Exa

Developer Tools2 toolsNo Auth Required

Exa's MCP server gives an agent live web search and full-page fetching over the open web. Two read-only tools by default, both openWorldHint:true, usable with no sign-in — verified live 2026-08-18.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on 18 August 2026.

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Exa via MCP

https://mcp.exa.ai/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Exa Tools & Capabilities (2)

web_search_exaRead-only

Search the web for any topic and get clean, ready-to-use content. Best for: Finding current information, news, facts, people, companies, or answering questions about any topic. Returns: Clean text content from top search results. Query tips: describe the ideal page, not keywords. "blog post comparing React and Vue performance" not "React vs Vue". Use category:people / category:company to search through Linkedin profiles / companies respectively. If highlights are insufficient, follow up with web_fetch_exa on the best URLs.

web_fetch_exaRead-only

Read a webpage's full content as clean markdown. Use after web_search_exa when highlights are insufficient or to read any URL. Best for: Extracting full content from known URLs. Batch multiple URLs in one call. Returns: Clean text content and metadata from the page(s).

Read from the server on 2026-08-18, including each tool's own safety annotations.

Limits

It reads the web; it changes nothing. Both enabled tools are annotated read-only and non-destructive. There is no account, no object model, and no write path anywhere on the surface.
Everything it returns is third-party content. Both tools declare openWorldHint: true. Page content is untrusted input by construction, and the MCP documentation page carries no security or trust section addressing that.
The free surface is rate-limited and Exa does not publish the MCP tier's numbers. Exa's troubleshooting section documents a 429 rate-limit error on the free plan and says to add an API key to continue. Its published rate-limit page covers REST endpoints — 10 QPS for search, 100 QPS for contents, 10 QPS for answers — and does not state a figure for anonymous MCP use. We did not probe for one, because finding a rate limit means deliberately exceeding it.
The agent tool is not available anonymously, and fails silently. An anonymous ?tools=agent_run request returned an empty tool list rather than an authentication error, so a misconfigured client gets nothing to debug.
Two tools by default, not the full catalogue. Ten of the twelve tools in the server's own resource are disabled, eight of them deprecated. ?tools= re-enables the two live ones.
Directory metadata is out of date. Anthropic's snapshot names a tool the server no longer serves and files the connector under code on the strength of it.
Content extraction is capped by default. web_fetch_exa returns 3,000 characters per page unless maxCharacters is raised, so long pages are truncated silently.
Regional access is restricted. Exa states that it blocks API access from sanctioned or restricted countries and regions, and that such requests may be blocked upstream by Cloudflare before reaching Exa, returning a block page rather than an Exa error.
We report Exa's commercial terms only by reference. Exa publishes pay-as-you-go rates and a free credit allowance on its pricing page. Pricing changes without notice and we make no claim about what any tier costs — read it from Exa.
Results depend on Exa's index, not on the whole web. Exa's FAQ states it will not crawl a page carrying a noindex tag, and describes a curated index updated hourly. Absence from a result set is not evidence a page does not exist.
What we exercised, and what we did not. We made two tool calls, both deliberately benign: one web_fetch_exa on https://example.com, the IANA-reserved documentation domain, and one web_search_exa for IANA's own reserved-domain documentation. Both returned real content anonymously. We ran no other tool, sent no private data, and fetched nothing sensitive through the connector.

Frequently asked questions

Do you need an Exa API key to use the Exa MCP server?

No, not for the two default tools. Our anonymous handshake on 2026-08-18 returned both schemas with no credential, and an anonymous call to each tool returned real results. Exa's documentation says the free plan covers casual use and that adding an API key lifts the rate limits for production. The key changes throughput and unlocks the paid agent tool, not access.

Can the Exa MCP server put untrusted web content into your agent's context?

Yes, and that is the point of it. Both tools are annotated openWorldHint:true, meaning the server itself declares the results come from an open-ended external source. Anything a page author writes can reach your model, including text shaped like instructions. Treat every returned page as data, never as a directive, and keep the tools away from agents holding credentials or write access.

Does Exa warn about prompt injection in its MCP documentation?

No. We searched all 184 pages in Exa's published documentation corpus on 2026-08-18. Exactly one page states the risk — the voice agent example, which tells builders to treat search results as untrusted and instruct the model to ignore instructions inside source content. That guidance is correct and it is Exa's own, but it does not appear on the MCP reference page.

Why does Anthropic's directory list get_code_context_exa when the server does not?

Because the listing is stale. The directory snapshot names web_search_exa and get_code_context_exa; the live server returns web_search_exa and web_fetch_exa. The server's own resource resolves it: get_code_context_exa is present in the internal catalogue but marked disabled and described as deprecated in favour of web_search_exa. The count matches at two, the names do not.

Can you enable more than the two default Exa tools?

Yes, through a query parameter on the endpoint. Exa documents appending ?tools= to the MCP URL with a comma-separated list. We confirmed on 2026-08-18 that requesting web_search_advanced_exa alone returns that tool anonymously. Requesting agent_run anonymously returned an empty tool list rather than an error, which matches Exa's statement that the agent tool requires authentication.

What do the Exa MCP server's prompt and resource surfaces contain?

One of each, both minimal. The prompt web_search_help renders a single user message asking for recent AI news, so it is a worked example rather than a template. The resource at exa://tools/list returns a JSON catalogue of twelve tools with an enabled flag on each, of which ten are false. Resources are client-fetched and carry no safety annotations.

Why is the Exa connector filed under the code category?

Because of what it replaced. Anthropic's directory files Exa under code and its blurb still leads on code examples and GitHub search, matching the deprecated get_code_context_exa tool. The live surface is general web search and page fetching, and Exa's own documentation now points code-context queries at web_search_exa. The category describes the connector's history rather than its current tools.