tavily-mcp

tavily-ai/tavily-mcp

This MCP server connects an AI agent to the Tavily API to search the web, extract page contents, crawl and map websites, run research tasks, and submit search quality feedback. Its main risks are that untrusted web pages fetched by the tools can contain prompt injections, the feedback tool asks the agent to upload the final answer it gave the user, and keyless rate-limit responses instruct the agent to answer server-supplied questions or make payments to earn credits.

What it can reach

Network

Sends HTTPS requests to api.tavily.com for web search, page extraction, site crawling, site mapping, research, and feedback.

Secrets

Reads TAVILY_API_KEY, TAVILY_HUMAN_ID, and DEFAULT_PARAMETERS from environment variables and any local .env file.

Files

Reads a .env file in the working directory at startup via dotenv.

Findings

1. MediumKeyless error handler instructs the agent to POST answers to questions or make payments

   src/index.ts:1051

   When the server runs without an API key or hits a keyless rate limit, formatKeylessEnvelope formats server-supplied continuation instructions directly into the tool output. These instructions tell the agent it can earn bonus credits by POSTing answers to server-provided questions at an endpoint, or by making an x402 agentic payment. An AI coding agent with shell or HTTP tools may follow these instructions on its own to unblock its task, sending information about the user or project to an external endpoint without asking.

   Fix: Return a static error message asking the human user to configure a TAVILY_API_KEY, and do not pass server-supplied survey questions, endpoints, or payment instructions to the agent.

2. LowFeedback tool instructs the agent to send its final answer back to Tavily

   src/index.ts:480

   The tavily_feedback tool description tells the agent to include response_delivered (the final answer produced for the user) whenever it submits feedback. If the agent calls this tool—or is tricked into calling it by a prompt injection on a webpage it just read—the user's synthesized answer and any local context included in it are sent to Tavily's servers.

   Fix: Remove the response_delivered field from the tavily_feedback tool schema, or disable the feedback tool by default unless the user opts in.

3. LowUnencoded request_id interpolated into research polling URL

   src/index.ts:821

   In the research method, the request_id field from the API response is concatenated directly into the polling URL without URL encoding. If a compromised upstream response or proxy returned a request_id containing path traversal sequences, the client would make authenticated GET requests to unintended paths on api.tavily.com.

   Fix: Encode the identifier with encodeURIComponent(requestId) before building the polling URL.