Torrent Search Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Torrent Search Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This repository provides a Python API/WebUI and an MCP (Model Context Protocol) server to find torrents programmatically on ThePirateBay, 1337x, Nyaa, YTS, EZTV, FitGirl, SubsPlease and UIndex. It allows for easy integration into other applications or services.
<div align="center" style="margin: 20px 0;"> <img src=".github/assets/cover.png" alt="Torrent Search web UI - popular torrents view" width="720" /> </div>
How to use it with MCP Clients
Run it with Docker to bypass common DNS issues
Search directly from the command line
uvx torrent-search-mcp --mode cli "sample show"
# MCP server over stdio (default)
uvx torrent-search-mcp --mode stdio
# MCP server over streamable HTTP (port 8000, endpoint /mcp)
uvx torrent-search-mcp --mode http
# MCP server over SSE (port 8000, endpoint /sse, legacy)
uvx torrent-search-mcp --mode sse
# Standalone API server (port 8000)
uvx torrent-search-mcp --mode api2026-07-28 protocol revision over stdio or streamable HTTP (http), with automatic negotiation of older handshake revisions and legacy transport aliases (streamable-http, sse).popular_torrents cached for 2 minutes for Web UI delivery (a Web UI POPULAR click passes refresh=true to drop the caches and re-scrape every source); searches are never cached (only identical concurrent requests are coalesced) so new results appear immediately.get_torrent without re-scraping.INCLUDE_LINKS=true.| Source | Scraping domain | Fetch method |
|---|---|---|
| ThePirateBay | apibay.org | JSON API |
| 1337x | 1337x.la + mirrors | HTML search/top pages |
| Nyaa | nyaa.si | RSS + HTML top page |
| YTS | yts.mx + mirrors | JSON API |
| EZTV | eztvx.to | JSON API |
| FitGirl | fitgirl-repacks.site | RSS |
| SubsPlease | subsplease.org | JSON API |
| UIndex | uindex.org | HTML top list |
The API exposes public display domains where applicable: apibay.org is shown as thepiratebay.org, and yts.mx as yts.vg. Results may include a validated HTTP(S) page_url linking back to their source page.
Note on UIndex: the site exposes no programmatic search endpoint (its search path is protected by a browser challenge), so queries are matched client-side against its live top list - which conveniently carries magnet links inline.
Sources can be excluded individually via the EXCLUDE_SOURCES env var.
uv (for local development).The application reads configuration from environment variables. The recommended way to set them is by creating a .env file in your project's root directory. The application will load it automatically. See .env.example for all available options.
| Variable | Default | Description |
|---|---|---|
INCLUDE_LINKS | false | When true, include magnet links in the MCP search_torrents / popular_torrents results. Left off by default to greatly reduce token usage. |
EXCLUDE_SOURCES | _(none)_ | Comma-separated list of sources to exclude from results (e.g. nyaa.si,1337x.to). |
TORRENT_SEARCH_API_URL | _(none)_ | MCP only: base URL of a running Torrent Search REST API - tools proxy it instead of scraping locally. Unset = standalone. |
TELEGRAM_BOT_HANDLE | _(none)_ | Telegram bot handle used by the Web UI torrent action. Unset = the web UI runs without the pairing gate and Telegram features stay hidden. |
TORRENT_SEARCH_API_KEY | _(none)_ | Secret required to approve Web UI pairing codes (register endpoint + authorize_webapp MCP tool). Must match between API and MCP servers. Unset = pairing disabled (no gate). |
TELEGRAM_BOT_TOKEN | _(none)_ | Bot token enabling server-side sending via POST /forward_telegram (non-agent mode). Unset = that endpoint replies 503 unless agent mode is configured; the Web UI forward popup still works through Telegram draft deep links. |
AGENT_RELAY_URL | _(none)_ | Agent relay mode (with AGENT_RELAY_TOKEN, required): forward becomes a Confirm/Cancel dialog POSTing {chat_id, sender, notice, prompt} to the agent's HTTP relay instead of the Bot API (bots never receive bot-authored Telegram messages). |
AGENT_RELAY_TOKEN | _(none)_ | Agent relay mode: shared secret sent as the X-Relay-Token header; must match the agent's AGENT_RELAY_TOKEN. |
TELEGRAM_AGENT_NAME | _(none)_ | Agent relay mode: sender name passed to the relay (spoofed as the chat identity downstream). |
TELEGRAM_MSG_FORWARD | _(none)_ | Agent relay mode: notice echoed into the chat by the agent before it processes the prompt. |
PRUNE_MAGNET_LINKS | false | When true, magnets sent over every Telegram path (forward popup draft + /forward_telegram) are pruned to magnet:?xt=urn:btih:<hash>&dn=<name>; copy/magnet buttons keep originals. |
TELEGRAM_AUTH_FILE | ./authorized_tokens.json | Persistence file for authorized session tokens (SHA-256 hashes only); shared between API and MCP processes via mtime-based reload. |
WEBUI_URL | _(none)_ | MCP only: public URL of the web UI; enables the torrent_webapp tool that presents the app and its pairing flow. |
Choose one of the following installation methods.
