Ssmcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Ssmcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Model Context Protocol (MCP) server providing web search with content extraction.
Many AI models, especially local models or certain cloud-based models, don't have built-in web browsing capabilities. SSMCP bridges that gap by providing a simple, self-hosted solution that gives your AI assistant the ability to:
Example Use Cases:
git clone https://github.com/antonsokolskyy/SSMCP.gitcd SSMCP/
cp .env.example .envStart and stop the searxng container to generate settings.yml:
docker compose up searxngWait until you see:
"/etc/searxng/settings.yml" does not exist, creating from template...Then press Ctrl+C to stop it.
Edit deploy/docker/searxng_data/settings.yml and add json to the formats list:
# remove format to deny access, use lower case.
# formats: [html, csv, json, rss]
formats:
- html
- jsondocker compose builddocker compose up -dTo access age-restricted or private YouTube videos, and to reduce the chances of hitting captchas or IP blocking, you can provide cookies from your browser.
Note: The cookies file must be in Netscape cookie format.
<details> <summary>Generating cookies.txt</summary>
Option 1: Using Browser Extension
Install an extension (like "Get cookies.txt LOCALLY") for your browser and export cookies for youtube.com in Netscape format.
Option 2: Using yt-dlp Binary
yt-dlp --cookies-from-browser chrome --cookies cookies.txt https://www.youtube.com/watch?v=VIDEO_IDReplace chrome with your browser (firefox, edge, safari, etc.). This automatically exports in Netscape format. </details>
<details> <summary>Using cookies.txt</summary>
Place the generated cookies.txt file in:
deploy/docker/ssmcp/cookies.txtSecurity Warning: The cookies file contains authentication tokens and sensitive data. Set appropriate file permissions to prevent unauthorized access:
chmod 600 deploy/docker/ssmcp/cookies.txtThe file will be automatically detected and used by Docker container. </details>
The server uses Streamable HTTP transport. Connect to the MCP server at:
http://{HOST}:{PORT}/mcpExample:
http://localhost:8000/mcp{
"mcpServers": {
"ssmcp": {
"url": "http://localhost:8000/mcp"
}
}
}SSMCP includes an optional Web UI for monitoring requests and responses. This is particularly useful for debugging and inspecting how the model uses the tools.
<details> <summary>Enabling the Web UI</summary>
.env file and uncomment the REDIS_URL line: REDIS_URL=redis://redis:6379docker-compose.yml (and docker-compose.dev.yml if using development mode) and uncomment the redis and ssmcp-ui service blocks. make build</details>
Performs a web search and returns relevant results with extracted content.
Parameters:
query (str): Search query or keywords to find relevant web contentReturns:
url (str): The webpage URLcontent (str): Page content in Markdown formatFetches content from a specified URL and converts it to Markdown.
Parameters:
url (str): The URL to fetch content fromReturns:
Gets subtitles/captions from a YouTube video and returns the text content.
Parameters:
url (str): YouTube video URL to get subtitles fromReturns:
SSMCP uses a pipeline to deliver clean content from web searches:
Two-stage filtering extracts clean main content:
article, main, etc.) to find main content areaIf any filter produces output, the filtered HTML is re-processed through Crawl4AI for cleaner output before markdown conversion.
When enabled, SSMCP uses an LLM to summarize search results before returning them to your AI model. This reduces the token count in your context window - search results can be 40k-60k tokens, but summaries significantly reduce that.
Note: LLM summarization is disabled by default. Enable it via environment variables if needed (see .env.example).
All development tasks are performed inside the Docker container. Nothing needs to be installed on the host machine except Docker and Docker Compose.
Run make help to see all available commands:
<details> <summary>Development Workflow</summary>
Open .env and uncomment the line
COMPOSE_FILE=docker-compose.yml:docker-compose.dev.yml make build make shellInside the shell, you can run any command:
uv run python -m ssmcp.server
uv run pytest -v make test make check make restart
make rebuild make down</details>
All configuration is managed through environment variables. See .env.example for available options
SSMCP supports OAuth authentication for use with OpenWebUI and any OIDC-compliant identity provider.
When you select OAuth in OpenWebUI for an MCP server:
Authorization: Bearer <token> headersub claim<details> <summary>Enabling OAuth</summary>
To enable OAuth authentication, set the following environment variables in your .env file:
# Enable OAuth authentication
OAUTH_ENABLED=true
# JWKS endpoint URL for your identity provider's public keys
# Examples:
# Authentik: https://authentik.example.com/application/o/my-app/jwks
OAUTH_JWKS_URL=https://your-idp.example.com/path/to/jwks
# Issuer URL for token issuer verification
# Must match the 'iss' claim in JWT tokens
# Examples
# Authentik: https://authentik.example.com/application/o/my-app
OAUTH_ISSUER=https://your-idp.example.com/application/o/my-app
# Open WebUI client ID for token audience verification
OAUTH_CLIENT_ID=your-openwebui-client-id</details>
<details> <summary>Token Validation</summary>
When OAuth is enabled, SSMCP validates:
iss claim matches OAUTH_ISSUERexp claim - rejects expired tokensaud claim matches OAUTH_CLIENT_IDsub claim (contains user identifier)</details>
<details> <summary>OpenWebUI Configuration</summary>
In OpenWebUI, configure the MCP server with:
http://ssmcp:8000/mcp)</details>
<details> <summary>Supported Identity Providers</summary>
SSMCP works with any OIDC-compliant identity provider that:
sub, aud, exp, iss)</details>
Apache License 2.0 - see LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.