SearXNG MCP Server

searxng-mcp-server

Self-hosted SearXNG metasearch for MCP clients — six tools (web, image, news, video, music, page fetch) with no API keys and no tracking.

Documentation · Changelog · npm · SearXNG · Report an issue

Why

Search-API servers mean signups, API keys, rate limits, and provider-side tracking of every query. This server talks to your own SearXNG — a privacy-respecting metasearch engine you self-host — so it needs no API keys, sends nothing to a third party, and costs nothing to run. fetch_content is hardened for exactly this job: SSRF and DNS-rebind guarding on every redirect hop, and prompt-injection wrapping on all web output.

Also ships MCP icons metadata on the server and every tool — self-contained data URIs, rendered by icon-aware clients.

A typical session

# Arguments are JSON in real MCP calls; this shows the flow:
search "rust async"                          → ranked results + answers + infoboxes
news_search "linux" (time_range: "week")     → fresh articles
fetch_content https://result-url.example     → the page as clean Markdown
image_search "red panda"                     → direct image links + thumbnails

Architecture

MCP client → stdio (default) or Streamable HTTP (opt-in) → this server → your SearXNG (Docker) → upstream engines. Page fetches go directly to the public web, SSRF-guarded.

flowchart LR
    C["MCP client<br/>(Claude, Cursor, OpenCode…)"] -->|"stdio (JSON-RPC)"| S["searxng-mcp-server"]
    C -.->|"HTTP /mcp (opt-in)"| S
    S -->|"search, *_search"| X["SearXNG<br/>(self-hosted, Docker)"]
    X --> E["engines<br/>(Google, Bing, DDG…)"]
    S -->|"fetch_content<br/>(SSRF-guarded)"| W["public web"]

Requirements

• Node >= 22.19 (the npx runtime); Docker, for the SearXNG stack

Quick start

1. Run SearXNG

printf 'SEARXNG_SECRET=%s\n' "$(openssl rand -hex 32)" > .env
docker compose up -d
curl -fsS 'http://localhost:8888/search?q=test&format=json' | head -c 80

The bundled docker-compose.yml enables the JSON API and binds 127.0.0.1 only — the API is unauthenticated, so never expose the port publicly. Engine credentials (e.g. an OpenAlex api_key) belong in searxng/settings.yml.

2. Add to any MCP client

Shortened. The full README is on GitHub.