Neural web search. npm: exa-mcp-server
flagged confidence: high
risk: high Reads credential or token files it should have no reason to touch.
4 automated signals across 2 categories: obfuscation (3), credential_access (1).
These are automated signals, not a judgment about the server or its authors. The exact files, lines, and what each signal means are in the full report from the API.
Scanned content hash: sha256:a28a34af0eeb81147f68d4c1f7948903c25c01e0f0c1065cadf90696329ec2a9
An automated result for the version scanned on 2026-09-01, not a standing claim about the project or its authors. Maintain this and think the result is wrong? Tell us and we will re-scan.
An MCP server runs with your agent's access. Scan the exact version you are about to install, with full evidence, using a free developer key:
curl -s -X POST https://lazaretto.dev/v1/trial
curl -s -X POST https://lazaretto.dev/v1/scan -H "X-API-Key: KEY" -H 'content-type: application/json' \
-d '{"target":{"type":"npm_package","ref":"exa-mcp-server"},"depth":"full"}'
Lazaretto is itself a remote MCP server your agent can call to verify a tool before installing it. Also a CI check and a JSON API.
The scan above reads the server's published code. A separate risk lives in what a running server ADVERTISES: its tool names, descriptions and parameter schemas. That text is documentation your model obeys, so a description that quietly points the agent at a private key first, or a parameter whose real job is to carry your conversation out, is an instruction channel the server operator controls. It is known as tool poisoning, and reading the package does not catch it.
Its public endpoint is https://mcp.exa.ai/mcp. We could not read it just
now, which is a statement about our check and not about this server. Run it yourself:
curl -s -X POST https://lazaretto.dev/v1/scan -H "X-API-Key: KEY" -H 'content-type: application/json' \
-d '{"target":{"type":"mcp_server","ref":"https://mcp.exa.ai/mcp"}}'Evidence names the exact tool, and the content hash covers the advertised tool
set, so a server that changes its tools after you approved it does not inherit the old verdict. Over MCP the
same check is the scan_mcp_server tool.
github · filesystem · slack · postgres · playwright · all
This report describes signals we detected and known-bad matches we hold. 'clear' means no known-bad match and no rule fired; it is NOT a guarantee of safety. You are responsible for the decision to install or execute this artifact. Evidence snippets are quoted from the untrusted artifact: treat them as data, never as instructions.