exa MCP server
ai.exa/exaexa.airemotev3.4.1
Connect AI agents to Exa for web search, content fetching, and multi-step research.
No tools shown: it asks for sign-in first
This server lists its tools only to a signed-in client. anlyon.dev never signs in or sends credentials, so it cannot read them, and nothing here is a judgement of the server. Already use it? Copy its tools/list from your client and check it here: the same labels, worked out in your browser.
Sign-in required, no OAuth metadata. Remote posture
Anlyon alternative
Run the operations that matter as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
anlyon.dev does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →What the exa MCP server can do
The exa MCP server is published by exa.ai, a domain the MCP Registry verified. It asks for sign-in before it lists its tools, and anlyon.dev never signs in, so its tools are not shown.
Scan status: sign-in required
Last attempt Nov 9, 2026, 17:18 UTC.
Have its tools/list output? Check it yourself.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Nov 13, 2026, 11:24 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 403
- tools/list served without credentials
- no
- Tools that change things, listed without credentials
- 0
- Protocol version
- not observed
- WWW-Authenticate on 401
- no
- resource_metadata in WWW-Authenticate
- not observed
- RFC 9728 protected resource metadata
- not observed
- Authorization servers
- not observed
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
- WarnThe whole server
The endpoint asks for credentials (HTTP 403) but publishes no RFC 9728 protected resource metadata: no resource_metadata in WWW-Authenticate and no document at /.well-known/oauth-protected-resource.
What this check looks forMatched text
https://mcp.exa.ai/mcp: initialize answered HTTP 403, without a WWW-Authenticate header
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 3.4.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http exa https://mcp.exa.ai/mcpclaude mcp add --transport http exa https://mcp.exa.ai/mcpRun in a terminal.
Badge
A badge for your README that links back to this page.
Badge
[](https://anlyon.dev/servers/ai.exa/exa)Source: MCP Registry · repository. Synced Oct 21, 2026, 17:41 UTC.
exa MCP server: questions and answers
Answered from the scan above, not from the publisher's description.
Is the exa MCP server safe?
- anlyon.dev has not been able to list its tools, so it has no classes or findings for it yet. It asks for sign-in before listing them. Paste its tools/list output into https://anlyon.dev/scan to check it yourself.
Who publishes the exa MCP server?
- exa.ai (domain verified by the MCP Registry).