
Web Researcher MCP
io.github.zoharbabin由 GitHub 账号 zoharbabin 发布v1.50.4更新于 Oct 25, 2026
Your AI research assistant that cites real sources and stays honest
概览
本地运行的研究类 MCP 服务器,让助手搜索网络与一手来源、读取完整页面,并在依赖引用前核验其真实性。
- 可以做什么
- 搜索网页、新闻、图片,并可限定在可信站点范围内,支持多搜索源自动切换
- 检索一手来源:学术论文与全文、引用关系图、专利、SEC 文件、美国法院记录、经济数据、临床试验与生物医学图谱
- 读取完整页面与文档:网页、PDF、Word 与 PowerPoint 文件、YouTube 文字稿和 Hacker News 讨论串
- 核验来源:检查单条引用、批量审计参考文献、审查推荐清单,并为页面抓取存档快照
- 跨对话保留研究进度、对比多个模型的回答、按 APA、MLA、BibTeX、RIS 或 CSL-JSON 导出引用
- 可选:读取需登录才能访问的页面,并运行已保存查询的监控
- 适用场景
- 适合研究结论需要经得起检验的场合:客户交付物、论文发表、法律或基金申请、新闻报道,以及任何需要可点击且已核实来源的说法。也适合从公司文件、法院、专利和临床试验中获取结构化记录,而不只是摘要片段。
- 运行要求
- 以本地进程(stdio)运行,可通过 uvx、pip、Homebrew、Docker 或签名二进制安装,无需账号。DuckDuckGo、Hacker News、Reddit、Bluesky 和 GitHub 搜索无需密钥。可选密钥按搜索源配置:BRAVE_API_KEY、SERPER_API_KEY、SEARCHAPI_API_KEY、TAVILY_API_KEY、EXA_API_KEY、XQUIK_API_KEY、GOOGLE_CUSTOM_SEARCH_API_KEY 与 GOOGLE_CUSTOM_SEARCH_ID、SEARXNG_URL、FRED_API_KEY、COURTLISTENER_API_TOKEN、EDGAR_CONTACT_EMAIL。需要网络访问。
安装
在 SourceWeft 中
- 打开 控制台中的 Web Researcher MCP,将其添加到工作区。
- 为需要使用其工具的对话启用该服务。
Desktop only,通过 STDIO。 STDIO 服务会启动本地进程,因此需要 SourceWeft 桌面宿主。
其他 MCP 客户端
参照 仓库 中的启动说明。
README
web-researcher-mcp
Your AI research assistant. It searches, reads what you can open, and checks its sources.
Search the web and primary sources: SEC filings, court records, patents, clinical trials, full-text papers.
Read whole pages, including pages behind your own logins, like LinkedIn and X.
Check every citation, keep your research across chats, and run it all on your machine.
No API key needed to start.
⭐ If you're tired of AI making things up, and web-researcher-mcp helps you, give us a star ⭐ — it helps more teams discover the project.
[Cartoon: an AI genie pulls a citation out of a hat, and it poofs. Then real tool runs catch fake citations.]
A cartoon of the problem, then real tool output. Watch the 43-second video.
[CI] [Go Report Card] [OpenSSF Scorecard] [Go Reference] [License: MIT] [Release] [Docker] [PyPI] [web-researcher-mcp MCP server] [GitHub Stars] [MCP Toplist]
Get started in 30 seconds
Python users — uvx (no compile, any OS):
uv fetches the right prebuilt binary for your platform and runs it — no Go, no compile, no manual PATH. Point any MCP client at uvx web-researcher-mcp. Also works with uv tool install web-researcher-mcp or pip install web-researcher-mcp.
macOS (Homebrew):
macOS / Linux (no package manager):
Windows (PowerShell):
No dev tools needed — every method ships the same signed binary (the PyPI wheels vendor it; the others download it and verify its checksum) and puts it on your PATH. The curl/PowerShell installers also register it with Claude Code automatically when the claude CLI is present; Homebrew installs the binary, so run the claude mcp add line above to connect it.
One-click install:
[Add to Cursor] [Install in VS Code] [Add to LM Studio]
The Cursor / VS Code / LM Studio buttons install the zero-config uvx setup (your editor prompts to confirm before adding it; needs uv — see above). It runs DuckDuckGo web search with no API key — great to try instantly; image_search/news_search and richer providers need a key (2 min, see Configuration). Claude Desktop: download the .mcpb bundle for your platform and double-click it (Settings → Extensions), or use the uvx line above.
Using a different MCP client or want to pass API keys? See Connect to Your AI Assistant for the per-app config, and Configuration to pick a search provider.
Your AI can now search the web and primary sources, read pages (including ones behind your logins), check citations, and run multi-step research. Pick the sources you trust.
Python SDK
Full documentation: docs/PYTHON_CLIENT.md
Sync wrapper (for scripts and notebooks that don't use async):
What it does
Why does this exist?
AI answers look sourced and often aren't.
- Courts: the Charlotin database lists over 2,200 court decisions that involve AI-hallucinated content. From 2027-01-01, California SB 574 requires attorneys to personally verify every citation in a court filing.
- Search: a 2026 WashU audit found that about 1 in 9 verifiable claims in Google AI Overviews was not backed by the page it cited (the authors call this an upper bound). The Tow Center at CJR tested eight AI search engines and found all of them bad at citing news.
- Your work: if it gets cited, published, filed, or shown to a client, "probably real" is not enough.
What this does about it: your AI reads the real pages and records, from sources you choose, and then checks the citations. Every claim traces to a link you can open.
Works with Claude, Claude Desktop, Cursor, VS Code, Codex, Gemini CLI, and any AI assistant that supports MCP.
Who uses this
- Academic researchers — "I need a literature review with real DOIs, not made-up citations"
- Business analysts — "My deliverable needs sources a client can actually click and verify"
- Lawyers — "If I cite a case that doesn't exist, I get fined $50,000"
- Journalists — "I need to cross-check government records and court filings, not Perplexity summaries"
- Medical researchers — "Clinical decisions based on a health blog could hurt someone"
- Graduate students — "I spent 3 hours tracking down a citation my AI invented"
- Market and sales researchers — "The best context is on pages I can only open when I'm signed in"
- Enterprise teams — "Our competitive research can't go through a third party's servers"
- Developers building agents — "I want search and page reading without a per-query bill or a vendor lock-in"
How It Compares
Based on each vendor's public docs, October 2026. If something is out of date, open an issue.
When to use what
- Built-in AI search — Quick casual lookups where you don't need to cite your sources
- Search APIs — You only need ranked links. Pair one with this tool (any of them plugs in as a provider) to also read pages and check citations
- Paper tools — Browsing one database of academic papers
- web-researcher-mcp — Anything where your reputation is attached to the research: client work, court filings, publications, grant proposals, medical decisions, journalism
What your AI can do with this
Most tools above are always available. A few activate only when the right provider or config is present: citation_graph and research_panel require at least one configured backing provider; filing_search requires EDGAR_CONTACT_EMAIL; local_search requires BRAVE_API_KEY.
Opt-in tools. These stay off until you turn the feature on. Personal-data features also need recorded consent.
See docs/TOOLS.md for the authoritative, CI-verified tool list and full schemas.
Ready-made research templates
The server also ships guided prompt templates your AI assistant can pull in with one click — they walk it through a proven, multi-step process so you don't have to spell out every instruction:
In most AI apps these show up wherever you pick a prompt or "/" command. The server exposes live status resources (stats://tools, stats://sessions, stats://rate-limits, stats://providers), a lens catalog (lenses://catalog), diagnostics (diagnostics://errors/recent, diagnostics://health, diagnostics://panel/spend), and a large-payload artifact store (research://artifact/{id}) so you — or your AI — can check usage, limits, and which providers are active. See docs/DEPLOYMENT.md for the full list.
Quick Start
Option 1: Homebrew (macOS / Linux — recommended)
Homebrew handles trust, updates, and PATH for you — no signing warnings.
Option 2: One-command install (any OS — no dev tools needed)
macOS / Linux:
Windows (PowerShell):
Downloads the binary, verifies its SHA-256 checksum against the signed release, puts it on your PATH, and registers it with Claude Code if installed. Customize the install location:
Other install methods
AUR (Arch Linux):
Or manually: git clone https://aur.archlinux.org/web-researcher-mcp.git && cd web-researcher-mcp && makepkg -si
Nix / NixOS:
See packaging/nix/flake.nix for NixOS module usage.
Continue.dev:
Add to your Continue ~/.continue/config.json:
Or copy packaging/continue/config.json as a starting point.
WinGet (Windows):
Scoop (Windows):
Chocolatey (Windows):
Homebrew Cask (macOS — Developer ID-signed + notarized binary):
The cask ships the notarized darwin binary (Gatekeeper-clean). Most users want the formula above (brew install zoharbabin/tap/web-researcher-mcp), which the bare name resolves to; pass --cask explicitly for the notarized artifact.
Go install (if you have Go):
Docker:
Build from source:
Connect to Your AI Assistant
The install script registers with Claude Code automatically. For other apps, add to your AI's config file:
No key yet? Leave env out. DuckDuckGo works with no setup.
Other clients:
Swap in any provider from the Configuration table by setting SEARCH_PROVIDER and that provider's key. Done — your AI assistant now has access to all research tools.
