Is Exa MCP server safe?

No malicious indicators - review capabilities before installing

Notable — review in context (capabilities are not malware):

Node.js network egress
npm prepare hook
Server bound to all network interfaces

exa-mcp-server is an AI mcp_server analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 4 risky constructs are reported for review. It can: install time execution, mcp tools detected and network egress — capabilities are what the code can do, not a verdict on intent. Risk score 10/100 (low).

exa-mcp-server 3.4.1

mcp_server · https://github.com/exa-labs/exa-mcp-server

LOW

/ 100 risk score

Snapshot · scanned Sep 24, 2026 · exa-mcp-server@3.4.1 · engine 0.53.0 / ruleset 60

Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Exa MCP server's authors. Report a false positive.

Capabilities — what this component can do (not a risk score):

install time executionmcp tools detectednetwork egress

Behavioral traits

How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.

Tool surface

Tool Usage

Network egress

Interaction & Communication / Direct Communication

Network exposure

Interaction & Communication

Supply-chain provenance risk

General Protections / Supply Chain

Findings (4)

MEDIUMServer bound to all network interfacesST-EXPOSE-BIND

A server is bound to all network interfaces (0.0.0.0), not just your own machine.

src/runtime-server.ts:5-5

const HOST = process.env.HOST || "0.0.0.0";

Why it matters: Without authentication, other hosts on the network can reach it.

Fix: Bind to 127.0.0.1 for local-only use, or require authentication and restrict access if remote exposure is intended.

MEDIUMnpm prepare hookST-INSTALL-NPM-PREPARE

package.json has a 'prepare' script (runs on git/local installs and before publishing).

package.json:51-51

"prepare": "npm run build:stdio",

Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.

Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.

MEDIUMNode.js network egressST-NET-NODE

The component makes outbound network requests.

src/runtime-server.ts:1-1

import { createServer, type IncomingMessage, type ServerResponse } from "node:http";

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

LOWMCP tool surface detectedST-MCP-DETECTED

An MCP tool surface (manifest or tool definitions) was found.

.claude-plugin/plugin.json:10-10

"mcpServers": {

gemini-extension.json:5-5

"mcpServers": {

mcp.json:3-3

"mcpServers": {

mcp.json:1-1

server.json:1-1

src/stdio.ts:47-47

const server = new McpServer({

src/tools/agentRun.ts:543-544

server.tool(
    "agent_run",

src/tools/companyResearch.ts:15-16

server.tool(
    "company_research_exa",

src/tools/deepResearchCheck.ts:19-20

server.tool(
    "deep_researcher_check",

src/tools/deepResearchStart.ts:14-15

server.tool(
    "deep_researcher_start",

src/tools/deepSearch.ts:20-21

server.tool(
    "deep_search_exa",

src/tools/exaCode.ts:15-16

server.tool(
    "get_code_context_exa",

src/tools/linkedInSearch.ts:15-16

server.tool(
    "linkedin_search_exa",

src/tools/peopleSearch.ts:15-16

server.tool(
    "people_search_exa",

src/tools/webSearchAdvanced.ts:20-21

server.tool(
    "web_search_advanced_exa",

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →