Modelcontextprotocol — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Modelcontextprotocol (Plugin) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The official MCP server implementation for the Perplexity API Platform, providing AI assistants with real-time web search, reasoning, and research capabilities through Sonar models and the Search API.
Direct web search using the Perplexity Search API. Returns ranked search results with metadata, perfect for finding current information.
General-purpose conversational AI with real-time web search using the sonar-pro model. Great for quick questions and everyday searches.
Deep, comprehensive research using the sonar-deep-research model. Ideal for thorough analysis and detailed reports.
Advanced reasoning and problem-solving using the sonar-reasoning-pro model. Perfect for complex analytical tasks.
[!TIP] Available as an optional parameter for perplexity_reason and perplexity_research: strip_thinking>
Set totrueto remove<think>...</think>tags from the response, saving context tokens. Default:false
your_key_here in the configurations below with your API keyPERPLEXITY_TIMEOUT_MS=600000 (default: 5 minutes)PERPLEXITY_BASE_URL=https://your-custom-url.com (default: https://api.perplexity.ai)PERPLEXITY_LOG_LEVEL=DEBUG|INFO|WARN|ERROR (default: ERROR)claude mcp add perplexity --env PERPLEXITY_API_KEY="your_key_here" -- npx -y @perplexity-ai/mcp-serverOr install via plugin:
export PERPLEXITY_API_KEY="your_key_here"
claude
# Then run: /plugin marketplace add perplexityai/modelcontextprotocol
# Then run: /plugin install perplexitycodex mcp add perplexity --env PERPLEXITY_API_KEY="your_key_here" -- npx -y @perplexity-ai/mcp-serverMost clients can be configured manually using the same mcpServers wrapper in their client config (as shown for Cursor). If a client has a different schema, check its docs for the exact wrapper format.
For manual setup, these clients all use the same mcpServers structure:
| Client | Config File |
|---|---|
| Cursor | ~/.cursor/mcp.json |
| Claude Desktop | claude_desktop_config.json |
| Kiro | .kiro/settings/mcp.json |
| Windsurf | ~/.codeium/windsurf/mcp_config.json |
| VS Code | .vscode/mcp.json |
{
"mcpServers": {
"perplexity": {
"command": "npx",
"args": ["-y", "@perplexity-ai/mcp-server"],
"env": {
"PERPLEXITY_API_KEY": "your_key_here"
}
}
}
}If you are running this server at work—especially behind a company firewall or proxy—you may need to tell the program how to send its internet traffic through your network's proxy. Follow these steps:
1. Get your proxy details
2. Set the proxy environment variable
The easiest and most reliable way for Perplexity MCP is to use PERPLEXITY_PROXY. For example:
export PERPLEXITY_PROXY=https://your-proxy-host:8080If your proxy needs a username and password, use:
export PERPLEXITY_PROXY=https://username:password@your-proxy-host:80803. Alternate: Standard environment variables
If you'd rather use the standard variables, we support HTTPS_PROXY and HTTP_PROXY.
[!NOTE] The server checks proxy settings in this order:PERPLEXITY_PROXY→HTTPS_PROXY→HTTP_PROXY. If none are set, it connects directly to the internet. URLs must includehttps://. Typical ports are8080,3128, and80.
For cloud or shared deployments, run the server in HTTP mode.
#### Environment Variables
| Variable | Description | Default |
|---|---|---|
PERPLEXITY_API_KEY | Your Perplexity API key | Required |
PERPLEXITY_BASE_URL | Custom base URL for API requests | https://api.perplexity.ai |
PORT | HTTP server port | 8080 |
BIND_ADDRESS | Network interface to bind to. Defaults to loopback. Set to 0.0.0.0 to expose on all interfaces. | 127.0.0.1 |
ALLOWED_ORIGINS | CORS origins (comma-separated). Defaults to empty (no cross-origin browser requests). Set to an explicit allowlist (e.g. https://app.example.com) or to * to allow any origin. | (empty) |
ALLOWED_HOSTS | Additional Host header values to accept (comma-separated). Loopback hosts on PORT are always allowed. Add the public hostname when binding to 0.0.0.0. | (loopback only) |
#### Docker
docker build -t perplexity-mcp-server .
docker run -p 8080:8080 -e PERPLEXITY_API_KEY=your_key_here perplexity-mcp-server#### Node.js
export PERPLEXITY_API_KEY=your_key_here
npm install && npm run build && npm run start:httpThe server will be accessible at http://localhost:8080/mcp
PERPLEXITY_API_KEY is set correctlyPERPLEXITY_TIMEOUT_MS to a higher valuePERPLEXITY_PROXY or HTTPS_PROXY setup and ensure api.perplexity.ai isn't blocked by your firewall.npx writes installation messages to stdout. Use npx -yq instead of npx -y to suppress this output.For support, visit community.perplexity.ai or file an issue.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.