Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Cluefinch MCP

PYPI · CLUEFINCH

Local-first web research for AI agents with SearXNG search and SSRF-safe page retrieval.

Available components

−12 this week 73 Trust /100

Last scanned (20 hours ago)

Scores higher than 69% of PyPI servers

Category Search and Retrieval

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security50
  • Malware scan not yet available for this package.Unverified
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 2 of 48 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to cluefinch/mcp-server). View diagnostics → Pass
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 30 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability59
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2288 tokens (~572/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
  • Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 −14
    • Malware scan: pass → unverified ▼ security
  • 3 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 1 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

  • 30 Oct 26 −14
    • Malware scan: pass → unverified ▼ security
  • 28 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

  • 24 Oct 26 +6
    • Source repository: unverified → pass ▲ security
  • 23 Oct 26 −2
    • Provenance: pass → unverified ▼ security
    • Stability: unverified → 0.27 ▲ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed pypi/cluefinch@0.1.4

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo cluefinch/mcp-server
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/cluefinch/mcp-server/.github/workflows/release.yml@refs/heads/main
Rekor log index 3078117919
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:d79dadcee04609ac94cb2a433f03d45572ec59f4c2277cd017fc6b3e5076e2a9

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 48 packages
Packages resolved 48
Stale 2
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 4 exposed · ~2,013 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
research_collect ~522

Collect bounded evidence from several selected or searched sources. USE THIS for multi-source evidence gathering when you have explicit URLs, several search formulations, or both. It searches/fetches candidate documents, extracts literal passages and reports acquisition gaps. It does NOT crawl links found inside those documents. If a strong source must first be navigated to a chapter, appendix or related page, use web_links and then pass the selected URLs here or to web_fetch. Supply queries=["variant one", "variant two"] and/or urls=["https://..."]. topic only ranks excerpts; topic alone does not search. Explicit URLs consume the source budget first. If they already fill max_sources, no search is run. Remaining candidate slots are distributed round-robin across query variants. For domain/exclude_domains filtering, use web_search first and pass selected result URLs here. Returns raw material, not synthesis: query_variants, sources and gaps. Each source has stable source_id, final URL, source_type, content_hash, text_truncated and literal excerpts with Unicode offsets. BM25 selects passages; source_type and ranking are not credibility judgments. For more context around an excerpt, copy excerpt.expand.arguments into the indicated tool; URL, offset, budget and expected_content_hash are already supplied. content_changed returns no stale-coordinate slice. Always inspect gaps before judging coverage. They can report failed/empty searches, unresponsive engines, blocked/unreadable pages, insufficient text, redirect duplicates, omitted candidates and truncation. Empty gaps do not prove topic completeness. Expected request failures return {error, hint}; individual source failures can coexist with successful sources.

NameTypeReqDescription
language––Language/locale forwarded to search; unused in URL-only mode.
max_sourcesinteger–Candidate fetch budget: default 5, configured cap 10. Failed/duplicate candidates can leave fewer successful sources. Explicit URLs take priority.
queries––Your search variants, normally 2-3; at most 10. The server does not generate queries. May be combined with explicit URLs.
time_range––Search recency: day, week, month or year. Does not assert a source publication date.
topic––Optional topic used only to rank excerpts alongside queries. Does not initiate a search without queries.
urls––Exact source URLs to fetch first; useful after web_search with domain/exclude_domains. Supply urls and/or queries. At most 100 input URLs; max_sources still controls the fetch budget.

Structured output declared, but exposes no named fields.

No examples provided.

web_fetch ~435

Read one selected HTML document as bounded Markdown text. USE THIS when you already know which document you want to read, preview, or expand around a collected excerpt. If you know the source but need to find its chapter, appendix, next page, reference, or related document first, use web_links instead. If you do not yet know a source, use web_search. Preview with max_chars=500 to limit model context; this does not reduce the initial network download. When more retained text is useful, copy continuation.arguments into the indicated tool rather than recalculating the next offset. Null continuation means the retained text has ended. continuation and excerpt.expand use expected_content_hash. If the retained text version changed, content_changed returns no slice: reacquire the document and choose coordinates again. A matching hash protects coordinates, not origin freshness. A page can have too little readable text for web_fetch while still exposing useful ordinary HTML links through web_links; treat such pages as possible navigation hubs instead of assuming the source has no usable structure. Returns content, title, final URL, source category, Unicode-coordinate paging, cache/hash fields and continuation. truncated means more retained text can be continued; text_truncated means a tail was discarded by the hard retention ceiling and cannot be recovered by pagination. Expected failures return {error, hint}.

NameTypeReqDescription
expected_content_hash––Optional retained-text version guard. Ready actions supply it; mismatch returns content_changed without a slice. Omit for unguarded reading.
max_charsinteger–Maximum returned characters: default 10000, configured cap 20000. Use 500 for preview. Ready actions include a budget; smaller output saves context, not the initial download.
start_offsetinteger–Unicode-character offset; default 0. Ready continuation/expand arguments provide it. For manual reading, use next_start or excerpt.start_char.
urlstringyesHTTP(S) page URL, a search result.url or research source.url. Supports HTML/XHTML; no PDF or JavaScript rendering.

