Web Researcher MCP

io.github.zoharbabinPublished by GitHub account zoharbabinv1.50.4Updated Oct 25, 2026

Your AI research assistant that cites real sources and stays honest

VerifiedSTDIODesktop onlyWeb Search & ScrapingKnowledge & MemoryData & Analytics

Overview

AI-generated overview

Local research MCP server that lets an assistant search the web and primary sources, read full pages, and verify citations before relying on them.

What you can do
  • Search the web, news, images and trusted-site lenses, with optional multi-provider failover
  • Search primary sources: academic papers and full text, citation graphs, patents, SEC filings, US court records, economic data, clinical trials and biomedical graphs
  • Read whole pages and documents: web pages, PDFs, Word and PowerPoint files, YouTube transcripts and Hacker News threads
  • Verify sources: check citations, audit a bibliography, vet recommendation lists, and archive a page snapshot
  • Keep research across chats, compare model answers, export citations in APA, MLA, BibTeX, RIS or CSL-JSON
  • Optionally read pages behind your own logins and run saved-query monitors
When to use it
Useful when research output must be defensible: client deliverables, publications, legal or grant work, journalism, or any claim that needs a clickable, checked source. Also handy for pulling structured records from filings, courts, patents and trials rather than snippets.
Requirements
Runs as a local process (stdio) via uvx, pip, Homebrew, Docker or a signed binary; no account needed. DuckDuckGo, Hacker News, Reddit, Bluesky and GitHub search work with no key. Optional keys per provider: BRAVE_API_KEY, SERPER_API_KEY, SEARCHAPI_API_KEY, TAVILY_API_KEY, EXA_API_KEY, XQUIK_API_KEY, GOOGLE_CUSTOM_SEARCH_API_KEY with GOOGLE_CUSTOM_SEARCH_ID, SEARXNG_URL, FRED_API_KEY, COURTLISTENER_API_TOKEN, EDGAR_CONTACT_EMAIL. Network access required.
Before you install
Optional keys are secrets and are passed as environment variables; keep them out of shared configs. Opt-in site_login stores encrypted per-user logins that expire, and some sites such as LinkedIn forbid automated access in their terms. archive_source writes a public Wayback snapshot. Saved logins, memory, analytics and workspaces store personal data and are off by default. Queries go to whichever search providers you configure.

Installation

In SourceWeft

  1. Open Web Researcher MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[web-researcher-mcp logo]

web-researcher-mcp

Your AI research assistant. It searches, reads what you can open, and checks its sources.

Search the web and primary sources: SEC filings, court records, patents, clinical trials, full-text papers.
Read whole pages, including pages behind your own logins, like LinkedIn and X.
Check every citation, keep your research across chats, and run it all on your machine.
No API key needed to start.

⭐ If you're tired of AI making things up, and web-researcher-mcp helps you, give us a star ⭐ — it helps more teams discover the project.

[Cartoon: an AI genie pulls a citation out of a hat, and it poofs. Then real tool runs catch fake citations.]
A cartoon of the problem, then real tool output. Watch the 43-second video.

[CI] [Go Report Card] [OpenSSF Scorecard] [Go Reference] [License: MIT] [Release] [Docker] [PyPI] [web-researcher-mcp MCP server] [GitHub Stars] [MCP Toplist]

Get started in 30 seconds

Python users — uvx (no compile, any OS):

bash
# One-time: install uv (skip if you already have it)curl -LsSf https://astral.sh/uv/install.sh | sh        # macOS/Linux  (Windows: winget install astral-sh.uv)
claude mcp add --scope user web-researcher -- uvx web-researcher-mcp

uv fetches the right prebuilt binary for your platform and runs it — no Go, no compile, no manual PATH. Point any MCP client at uvx web-researcher-mcp. Also works with uv tool install web-researcher-mcp or pip install web-researcher-mcp.

macOS (Homebrew):

bash
brew install zoharbabin/tap/web-researcher-mcpclaude mcp add --scope user web-researcher -- web-researcher-mcp

macOS / Linux (no package manager):

bash
curl -fsSL https://raw.githubusercontent.com/zoharbabin/web-researcher-mcp/main/install.sh | sh

Windows (PowerShell):

powershell
powershell -ExecutionPolicy Bypass -c "irm https://raw.githubusercontent.com/zoharbabin/web-researcher-mcp/main/install.ps1 | iex"

No dev tools needed — every method ships the same signed binary (the PyPI wheels vendor it; the others download it and verify its checksum) and puts it on your PATH. The curl/PowerShell installers also register it with Claude Code automatically when the claude CLI is present; Homebrew installs the binary, so run the claude mcp add line above to connect it.

