Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

OpenSERP

NPM · @OPENSERP/MCP

Search Google, Bing, Yandex, Baidu, DuckDuckGo and Ecosia with original ranks, plus page extraction.

Available components

+4 this week 82 Trust /100

Last scanned (18 hours ago)

Scores higher than 72% of npm servers

Category Search and Retrieval

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to openserpapi/mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 7 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability59
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4515 tokens (~451/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
  • Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

  • 31 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

  • 29 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 27 Oct 26 +1
    • Malware scan: unverified → pass ▲ security
    • Stability: unverified → 0.03 ▲ functional
    • Package version: 0.1.10 → 0.1.12 functional
  • 26 Oct 26 62

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/@openserp/mcp@0.1.12

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo openserpapi/mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/openserpapi/mcp/.github/workflows/publish.yml@refs/heads/main
Rekor log index 3525408023
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:272614fd1876f5bf9bc1df06570a56c84b9e22b04623625ebf2f7890406a00f56361e853aca2371e6c479cc6b22a7c983f39d8742ca75d19d723b3450

Background: How many MCP packages publish verified provenance →

Dependencies 93 packages
Packages resolved 93
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 10 exposed · ~4,515 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
any_search ~637

Try engines one at a time in the order you give and return the first result set that succeeds, e.g. engines [google, bing, duckduckgo]. Use it as a resilient default when you prefer one engine but need a fallback; use fast_search when the order doesn't matter. On Cloud a slow attempt can overlap with the next one. Returns JSON: results (rank, title, url, snippet, domain, engine), pagination (has_more, next_start) and meta (request_id, took_ms, engines_failed). Cloud: 1 credit. Errors return isError with status, error code and retry_after. On 429 or 503 wait retry_after; if an engine is blocked (CAPTCHA, 502/503), try another engine. Unsupported parameters return 400 and are not charged.

NameTypeReqDescription
datestring–Published-date range YYYYMMDD..YYYYMMDD. Cloud web search supports Google and Ecosia; unsupported filters return 400 without charge.
dedupeboolean–Drop duplicate URLs across engines (default true).
enginesarray–Engines to query, in priority order for any mode. Omit to use all available engines.
extract––Enrich the top web results with cleaned page content. Boolean or integer depth: false/0 off, true/1 top result, N top N (1-5).
extractModestring–auto (default): fast HTTP fetch, browser render if the page comes back empty. fast: HTTP only. rendered: always a browser, for JavaScript-heavy pages.
featuresboolean–Add serp_features (AI summary, answer box, People Also Ask, related searches) when the engine shows them.
filestring–File extension filter, such as PDF.
filterboolean–Let the engine collapse near-duplicate results (default true, mostly affects Google).
formatstring–json (default) for structured results; markdown, text or ndjson for compact plain text.
langstring–Language code, such as EN or de.
limitinteger–Maximum result count, 1-100. Keep 10 when paging with start.
mergeboolean–true (default): one list from every engine that succeeded. false: keep only the first engine that returned results.
minRunesinteger–Minimum text length (in runes) before auto mode escalates to a browser render. 0 uses the built-in floor.
regionstring–Market or location hint, such as US, DE, en-GB, Berlin, or a Yandex lr id.
sitestring–Domain filter, such as example.com.
startinteger–Result offset. On Cloud, Google/Bing/Yandex use multiples of 10, Baidu supports early pages, Ecosia any offset, DuckDuckGo none. Balanced mega requires 0; unsupported offsets return 400.
textstring–Search query text. At least one of text, site, or file should be provided.

No output schema declared.

No examples provided.

batch_extract ~371

Extract LLM-ready content from up to 20 URLs in one request. Prefer this over repeated extract calls when grounding an answer in several pages: it is one round-trip, and a URL that fails returns an item with an error instead of failing the batch. Returns results (url, page_content as Markdown, error when that URL failed; metadata with title, mode_used and, when cut, truncated and total_chars) and meta (requested, succeeded, failed). Cloud: billed per URL like extract; failed and empty URLs are free.

NameTypeReqDescription
cleanboolean–Article-only extraction (default true). Set false for landing pages, docs indexes and dashboards, where content sits in navigation or feature blocks.
langstring–Preferred page language, sent as Accept-Language, such as en or de.
maxCharsinteger–Max characters of content per URL. Default splits 40000 across the batch (at least 2000 each). Longer pages are cut and marked metadata.truncated.
minRunesinteger–Minimum text length (in runes) before auto mode escalates to a browser render. 0 uses the built-in floor.
modestring–auto (default): fast HTTP fetch, browser render if the page comes back empty. fast: HTTP only. rendered: always a browser, for JavaScript-heavy pages.
regionstring–Two-letter country code applied to every URL, e.g. US or DE. On Cloud this adds 1 credit per extracted URL.
urlsarrayyesAbsolute URLs to fetch and extract. Duplicates are dropped.
useLlmsTxtboolean–For a site root URL, return the site's /llms-full.txt or /llms.txt instead when it has one.

