robbyczgw-cla/web-search-plus-mcp

Web Search Plus MCP v0.14.0

Syncs the standalone MCP server with the Web Search Plus v2.7.0 engine family where applicable.

Security

• Adds private/internal extraction target protection for web_extract before provider dispatch.
• Blocks loopback, RFC1918, CGNAT/shared-address ranges, IPv6 local/mapped-private ranges, multicast, cloud metadata hosts, and hostnames resolving to private/internal IPs.
• Keeps operator-configured local provider endpoints working, with explicit trusted intranet escape hatch via extract.allow_private_urls: true.

Fixed

• Provider configuration errors such as missing API keys no longer mark providers unhealthy or place them into cooldown.
• Provider cooldown handling now accepts and caps Retry-After metadata for real provider failures.

Changed

• Bumps package/server/docs metadata to 0.14.0.
• README now documents the MCP-specific v2.7 sync boundary and private extraction target guard.

Attribution / upstream sync notes

• #60 by @IlyaGusev: keyless setup/config preservation is credited; MCP already has its own onboarding/config surface and Keenable keyless semantics from v0.13.0, so no setup-wizard code was ported.
• #61 by @robbyczgw-cla: private/internal extract target guard ported.
• #62 by @robbyczgw-cla: setup.py fastpath is Hermes-plugin-specific and not applicable to the standalone MCP package.
• #63 by @robbyczgw-cla: provider config errors avoid cooldown, ported.

Verification

• python3 -m compileall -q web_search_plus_mcp tests
• python3 -m pytest tests -q → 96 passed
• python3 -m ruff check web_search_plus_mcp tests
• python3 -m build
• python3 -m twine check dist/*
• MCP schema smoke: web_search, web_extract; web_extract includes keenable
• Andy review: initial BLOCK caught the missing retry_after provider-health port; follow-up PASS after fix and regression tests.