One-click install:

[Add to Cursor] [Install in VS Code] [Add to LM Studio]

The Cursor / VS Code / LM Studio buttons install the zero-config uvx setup (your editor prompts to confirm before adding it; needs uv — see above). It runs DuckDuckGo web search with no API key — great to try instantly; image_search/news_search and richer providers need a key (2 min, see Configuration). Claude Desktop: download the .mcpb bundle for your platform and double-click it (Settings → Extensions), or use the uvx line above.

Using a different MCP client or want to pass API keys? See Connect to Your AI Assistant for the per-app config, and Configuration to pick a search provider.

Your AI can now search the web and primary sources, read pages (including ones behind your logins), check citations, and run multi-step research. Pick the sources you trust.

Python SDK

python
from web_researcher_mcp import WebResearcherClient
async with WebResearcherClient() as client:    response = await client.web_search("CRISPR off-target effects 2024", num_results=5)    for r in response.results:        verified = await client.verify_citation(r.url)        print(r.title, "—", "✓" if verified.exists else "?")

Full documentation: docs/PYTHON_CLIENT.md

[Open In Colab]

Sync wrapper (for scripts and notebooks that don't use async):

python
with WebResearcherClient.sync() as client:    response = client.web_search("climate change 2024")    print(response.results[0].title)

What it does

What it means for you
Search everywhere you'd lookWeb search that you can limit to sites you trust (lenses). Dedicated tools for SEC filings, US court records, patents, clinical trials, economic data and full-text papers. Works with no API key.
Work as youOpt-in site_login lets your AI read pages you can already open: LinkedIn, X, Facebook, Instagram, YouTube and more. You sign in yourself, 2FA included, in your own browser or a private login window. Your password is never saved. Logins are encrypted, per user, expire, and site_logout removes them. Some sites, such as LinkedIn, forbid automated access in their terms. Use it where yours allow.
Check before you relyverify_citation, audit_bibliography and verify_recommendation check that a source exists, was not retracted, has a live link, and says what is claimed. They return evidence, not a verdict. Accuracy is measured on a labeled gold set (docs/TRUST_EVAL.md).
Read the whole pagePDFs, Word and PowerPoint files, YouTube transcripts and Hacker News threads, not just snippets.
Keep it and watch itSessions survive context loss. research_panel compares answers from several models. Export citations as APA, MLA, BibTeX, RIS or CSL-JSON. Opt-in saved-query monitors flag new results, memory keeps findings across chats, and team workspaces share them.
Run it yourselfFree, open source (MIT), no account. Your queries go only to the search providers you choose. Use one binary on your laptop, or a shared server for a team.
Always has a backupSeveral search engines work together. If one fails, the next takes over.
Paper trailAn opt-in audit log records every tool call in a tamper-evident hash chain. Releases ship with signatures and SLSA provenance.

Why does this exist?

AI answers look sourced and often aren't.

  • Courts: the Charlotin database lists over 2,200 court decisions that involve AI-hallucinated content. From 2027-01-01, California SB 574 requires attorneys to personally verify every citation in a court filing.
  • Search: a 2026 WashU audit found that about 1 in 9 verifiable claims in Google AI Overviews was not backed by the page it cited (the authors call this an upper bound). The Tow Center at CJR tested eight AI search engines and found all of them bad at citing news.
  • Your work: if it gets cited, published, filed, or shown to a client, "probably real" is not enough.

What this does about it: your AI reads the real pages and records, from sources you choose, and then checks the citations. Every claim traces to a link you can open.

Works with Claude, Claude Desktop, Cursor, VS Code, Codex, Gemini CLI, and any AI assistant that supports MCP.

Who uses this

  • Academic researchers — "I need a literature review with real DOIs, not made-up citations"
  • Business analysts — "My deliverable needs sources a client can actually click and verify"
  • Lawyers — "If I cite a case that doesn't exist, I get fined $50,000"
  • Journalists — "I need to cross-check government records and court filings, not Perplexity summaries"
  • Medical researchers — "Clinical decisions based on a health blog could hurt someone"
  • Graduate students — "I spent 3 hours tracking down a citation my AI invented"
  • Market and sales researchers — "The best context is on pages I can only open when I'm signed in"
  • Enterprise teams — "Our competitive research can't go through a third party's servers"
  • Developers building agents — "I want search and page reading without a per-query bill or a vendor lock-in"

[Same query, two answers — a typical AI search tool presents a fabricated DOI with full confidence; web-researcher-mcp verifies the citation against Crossref before it reaches you]