No output schema declared.

No examples provided.

extract ~415

Fetch one URL and return its main content as Markdown, e.g. to read a page found by search. Returns JSON: url, title, description, markdown, text, headings, links (first 50), lang and meta.mode_used. Content over maxChars (default 20000) is cut and the result gets truncated: true. For two or more pages use batch_extract. Pages behind logins or bot walls can fail or come back thin; try mode rendered or another source. Cloud: 1 credit for a fast fetch, 3 when the page needs a browser, +1 with region; failed and empty pages are free. Errors return isError with status and error code.

NameTypeReqDescription
cleanboolean–Article-only extraction (default true). Set false for landing pages, docs indexes and dashboards, where content sits in navigation or feature blocks.
formatstring–json (default) for the structured fields; markdown or text for the page content as plain text.
langstring–Preferred page language, sent as Accept-Language, such as en or de.
maxCharsinteger–Max characters of page content (default 20000). Longer pages are cut and marked truncated.
minRunesinteger–Minimum text length (in runes) before auto mode escalates to a browser render. 0 uses the built-in floor.
modestring–auto (default): fast HTTP fetch, browser render if the page comes back empty. fast: HTTP only. rendered: always a browser, for JavaScript-heavy pages.
regionstring–Two-letter country code to extract from, e.g. US or DE, for geo-fenced or localized pages. On Cloud this adds 1 credit per extracted URL.
urlstringyesAbsolute URL to fetch and extract.
useLlmsTxtboolean–For a site root URL, return the site's /llms-full.txt or /llms.txt instead when it has one.

No output schema declared.

No examples provided.

fast_search ~616

Return one web result set as fast as possible, from the engine with the best recent health and latency. Use it for quick lookups where the engine doesn't matter; use search to pick the engine, or any_search to set a fallback order. Returns JSON: results (rank, title, url, snippet, domain, engine), pagination (has_more, next_start) and meta (request_id, took_ms, engines_failed). Cloud: 1 credit. Errors return isError with status, error code and retry_after. On 429 or 503 wait retry_after; if an engine is blocked (CAPTCHA, 502/503), try another engine. Unsupported parameters return 400 and are not charged.

NameTypeReqDescription
datestring–Published-date range YYYYMMDD..YYYYMMDD. Cloud web search supports Google and Ecosia; unsupported filters return 400 without charge.
dedupeboolean–Drop duplicate URLs across engines (default true).
enginesarray–Engines to query, in priority order for any mode. Omit to use all available engines.
extract––Enrich the top web results with cleaned page content. Boolean or integer depth: false/0 off, true/1 top result, N top N (1-5).
extractModestring–auto (default): fast HTTP fetch, browser render if the page comes back empty. fast: HTTP only. rendered: always a browser, for JavaScript-heavy pages.
featuresboolean–Add serp_features (AI summary, answer box, People Also Ask, related searches) when the engine shows them.
filestring–File extension filter, such as PDF.
filterboolean–Let the engine collapse near-duplicate results (default true, mostly affects Google).
formatstring–json (default) for structured results; markdown, text or ndjson for compact plain text.
langstring–Language code, such as EN or de.
limitinteger–Maximum result count, 1-100. Keep 10 when paging with start.
mergeboolean–true (default): one list from every engine that succeeded. false: keep only the first engine that returned results.
minRunesinteger–Minimum text length (in runes) before auto mode escalates to a browser render. 0 uses the built-in floor.
regionstring–Market or location hint, such as US, DE, en-GB, Berlin, or a Yandex lr id.
sitestring–Domain filter, such as example.com.
startinteger–Result offset. On Cloud, Google/Bing/Yandex use multiples of 10, Baidu supports early pages, Ecosia any offset, DuckDuckGo none. Balanced mega requires 0; unsupported offsets return 400.
textstring–Search query text. At least one of text, site, or file should be provided.

No output schema declared.

No examples provided.

get_usage ~88

Show the OpenSERP Cloud account behind OPENSERP_API_KEY: account (plan, credits_remaining) and lastResponse (request_id, credits used, engine) for the previous tool call in this session. Read-only and free. Use it to check the balance before a large batch or to see what a call cost. Self-hosted mode has no credits, so it returns an error there.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

image_search ~425

Search images on one engine you choose. Returns JSON results (rank, title, image url/thumbnail/width/height, source page_url and domain, engine) and pagination. Use mega_image to combine several engines. Cloud: cost scales with the number of returned images. Errors return isError with status, error code and retry_after. On 429 or 503 wait retry_after; if an engine is blocked (CAPTCHA, 502/503), try another engine. Unsupported parameters return 400 and are not charged.

NameTypeReqDescription
datestring–Published-date range YYYYMMDD..YYYYMMDD. Cloud web search supports Google and Ecosia; unsupported filters return 400 without charge.
enginestringyesEngine to query: google, bing, yandex, baidu, duckduckgo (or duck), ecosia.
featuresboolean–Add serp_features (AI summary, answer box, People Also Ask, related searches) when the engine shows them.
filestring–File extension filter, such as PDF.
filterboolean–Let the engine collapse near-duplicate results (default true, mostly affects Google).
formatstring–json (default) for structured results; markdown, text or ndjson for compact plain text.
langstring–Language code, such as EN or de.
limitinteger–Maximum result count, 1-100. Keep 10 when paging with start.
regionstring–Market or location hint, such as US, DE, en-GB, Berlin, or a Yandex lr id.
sitestring–Domain filter, such as example.com.
startinteger–Result offset. On Cloud, Google/Bing/Yandex use multiples of 10, Baidu supports early pages, Ecosia any offset, DuckDuckGo none. Balanced mega requires 0; unsupported offsets return 400.
textstring–Search query text. At least one of text, site, or file should be provided.

No output schema declared.

No examples provided.

list_engines ~91

List the engines this OpenSERP backend can use and whether they work right now. Self-hosted: each engine with initialized and circuit_state (open means it is failing, skip it). Cloud: per-engine web/image support and status (operational, loaded, down) with latency. Read-only and free. Call it when searches keep failing, then pick a healthy engine for search or the engines list.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

mega_image ~559

Search images on several engines and merge them into one list (mode balanced, the default); each image keeps its source engine and rank, and duplicates are dropped. Use it when one engine gives too few or too similar images; use image_search for a single engine. Balanced mode serves only the first page; mode any or fast returns the first engine that succeeds. Output fields match image_search. Cloud: any/fast cost 1 credit, balanced depends on engines and image volume. Errors return isError with status, error code and retry_after. On 429 or 503 wait retry_after; if an engine is blocked (CAPTCHA, 502/503), try another engine. Unsupported parameters return 400 and are not charged.

NameTypeReqDescription
datestring–Published-date range YYYYMMDD..YYYYMMDD. Cloud web search supports Google and Ecosia; unsupported filters return 400 without charge.
dedupeboolean–Drop duplicate URLs across engines (default true).
enginesarray–Engines to query, in priority order for any mode. Omit to use all available engines.
featuresboolean–Add serp_features (AI summary, answer box, People Also Ask, related searches) when the engine shows them.
filestring–File extension filter, such as PDF.
filterboolean–Let the engine collapse near-duplicate results (default true, mostly affects Google).
formatstring–json (default) for structured results; markdown, text or ndjson for compact plain text.
langstring–Language code, such as EN or de.
limitinteger–Maximum result count, 1-100. Keep 10 when paging with start.
mergeboolean–true (default): one list from every engine that succeeded. false: keep only the first engine that returned results.
modestring–balanced (default): all engines in parallel, results merged. any: engines in your order until one succeeds; on Cloud slow attempts can overlap. fast: the healthiest, fastest engine. Only any and fast…
regionstring–Market or location hint, such as US, DE, en-GB, Berlin, or a Yandex lr id.
sitestring–Domain filter, such as example.com.
startinteger–Result offset. On Cloud, Google/Bing/Yandex use multiples of 10, Baidu supports early pages, Ecosia any offset, DuckDuckGo none. Balanced mega requires 0; unsupported offsets return 400.
textstring–Search query text. At least one of text, site, or file should be provided.

No output schema declared.

No examples provided.

mega_search ~723

Query several engines in parallel and merge their web results into one list (mode balanced, the default). Each result keeps its source engine and rank, and clusters list each URL with its rank on every engine that found it. Use it to compare engines, check where a page ranks across engines, or widen coverage for research; it is slower and costs more than one engine. Balanced mode serves only the first page (start 0); mode any or fast behaves like any_search or fast_search. Returns JSON: results (rank, title, url, snippet, domain, engine), pagination (has_more, next_start) and meta (request_id, took_ms, engines_failed). Cloud: balanced is billed per engine that returns results. Errors return isError with status, error code and retry_after. On 429 or 503 wait retry_after; if an engine is blocked (CAPTCHA, 502/503), try another engine. Unsupported parameters return 400 and are not charged.

