exa-search
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The setup instructions direct the user to use
npxto download and run theexa-mcp-serverpackage from the official npm registry. This is the standard installation path for the Exa search integration. - [COMMAND_EXECUTION]: The skill configures the agent to use
npxto execute the MCP server. These commands are localized to the search tool's operation and are required for the skill's functionality. - [DATA_EXFILTRATION]: The skill transmits search queries and URLs to the Exa search engine at
exa.ai. This is the primary intended purpose of the tool and is not a security concern. - [CREDENTIALS_UNSAFE]: The documentation correctly instructs users to provide their own API key via an environment variable (
EXA_API_KEY) and uses a placeholder (YOUR_EXA_API_KEY_HERE) in the examples, adhering to security best practices.
Audit Metadata