How It Compares

web-researcher-mcpBuilt-in AI search (Perplexity, ChatGPT, Google AI)Search APIs (Tavily, Exa, Brave)Paper tools (Scite, Consensus, Elicit)
Checks that citations exist, are not retracted, and say what is claimedYesNoNoPapers only
You pick which sources are searchedYes (lenses)NoDomain filtersNo
SEC filings, court records, patents, clinical trialsYesWeb pages onlyWeb pages onlyNo
Reads full pages, PDFs, YouTube transcriptsYesSnippets and summariesVariesNo
Runs on your machine, no accountYesNoNo (hosted API)No (hosted)
Works inside your existing AI clientYesSeparate appYesPartly
CostFree, open source (MIT)Subscription or bundledMetered API keySubscription

Based on each vendor's public docs, October 2026. If something is out of date, open an issue.

When to use what

  • Built-in AI search — Quick casual lookups where you don't need to cite your sources
  • Search APIs — You only need ranked links. Pair one with this tool (any of them plugs in as a provider) to also read pages and check citations
  • Paper tools — Browsing one database of academic papers
  • web-researcher-mcp — Anything where your reputation is attached to the research: client work, court filings, publications, grant proposals, medical decisions, journalism

What your AI can do with this

[37 tools organized by outcome — catch fake citations, cross-check models, track topics over time, search filings and case law]

ToolWhat it does
web_searchSearch the web — optionally restricted to only the sources you trust via lenses
scrape_pageRead any URL in full — web pages, PDFs, Word docs, slideshows, YouTube transcripts, Hacker News threads (read natively via the HN API); supports mode: raw for verbatim, unsanitized source (e.g. inspecting JSON or HTML)
search_and_scrapeSearch and then read the best results — with quality scoring to surface the most reliable sources
image_searchFind images by size, type, color, or format
news_searchSearch recent news with date controls and source filtering
academic_searchFind real papers with real DOIs — authors, citation counts, open-access links
paper_fulltextFetch a paper's full text in one call from its DOI, Semantic Scholar ID, or URL — no need to chain academic_search then scrape_page
citation_graphWalk a paper's citation neighborhood — works it cites and works that cite it, with intent/influence signals
patent_searchSearch patent offices (US, Europe, international) with classification codes
filing_searchSearch SEC EDGAR for US public-company filings (10-K, 10-Q, 8-K, …) — or pull structured XBRL company facts
legal_searchSearch US court opinions and dockets via CourtListener — real cases with real citations
econ_searchLook up economic data — World Bank global development indicators, OECD economic indicators, Eurostat European statistics (all keyless), and FRED US macro series (GDP, CPI, unemployment, rates; requires FRED_API_KEY)
clinical_searchSearch ClinicalTrials.gov — clinical-trial registrations with status, phase, sponsor, and whether results are posted (discovery, not medical advice)
monarch_searchQuery the Monarch Initiative biomedical knowledge graph — rank diseases and genes by phenotype similarity, look up disease/gene/phenotype entities, traverse gene-disease-phenotype associations
awesome_list_searchSearch the ecosyste.ms Awesome API for community-curated "awesome-*" lists on a GitHub topic — structured, filterable coverage (stars, curated-entry count, topics) beyond free-text search
local_searchSearch for physical places (restaurants, shops, services, points of interest) by local intent query — structured POI details and descriptions. Requires BRAVE_API_KEY
brand_researchResearch a company's complete brand identity — colors (hex), logos, typography, tone of voice, and social handles — from any domain or company name. Returns structured JSON for AI content generation. No API key required; BrandFetch key optional for richer data
company_reconOSINT company reconnaissance — Certificate Transparency log SANs, Wayback Machine historical URL inventory, derived subdomains, and a web-search company summary. Each phase fails soft and is independently selectable
verify_citationCheck a citation before you rely on it — does it exist, match a real record, and is it retracted or a dead link? Evidence, not a verdict
audit_bibliographyAudit a whole reference list in one pass — paste a CSL-JSON/RIS/BibTeX file (or a session) and get per-entry + corpus-level flags for retracted, dead-link, and unverifiable citations
verify_recommendationAudit an AI-generated recommendation list (listicle, product ranking) for self-promotion, author conflicts of interest, domain reputation, and dead links — catches GEO-gamed picks. Evidence, not a verdict
archive_sourceCapture a fresh Internet Archive (Wayback Machine) snapshot of a URL via Save Page Now so a cited source stays verifiable if the page later changes or disappears — returns snapshot URL + timestamp (write tool)
sequential_searchMulti-step deep research — your AI remembers what it already found and builds on it
get_research_sessionRecover a research session after context loss — picks up right where you left off
research_exportExport a research session as a shareable report (markdown or JSON), with full per-step provenance
format_bibliographyTurn collected sources into a formatted bibliography — APA, MLA, BibTeX, RIS, or CSL-JSON (Zotero/EndNote/Mendeley-ready)
research_panelAsk the same question to a panel of independently configured LLMs and compare answers — consensus, contradictions, and model-unique points, computed deterministically, never smoothed over by an arbiter model

Most tools above are always available. A few activate only when the right provider or config is present: citation_graph and research_panel require at least one configured backing provider; filing_search requires EDGAR_CONTACT_EMAIL; local_search requires BRAVE_API_KEY.

