THRONE
See report Verify server

registry / record

exa-mcp-server

npm / sealed 2026-06-12 / No. 8de0046b

> throne registry exa-mcp-server sealed
receiptsealed evidence
scan id
8de0046ba07445f782ddf4beb57fabb8
target
exa-mcp-server
sealed at
2026-06-12 06:50:05Z
evidence hash
sha256:a04e5568d5318a296ce3b5ffcce1213de3439332f8b5a47e158e858eec46d16d
01connectPASS728ms

initialize ok: server exa-search-server 3.2.1, negotiated protocolVersion 2025-11-25, capabilities ['completions', 'prompts', 'resources', 'tools']

02discoverPASS7ms

supported: tools/list (2 tools), resources/list (1), prompts/list (1)

03validate_schemasPASS3ms

all 2 tool inputSchemas are valid JSON Schema

04smoke_test_toolsPASS395ms

called 2 of 2 tools (cap 10): 0 ok, 2 returned tool-level errors (expected for synthesized args)

05error_handlingPASS3.9s

structured error responses, connection survived — wrong_type_args: accepted (returned result); unknown_method: error(-32601); invalid_id: no response (silent), connection alive

06streamingPASS1ms

no streaming-capable tool declared by this server; not applicable (pass-na)

07resource_lifecyclePASS5ms

read exa://tools/list (1 content blocks); subscribe capability not declared (pass-na)

08concurrent_callsWARN12ms

ladder 1/2/4/8 overlapping web_search_exa calls: max_observed_stable_concurrency=8; all ids answered exactly once, but every call returned an error (tool-level isError result) — the tool may need runtime dependencies this sandbox does not provide

09reconnectPASS2.7s

transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)

01connectPASS864ms

initialize ok: server exa-search-server 3.2.1, negotiated protocolVersion 2025-11-25, capabilities ['completions', 'prompts', 'resources', 'tools']

02discoverPASS6ms

supported: tools/list (2 tools), resources/list (1), prompts/list (1)

03validate_schemasPASS1ms

all 2 tool inputSchemas are valid JSON Schema

04smoke_test_toolsPASS171ms

called 2 of 2 tools (cap 10): 0 ok, 2 returned tool-level errors (expected for synthesized args)

05error_handlingPASS4.0s

structured error responses, connection survived — wrong_type_args: accepted (returned result); unknown_method: error(-32601); invalid_id: no response (silent), connection alive

06streamingPASS0ms

no streaming-capable tool declared by this server; not applicable (pass-na)

07resource_lifecyclePASS5ms

read exa://tools/list (1 content blocks); subscribe capability not declared (pass-na)

08concurrent_callsWARN13ms

ladder 1/2/4/8 overlapping web_search_exa calls: max_observed_stable_concurrency=8; all ids answered exactly once, but every call returned an error (tool-level isError result) — the tool may need runtime dependencies this sandbox does not provide

09reconnectPASS2.9s

transport closed and relaunched; re-handshake ok (protocolVersion 2025-11-25, first session was 2025-11-25)

chatgpt desktopemulation profile pending real-traffic captureCOMING SOON
SECURITY: REVIEW / 4 finding(s) / review material, not a verdict
LOWTHR-INSTALL-03 / Install-time script execution (npm lifecycle)

"prepare" runs on git-dependency installs and local dev (not registry installs): 'npm run build:stdio'

package/package.json
LOWTHR-NET-05 / Hardcoded outbound endpoints

8 non-local endpoint host(s) referenced in code — verify each is expected for this server's purpose: api.agnost.ai (package/smithery/stdio/index.cjs:75), api.exa.ai (package/smithery/stdio/index.cjs:80), dashboard.exa.ai (package/smithery/stdio/index.cjs:88), lodash.com (package/smithery/stdio/index.cjs:214), mcp.exa.ai (package/smithery/stdio/index.cjs:88), npms.io (package/smithery/stdio/index.cjs:19), openjsf.org (package/smithery/stdio/index.cjs:215), underscorejs.org (package/smithery/stdio/index.cjs:217)

package/smithery/stdio/index.cjs:19
LOWTHR-VER-11 / Outdated MCP SDK or protocol version pin

obsolete protocol version string '2024-10-07' in source

package/smithery/stdio/index.cjs:65
LOWTHR-VER-11 / Outdated MCP SDK or protocol version pin

obsolete protocol version string '2024-11-05' in source

package/smithery/stdio/index.cjs:65
VERDICT: FIT TO SHIPSANDBOXED RUN — submitted server executed in a disposable microVM — compatibility: 0 fail / 2 warn across 2 clients / security: review — 4 finding(s), 0 highsealed by THRONE / No. 8de0046b / 2026-06-12
THRONE: FIT TO SHIPwear the crown

paste this in your README. it renders the live verdict and links back to this record. if a release ever breaks the verdict, the badge says so on its own.

[![THRONE: FIT TO SHIP](https://api.usethrone.dev/api/badge/exa-mcp-server)](https://usethrone.dev/server/exa-mcp-server)
executed in a disposable microVM, created for this scan and destroyed after it. nothing outlives a run.

maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.

this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.