Web Researcher MCP

v1.42.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 11d MCP Developer Tools

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai ai-agent anti-hallucination bibliography citation-verification claude

+13 more

claude-code claude-desktop content-extraction cursor fact-checking go llm mcp mcp-server model-context-protocol research web-scraping web-search

Affected surfaces

deps

Summary

AI summary

Updates Hardening, Bug Fixes, and issue/PR across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Fixes URL construction vulnerability that could truncate outbound GitHub requests at '#' or '?' characters. Fixes URL construction vulnerability that could truncate outbound GitHub requests at '#' or '?' characters. Source: llm_adapter@2026-07-16 Confidence: high	—
Feature	Medium	Adds zero-config GitHub API research and content-reading capabilities. Adds zero-config GitHub API research and content-reading capabilities. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix
Bugfix	Low	Fixes duplication of nixpkgs submission PRs per release in CI/CD. Fixes duplication of nixpkgs submission PRs per release in CI/CD. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Low	Corrects docs/DEPLOYMENT.md reference from nonexistent github_search to web_search/news_search with provider=github. Corrects docs/DEPLOYMENT.md reference from nonexistent github_search to web_search/news_search with provider=github. Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Low	Adds missing "github" entry to provider jsonschema enum for web_search, news_search, and search_and_scrape tools. Adds missing "github" entry to provider jsonschema enum for web_search, news_search, and search_and_scrape tools. Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

What's Changed

New Features

Zero-config GitHub API research & content-reading (#397, spec/audit trail: #396)

Three integrated pieces, all working with no GITHUB_TOKEN or gh CLI required — everything runs against public, unauthenticated GitHub infrastructure:

GitHub search provider (#282) — web_search and news_search accept provider: "github" to search GitHub issues and pull requests via the public REST Search API. 10 req/min unauthenticated; set GITHUB_TOKEN to raise that to 30 req/min. Results include issue number, state, kind (issue/PR), reaction count, comment count, author, and creation date.
Native GitHub content routing (#395) — scrape_page and search_and_scrape now read github.com README/blob URLs and gist.github.com gists natively via the raw CDN and REST/Gist APIs, instead of falling through to the generic HTML scraper. Faster, cleaner extraction with proper extractedBy provenance (github:raw / github:contents-api / github:gist-api).
Awesome-list GitHub fallback (#394) — awesome_list_search now falls back to a GitHub topic search when the ecosyste.ms Awesome API has no match for a given topic.

Bug Fixes

fix(cicd): stop nixpkgs submission from duplicating PRs per release (#392)

Hardening (found and fixed during implementation of #397)

Outbound GitHub CDN/API request URLs were built via raw string concatenation, which could silently truncate at a # or ? character in a decoded path segment. Fixed with url.PathEscape on every path segment, with a permanent regression test.
docs/DEPLOYMENT.md referenced a nonexistent github_search tool; corrected to web_search/news_search with provider=github.
Live testing against a rebuilt binary through the actual MCP client surfaced a missing github entry in three tools' (web_search, news_search, search_and_scrape) provider jsonschema enum descriptions; fixed.

Full changelog: https://github.com/zoharbabin/web-researcher-mcp/compare/v1.39.0...v1.42.0

Security Fixes

Fixed URL construction vulnerability that could truncate at `#` or `?` via proper path escaping

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Web Researcher MCP

Get notified when new releases ship.

About Web Researcher MCP

All releases →