Opt-in tools. These stay off until you turn the feature on. Personal-data features also need recorded consent.

ToolWhat it doesTurn on with
site_login, site_logoutSave or remove a login (cookies or a browser profile) so scrape_page can read pages behind it. Encrypted, per user.COOKIE_VAULT_ENABLED=true
monitor_query_save, monitor_query_checkSave a query, then ask later for only the results that are newMONITORING_ENABLED=true
memory_save, memory_recallKeep findings across sessions, per user, with a retention limitMEMORY_ENABLED=true
workspace_contribute, workspace_readShare findings into a team workspace, with provenanceWORKSPACES_ENABLED=true
get_my_analyticsSee your own usage statsUSER_ANALYTICS_ENABLED=true

See docs/TOOLS.md for the authoritative, CI-verified tool list and full schemas.

Ready-made research templates

The server also ships guided prompt templates your AI assistant can pull in with one click — they walk it through a proven, multi-step process so you don't have to spell out every instruction:

TemplateWhat it guides your AI to do
comprehensive-researchRun a structured, multi-step deep dive on a topic
fact-checkVerify a claim against multiple independent sources
competitive-analysisSize up a company and its market (news, patents, web)
literature-reviewSystematically review academic literature on a topic
brand-guidelinesResearch a brand and produce use-case-specific creative direction (landing page, email, video brief) — calls brand_research and interprets the structured JSON for you
company-reconDeep OSINT reconnaissance on a company — maps infrastructure, filings, personnel, and public footprint
rare-disease-researchRare-disease differential and gene-disease research over the Monarch knowledge graph, corroborated with literature and trials
research-panel-factcheckFact-check a claim across a panel of LLMs and chase every disagreement
research-panel-synthesisSynthesize one answer across a panel of LLMs, treating contradictions as uncertainty
curriculum-researchResearch a subject's syllabus coverage, institutional climate, and academic-freedom context — calls web_search with the curriculum lens

In most AI apps these show up wherever you pick a prompt or "/" command. The server exposes live status resources (stats://tools, stats://sessions, stats://rate-limits, stats://providers), a lens catalog (lenses://catalog), diagnostics (diagnostics://errors/recent, diagnostics://health, diagnostics://panel/spend), and a large-payload artifact store (research://artifact/{id}) so you — or your AI — can check usage, limits, and which providers are active. See docs/DEPLOYMENT.md for the full list.

Quick Start

Option 1: Homebrew (macOS / Linux — recommended)

bash
brew install zoharbabin/tap/web-researcher-mcpclaude mcp add --scope user web-researcher -- web-researcher-mcp

Homebrew handles trust, updates, and PATH for you — no signing warnings.

Option 2: One-command install (any OS — no dev tools needed)

macOS / Linux:

bash
curl -fsSL https://raw.githubusercontent.com/zoharbabin/web-researcher-mcp/main/install.sh | sh

Windows (PowerShell):

powershell
powershell -ExecutionPolicy Bypass -c "irm https://raw.githubusercontent.com/zoharbabin/web-researcher-mcp/main/install.ps1 | iex"

Downloads the binary, verifies its SHA-256 checksum against the signed release, puts it on your PATH, and registers it with Claude Code if installed. Customize the install location:

bash
INSTALL_DIR=/opt/tools curl -fsSL https://raw.githubusercontent.com/zoharbabin/web-researcher-mcp/main/install.sh | sh
Other install methods

AUR (Arch Linux):

bash
# Using any AUR helper (yay, paru, etc.)yay -S web-researcher-mcp

Or manually: git clone https://aur.archlinux.org/web-researcher-mcp.git && cd web-researcher-mcp && makepkg -si

Nix / NixOS:

bash
# Run without installingnix run github:zoharbabin/web-researcher-mcp
# Add to your flake inputsnix profile install github:zoharbabin/web-researcher-mcp

See packaging/nix/flake.nix for NixOS module usage.

Continue.dev:
Add to your Continue ~/.continue/config.json:

json
{  "mcpServers": {    "web-researcher": {      "command": "uvx",      "args": ["web-researcher-mcp"]    }  }}

Or copy packaging/continue/config.json as a starting point.

