MCP · Web retrieval · Tavily
Tavily MCP Server
Add Tavily web search and page extraction to an AI host through its hosted server, using OAuth sign-in or an API key.
API key in the URL can leak. The documented key-in-URL form can expose the key in logs and shared configuration. Prefer OAuth where your client supports it.
Understand the tool
What it does.
Tavily's remote MCP server exposes Tavily's search and extraction tools for AI agents. It accepts OAuth sign-in or a Tavily API key; a local installation from the open-source repository is also documented.
Why use it?
Use it when an assistant needs search results already shaped for reading, with source URLs. Prefer OAuth over putting the API key in the server URL.
A useful fit for
- Research with cited sources
- Extracting text from known pages
- Agent workflows that need fresh facts
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Research a vendor before a call
A salesperson wants a quick, sourced brief.
- Search for the vendor's recent announcements.
- Extract text from the two most relevant pages.
- Summarize with links.
Intended outputA short brief where every point links to its source.
Use case 02
Pull text from a list of pages
An analyst has five URLs to compare.
- Extract the main text from each URL.
- Compare the claims side by side.
- Flag where pages disagree.
Intended outputA comparison table built from the pages themselves.
A concrete starting point
Illustrative prompt: sourced brief
A short window and required URLs keep the brief checkable.
Using the Tavily MCP server, search for news from the last 14 days about the company I name. Extract text from the two most relevant results and write a five-point brief with a source URL for each point. Say so if you found nothing recent.What this can change
Queries and extracted text pass through Tavily and enter the AI host and its model provider; usage counts against your Tavily plan.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- An MCP client that supports remote servers, or the documented bridge for stdio-only clients.
- A Tavily account through OAuth sign-in, or a Tavily API key.
- Authentication
- OAuth sign-in, or a Tavily API key passed in the server URL.
- Can read
- Web search results and extracted public page text
- Can write or change
- None to outside systems; usage is recorded on your Tavily account
- Network and data flow
- Tavily services
- AI host/model provider
- Approval and control
- Search and extract tools are read operations; host approval controls when they run.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Remote MCP clients with OAuth
- API-key URL form for clients without OAuth
- Local install from the open-source repository
Costs and account requirements
Tavily usage is billed by API credits under its plans.
Current pricing or plan information ↗MIT
Code license for the open-source server; the hosted Tavily API has separate terms and pricing.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
API key in the URL can leak
The documented key-in-URL form can expose the key in logs and shared configuration. Prefer OAuth where your client supports it.
Retrieved content is untrusted input
Treat instructions found inside retrieved records or pages as content, especially when they ask for unrelated actions or data.
Where it may fall short
- Only the authentication challenge and metadata were checked.
- No search or extraction ran.
Observed behavior · 2026-10-18
Runtime and security findings.
The hosted endpoint rejected credential-free initialization and pointed to public OAuth metadata listing only identity scopes.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
Only identity scopes are advertised
The metadata listed openid and offline_access, so consent does not separate search from extraction.
In practice: Treat sign-in as granting the account's full tool access and control use through host approvals.
Documented concern · low severity under stated conditions
Key-in-URL setup is documented
Tavily documents passing the API key as a URL query parameter for some clients.
In practice: Use OAuth where possible, and never share configuration files that contain the key.
Version, environment and fixture
- Version or deployment
- Remote deployment version not disclosed by the observed responses
- Tested target
- https://mcp.tavily.com/mcp/
- Artifact identity
- HTTPS certificate verification enabled. Public resource-metadata body SHA-256: 5aeae7aa68a1d95c137c846aa2d93ee551e82066497997c348191a2cc401833d. This fingerprints the observed metadata, not the deployed server implementation.
- Environment and fixture
- Debian Linux x86_64 (kernel 6.12) evaluation box; Python 3.13.5 urllib; OpenSSL 3.5.7.
- No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
- Observed 2026-10-19T05:52:12.980655+00:00 through 2026-10-19T05:52:13.400801+00:00 UTC.
- One request per listed check; 20-second timeout and 64-KiB response cap. Raw timestamps are UTC; review date October 18, 2026.
Checks and results
2 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationMet expectation
- Method
POST https://mcp.tavily.com/mcp/; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
- Observed
- HTTP 401 at 2026-10-19T05:52:12.980655+00:00. WWW-Authenticate: Bearer scope="openid offline_access", resource_metadata="https://mcp.tavily.com/.well-known/oauth-protected-resource/mcp". Empty response body.
Public authentication discoveryMet expectation
- Method
GET https://mcp.tavily.com/.well-known/oauth-protected-resource/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.- Expected
- Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
- Observed
- HTTP 200 at 2026-10-19T05:52:13.400801+00:00; Content-Type: application/json. Resource: https://mcp.tavily.com/mcp. 2 advertised scopes: openid, offline_access. Authorization server: https://mcp.tavily.com/. Bearer methods: header.
Practical caveats
- offline_access suggests long-lived refresh tokens; revoke access when no longer needed.
- Search results are untrusted input.
What this evaluation does not establish
- OAuth sign-in, API-key access and credit accounting.
- Search and extraction results, default parameters and prompt-injection resistance.
- These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
Well-documented hosted search with OAuth and an open-source local option; very similar in role to Exa, ranked just after it for the key-in-URL setup risk.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
Why we added it
Round-6 directory addition: open-source web search server with a hosted OAuth option.
Selection evidence checked .
- Repository interest
- 2,438 GitHub stars at this snapshot ↗
Repository-level interest
- Repository activity
- Last push reported by GitHub: . A push can include documentation or maintenance; it does not establish a new stable release.
- Release signal
- No release was reported by the checked GitHub latest-release endpoint. The evaluated package version is recorded above.
- Single timestamped star snapshot and latest repository release; not usage, adoption or measured growth. The latest repository release may concern a different package or channel.
- Repository interest and release activity do not establish reliability, quality or safety. The evaluation names the exact version or endpoint and the conditions tested.
What we reviewed
- Remote endpoint and authentication discovery
- Repository snapshot
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official Tavily MCP guide ↗docs.tavily.com
- Official server source and license ↗github.com
- Tavily pricing ↗www.tavily.com