Configuration
No API key required. DuckDuckGo is the built-in zero-config fallback — install and go. To raise result quality and unlock image/news search, add any one of the providers below. They're all optional and interchangeable — pick whichever you already use or prefer; the server treats them equally.
Search providers
Set SEARCH_PROVIDER=<name> and supply that provider's key. Every provider works with search lenses, and any of them can be combined for automatic failover (see Search Providers).
Google PSE is ending. Google closed its Custom Search JSON API to new customers and shuts it down on 2027-01-01 (Google). Existing keys work until then. For new setups, use Brave, Serper, SearXNG, or another provider.
Each provider has its own free tier, signup flow, and capability mix (images, news, freshness). See docs/PROVIDERS.md for a full comparison (index classification, capability matrix, quick-pick guide) and docs/API_SETUP.md for step-by-step key setup. Set up more than one and the server fails over automatically — see Search Providers.
When SEARCH_PROVIDER is unset, the server uses Google if its keys are present and otherwise falls back to the zero-config DuckDuckGo provider — so it always works out of the box, with or without keys.
Academic Search (Optional — no signup needed)
Academic search providers (OpenAlex, CrossRef) accept a contact email to unlock faster access via the polite pool — no registration, just an email. See docs/API_SETUP.md for setup and docs/DEPLOYMENT.md for the full variable reference.
With these set,
academic_searchreturns real papers with DOIs, authors, citation counts, and open-access PDF links. Without them, it still works but uses web search as a fallback.
Patent Search (Optional)
Patent providers (EPO, USPTO, The Lens) require API keys for structured patent data. See docs/API_SETUP.md for step-by-step setup and docs/DEPLOYMENT.md for the full variable reference.
With these,
patent_searchreturns structured patent data with classification codes, dates, and inventors. Without them, it falls back to web search.
Advanced: HTTP mode, OAuth, and all other settings
HTTP mode, OAuth, rate limiting, cache, scraping, and observability settings are documented in docs/DEPLOYMENT.md.
Under the Hood
Architecture (for developers and contributors)
The full per-package map and the layered diagram (MCP transports → tool dispatch → service layer → infrastructure) live in ARCHITECTURE.md — kept in one place to avoid drift.
Design Principles (for developers)
- Zero global state -- all dependencies injected via constructors
- Interface-driven -- every external dependency behind an interface for testing and swapping
- Bounded concurrency -- explicit semaphores for external API calls
- Defense in depth -- SSRF protection, rate limiting, content sanitization at every layer
- Fail loud -- errors returned, never swallowed; validation at boundaries
Search Providers
You choose which search engine powers your research. All of them work with lenses.
Multiple Providers (recommended)
Set up multiple search engines so if one has issues, your research doesn't stop:
If Brave is down, it automatically tries Serper. If Serper is rate-limited, it falls through to DuckDuckGo. Your research just works.
See docs/PROVIDERS.md for a full provider comparison (index classification, capabilities, free tiers) and docs/DEPLOYMENT.md for advanced routing options (per-topic routing, patent-specific providers, etc.).
Single Provider
If you only have one search API key, that works too — just set it up and go.
Provider Setup Examples
Multi-provider routing (recommended):
Single provider — Brave Search:
Single provider — SearXNG (self-hosted, privacy-first):
Single provider — Exa:
Single provider — Brave:
Any provider from the Configuration table works the same way — set SEARCH_PROVIDER and its key(s).
Search Lenses
Search lenses let you control which websites your AI is allowed to search. Instead of searching the entire web (and getting blogs, spam, and AI-generated junk), a lens restricts results to only the sources you trust for that topic.
Built-in Lenses
You can also create your own lenses for any field — just list the domains you trust.
How it works
When you (or your AI) use a lens, results come only from the sites in that lens. For example, using the medical lens means your AI searches PubMed, WHO, NIH, and other clinical sources — never health blogs or supplement ads.
Your AI uses lenses automatically when you ask it to. For example: "Search for recent findings on SGLT2 inhibitors using the clinical lens."
Creating Your Own Lens
Create a directory for your custom lenses and add a JSON file for each one:
Then point the server to your lens directory:
Your AI will now have my-industry as an available lens. Custom lenses load after the built-in set — a custom lens with the same name as a built-in one overrides it. You can add up to ~10 domains per lens.
Advanced options (optional — most users can ignore these):
- cx — Marks the lens as scoped by a Google Programmable Search Engine. The lens then skips
site:injection. Set that engine as the globalGOOGLE_CUSTOM_SEARCH_ID. Google's API ends 2027-01-01, so preferdomainslenses - goggle — A Brave Goggle URL for server-side re-ranking (Brave only)
Privacy & Security
Your research queries go directly from your machine to the search provider you chose. They never pass through our servers (we don't have servers). The tool runs entirely on your computer.