NameTypeReqDescription
datestring–Published-date range YYYYMMDD..YYYYMMDD. Cloud web search supports Google and Ecosia; unsupported filters return 400 without charge.
dedupeboolean–Drop duplicate URLs across engines (default true).
enginesarray–Engines to query, in priority order for any mode. Omit to use all available engines.
extract––Enrich the top web results with cleaned page content. Boolean or integer depth: false/0 off, true/1 top result, N top N (1-5).
extractModestring–auto (default): fast HTTP fetch, browser render if the page comes back empty. fast: HTTP only. rendered: always a browser, for JavaScript-heavy pages.
featuresboolean–Add serp_features (AI summary, answer box, People Also Ask, related searches) when the engine shows them.
filestring–File extension filter, such as PDF.
filterboolean–Let the engine collapse near-duplicate results (default true, mostly affects Google).
formatstring–json (default) for structured results; markdown, text or ndjson for compact plain text.
langstring–Language code, such as EN or de.
limitinteger–Maximum result count, 1-100. Keep 10 when paging with start.
mergeboolean–true (default): one list from every engine that succeeded. false: keep only the first engine that returned results.
minRunesinteger–Minimum text length (in runes) before auto mode escalates to a browser render. 0 uses the built-in floor.
modestring–balanced (default): all engines in parallel, results merged. any: engines in your order until one succeeds; on Cloud slow attempts can overlap. fast: the healthiest, fastest engine. Only any and fast…
regionstring–Market or location hint, such as US, DE, en-GB, Berlin, or a Yandex lr id.
sitestring–Domain filter, such as example.com.
startinteger–Result offset. On Cloud, Google/Bing/Yandex use multiples of 10, Baidu supports early pages, Ecosia any offset, DuckDuckGo none. Balanced mega requires 0; unsupported offsets return 400.
textstring–Search query text. At least one of text, site, or file should be provided.

No output schema declared.

No examples provided.

search ~590

Search one engine you choose and return its ranked web results. Use it when the engine matters (Yandex for Russian, Baidu for Chinese, Google for the widest index) or to page with start. If any engine will do, use any_search; to compare engines, use mega_search. Returns JSON: results (rank, title, url, snippet, domain, engine), pagination (has_more, next_start) and meta (request_id, took_ms, engines_failed). Cloud: 1 credit per 10 returned results. Errors return isError with status, error code and retry_after. On 429 or 503 wait retry_after; if an engine is blocked (CAPTCHA, 502/503), try another engine. Unsupported parameters return 400 and are not charged.

NameTypeReqDescription
datestring–Published-date range YYYYMMDD..YYYYMMDD. Cloud web search supports Google and Ecosia; unsupported filters return 400 without charge.
enginestringyesEngine to query: google, bing, yandex, baidu, duckduckgo (or duck), ecosia.
extract––Enrich the top web results with cleaned page content. Boolean or integer depth: false/0 off, true/1 top result, N top N (1-5).
extractModestring–auto (default): fast HTTP fetch, browser render if the page comes back empty. fast: HTTP only. rendered: always a browser, for JavaScript-heavy pages.
featuresboolean–Add serp_features (AI summary, answer box, People Also Ask, related searches) when the engine shows them.
filestring–File extension filter, such as PDF.
filterboolean–Let the engine collapse near-duplicate results (default true, mostly affects Google).
formatstring–json (default) for structured results; markdown, text or ndjson for compact plain text.
langstring–Language code, such as EN or de.
limitinteger–Maximum result count, 1-100. Keep 10 when paging with start.
minRunesinteger–Minimum text length (in runes) before auto mode escalates to a browser render. 0 uses the built-in floor.
regionstring–Market or location hint, such as US, DE, en-GB, Berlin, or a Yandex lr id.
sitestring–Domain filter, such as example.com.
startinteger–Result offset. On Cloud, Google/Bing/Yandex use multiples of 10, Baidu supports early pages, Ecosia any offset, DuckDuckGo none. Balanced mega requires 0; unsupported offsets return 400.
textstring–Search query text. At least one of text, site, or file should be provided.

No output schema declared.

No examples provided.

Install

How do I install the OpenSERP MCP server?

OpenSERP runs locally as an npm package, launched with npx -y @openserp/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @openserp/mcp

# add to Claude Code
claude mcp add org-openserp-mcp -- npx -y @openserp/mcp
Common questions

What is the OpenSERP MCP server?

OpenSERP is an MCP server listed in the public MCP registry as org.openserp/mcp. Search Google, Bing, Yandex, Baidu, DuckDuckGo and Ecosia with original ranks, plus page extraction. This page covers its npm package (@openserp/mcp).

Is the OpenSERP MCP server safe to use?

OpenSERP scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the OpenSERP MCP server expose?

OpenSERP exposes 10 tools: search, mega_search, fast_search, any_search, image_search, and 5 more. Their descriptions and schemas cost roughly 4,515 tokens of context every time the server is loaded.

Is the OpenSERP MCP server still maintained?

OpenSERP is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the OpenSERP MCP server under?

OpenSERP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.