{
  "slug": "io-github-tavily-ai-tavily-mcp",
  "name": "io.github.tavily-ai/tavily-mcp",
  "title": "tavily-mcp",
  "description": "MCP server for advanced web search using Tavily",
  "version": "0.2.15",
  "publishedAt": "2026-01-26T21:26:43.076Z",
  "updatedAt": "2026-01-26T21:26:43.076Z",
  "repoUrl": "https://github.com/tavily-ai/tavily-mcp",
  "websiteUrl": null,
  "namespace": {
    "type": "github",
    "owner": "tavily-ai"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "npm",
      "identifier": "tavily-mcp",
      "version": "0.2.15",
      "transport": "stdio",
      "runtimeHint": null
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "TAVILY_API_KEY",
      "isSecret": true,
      "isRequired": true,
      "description": "Your Tavily API key from tavily.com"
    },
    {
      "name": "DEFAULT_PARAMETERS",
      "isSecret": false,
      "isRequired": false,
      "description": "JSON string with default search parameters (e.g., {\"include_images\": true, \"max_results\": 15})"
    }
  ],
  "category": "search-web",
  "subcategory": "search",
  "company": "tavily",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/tavily-ai/tavily-mcp"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "info",
      "detail": "Asks for 1 secret: TAVILY_API_KEY"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via GitHub account tavily-ai"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "tavily-mcp@0.2.15 runs nothing at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 3 files in tavily-mcp@0.2.15: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 3 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (npm)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"tavily-mcp\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"tavily-mcp@0.2.15\"\n      ],\n      \"env\": {\n        \"TAVILY_API_KEY\": \"<your value>\"\n      }\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 2462,
  "archived": false,
  "pushedAt": "2026-10-28T01:38:09Z",
  "review": {
    "package": "tavily-mcp",
    "version": "0.2.15",
    "at": "2026-10-31",
    "files": 1,
    "lines": 667,
    "verdict": "pass",
    "summary": "Tavily gives the AI web search, page extraction, site crawling and site mapping. Every request goes only to Tavily's API with your search text or URLs and your Tavily API key; the actual web fetching happens on Tavily's servers. It reads no files apart from an optional .env and runs no commands.",
    "hosts": [
      {
        "host": "api.tavily.com (/search, /extract, /crawl, /map)",
        "when": "only when a tool is called",
        "sends": "query / URLs / crawl instructions and options; TAVILY_API_KEY both as Bearer header and as api_key in the JSON body; X-Client-Source: MCP"
      }
    ],
    "env": [
      {
        "name": "TAVILY_API_KEY",
        "sent_to": "api.tavily.com (Authorization header and request body)"
      },
      {
        "name": "DEFAULT_PARAMETERS",
        "sent_to": "local; JSON that overrides tavily_search parameters before sending"
      }
    ],
    "local": "dotenv loads a .env file from the working directory at startup (index.js:10). No other file access. URLs to crawl/extract are fetched by Tavily's servers, not locally, so there is no local SSRF.",
    "exec": "None.",
    "telemetry": "None.",
    "tools": [
      "tavily_search",
      "tavily_extract",
      "tavily_crawl",
      "tavily_map"
    ],
    "toolText": "clean. No hidden or invisible text, no cross-tool instructions.",
    "deps": [
      "@modelcontextprotocol/sdk",
      "axios",
      "dotenv",
      "yargs"
    ],
    "findings": [
      {
        "severity": "info",
        "at": "build/index.js:35,466,507,525,543",
        "what": "The API key is sent twice per request (Authorization header and api_key body field), both only to api.tavily.com over HTTPS."
      },
      {
        "severity": "info",
        "at": "build/index.js:61-73,469-473",
        "what": "DEFAULT_PARAMETERS env JSON silently overrides model-chosen search parameters (search tool only); invalid JSON is echoed in a console warning."
      },
      {
        "severity": "info",
        "at": "build/index.js:10",
        "what": "dotenv reads .env from the current working directory, so a .env in the folder the client starts it from can set TAVILY_API_KEY."
      },
      {
        "severity": "info",
        "at": "build/index.js:25",
        "what": "Server reports version 0.2.10 although the package is 0.2.15; cosmetic."
      },
      {
        "severity": "info",
        "at": "package.json/pyproject",
        "what": "The manifest file was not in the reviewed tree; dependencies listed are inferred from import statements. None look unusual or typosquatted for the job."
      }
    ]
  },
  "health": {
    "score": 82,
    "parts": {
      "popularity": 0.8113109740150697,
      "activity": 0.9341369565641697,
      "issues": 0.4305555555555556,
      "security": 1
    },
    "fail": 0,
    "warn": 0,
    "raw": {
      "stars": 2467,
      "forks": 308,
      "downloads": 26333,
      "hn": {
        "n": 0,
        "pts": 0,
        "t": []
      },
      "issuesOpen": 41,
      "issuesClosed": 31,
      "prsMerged": 89,
      "commits90": 30,
      "release": null,
      "pushed": "2026-10-28T01:38:09Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:42:38.200Z"
  },
  "icon": "/icons/co/tavily.png"
}