mcp-prism-search

MCP search aggregator: one query, refracted across many keyless search engines.

mcp-prism-search is a self-hosted Python MCP server (mcp SDK 2.x) that aggregates web search from multiple keyless engines — Bing, DuckDuckGo (HTML + lite), ddgs backends, FreeSerp, Keenable, Mwmbl, 4get, self-hosted SearXNG — with automatic fallback chains, deterministic ranking, TTL caching, SSRF-safe webpage fetching, and keyless vertical sources (Wikipedia, HackerNews). Keyed providers with free tiers (Tavily, Exa, Brave, You.com, Serper, Jina) plug in via env vars and are skipped when absent.

The client or agent reasons over the returned data; the server never calls LLMs, summarizes, or generates reports.

Documentation

Related MCP server: local-websearch-mcp

Tools

All tools publish typed outputSchema and return validated structuredContent. Provider failures surface as MCP isError results (ToolError), with a provider_attempts tally for diagnostics.

Providers

Keyless (no configuration needed):

Keyed (free tiers verified against official docs):

Providers whose key is missing are skipped automatically; only the keyless ones run.

Quick start

stdio (desktop MCP clients — no network, no token):

python3.12 -m venv .venv
.venv/bin/python -m pip install -e .
.venv/bin/python -m mcp_prism_search.server

Streamable HTTP (Docker compose — loopback-only by default):

MCP_AUTH_TOKEN=$(openssl rand -hex 32) docker compose up -d --build
curl -s http://127.0.0.1:49317/health   # -> {"ok": true}

Then call it from any MCP client at http://127.0.0.1:49317/mcp with Authorization: Bearer <token>.

Search across every keyless engine at once:

{"query": "model context protocol", "provider": "all", "max_results": 15}

Security

Layered SSRF defenses on every fetch: scheme allowlist, hostname and literal IP blocklists (private, loopback, CGNAT, link-local, metadata), DNS resolution checks with IP pinning (the validate-then-connect TOCTOU window is closed), per-hop redirect re-validation with a 5-hop cap, streamed bodies hard-capped at FETCH_MAX_BYTES, and Accept-Encoding: identity enforcement. HTTP mode requires a bearer token and rejects known placeholder tokens at startup. Full model: docs/architecture.md.

The server does not rotate proxies, bypass captchas, or attempt to evade rate limits: upstream blocks surface as structured errors instead.

Development

Python 3.12+, pytest (offline, 100+ tests), ruff. Conventional commits drive semantic-release (automatic versioning, tags, releases, and multi-arch Docker images).

python3.12 -m venv .venv && .venv/bin/python -m pip install -e '.[dev]'
.venv/bin/python -m pytest -q
.venv/bin/python -m ruff check src tests

Details: docs/development.md.

License

AGPL-3.0 — see LICENSE.