Structured output declared, but exposes no named fields.

No examples provided.

web_links ~589

Navigate from a known HTML page to pages that it explicitly links. USE THIS when you already found a useful source but need its structure: documentation sections, report chapters, table-of-contents entries, next/previous publication pages, appendices, references, datasets, standards, or related pages. It is the bridge between web_search discovery and web_fetch reading. Prefer this over another search when the desired page is plausibly linked from the source you already have. This is NOT a crawler or browser. It inspects ordinary <a href> links in this one fetched HTML page only. It does not follow them, click controls, execute JavaScript, submit forms, DNS-resolve destinations, or safety-approve them. Selecting a returned URL for web_fetch/web_links later triggers the normal outbound SSRF policy. same_origin=true keeps only links with the same scheme, normalized hostname and effective port as the final fetched page. Leave same_origin=null when external citations or primary sources may matter; same origin does not mean same organization, and cross-origin does not mean untrusted. The retained list preserves document order after deterministic URL deduplication. Fragments remain part of link identity. same_document=true means only that the destination has the same document identity ignoring the fragment; web_fetch still navigates text by Unicode offsets, not HTML anchors. Filtering happens BEFORE pagination. Copy continuation.arguments to retrieve the next retained link page. links_hash versions the whole retained ordered list before filtering/pagination; links_changed means the old start_index must not be reused. continuation means more retained links exist; links_truncated means some admissible links were lost to hard page-level resource ceilings and continuation cannot recover them. Each link returns url, best-effort label, rel, fragment, same_origin and same_document. An empty links list does not prove that the site has no other pages. Expected failures retur…

NameTypeReqDescription
expected_links_hash––Optional retained-link-list version guard. Ready continuations supply it; mismatch returns links_changed without using the old index.
max_linksinteger–Maximum links returned: default 50, hard cap 100. Ready continuation preserves the effective budget.
same_origin––Navigation filter relative to the final fetched page. true=same scheme+normalized host+effective port only; false=cross-origin only; null=keep both (default, best when external references may matter)…
start_indexinteger–Zero-based index in the filtered retained link list. Ready continuation arguments provide it.
urlstringyesKnown HTTP(S) HTML page whose exposed navigation you want to inspect. Use after finding a useful source when you need chapters, pagination, references or related pages. The page itself is fetched saf…

Structured output declared, but exposes no named fields.

No examples provided.

web_search ~467

Discover candidate sources through search; this does not fetch page content. USE THIS when the needed source or URL is not yet known, when you need a new independent source, or when search-engine discovery itself is required. DO NOT search again merely to find another page inside a strong source when that page is likely linked from the current page; use web_links instead. Domain filtering example: web_search(query="asyncio", domain="python.org", exclude_domains=["discuss.python.org"], max_results=20). Domain operators depend on the provider. Search pagination is not supported. Results are candidates, not verified page evidence: snippet is a search-engine preview and result.url has not been fetched. For a candidate: - web_links(url=result.url): inspect chapters, pagination, references or related pages exposed by that source without crawling them; - web_fetch(url=result.url, max_chars=500): preview/read the selected document; - research_collect(urls=[...]): collect bounded evidence from selected URLs. Returns results, query_used, unresponsive_engines and cached. Always inspect unresponsive_engines: nonempty means incomplete search coverage. Expected failures return {error, hint}.

NameTypeReqDescription
domain––Include site:domain in the query, e.g. docs.python.org. Use a hostname, not a page URL. Can be combined with exclude_domains.
engines––Optional engine subset: google, google cse, brave, wikipedia, wikidata. Omit to use SearXNG defaults.
exclude_domains––Exclude domains with -site: operators, e.g. ['pinterest.com', 'example.org']. Provider support varies; verify returned URLs.
language––Language/locale such as en or ru. Omit for any language.
max_resultsinteger–Requested candidates. Default 10; configured cap 20. This is a result limit, not search pagination.
querystringyesSearch terms. For several query variants and fetched excerpts, use research_collect instead.
safe_search––0=off, 1=moderate, 2=strict. Omit for provider defaults.
time_range––Optional recency filter: day, week, month or year.

Structured output declared, but exposes no named fields.

No examples provided.

Install

How do I install the Cluefinch MCP server?

Cluefinch MCP runs locally as a PyPI package, launched with uvx cluefinch. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · cluefinch

# add to Claude Code
claude mcp add cluefinch-mcp -- uvx cluefinch
Common questions

What is the Cluefinch MCP server?

Cluefinch MCP is listed in the public MCP registry as io.github.cluefinch/mcp. Local-first web research for AI agents with SearXNG search and SSRF-safe page retrieval. This page covers its PyPI package (cluefinch).

Is the Cluefinch MCP server safe to use?

Cluefinch MCP scores 73 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Cluefinch MCP server expose?

Cluefinch MCP exposes 4 tools: web_search, web_fetch, web_links, research_collect. Their descriptions and schemas cost roughly 2,013 tokens of context every time the server is loaded.

Is the Cluefinch MCP server still maintained?

Cluefinch MCP is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Cluefinch MCP server under?

Cluefinch MCP declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.