WinGet (Windows):

powershell
winget install zoharbabin.web-researcher-mcp

Scoop (Windows):

powershell
scoop bucket add zoharbabin https://github.com/zoharbabin/scoop-bucketscoop install web-researcher-mcp

Chocolatey (Windows):

powershell
choco install web-researcher-mcp

Homebrew Cask (macOS — Developer ID-signed + notarized binary):

bash
brew install --cask zoharbabin/tap/web-researcher-mcp

The cask ships the notarized darwin binary (Gatekeeper-clean). Most users want the formula above (brew install zoharbabin/tap/web-researcher-mcp), which the bare name resolves to; pass --cask explicitly for the notarized artifact.

Go install (if you have Go):

bash
go install github.com/zoharbabin/web-researcher-mcp/cmd/web-researcher-mcp@latestclaude mcp add --scope user web-researcher -- web-researcher-mcp

Docker:

bash
# STDIO mode needs -i so the container's stdin stays attached for MCP JSON-RPCdocker run -i --rm \           -e SEARCH_PROVIDER=brave \           -e BRAVE_API_KEY=YOUR_KEY \           docker.io/zoharbabin/web-researcher-mcp:latest

Build from source:

bash
git clone https://github.com/zoharbabin/web-researcher-mcp.gitcd web-researcher-mcpgo build -o web-researcher-mcp ./cmd/web-researcher-mcp

Connect to Your AI Assistant

The install script registers with Claude Code automatically. For other apps, add to your AI's config file:

json
{  "mcpServers": {    "web-researcher": {      "command": "web-researcher-mcp",      "env": {        "SEARCH_PROVIDER": "brave",        "BRAVE_API_KEY": "YOUR_BRAVE_API_KEY"      }    }  }}

No key yet? Leave env out. DuckDuckGo works with no setup.

Other clients:

ClientWhere
Gemini CLIgemini mcp add web-researcher uvx web-researcher-mcp, or the JSON block above in ~/.gemini/settings.json
Codex~/.codex/config.toml: [mcp_servers.web-researcher] with command = "uvx" and args = ["web-researcher-mcp"]

Swap in any provider from the Configuration table by setting SEARCH_PROVIDER and that provider's key. Done — your AI assistant now has access to all research tools.

Configuration

[30+ providers across web, academic, patent, legal, economic, and clinical domains — with automatic failover and STDIO/HTTP·Docker deployment]

No API key required. DuckDuckGo is the built-in zero-config fallback — install and go. To raise result quality and unlock image/news search, add any one of the providers below. They're all optional and interchangeable — pick whichever you already use or prefer; the server treats them equally.

Search providers

Set SEARCH_PROVIDER=<name> and supply that provider's key. Every provider works with search lenses, and any of them can be combined for automatic failover (see Search Providers).

ProviderSEARCH_PROVIDERKey variable(s)Get a key
DuckDuckGoduckduckgononeBuilt in — zero config
Google PSEgoogleGOOGLE_CUSTOM_SEARCH_API_KEY + GOOGLE_CUSTOM_SEARCH_IDcloud console + engine
BravebraveBRAVE_API_KEYbrave.com/search/api
SerperserperSERPER_API_KEYserper.dev
SearchAPI.iosearchapiSEARCHAPI_API_KEYsearchapi.io
You.comyoucomYOUDOTCOM_API_KEYyou.com/docs/api-reference/search/v1-search
SearXNGsearxngSEARXNG_URLself-hosted
TavilytavilyTAVILY_API_KEYapp.tavily.com
ExaexaEXA_API_KEYdashboard.exa.ai
Hacker NewshackernewsnoneBuilt in — zero config (HN Algolia index)
RedditredditnoneBuilt in — zero config (public RSS)
BlueskyblueskynoneBuilt in — zero config (public AT Protocol API)
GitHubgithubnone (GITHUB_TOKEN optional, raises rate limit)Built in — zero config (public REST Search API)
XquikxquikXQUIK_API_KEYdashboard.xquik.com

Google PSE is ending. Google closed its Custom Search JSON API to new customers and shuts it down on 2027-01-01 (Google). Existing keys work until then. For new setups, use Brave, Serper, SearXNG, or another provider.

Each provider has its own free tier, signup flow, and capability mix (images, news, freshness). See docs/PROVIDERS.md for a full comparison (index classification, capability matrix, quick-pick guide) and docs/API_SETUP.md for step-by-step key setup. Set up more than one and the server fails over automatically — see Search Providers.