Features that store personal data (saved logins, memory, analytics, workspaces) are off by default. Each needs an opt-in, a recorded consent, and encrypted storage.
Technical security details (for enterprise / compliance teams)
- SSRF protection — blocks internal network access, cloud metadata endpoints, DNS rebinding attacks
- OAuth 2.1 (HTTP mode) — JWKS token validation, per-tenant isolation, audience/issuer validation
- Rate limiting (HTTP mode) — per-tenant + global limits to protect upstream APIs
- Content sanitization — HTML cleaned via whitelist policy, deduplication, quality scoring
For the full threat model, see docs/SECURITY.md.
Setup for Each AI App
Claude Code
Add to your MCP config (~/.claude.json). Set SEARCH_PROVIDER and the matching key for whichever provider you use (see the Configuration table) — this example uses Brave:
Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
Cursor
Add to .cursor/mcp.json in your project root:
HTTP Mode (Teams / Shared Server)
For teams that want one shared instance everyone connects to:
Then connect any AI app to http://localhost:3000/mcp/.
Docker Compose Example
Note: Tool behavior is identical across all connection modes (STDIO and HTTP). The only differences are auth (HTTP requires OAuth) and rate limiting (HTTP enforces per-tenant limits; STDIO has only upstream API quotas). See docs/DEPLOYMENT.md for details.
Performance
Searches come back in under a second. Previously-seen results are cached so repeats are instant. Full article extraction works on 95%+ of the web — including sites that try to block bots. Heavy JavaScript sites get a real browser behind the scenes (automatic, no setup needed).
Development
The lint, gosec, and govulncheck tools are pinned as go.mod tool directives, so make verify runs them at the exact versions CI uses (no global installs needed). Branch protection requires the Lint, Test, Security, and E2E checks to pass.
See CONTRIBUTING.md for the full development workflow, code style guide, and PR process.
Troubleshooting
Server starts but tools fail with "API key" errors
The server starts even with missing credentials (to allow MCP handshake). Set your API keys in the env block of your MCP client config, not in your shell profile.
Some pages come back empty
For JavaScript-heavy sites, the tool uses a real browser (Chromium). With the binary install it auto-downloads on first use (~200MB). If you already have Chrome installed, set CHROME_PATH to point to it. The Docker image ships with Chromium bundled (CHROME_PATH preset), so JavaScript rendering works out of the box — no download.
Cache serving stale results after upgrade
The disk cache lives at your OS cache directory (e.g., ~/Library/Caches/web-researcher-mcp/ on macOS, ~/.cache/web-researcher-mcp/ on Linux). Delete that directory to clear it, or set CACHE_DIR to a custom path.
Hitting search limits (429 errors)
If your provider's free tier runs out:
- Switch to a different provider — set
SEARCH_PROVIDERto any other option (see Configuration); each has its own free tier - Set up multiple providers (e.g.
SEARCH_ROUTING=brave,serper) — if one is rate-limited, it automatically falls through to the next - Or upgrade your provider's plan
macOS: "Failed to reconnect" / error -32000 after a manual update
This happens only if you replaced the binary by copying new bytes over the existing file in place (cp new /path/to/web-researcher-mcp). On Apple Silicon, macOS caches the binary's ad-hoc code signature against the file, and overwriting it in place can make the next launch get killed before it starts. The official installers (Homebrew, the one-command install.sh, and the Claude Code plugin) avoid this by installing to a fresh file. To fix a manual install, replace it cleanly and re-sign:
Then reconnect your client. (Re-running install.sh does this correctly for you.)
Contributing
Contributions are welcome. Please see CONTRIBUTING.md for code style guidelines, development workflow, and how to submit pull requests.
Documentation
License
Built by Zohar Babin, with Go and the Model Context Protocol
来源:README.md,提交 714848f
工具
0版本历史
8- v1.50.4最新Oct 25, 2026
- v1.50.3Oct 14, 2026
- v1.50.2Oct 14, 2026
- v1.50.1Oct 14, 2026
- v1.50.0Oct 13, 2026
- v1.49.5Oct 11, 2026
- v1.49.4Sep 29, 2026
- v1.49.3Sep 16, 2026
评分
已满足适用检查项的 50%
该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。
- 近 30 天内可连通25 分
请保持端点能够响应 MCP 握手;SourceWeft 每 30 天探测一次。
- 已声明认证方式10 分
请在注册中心条目中声明凭据请求头,或保持端点能够响应探测,以便判定其认证方式。
- 已列出工具15 分
请让服务器在无凭据时响应 tools/list,或发布可在沙箱中无凭据启动的软件包。
- 描述必需15 分
- 图标10 分
- 文档15 分
- 许可证10 分