Exa API + MCP by Exa

# Fix list: Exa API + MCP

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/exa-mcp, the October 2026 research run, assessed 1 October 2026. Grade B, 66.1 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Exa API + MCP: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Security & auth, 43 out of 100, up to 10 more on the total

Why it scored 43: Bearer or `x-api-key` keys, and a team-management API creates keys with their own rate limit and budget. The hosted MCP also takes OAuth. The README documents `?exaApiKey=` in the URL, so 25 less 10 (15). Every tool is read-only and annotated so, and `?tools=` limits the set. Agent runs spend credit but change nothing (18). Search and fetch return untrusted page text, and we found no prompt-injection guidance in the security overview, the MCP README or the tool descriptions (0). No audit log found (0). SOC 2 Type II with reports in a trust centre. No security.txt, no SECURITY.md, no bug bounty and no GitHub advisories. The April 2026 key leak below was handled in a commit message only (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 2. Reliability, 67 out of 100, up to 6.6 more on the total

Why it scored 67: Instatus page at status.exa.ai with Search API, Exa MCP, Agents API and Websets components and dated history (20). Since 14 August the Search API logged a 10-minute major outage (14 August), latency incidents of 53 minutes, 1 hour 24 minutes and 2 hours 21 minutes, and a 1-minute blip. The Agents API had 25 minutes of runs failing to start on 18 September and 4 hours 56 minutes of elevated run failures on 21 to 22 September. We count that last one as one major outage. July's history page returned a server error to us (10). Rate limits published per endpoint, 10 QPS search and answer, 5 QPS deep, 100 QPS contents (15). 429 with `Retry-After` when available and exponential backoff advice. We found no idempotency guidance for creating Agent runs, which cost money (12). No SLA found (0). Search, contents and the MCP are GA (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 3. Transparency & trust, 65 out of 100, up to 3.1 more on the total

Made of editorial 44, provenance 86.

Why it scored 65: The MCP server is MIT and the API is closed with published terms (20). The privacy policy, updated 29 June 2026, says query data is used to train and fine-tune Exa's models and states no retention period. Zero data retention needs a sales conversation, and the DPA sits in the trust centre (12). Dated deprecations in the changelog, such as the `pdf`, `github` and `tweet` categories on 23 July, with no removal dates (12). The MCP server, hosted and on npm, sends usage events to Agnost (api.agnost.ai) with no mention in the README, no opt-out flag, and no named subprocessor list in the privacy policy (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Domain age: exa.ai, registered 2017-12-16 (8 years) (11 of 15)
- security.txt: not found (0 of 10)

## 4. Schema & documentation, 86 out of 100, up to 2.3 more on the total

Why it scored 86: OpenAPI at exa.ai/docs/exa-spec.yaml per the 30 September check, and JSON Schema inputs on every MCP tool (25). llms.txt and Markdown docs (10). `web_search_exa` tells the model how to phrase a query and when to follow up with `web_fetch_exa`, and deprecated tools name their replacement. Nothing says when not to use a tool (15). Inputs coerce loosely. `numResults` is described as 1 to 100 but the schema has no bounds, and bad numbers fall back to defaults silently (10). An error-codes page and examples on every endpoint page (13). Dated changelog with deprecations. The MCP repository has no tags, so versions show only in package.json and the registry (13).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 5. Payments & pricing, 90 out of 100, up to 1.3 more on the total

Why it scored 90: x402 on POST /search and /contents, USDC on Base or Solana, not on answer, Agent runs, monitors or Websets, so partial (30). Per-call prices published without login, $0.004 instant to $0.015 deep-reasoning per search (20). $10 a month and a $10 onboarding bonus with no card, per the 30 September check, since the billing page doesn't say (20). An agent can pay by x402 with no account, and the hosted MCP works anonymously within rate limits (20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 6. Maintenance & community, 88 out of 100, up to 1.1 more on the total

Why it scored 88: exa-py v2.25.0 on 2026-10-01 and an API changelog entry on 24 September (30). Ten exa-py releases since 14 August and changelog entries on 23 July, 28 August and 24 September (20). 28 open MCP issues, many of them listing-site solicitations, and pull requests merge most weeks. We couldn't see reply times (15). Official registry entry ai.exa/exa under Exa's own domain, and current Python and TypeScript SDKs (15). CI typechecks and tests the MCP server on every push. The npm package ships from a workflow without git tags (8).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Agent ergonomics, 96 out of 100, up to 0.7 more on the total

Why it scored 96: Two tools on by default, `web_search_exa` and `web_fetch_exa`, about 1,250 characters of descriptions between them, and `?tools=` turns on `web_search_advanced_exa` and `agent_run` when needed (25). `numResults`, `maxCharacters`, highlights instead of full text, category, domain and date filters (20). The error-codes page lists codes, and the MCP server rewrites a 429 into a message about the free tier and keys. Errors reach the model as text rather than a code (16). Every tool sets `readOnlyHint`, `destructiveHint: false` and `idempotentHint`, and the server retries transient errors twice (20). Only `query` is required. Python and TypeScript SDKs (15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## Deductions

Each comes off the total. A fixed and documented problem counts for less at the next check.

- 2026-04-15. Exa's own fix (#292) says Agnost analytics on the hosted MCP captured headers, query parameters and full URLs from every request and sent them to api.agnost.ai, which leaked user API keys passed as `x-api-key` or `?exaApiKey=`. Fixed the same day, but disclosed only in the commit message, with no advisory or rotation notice that we found. Decayed for the fix, so -6 (https://github.com/exa-labs/exa-mcp-server/commit/49797a5376217da506853b12163f21db9f9c95b8)
- 2026-10-01. The MCP server calls Agnost's `trackMCP` on startup in both the hosted and the npm stdio builds, with no README mention and no opt-out. Inputs, outputs and errors are switched off, so the events are tool names and timings. -3 (https://github.com/exa-labs/exa-mcp-server/blob/main/src/mcp-handler.ts)

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: status history for July 2026 (status.exa.ai/history/2 returned a server error)
- When analytics first ran on the hosted endpoint, and whether Exa told affected users to rotate keys
- Whether failed or empty searches are charged
- Whether the free tier still needs no card, which the billing page we read doesn't state

## Weaknesses

- The hosted MCP leaked API keys to a third-party analytics endpoint from November 2025 to 15 April 2026, per Exa's own commits
- Agnost usage analytics in the MCP server with no disclosure or opt-out
- The privacy policy says query data trains Exa's models and gives no retention period
- No security.txt, no SECURITY.md and no prompt-injection guidance
- Agents API had 4 hours 56 minutes of elevated run failures on 21 to 22 September

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Send the key as `x-api-key` or a Bearer header, never `?exaApiKey=` in the MCP URL
- Ask for highlights rather than full text, and cap `maxCharacters` on `web_fetch_exa`
- Request only the results you'll read. More than 10 costs extra, and x402 calls stop at 10
- On 429, honour `Retry-After`. The QPS limit is shared by every key on the team
- Add `?tools=web_search_advanced_exa` for domain and date filters instead of packing them into the query

## What the review panel asked for

- A stated anonymous limit
- x402 on MCP
- reject bad parameters
- removal dates for categories

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.