OAuth-protected · Streamable HTTP

Web intelligence for agents, secured by design.

Give any MCP-compatible AI client high-quality Exa search without handing it an API key. ScaleKit validates every request before FastAPI routes it to one of three purpose-built tools.

Connect a client → Explore the code ↗
✓ OAuth 2.1 ✓ RFC 9728 discovery ✓ MCP Streamable HTTP
secure-search.json ● protected
01
MCP clienttools/call
request
02
ScaleKit OAuthBearer token verified
authorized
03
Exa Search APIGrounded results
200 OK 
{
  "tool": "exa_search",
  "query": "latest agent security research",
  "num_results": 10
}
3Focused MCP tools
1Protected endpoint
100Results per request
0API keys exposed to clients
Tool surface

Everything an agent needs to research the web.

Small, predictable tools with structured responses—easy for models to select and developers to audit.

⌕01

exa_search

Semantic, instant, fast, or deep web search with domain, category, date, locale, and moderation controls.

querysearch_typenum_results+ 10
View parameters →
Content enrichment
≡02

exa_get_contents

Turn Exa result IDs into clean page text, relevant highlights, AI summaries, and freshness statuses.

idshighlightslivecrawl+ 3
View parameters →
≈03

exa_find_similar

Discover semantically related pages from one trusted URL, with the same filters and content options.

urlinclude_domainssummary+ 6
View parameters →
Security model

Your Exa key stays server-side. Every tool call proves who sent it.

The public surface is intentionally narrow. Health checks and OAuth metadata are discoverable; the MCP transport fails closed until ScaleKit validates issuer, audience, signature, expiry, and scope.

  • ✓
    Standards-based discoveryRFC 9728 metadata and WWW-Authenticate challenges
  • ✓
    Least-privilege scopesRequire exa:read before any MCP operation
  • ✓
    Safe production defaultsRestricted CORS, security headers, sanitized upstream errors
Quickstart

From clone to connected in four steps.

  1. 1
    InstallSync the locked Python environment
  2. 2
    ConfigureAdd Exa and ScaleKit credentials
  3. 3
    RunStart FastAPI and the MCP transport
  4. 4
    ConnectPoint any MCP client at /exa
TerminalPowerShell / Bash
# 1. Install reproducible dependencies
$ uv sync --all-extras

# 2. Create your local configuration
$ cp .env.example .env

# 3. Start the FastAPI + MCP service
$ uv run main.py

# 4. Verify the public health endpoint
$ curl http://localhost:8000/health
Architecture

A short, observable path from prompt to source.

ClientAI applicationClaude · Windsurf · Inspector
Bearer token
IdentityScaleKitOAuth 2.1 · scopes · discovery
verified request
ProtocolFastAPI + MCPStreamable HTTP · JSON-RPC
x-api-key
SearchExa AIWeb search · contents · similarity
Client configuration

Use the same endpoint from any MCP client.

Replace the example host with your deployed FastAPI service. The client discovers ScaleKit through the protected-resource metadata response.

mcp.json
{
  "mcpServers": {
    "secure-exa": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://your-service.example.com/exa"
      ]
    }
  }
}
Open source · MIT

Build an agent that can search without compromising security.

Clone the project, register your MCP resource in ScaleKit, and deploy with Docker or the included Render blueprint.

Open on GitHub ↗