When SEARCH_PROVIDER is unset, the server uses Google if its keys are present and otherwise falls back to the zero-config DuckDuckGo provider — so it always works out of the box, with or without keys.

Academic Search (Optional — no signup needed)

Academic search providers (OpenAlex, CrossRef) accept a contact email to unlock faster access via the polite pool — no registration, just an email. See docs/API_SETUP.md for setup and docs/DEPLOYMENT.md for the full variable reference.

With these set, academic_search returns real papers with DOIs, authors, citation counts, and open-access PDF links. Without them, it still works but uses web search as a fallback.

Patent Search (Optional)

Patent providers (EPO, USPTO, The Lens) require API keys for structured patent data. See docs/API_SETUP.md for step-by-step setup and docs/DEPLOYMENT.md for the full variable reference.

With these, patent_search returns structured patent data with classification codes, dates, and inventors. Without them, it falls back to web search.

Advanced: HTTP mode, OAuth, and all other settings

HTTP mode, OAuth, rate limiting, cache, scraping, and observability settings are documented in docs/DEPLOYMENT.md.

Under the Hood

Architecture (for developers and contributors)

The full per-package map and the layered diagram (MCP transports → tool dispatch → service layer → infrastructure) live in ARCHITECTURE.md — kept in one place to avoid drift.

Design Principles (for developers)
  1. Zero global state -- all dependencies injected via constructors
  2. Interface-driven -- every external dependency behind an interface for testing and swapping
  3. Bounded concurrency -- explicit semaphores for external API calls
  4. Defense in depth -- SSRF protection, rate limiting, content sanitization at every layer
  5. Fail loud -- errors returned, never swallowed; validation at boundaries

Search Providers

You choose which search engine powers your research. All of them work with lenses.

ProviderWhole-WebImagesNewsNotes
DuckDuckGoYes——Zero-config default (no API key needed); rate-limited for heavy use
Google PSEYesYesYesClosed to new customers; ends 2027-01-01. Free tier: 100 queries/day
Brave SearchYesYesYesIndependent index; free tier available
Serper.devYesYesYesGoogle-identical results
SearXNGYesYesYesSelf-hosted, privacy-first, air-gapped deployments
SearchAPI.ioYesYesYesUnified API with multiple engine backends
You.comYes—YesWeb and news search via the You.com API
TavilyYes—YesAI-agent search; clean, LLM-ready content
ExaYes—YesNeural/semantic search; also backs academic_search and the optional paid scrape tier
Hacker NewsHN only—YesZero-config (HN Algolia index); searches HN threads, not the full web
RedditReddit only—YesZero-config (public RSS); searches Reddit posts, not the full web
BlueskyBluesky only——Zero-config (public AT Protocol API); searches Bluesky posts, not the full web
GitHubGitHub only—YesZero-config (public REST Search API); searches issues/PRs, not the full web
XquikX/Twitter only—YesSearches X posts, not the full web; needs XQUIK_API_KEY

Multiple Providers (recommended)

Set up multiple search engines so if one has issues, your research doesn't stop:

bash
export SEARCH_ROUTING=brave,serper,duckduckgo

If Brave is down, it automatically tries Serper. If Serper is rate-limited, it falls through to DuckDuckGo. Your research just works.

See docs/PROVIDERS.md for a full provider comparison (index classification, capabilities, free tiers) and docs/DEPLOYMENT.md for advanced routing options (per-topic routing, patent-specific providers, etc.).

Single Provider

If you only have one search API key, that works too — just set it up and go.

Provider Setup Examples

Multi-provider routing (recommended):

bash
export SEARCH_ROUTING=brave,serperexport BRAVE_API_KEY=BSAxxxxxxxxxxexport SERPER_API_KEY=...

Single provider — Brave Search:

bash
export SEARCH_PROVIDER=braveexport BRAVE_API_KEY=BSAxxxxxxxxxx

Single provider — SearXNG (self-hosted, privacy-first):

bash
export SEARCH_PROVIDER=searxngexport SEARXNG_URL=http://localhost:8080

Single provider — Exa:

bash
export SEARCH_PROVIDER=exaexport EXA_API_KEY=...

Single provider — Brave:

bash
export SEARCH_PROVIDER=braveexport BRAVE_API_KEY=BSA...

Any provider from the Configuration table works the same way — set SEARCH_PROVIDER and its key(s).

Search Lenses

Search lenses let you control which websites your AI is allowed to search. Instead of searching the entire web (and getting blogs, spam, and AI-generated junk), a lens restricts results to only the sources you trust for that topic.

