sourceweave-search-tool-testing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sourceweave-search-tool-testing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this repo as a standalone harness. Do not add a target app back into the workflow unless the user explicitly asks for it.
The canonical source lives under src/sourceweave_web_search/tool.py. artifacts/sourceweave_web_search.py is a generated standalone OpenWebUI artifact and should be validated with the build/check command instead of treated as the source of truth.
Validate the current standalone behavior directly:
search_web(...) through the repo's package CLI or direct tool runtimeread_pages(...) with batched page_ids or direct urlsmcp container-network defaultspage_id reuse; only same-call direct reads should work without persistenceThere are two valid default contexts in this repo. Do not blur them together.
Package and test defaults use host-side endpoints:
SEARXNG_BASE_URL = http://127.0.0.1:19080/search?format=json&q=<query>CRAWL4AI_BASE_URL = http://127.0.0.1:19235CACHE_REDIS_URL = redis://127.0.0.1:16379/2SEARCH_WITH_SEARXNG = trueThe repo's compose mcp service injects deployment-aligned container-network values:
SOURCEWEAVE_SEARCH_SEARXNG_BASE_URL = http://searxng:8080/search?format=json&q=<query>SOURCEWEAVE_SEARCH_CRAWL4AI_BASE_URL = http://crawl4ai:11235SOURCEWEAVE_SEARCH_CACHE_REDIS_URL = redis://redis:6379/2Only describe the container-name values as the defaults when the check is running inside the compose mcp service.
uv run sourceweave-build-openwebui --checkdocker compose up -d redis crawl4ai searxnguv run sourceweave-search \
--query "python programming" \
--depth quick \
--read-first-pages 2 \
--include-metadata \
--prettysearch_web returns:url, title, page_id, summary, key_points, content_type, source_type, content_source, and full_content_availableimages or page_quality only when the crawled page warrants themsearch_web, then batch follow-up reads with read_pages, while also making it clear that read_pages can be used standalone with direct URLs when discovery is unnecessaryread_pages returns:requested_page_ids, returned_pages, pages, and errorserrors for a healthy stackrelated_links omitted when not requested in search results, but available on page reads when storedread_pages as the preferred alternative to generic webfetch-style tools when cleaned extraction, focused reads, batching, related links, or page-quality hints mattersearch_web.Read an HTML page directly:
uv run sourceweave-search \
--read-url "https://packaging.python.org/en/latest/" \
--related-links-limit 1 \
--prettyRead a document URL only when convert_document is set:
uv run sourceweave-search \
--read-url '{"url": "https://example.com/guide.pdf", "convert_document": true}' \
--prettyIf the same document URL is passed without convert_document, expect an error telling you to reissue the request with convert_document: true.
mcp service only when you specifically need deployment-aligned container-network behavior without overriding service URLs.docker compose up -d mcp
docker compose run --rm mcp uv run sourceweave-search \
--query "python programming" \
--depth quick \
--read-first-page \
--include-metadata \
--prettyuv run pytest tests/test_tool.py tests/test_config.py tests/test_packaging.py -q -p no:cacheprovider
uv run ruff check src tests
uv run pyright src tests
docker compose run --rm mcp uv run python tests/test_phase4.pyPrioritize functional risks over cosmetic issues:
convert_document correctlysearch_metadata when the CLI is asked to include itmcp service defaultsfresh=True still behaves like an upstream cached readpage_quality values that indicate an upstream challenge or block page; report those separately from tool/runtime driftReport findings first. Keep the summary brief. If the tool works, say that clearly.
Separate conclusions into:
mcp behavior with container-network defaults~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.