0.1 SEARXNG_INSTANCE_URL=http://localhost:8080 npx -y @nitish-raj/searxng-mcp-bridge # Or run the built bundle TRANSPORT=http node build/index.jsConfigure in your MCP settings file (stdio / legacy clients)
Add to your MCP settings file (e.g.,~/.vscode-server/.../mcp_settings.json):{ "mcpServers": { "searxng-bridge": { "command": "npx", "args": [ "-y", "@nitish-raj/searxng-mcp-bridge" ], "env": { "SEARXNG_INSTANCE_URL": "http://localhost:8080" }, "disabled": false } } }
HTTP Configuration: Set TRANSPORT=http to run the bridge over HTTP instead of stdio. The transport mode can be configured via environment variables.
Features
- Search Tool: Perform web searches using SearXNG with configurable parameters
- Health Check: Monitor SearXNG instance connectivity and performance
- Dual Transport: Supports both STDIO (default) and HTTP transports
- Session Management: HTTP transport includes session-based connections
- CORS Support: Proper cross-origin headers for web client integration
- Rate Limiting: Built-in protection against excessive requests (HTTP mode)
Configuration
SEARXNG_INSTANCE_URL— REQUIRED. The full URL of the SearXNG instance (e.g.,http://localhost:8080).TRANSPORT— Transport protocol:stdio(default) orhttpPORT— HTTP server port. Default:3000(use3002for development)HOST— Server bind address. Default:127.0.0.1(use0.0.0.0for containers)CORS_ORIGIN— Comma-separated list of allowed origins for CORS. Default: localhost:3002 (development) or*(production)MCP_HTTP_BEARER— Optional bearer token for HTTP authentication
HTTP Transport Features:- Session management with
mcp-session-idheaders - Secure CORS with origin whitelist validation
- Rate limiting (100 requests/minute per IP)
- Optional bearer authentication via
MCP_HTTP_BEARER - DNS rebinding protection
Security Notes:
- CORS uses secure whitelist in development (localhost:3002 only)
- Production reflects specific origins for credentialed requests (CORS-compliant)
- Set
CORS_ORIGINto customize allowed origins for your use case - Set
TRANSPORT=stdioto revert to stdio mode
HTTP Transport
The HTTP transport implements the MCP Streamable HTTP specification (2025-03-26) with the following endpoints:
MCP Endpoints:
POST /mcp- Send MCP requestsGET /mcp- Server-Sent Events for notificationsDELETE /mcp- Terminate sessionsOPTIONS /mcp- CORS preflight requests
System Endpoints:
GET /healthz- Health check and status
Test HTTP endpoint:
curl -X POST http://localhost:3002/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
This returns a JSON-RPC response with the list of available tools (search and health_check).
Docker
The Dockerfile exposes port 8081 for HTTP transport. To run the container and allow HTTP access:
# Build (example)
docker build -t searxng-mcp-bridge .
# Run mapping port 8081
docker run -d -p 8081:8081 --env SEARXNG_INSTANCE_URL=http://localhost:8080 --name searxng-mcp-bridge searxng-mcp-bridge
# To run HTTP transport inside container:
docker run -d -p 8081:8081 -e TRANSPORT=http -e PORT=8081 -e SEARXNG_INSTANCE_URL=http://localhost:8080 searxng-mcp-bridge
Note: when containerized set HOST=0.0.0.0 or rely on the default exposed port mapping.
Usage
STDIO Clients: Use the tool unchanged - no configuration changes required.
HTTP Clients: Connect to http://localhost:3002/mcp (development port) and send MCP JSON-RPC requests.
Development
npm install: Install dependencies.npm run build: Compile TypeScript to JavaScript.npm run watch: Watch for changes and rebuild automatically.npm run inspector: Run the MCP inspector to test the server.npm run start:http: Start server in HTTP streaming mode on localhost:3002.
Migration & Compatibility
Backward Compatibility:
- STDIO remains the default transport - existing users need no changes
- All tool names, parameters, and responses remain unchanged
- Configuration is opt-in via environment variables
Migration to HTTP:
- Set
TRANSPORT=httpto enable HTTP transport - Configure
PORTandHOSTas needed - Update client to use HTTP endpoint instead of stdio
Rollback:
- Set
TRANSPORT=stdioor omit the variable to return to stdio
Reviews (0)
Sign in to leave a review.
Leave a reviewNo results found