#### Install from PyPI (Recommended)
This method is best for using the package as a library or running the server without modifying the code.
pip install torrent-search-mcp.env file in the directory where you'll run the application (optional).python -m torrent_search#### For Local Development
This method is for contributors who want to modify the source code. Using uv:
git clone https://github.com/philogicae/torrent-search-mcp.git
cd torrent-search-mcpuv:uv sync --frozencp .env.example .envuv run -m torrent_searchThe repo also ships a dev.sh helper that locks/syncs deps, formats, lints, type-checks (ty) and runs the test suite with coverage:
./dev.sh#### For Docker
This method uses Docker Compose to run two containers: the REST API + web UI, and an MCP server that proxies the API (no local scraping).
compose.yaml is configured to bypass DNS issues (using quad9 DNS).
| Container | Mode | Host port | Endpoints |
|---|---|---|---|
torrent-search-api | api | 8000 | / (web UI), /torrent/*, /sources, /docs |
torrent-search-mcp | http | 8001 | /mcp (MCP over streamable HTTP, TORRENT_SEARCH_API_URL=http://torrent-search-api:8000) |
git clone https://github.com/philogicae/torrent-search-mcp.git
cd torrent-search-mcpcp .env.example .envdocker compose up --build -ddocker logs torrent-search-api -f
docker logs torrent-search-mcp -fThe package exposes a single entry point, torrent-search-mcp (installed by pip/uvx), equivalent to python -m torrent_search. It supports the following --mode values:
| Mode | Endpoint | Description |
|---|---|---|
cli | - | Run a single search query and print results to stdout. |
stdio | - | MCP server over stdio (default). |
http | /mcp | MCP server using streamable HTTP. Serves MCP protocol revision 2026-07-28 (sessionless) and negotiates older revisions for legacy clients. |
streamable-http | /mcp | Alias of http (legacy fastmcp transport name). |
sse | /sse | MCP server using Server-Sent Events. Legacy HTTP transport (deprecated by the MCP spec in favor of http). |
api | / | Standalone API HTTP server (see As API Server). |
The server is built on FastMCP 4 (MCP SDK v2). Clients supporting the 2026-07-28 revision negotiate it automatically (stateless requests, server/discover, no session IDs); older clients fall back to the previous handshake era against the same deployment.
MCP modes (stdio, http, streamable-http, sse) run standalone by default (tools scrape locally). Set TORRENT_SEARCH_API_URL to switch to API mode: the tools proxy a running Torrent Search REST API instead.
Common flags (for http, streamable-http, sse and api modes): --host (default 0.0.0.0), --port (default 8000), --reload, --workers (API only).
Run a one-off search directly from the terminal. Prints each result as id (seeders|leechers|downloads) - filename, then fetches the magnet/torrent for the top hit.
# Using the installed entry point
torrent-search-mcp --mode cli "sample show"
# Or via uvx without installing
uvx torrent-search-mcp --mode cli "sample show"
# Or from source
uv run -m torrent_search --mode cli "sample show"from torrent_search import torrent_search_api
results = await torrent_search_api.search_torrents("sample show")
for torrent in results:
print(
f"{torrent.filename} | {torrent.size} | {torrent.seeders} SE | {torrent.leechers} LE | {torrent.date} | {torrent.source}"
)search_torrents is async and accepts an optional max_items (default 20). popular_torrents(per_source=20) returns the current most popular torrents from sources with a top listing - up to per_source results per source (pass per_source=None for everything), merged and ranked by seeders + leechers. Each Torrent exposes id, filename, category, size, seeders, leechers, downloads, date, source, uploader, and, when available, magnet_link and a validated HTTP(S) page_url. Pass a torrent's id to get_torrent() to retrieve its magnet link.
from torrent_search import torrent_search_mcp
torrent_search_mcp.run(transport="http")This project also includes a API server as an alternative way to interact with the library via a standard HTTP API. This can be useful for direct API calls, integration with other web services, or for testing purposes.
Running the API Server:
# With Python
python -m torrent_search --mode api
# With uv
uv run -m torrent_search --mode api--host <host>: Default: 0.0.0.0.--port <port>: Default: 8000.--reload: Enables auto-reloading when code changes (useful for development).--workers <workers>: Default: 1. Caching and request coalescing are in-process, so each worker keeps its own cache; use the default single worker unless per-worker caches are acceptable (a shared backend such as Redis would be needed to scale out).The API server will then be accessible at http://<host>:<port>.
