DuckDuckGo Search MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow search result and package compatibility as upstream behavior changes

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

MCP clients needing DuckDuckGo search and readable webpage fetching.

What we know

A DuckDuckGo search MCP with webpage fetching/parsing and long-URL reference tokens.

Maintenance / activity evidence

Observed Sep 4, 2026 (UTC)Bump version to 0.7.0

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Outbound web search/fetch plus optional inbound HTTP listener.
No service credential documented
Sensitive access: Arbitrary URLs/page content

Read-only web retrieval is bounded, but arbitrary fetch and remote endpoint exposure need network controls.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,524 repository stars

Stars observed Oct 6, 2026.

Registry provider returned conflicting availability during the audit; 30-day value withheld pending a clean recheck.

All limitations / Review context

Does the server still expose the documented DuckDuckGo search tools?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Read-only web retrieval is bounded, but arbitrary fetch and remote endpoint exposure need network controls.
Outbound web search/fetch plus optional inbound HTTP listener.
No service credential documented
Fetched pages may be held in in-memory cache.
Sensitive access: Arbitrary URLs/page content
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Stable 30-day package metric
Depends on DuckDuckGo and target-site availability.
Remote HTTP deployment requires DNS-rebinding and origin controls.

Original activity observations

2026-09-04T18:27:57Z: Bump version to 0.7.0

Technical identity

github.com/nickclyde/duckduckgo-mcp-server

Exact implementation source: https://github.com/nickclyde/duckduckgo-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: nickclyde/duckduckgo-mcp-server
Package identity: pypi:duckduckgo-mcp-server
Service endpoint: 127.0.0.1:8000

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
nickclyde/duckduckgo-mcp-server
Recorded repository material and project history.
Evidence source ↗
pypi.org/project/duckduckgo-mcp-server/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

claude-desktop

Publisher instructions with a documented client setup path.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
DuckDuckGo MCP server runs with uvx and no mandatory search API key.
mcp stdio launcher or diagnostic · Publisher instructions
uvx duckduckgo-mcp-server
Configure / authenticate
MCP100 setup guide
Install DuckDuckGo server with uvx duckduckgo-mcp-server, keyless. Default transport stdio; HTTP mode and DNS-rebinding allowlist require explicit configuration.
Advanced configuration · claude desktop json · MCP100 composed guide
claude desktop json · MCP100 composed guide
{ "mcpServers": { "ddg-search": { "args": [ "duckduckgo-mcp-server" ], "command": "uvx" } } }
Check connection
Suggested check
Read-only public search; do not disable DNS-rebinding protection.
Remove / uninstall / revoke
MCP100 setup guide
Matching publisher CLI server name; optional `uv tool uninstall duckduckgo-mcp-server` only if it was installed persistently through uv tool.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
claude mcp remove ddg-search

Official Documentation & Sources

What it does

A DuckDuckGo search MCP with webpage fetching/parsing and long-URL reference tokens.

Capability: Search & Web
Resource type: MCP Server
Best fit: MCP clients needing DuckDuckGo search and readable webpage fetching.

Representative uses

Search the web
Fetch and parse pages
Use safe-search and region settings
Run stdio or remote HTTP transports

Limitations

Depends on DuckDuckGo and target-site availability.
Remote HTTP deployment requires DNS-rebinding and origin controls.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: No service credential documented
Permissions: Outbound web search/fetch plus optional inbound HTTP listener.
Data handling: Fetched pages may be held in in-memory cache.
Cost: free
Risk and cautions: Read-only web retrieval is bounded, but arbitrary fetch and remote endpoint exposure need network controls.

Access scope and cautions

Write actions: None in the reviewed inventory
Sensitive access: Arbitrary URLs/page content
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Search the web; Fetch and parse pages; Use safe-search and region settings; Run stdio or remote HTTP transports.

What setup and authentication are documented?

Recorded installation/entrypoint step: uvx duckduckgo-mcp-server. Recorded transport: stdio, sse, streamable_http. Recorded environment-variable notes: DDG_SAFE_SEARCH; DDG_REGION; DDG_CA_CERTS; DDG_ALLOWED_HOSTS; DDG_ALLOWED_ORIGINS. No configuration values are supplied here. Prerequisites: Python/uvx. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: No API key documented.

Can it modify data or perform write operations?

The reviewed inventory lists no write actions. An empty inventory alone does not establish read-only authority. Recorded permission boundary: Outbound web search/fetch plus optional inbound HTTP listener.

What data-handling boundary should I consider?

Fetched pages may be held in in-memory cache. Recorded sensitive-access context: Arbitrary URLs/page content.

What limitations and risks should I check before use?

Read-only web retrieval is bounded, but arbitrary fetch and remote endpoint exposure need network controls. Depends on DuckDuckGo and target-site availability. Remote HTTP deployment requires DNS-rebinding and origin controls. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

Nick Clyde is listed as Community implementation in MCP100’s current evidence.