Agent Economy ReportAgent Economy ReportCAUTION version 1.0.1 · audited 2026-09-17
This package is documentation and shell-command examples for using the Exa MCP service through the mcporter command-line tool. It configures an Exa MCP endpoint and shows calls for web search, code context search, and company research, with optional advanced tools including web crawling and people search. The package does not contain executable malware, hidden destinations, or credential theft behavior. However, it sends queries and retrieved content to Exa and can persistently enable broader third-party search capabilities, so the disclosed data-sharing and configuration changes should be reviewed before use.
| Declared purpose | Free AI search via Exa MCP. Web search for news/info, code search for docs/examples from GitHub/StackOverflow, company research for business intel. No API key needed. |
| Observed behavior | The files provide markdown guidance and bash examples for checking mcporter, adding Exa MCP server configurations, and invoking Exa tools through `mcporter call`. The basic tools are web_search_exa, get_code_context_exa, and company_research_exa. The package also documents an optional persistent `exa-full` configuration that enables advanced web search, deep search, crawling, company research, people search, and deep researcher tools, and it links to external GitHub, npm, and Exa documentation. No standalone executable code is included. |
| Verdict, rules only | CAUTION · touches persistence (cron, shell profile, autostart) |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Configures and calls the remote Exa MCP endpoint at https://mcp.exa.ai/mcp, and directs users to exa.ai, github.com, www.npmjs.com, and anthropic.com example content. |
| shell | needed | Uses bash/mcporter commands to configure the MCP server and call search tools, such as `mcporter list exa` and `mcporter call 'exa.web_search_exa(...)'`. |
| persistence | needed | The `mcporter config add` commands persist Exa MCP configurations, including the optional broader `exa-full` configuration. |
| other | needed | Requires the `mcporter` command-line tool, declared in SKILL.md metadata. |
| severity | finding |
|---|---|
| medium | Registers third-party Exa MCP endpoint This command configures mcporter to connect to the remote Exa MCP service. Queries and retrieved context go to this third-party endpoint. SKILL.md:20 mcporter config add exa https://mcp.exa.ai/mcp |
| medium | Optional persistent all-tools configuration This command registers an `exa-full` endpoint enabling broader Exa tools: advanced web search, deep search, crawling, company research, people search, and deep researcher. It persists as a configuration change. SKILL.md:70 mcporter config add exa-full "https://mcp.exa.ai/mcp?tools=web_search_exa,web_search_advanced_exa,get_code_context_exa,deep_search_exa,crawling_exa,company_rese |
| medium | Data sharing with Exa disclosed The package states that search queries and returned context may be sent to Exa, so users should avoid secrets or sensitive data. skill-card.md:24 Risk: Queries and retrieved context may be sent to a third-party Exa MCP service. |
| medium | Persistent broader capabilities disclosed Confirms that the optional advanced setup is persistent and broadens capabilities beyond the basic search tools. skill-card.md:28 Risk: The optional all-tools configuration persistently enables broader crawling, people search, and deep researcher capabilities. |
| info | Shell-based setup command The skill uses the shell to run mcporter commands rather than performing operations directly. SKILL.md:15 mcporter list exa |
| low | Advanced tool can fetch external web pages When the optional exa-full setup is enabled, the crawling tool can retrieve content from external URLs such as anthropic.com. references/examples.md:116 mcporter call 'exa-full.crawling_exa(url: "https://anthropic.com/news/claude-3-5-sonnet")' |
| info | Declared purpose Matches the observed examples: web search, code context search, and company research, with no API key handling. SKILL.md:3 Free AI search via Exa MCP. Web search for news/info, code search for docs/examples from GitHub/StackOverflow, company research for business intel. No API key n |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| anthropic.com | not in the service index | references/examples.md:116 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| exa.ai | not in the service index | SKILL.md:86 |
| example.com | not in the service index | references/examples.md:119 |
| github.com | not in the service index | SKILL.md:84 |
| mcp.exa.ai | not in the service index | SKILL.md:20 |
| www.npmjs.com | not in the service index | SKILL.md:85 |
| Binaries invoked | bash, npm |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 1 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 86 | 878e35f9c0a0d50c… |
_meta.json | 6 | 14ce11b38c41407f… |
references/examples.md | 138 | 55ba75742332ecad… |
skill-card.md | 60 | f425f669e20536ed… |
For agents
JSON: https://agenteconomy.report/k/exa-web-search-free.audit.json · badge: https://agenteconomy.report/k/exa-web-search-free.audited.svg ·
skill rating: /k/exa-web-search-free · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).