Available Endpoints: The API server exposes similar functionalities to the MCP server. Key endpoints include:
GET /: Built-in web UI (dark/light) - search, per-site popular tiles, sortable results, source-page links and magnet actions. Telegram sending requires one-time QR pairing when configured.POST /torrent/search: Search for torrents. Query params: query (required), max_items (optional, default 20; uncapped when per_source is set) and per_source (optional, keep up to N results per source, ranked by swarm health).GET /sources: List the available torrent source domains.GET /torrent/popular: Get the most popular torrents. Query params: per_source (optional, default 20) and refresh (optional, default false; true drops the server-side caches and fetches a fresh listing from every source - the Web UI POPULAR button does this on each click).GET /torrent/{torrent_id}: Get the magnet link for a specific torrent by id. Returns the magnet URI as a JSON string.GET /telegram/session: Web UI auth state (enabled, authenticated, public bot handle, prune_magnet_links). Send the session token as Authorization: Bearer.POST /telegram/auth/challenge: Create a one-time 16-character alphanumeric pairing code (rate-limited). Codes expire after ~5 minutes and are shown as a QR + deep link in the pairing popup.GET /telegram/auth/poll?code=: Poll a pairing code; on approval returns the one-time session token for the browser to store.DELETE /telegram/auth/challenge/{code}: Cancel a pending pairing code.POST /telegram/auth/register: Approve a pairing code bound to a Telegram chat_id. Requires Authorization: Bearer $TORRENT_SEARCH_API_KEY.POST /telegram/auth/logout: Revoke the presented session token.POST /forward_telegram: Send torrent info to the Telegram chat bound to the presented session token; server-to-server callers may instead use Authorization: Bearer $TORRENT_SEARCH_API_KEY with the target chat_id query param. JSON body: filename (required), magnet_link (required), optional size, seeders. When PRUNE_MAGNET_LINKS=true the forwarded magnet is pruned; requires TELEGRAM_BOT_TOKEN, otherwise 503./docs: Interactive API documentation (Swagger UI)./redoc: Alternative API documentation (ReDoc).Environment variables are configured the same way as for the MCP server (via an .env file in the project root).
Usable with any MCP-compatible client. Available tools:
search_torrents(user_intent, query): Search for torrents across all available sources.user_intent: A short description reflecting the user's overall intention (e.g. "latest episode of Sample Show").query: Optimized, lowercase, space-separated keywords (e.g. "sample show s01e05"). Generic/filler/technical terms should be stripped per the tool's docstring.INCLUDE_LINKS=true to include them.INCLUDE_LINKS unset, results keep their id but no magnet. After picking the 2-5 torrents worth recommending, call get_torrent(id) once per pick: the server resolves it from its 1-hour torrent cache, or re-runs the search if the entry expired. Do not fetch magnets for every result.popular_torrents(per_source=20): Get the most popular torrents right now from sources with an official top listing (apibay, uindex, 1337x, YTS, nyaa, EZTV) - up to per_source results each, grouped per source and pre-ranked by seeders + leechers.INCLUDE_LINKS=true to include them.available_sources(): Get the list of available torrent sources.get_torrent(torrent_id): Get the magnet link for a specific torrent by id (the id returned by search_torrents or popular_torrents).authorize_webapp(code, chat_id): Approve a Web UI pairing code bound to your Telegram chat id (the code shown in the browser pairing gate). Requires TORRENT_SEARCH_API_KEY and TORRENT_SEARCH_API_URL.forward_torrent(filename, magnet_link, chat_id, size=None, seeders=None): Forward a torrent (filename + magnet) to your Telegram chat through the REST API (magnet pruned when PRUNE_MAGNET_LINKS=true). Requires TORRENT_SEARCH_API_KEY and TORRENT_SEARCH_API_URL; rate-limited per chat (20/min).torrent_webapp(): Present the web UI URL (WEBUI_URL) and its pairing-based access system.#### Example with Devin
Configuration:
{
"mcpServers": {
...
# with stdio (only requires uv)
"torrent-search-mcp": {
"command": "uvx",
"args": [ "torrent-search-mcp" ]
},
# with streamable-http transport (Docker compose: MCP on port 8001; standalone server: 8000)
"torrent-search-mcp": {
"serverUrl": "http://127.0.0.1:8001/mcp"
},
# with sse transport (legacy; requires running server)
"torrent-search-mcp": {
"serverUrl": "http://127.0.0.1:8001/sse"
},
...
}
}See CHANGELOG.md for a history of changes to this project.
Contributions are welcome! Please open an issue or submit a pull request.
This project is licensed under the MIT License - see the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.