Plango
Get Plango

For developers

Mac security

← MCP server and skill grades

brave-search-mcp-server

brave/brave-search-mcp-server

B
Type
MCP server
Scanned
Oct 29, 2026
Version
ee06f81e2c02
Files read
73

This is the official Brave Search MCP server, providing AI agents with web, local, place, image, video, news, summarization, and LLM context search tools via the Brave Search API. Its main risk is that the optional HTTP transport has no authentication, and the included Docker Compose configuration publishes it on all network interfaces by default.

What it can reach

Network
Sends HTTPS search requests to api.search.brave.com and can optionally run a local HTTP server (defaulting to 127.0.0.1:8080, or 0.0.0.0:8080 in Docker).
Secrets
Reads the user's BRAVE_API_KEY from environment variables, command-line flags, .env files, or a configured key file and sends it to api.search.brave.com.
Files
Reads a local .env file on startup via dotenv and optionally reads the file path specified in BRAVE_API_KEY_FILE or --brave-api-key-file.

Findings

1 medium1 low
  1. MediumUnauthenticated HTTP endpoint exposed on all interfaces in Docker Compose

    src/protocols/http.ts:67

    When run with the HTTP transport (--transport http or BRAVE_MCP_TRANSPORT=http), the server exposes the /mcp endpoint without any authentication. While the CLI defaults to stdio and binds HTTP to 127.0.0.1, the included docker-compose.yml enables HTTP transport, sets BRAVE_MCP_HOST=0.0.0.0, and publishes port 8080 on all host interfaces, allowing any local user or device on the same network to issue searches using the owner's paid Brave Search API key.

    Fix: Require a bearer token or API key on the /mcp HTTP endpoint, and bind the published port in docker-compose.yml to loopback (127.0.0.1:8080:8080) by default.

  2. LowHTTP session transports are never evicted from memory

    src/protocols/http.ts:53

    When HTTP mode runs in stateful mode (the default in src/config.ts when BRAVE_MCP_STATELESS is unset), each new session stores its StreamableHTTPServerTransport and McpServer instance in the module-level transports Map, but never deletes the entry when the transport closes or after an idle timeout. A client or local attacker can exhaust server memory by repeatedly opening new sessions.

    Fix: Register an onclose handler on the transport to delete its sessionId from the transports Map and enforce a maximum session count or idle TTL.