Built-in Lenses

LensFocus
docsOfficial documentation and API references only
academicPreprint servers, repositories, open-access journals
academic-extendedPreprint servers, OA aggregators, and repositories beyond core journal indexes
biomedRare-disease and biomedical knowledge-graph sources — ontology portals, gene-disease databases, curated rare-disease registries
clinicalClinical trials, drug safety, evidence-based medicine
curriculumAcademic curriculum data, institutional free speech climate, and global education statistics
securityCVEs, advisories, vulnerability research
investigative_recordsPublic records, corporate filings, FOIA
programmingCode docs, tutorials, Q&A
programming-goggleDeveloper-first results re-ranked by Brave's Programming Goggle — surfaces docs, repos, and authoritative technical content (requires Brave)
devopsInfrastructure and operations — Kubernetes, Docker, Terraform, cloud, CI/CD
newsCurrent events, journalism
techTechnology industry
legalLaw, cases, statutes
medicalHealth, medicine
financeMarkets, filings
scienceResearch, papers
governmentPolicy, regulations
osintOpen-source intelligence — public records, corporate registries, social footprint, infrastructure
awesome-listsCommunity-curated "awesome-*" lists on GitHub — PR-reviewed tool and resource collections across every domain

You can also create your own lenses for any field — just list the domains you trust.

How it works

When you (or your AI) use a lens, results come only from the sites in that lens. For example, using the medical lens means your AI searches PubMed, WHO, NIH, and other clinical sources — never health blogs or supplement ads.

Your AI uses lenses automatically when you ask it to. For example: "Search for recent findings on SGLT2 inhibitors using the clinical lens."

Creating Your Own Lens

Create a directory for your custom lenses and add a JSON file for each one:

json
{  "name": "my-industry",  "description": "Only searches sources I trust for my field",  "domains": [    "trusted-source.com",    "industry-journal.org",    "official-database.gov"  ],  "cx": ""}

Then point the server to your lens directory:

bash
export CUSTOM_LENSES_PATH=/path/to/my-lenses

Your AI will now have my-industry as an available lens. Custom lenses load after the built-in set — a custom lens with the same name as a built-in one overrides it. You can add up to ~10 domains per lens.

Advanced options (optional — most users can ignore these):

  • cx — Marks the lens as scoped by a Google Programmable Search Engine. The lens then skips site: injection. Set that engine as the global GOOGLE_CUSTOM_SEARCH_ID. Google's API ends 2027-01-01, so prefer domains lenses
  • goggle — A Brave Goggle URL for server-side re-ranking (Brave only)

Privacy & Security

Your research queries go directly from your machine to the search provider you chose. They never pass through our servers (we don't have servers). The tool runs entirely on your computer.

Features that store personal data (saved logins, memory, analytics, workspaces) are off by default. Each needs an opt-in, a recorded consent, and encrypted storage.

Technical security details (for enterprise / compliance teams)
  • SSRF protection — blocks internal network access, cloud metadata endpoints, DNS rebinding attacks
  • OAuth 2.1 (HTTP mode) — JWKS token validation, per-tenant isolation, audience/issuer validation
  • Rate limiting (HTTP mode) — per-tenant + global limits to protect upstream APIs
  • Content sanitization — HTML cleaned via whitelist policy, deduplication, quality scoring

For the full threat model, see docs/SECURITY.md.

Setup for Each AI App

Claude Code

Add to your MCP config (~/.claude.json). Set SEARCH_PROVIDER and the matching key for whichever provider you use (see the Configuration table) — this example uses Brave:

json
{  "mcpServers": {    "web-researcher": {      "command": "/path/to/web-researcher-mcp",      "env": {        "SEARCH_PROVIDER": "brave",        "BRAVE_API_KEY": "BSA..."      }    }  }}

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "web-researcher": {      "command": "/path/to/web-researcher-mcp",      "env": {        "SEARCH_PROVIDER": "brave",        "BRAVE_API_KEY": "BSA..."      }    }  }}

Cursor

Add to .cursor/mcp.json in your project root:

json
{  "mcpServers": {    "web-researcher": {      "command": "/path/to/web-researcher-mcp",      "env": {        "SEARCH_PROVIDER": "brave",        "BRAVE_API_KEY": "BSA..."      }    }  }}

HTTP Mode (Teams / Shared Server)

For teams that want one shared instance everyone connects to:

bash
PORT=3000 \OAUTH_ISSUER_URL=https://auth.example.com \OAUTH_AUDIENCE=https://api.example.com \./web-researcher-mcp

Then connect any AI app to http://localhost:3000/mcp/.

