exa-search-server

https://mcp.exa.ai/mcp · scanned 2026-10-17

None of its 2 tools were flagged. They read like lookups and searches.

19/ 100 · heuristic risk · Low

2 tools · 0 flagged

Runs code or commands0
Moves money0
Touches credentials0
Deletes0
Sends data out1
Exports data0
Writes or changes0

web_fetch_exa19 · Low
Sends data out
Read a webpage's full content as clean markdown. Use after web_search_exa when highlights are insufficient or to read any URL. Best for: Extracting full content from known URLs. Batch multiple URLs in one call. Returns: Clean text content and metadata from the page(s).
- Description mentions “any url” → sends data out
- Server annotation openWorldHint → sends data out
web_search_exa0 · Low
Search the web for any topic and get clean, ready-to-use content. Best for: Finding current information, news, facts, people, companies, or answering questions about any topic. Returns: Clean text content from top search results. Query tips: describe the ideal page, not keywords. "blog post compari…

Vulnify checks each tool call before it runs: ALLOW, REVIEW or BLOCK, with the reason logged.

Try Vulnify free Scan again

Badge for your README

Markdown

[![Scanned by Vulnify](https://api.vulnify.io/public/mcp-scanner/servers/mcp-exa-ai-mcp.svg)](https://www.vulnify.io/scanner/mcp-exa-ai-mcp?utm_source=badge&utm_medium=readme&utm_campaign=scanner-badge)

Automated heuristic result, scanned on 2026-10-17. It is based only on the tool names, descriptions, schemas and annotations this server publishes; no tool was called. It is not a security audit or certification, and not an endorsement of or accusation against the server or its operator. A high score is not a vulnerability finding, and a low score does not mean the server is safe. Vulnify is not affiliated with this server or its operator; names and marks belong to their owners. Server owner? Write to security@vulnify.io from an address at the server's domain to remove or correct this page, or scan it again to update it. We reply within 5 business days.

To exclude your server (and its subdomains) from the scanner and remove its public page, write to security@vulnify.io from an address at its domain. We process requests within 5 business days: the page stops being shown and its stored result is deleted. To fix an error instead, tell us what's wrong or scan the server again.