Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 0
- 4 0
- 3 9
- 2 6
- 1 2
Trust in production
- Trust it - 0%
- With caveats - 53%
- Wouldn't - 47%
18% would recommend this server
How reviewers scored it
- Setup & docs 2.3
- Auth experience 2.6
- Reliability 2.2
- Maintainer responsiveness 2.9
Why it got a D
A popular community server (about 1.6K stars, MIT) by one main developer. It needs no API key because it reads DuckDuckGo's HTML results page, which is not an official API, so DuckDuckGo can block it and searches can come back empty. Its fetch_content tool downloads any URL the model picks from your machine; it blocks private addresses by default, but its own security notes admit a small DNS-rebinding gap, so never set --allow-private-urls. No advisories on record. The last release, 0.7.0, was on 4 September 2026. Biggest deduction: there is no login at all, so keep it on the default stdio and never bind its HTTP mode to 0.0.0.0.
How to connect
claude mcp add ddg-search uvx duckduckgo-mcp-server// claude_desktop_config.json
{
"mcpServers": {
"ddg-search": {
"command": "uvx",
"args": ["duckduckgo-mcp-server"]
}
}
}Is DuckDuckGo MCP Server safe?
Is DuckDuckGo MCP Server safe to use?
DuckDuckGo MCP Server grades D (notable weaknesses - review closely). There is no login: anything that can start or reach it gets its full access. Updates are occasional, so fixes may be slow to arrive. It shells out to helper programs or serves HTTP without enforced TLS, so keep it local and isolated.
Does DuckDuckGo MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does DuckDuckGo MCP Server support authentication?
No. It has no login of its own, so limit who and what can start it.
Alternatives in Search & Retrieval
- A Exa MCPOfficial hosted Exa server for web search, page fetching, and multi-step research.
- A Perplexity MCP ServerOfficial Perplexity server for web search, quick answers, reasoning, and deep research through the Perplexity API.
- A Tavily MCPOfficial Tavily server for web search, page extraction, site mapping, crawling, and research.
- B Firecrawl MCP ServerOfficial Firecrawl server to search the web, scrape and crawl sites, parse documents, and interact with pages in a cloud browser.
- B LawDB MCP ServerHosted server to search German and EU legislation and German, European and international case law, and fetch full texts and single provisions with stable citations.
Embed this badge
[](https://trustedmcp.io/servers/duckduckgo-mcp-server)<a href="https://trustedmcp.io/servers/duckduckgo-mcp-server"><img src="https://trustedmcp.io/badge/duckduckgo-mcp-server.svg" alt="TrustedMCP grade D" height="80"></a>Community reviews
Handy for dev, careful in prod
I like it, with reservations. It is community maintained, so I pin the version and read the changelog before upgrading. There is no auth layer, so whatever can reach it can use it. I keep it local only. Keep permissions tight and it is a good tool.
Used for Technical research while coding
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Too much access for my comfort
Ran into problems pretty quickly. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Issues get answered eventually. Not fast, not abandoned.
Used for Research agent for market questions
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 1/5
- Maintainer responsiveness 3/5
Would not run this unattended
Ran into problems pretty quickly. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Keeping it to local experiments for now.
Used for Research agent for market questions
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 1/5
- Maintainer responsiveness 3/5
Works, just lock it down
Some tools are great, a couple feel half finished. There is no auth layer, so whatever can reach it can use it. I keep it local only. It is community maintained, so I pin the version and read the changelog before upgrading.
Used for Grounding answers with live results
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 4/5
Good, but read the permissions first
Mostly reliable, with the odd timeout. Being official from Community counts for a lot when I pitch it to security. Updates are a bit slow, but it is stable enough that it has not mattered. There is no auth layer, so whatever can reach it can use it. I keep it local only. I would use it in prod, but only with a human approving writes.
Used for Finding recent sources for articles
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
OK for read-only work
Works well enough for what I need. There is no auth layer, so whatever can reach it can use it. I keep it local only. Gave it its own API key so I can revoke it without breaking anything else. Issues get answered eventually. Not fast, not abandoned.
Used for Collecting references for reports
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 2/5
Promising, a bit raw
It does the job, but it took some tweaking. Updates are a bit slow, but it is stable enough that it has not mattered. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box.
Used for Competitive research
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Needs more maintenance love
Setup was rough and the result was flaky. Updates are a bit slow, but it is stable enough that it has not mattered. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. For anything real I would look elsewhere.
Used for Grounding answers with live results
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 1/5
- Maintainer responsiveness 3/5
Not ready for anything that matters
It works in a demo, but things got shaky under real use. Being official from Community counts for a lot when I pitch it to security.
Used for Collecting references for reports
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 4/5
Mixed feelings after two weeks
Useful tool, though I would not hand it to a junior unsupervised. Nice to use something maintained by Community rather than a random fork. Worth it, just do not skip the hardening steps.
Used for Grounding answers with live results
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Decent, not set-and-forget
I like it, with reservations. Release pace is moderate, so I pin a version and check in monthly. It is community maintained, so I pin the version and read the changelog before upgrading. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Keep permissions tight and it is a good tool.
Used for Fact-checking drafts
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Struggled to get it stable
Gave it a fair shot over two weeks. There is no auth layer, so whatever can reach it can use it. I keep it local only. Release pace is moderate, so I pin a version and check in monthly. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Recommended, with sensible guardrails.
Used for Technical research while coding
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 2/5
Solid core, fiddly setup
Good for experimenting, still deciding about production. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. The API key sits in the config file, so I made a dedicated key with minimal permissions.
Used for Competitive research
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 2/5
Does the job, docs could be better
Took longer to configure than I expected. The API key sits in the config file, so I made a dedicated key with minimal permissions. Worth it, just do not skip the hardening steps.
Used for Collecting references for reports
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Security story needs work
I wanted to like this one. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. It is community maintained, so I pin the version and read the changelog before upgrading. I will check back in a few releases.
Used for Finding recent sources for articles
- Setup & docs 1/5
- Auth experience 3/5
- Reliability 1/5
- Maintainer responsiveness 2/5
Went back to calling the API directly
Not what I expected from the description. Nice to use something maintained by Community rather than a random fork. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Fine in production if you sandbox it.
Used for Fact-checking drafts
- Setup & docs 1/5
- Auth experience 2/5
- Reliability 1/5
- Maintainer responsiveness 2/5
Fine for a demo, not for prod
Setup was rough and the result was flaky. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Not something I would put in production yet.
Used for Technical research while coding
- Setup & docs 1/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 2/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.