Docker Compose Example
yaml
services:  web-researcher:    image: zoharbabin/web-researcher-mcp    ports:      - "3000:3000"    environment:      PORT: "3000"      SEARCH_PROVIDER: brave      BRAVE_API_KEY: ${BRAVE_API_KEY}

Note: Tool behavior is identical across all connection modes (STDIO and HTTP). The only differences are auth (HTTP requires OAuth) and rate limiting (HTTP enforces per-tenant limits; STDIO has only upstream API quotas). See docs/DEPLOYMENT.md for details.

Performance

Searches come back in under a second. Previously-seen results are cached so repeats are instant. Full article extraction works on 95%+ of the web — including sites that try to block bots. Heavy JavaScript sites get a real browser behind the scenes (automatic, no setup needed).

Development

bash
go build -o web-researcher-mcp ./cmd/web-researcher-mcp   # Buildgo test -race ./...                                        # Test (with race detector)make verify                                                # Full CI gate (see Makefile for steps)

The lint, gosec, and govulncheck tools are pinned as go.mod tool directives, so make verify runs them at the exact versions CI uses (no global installs needed). Branch protection requires the Lint, Test, Security, and E2E checks to pass.

See CONTRIBUTING.md for the full development workflow, code style guide, and PR process.

Troubleshooting

Server starts but tools fail with "API key" errors

The server starts even with missing credentials (to allow MCP handshake). Set your API keys in the env block of your MCP client config, not in your shell profile.

Some pages come back empty

For JavaScript-heavy sites, the tool uses a real browser (Chromium). With the binary install it auto-downloads on first use (~200MB). If you already have Chrome installed, set CHROME_PATH to point to it. The Docker image ships with Chromium bundled (CHROME_PATH preset), so JavaScript rendering works out of the box — no download.

Cache serving stale results after upgrade

The disk cache lives at your OS cache directory (e.g., ~/Library/Caches/web-researcher-mcp/ on macOS, ~/.cache/web-researcher-mcp/ on Linux). Delete that directory to clear it, or set CACHE_DIR to a custom path.

Hitting search limits (429 errors)

If your provider's free tier runs out:

  • Switch to a different provider — set SEARCH_PROVIDER to any other option (see Configuration); each has its own free tier
  • Set up multiple providers (e.g. SEARCH_ROUTING=brave,serper) — if one is rate-limited, it automatically falls through to the next
  • Or upgrade your provider's plan
macOS: "Failed to reconnect" / error -32000 after a manual update

This happens only if you replaced the binary by copying new bytes over the existing file in place (cp new /path/to/web-researcher-mcp). On Apple Silicon, macOS caches the binary's ad-hoc code signature against the file, and overwriting it in place can make the next launch get killed before it starts. The official installers (Homebrew, the one-command install.sh, and the Claude Code plugin) avoid this by installing to a fresh file. To fix a manual install, replace it cleanly and re-sign:

bash
rm -f /path/to/web-researcher-mcpcp /path/to/new-build /path/to/web-researcher-mcpcodesign --force -s - /path/to/web-researcher-mcp   # ad-hoc re-sign

Then reconnect your client. (Re-running install.sh does this correctly for you.)

Contributing

Contributions are welcome. Please see CONTRIBUTING.md for code style guidelines, development workflow, and how to submit pull requests.

Documentation

DocumentDescription
ARCHITECTURE.mdDesign decisions, technology stack, dependencies
CONTRIBUTING.mdDevelopment setup, code style, PR workflow
docs/TOOLS.mdTool specifications and parameter schemas
docs/EXAMPLES.mdUsage examples with JSON tool calls
docs/API_SETUP.mdSearch provider API key setup for all providers
docs/SECURITY.mdThreat model, SSRF, auth, compliance (SOC2/GDPR/FedRAMP)
docs/PRIVACY.mdWhat data goes where, third-party processors, retention
docs/DEPLOYMENT.mdBuild, Docker, Kubernetes, client configs, scaling
docs/PYTHON_CLIENT.mdPython SDK — WebResearcherClient reference, sync wrapper, installation
docs/LESSONS_LEARNED.mdNode.js to Go migration story and lessons
docs/SESSION_PERSISTENCE.mdHow sessions survive context loss — design, data flow, citations
docs/MIGRATION.mdMigrating from the deprecated google-researcher-mcp

License

MIT

Built by Zohar Babin, with Go and the Model Context Protocol

Source: README.md at commit 714848f

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package type cannot run in the sandbox.

Version history

8
  1. v1.50.4LatestOct 25, 2026
  2. v1.50.3Oct 14, 2026
  3. v1.50.2Oct 14, 2026
  4. v1.50.1Oct 14, 2026
  5. v1.50.0Oct 13, 2026
  6. v1.49.5Oct 11, 2026
  7. v1.49.4Sep 29, 2026
  8. v1.49.3Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts