# web-search-mcp - Doramagic AI Context Pack > Positioning: a pre-install experience and judgment asset. It helps the host AI get off to a good start, but it does not mean the project has already been installed, run, or validated. ## Sufficiency Principle - **Sufficiency over compression**: The AI Context Pack should be sufficient for the host AI to understand the project's value, capability boundaries, entrypoints, risks, and evidence sources before starting work; it may be layered, but it does not aim for the shortest possible summary. - **Compression policy**: Compress only noise and duplication, never context that affects judgment or the quality of the work. ## How the Host AI Should Use This You are reading the AI Context Pack that Doramagic compiled for web-search-mcp. Treat it as pre-work context: help the user understand who it fits, what it can do, how to start, what must be verified after install, and where the risks are. Do not claim that you have already installed, run, or executed the target project. ## Claim Consumption Rules - **Fact source**: Repo Evidence + Claim/Evidence Graph; the Human Wiki only supplies salience, terminology, and narrative structure. - **Minimum status for a fact**: `supported` - `supported`: May be used as a project fact, but the answer must cite the claim_id and evidence path. - `weak`: Usable only as a low-confidence lead; the user must be asked to keep verifying. - `inferred`: Usable only for risk notes or open questions; must not be packaged as a project fact. - `unverified`: Must not be used as fact; state clearly that evidence is insufficient. - `contradicted`: Must show the conflicting sources and must not force a single version on the user's behalf. ## Who It Fits Best - **AI researchers or builders of research-oriented Agents**: The README clearly centers on research, experiment, or paper workflows. Evidence: `README.md` Claim: `clm_0002` supported 0.86 - **Developers already using host AIs such as Claude/Codex/Cursor/Gemini**: The README or plugin config mentions multiple host AIs. Evidence: `README.md` Claim: `clm_0003` supported 0.86 ## What It Can Do - **Project Knowledge Preview** (Previewable before install): The project can be read and explained, but current evidence is not enough to confirm installable capabilities or a runtime entrypoint. Evidence: `README.md`, `FOLLOW_UPS.md`, `NOTES.md`, `.env.example` et al. Claim: `clm_0001` supported 0.86 ## How to Start - No stable Quick Start command in the project evidence; this should be left empty rather than fabricated by Doramagic. ## Continue-or-Stop Decision Card - **Current recommendation**: Needs admin / security approval - **Why**: Continuing may involve secrets, accounts, external services, or sensitive context; get admin or security approval first. ### 30-Second Read - **What to do now**: Needs admin / security approval - **Minimum safe next step**: Run Prompt Preview first; if credentials or an enterprise environment are involved, get approval before trialing - **Do not trust yet**: Tool permission boundaries cannot be trusted before install. - **Continuing will touch**: Environment variables / API keys, Host AI context ### What You Can Trust Now - **Target-audience signal: AI researchers or builders of research-oriented Agents** (supported): Backed by a supported claim or project evidence, but that still is not the same as real install results. Evidence: `README.md` Claim: `clm_0002` supported 0.86 - **Target-audience signal: Developers already using host AIs such as Claude/Codex/Cursor/Gemini** (supported): Backed by a supported claim or project evidence, but that still is not the same as real install results. Evidence: `README.md` Claim: `clm_0003` supported 0.86 - **Capability exists: Project Knowledge Preview** (supported): You can trust that the project contains signals of this capability; whether it fits your specific task still needs trial or after-install verification. Evidence: `README.md`, `FOLLOW_UPS.md`, `NOTES.md`, `.env.example` et al. Claim: `clm_0001` supported 0.86 ### What You Cannot Trust Yet - **Tool permission boundaries cannot be trusted before install.** (unverified): MCP/tool projects usually touch files, the network, the browser, or external APIs, so permissions and logs must be checked for real. - **Real output quality cannot be trusted before install.** (unverified): Prompt Preview can only show how it guides you; it cannot prove result quality in the real project. - **Host AI version compatibility cannot be trusted before install.** (unverified): Host loading rules and version differences across Claude, Cursor, Codex, Gemini, and others must be verified in a real environment. - **That it will not pollute your existing host AI's behavior cannot be trusted directly.** (inferred): Skill, plugin, and AGENTS/CLAUDE/GEMINI instructions may change the host AI's default behavior. - **Safe rollback cannot be assumed by default.** (unverified): Unless the project clearly provides uninstall and recovery instructions, verify in an isolated environment first. - **After a real install, is it compatible with the user's current host AI version?** (unverified): Compatibility can only be verified in the actual host environment. - **Does the project's output quality meet the user's specific task?** (unverified): The pre-install preview can only show flow and boundaries; it cannot replace real evaluation. ### What Continuing Will Touch - **Environment variables / API keys**: Project entry docs explicitly showing API key, token, secret, or account credential configuration. Why: If a real install needs credentials, use test credentials first and go through a permission/compliance review. Evidence: `NOTES.md`, `README.md`, `probes/phase-1-probe.py`, `probes/phase-2-probe.py` et al. - **Host AI context**: The AI Context Pack, Prompt Preview, Skill routing, risk rules, and project facts. Why: Importing context affects the host AI's later judgment, so avoid packaging unverified items as facts. ### Minimum Safe Next Steps - **Run Prompt Preview first**: Use a pre-install interactive trial to judge whether the way of working fits; it needs no authorization or environment change. (applies when: Applies to any project, especially when output quality is unknown.) - **Trial-install only in an isolated directory or a test account**: Avoid letting install commands pollute your primary host AI, real projects, or home directory. (applies when: When there are signals of command execution, plugin config, or local writes.) - **Do not use real production credentials**: Once an environment variable / API key enters the host or toolchain, it can create account and compliance risk. (applies when: When environment signals like API, TOKEN, KEY, or SECRET appear.) - **After install, verify just one minimal task**: Verify loading, compatibility, output quality, and rollback first, then decide whether to use it deeply. (applies when: When moving from a trial into a real workflow.) ### Exit Plan - **Preserve the pre-install state**: Record the original host config and project state so you can later judge whether it is recoverable. - **Be ready to revoke test API keys or tokens**: If test credentials leak or are misused, you can cut losses quickly. - **If there is no rollback path, do not enter your primary environment**: No rollback is a blocker before continuing; do not proceed on trust or luck. ## What Can Only Be Previewed - Explain who the project fits and what it can do - Demonstrate a typical conversation flow based on project docs - Help the user decide whether it is worth installing or researching further ## What Must Be Verified After Install - Actually installing the Skill, plugin, or CLI - Running scripts, modifying local files, or accessing external services - Verifying real output quality, performance, and compatibility ## Boundary & Risk Decision Card - **Mistaking the pre-install preview for a real run**: The user may overestimate how much configuration, permission, and compatibility verification the project has already done. Mitigation: Clearly separate prompt_preview_can_do from runtime_required. Claim: `clm_0004` inferred 0.45 - **To confirm**: After a real install, is it compatible with the user's current host AI version?. Why: Compatibility can only be verified in the actual host environment. - **To confirm**: Does the project's output quality meet the user's specific task?. Why: The pre-install preview can only show flow and boundaries; it cannot replace real evaluation. ## Pre-Work Working Context ### Loading Order - First read how_to_use.host_ai_instruction to establish the boundaries of this pre-install judgment asset. - Read claim_graph_summary to confirm facts come from the Claim/Evidence Graph, not the Human Wiki narrative. - Then read intended_users, capabilities, and quick_start_candidates to judge whether the user is a match. - When you need to carry out a concrete task, check role_skill_index first, then evidence_index. - For real install, file modification, network access, performance, or compatibility questions, turn to risk_card and boundaries.runtime_required. ### Task Routes - **Project Knowledge Preview**: Use role_skill_index / evidence_index to help the user pick a usable role, Skill, or workflow first. Boundary: Can be experienced via a pre-install Prompt. Evidence: `README.md`, `FOLLOW_UPS.md`, `NOTES.md`, `.env.example` et al. Claim: `clm_0001` supported 0.86 ### Context Scale - Total files: 36 - Important-file coverage: 36/36 - Evidence index entries: 32 - Role / Skill entries: 3 ### Handling Insufficient Evidence - **missing_evidence**: State that evidence is insufficient and ask the user for the target file, a README section, or after-install verification records; do not fill in facts. - **out_of_scope_request**: State that the task is beyond the current AI Context Pack's evidence scope and suggest the user check the Human Manual or verify after a real install. - **runtime_request**: Provide a pre-install checklist and command sources, but do not run commands for the user or claim they have been run. - **source_conflict**: Show the conflicting sources side by side, mark them as unverified, and do not force a single version. ## Prompt Recipes ### Fit assessment - Goal: Judge whether this project fits the user's current task. - Expected output: A fit conclusion, key reasons, evidence citations, what can be previewed before install, what must be verified after install, and a next-step recommendation. ```text Based on the AI Context Pack for web-search-mcp, ask me 3 necessary questions first, then judge whether it fits my task. The answer must cover: who it fits, what it can do, what it cannot do, whether it is worth installing, and where the evidence comes from. Every project fact must cite evidence_refs, source_paths, or a claim_id. ``` ### Pre-install experience - Goal: Let the user feel the core workflow before installing, while avoiding packaging the preview as real capability or a marketing promise. - Expected output: An experience script with boundary labels, an after-install verification checklist, and a cautious recommendation; with no real-run promises or strong marketing language. ```text Treat web-search-mcp as a pre-install experience asset, not an already-installed tool or a real runtime environment. Output exactly four parts: 1. Ask me 3 necessary questions first. 2. Give an "experience script": use the three labels [Previewable before install], [Must verify after install], and [Insufficient evidence] to show how it might guide the workflow. 3. Give an after-install verification checklist: list which capabilities can only be confirmed after a real install, real host loading, and a real project run. 4. Give a cautious recommendation: only "worth researching/trialing further", "add information before deciding", or "not recommended to continue"; do not endorse the project. Hard boundaries: - Do not claim you have installed, run, executed tests, modified files, or produced real results. - Do not write promise-like phrasing such as "auto-adapts", "guarantees passing", "perfect fit", or "strongly recommend installing". - If you describe how it works after install, you must use a conditional such as "if installed successfully and the host loads the Skill correctly, it might...". - The experience script may only be written as "example lines / hypothetical flow": use "might ask / might suggest / might show", not "has written, has generated, has passed, is running, is generating". - Prompt Preview does not hand out install commands; if the user is ready to trial, only prompt them to read Quick Start and the Risk Card first and to verify in an isolated environment. - Every project fact must come from a supported claim, evidence_refs, or source_paths; inferred/unverified items can only be risks or open questions. ``` ### Role / Skill selection - Goal: Pick the best-matching asset from the project's roles or Skills. - Expected output: A list of candidate roles or Skills, each with an applicable scenario, evidence paths, risk boundary, and whether after-install verification is needed. ```text Read role_skill_index and recommend 3-5 of the most relevant roles or Skills for my target task. For each recommendation, state the applicable scenario, likely output, risk boundary, and evidence_refs. ``` ### Risk pre-check - Goal: Identify environment, permission, rule-conflict, and quality risks before installing or adopting. - Expected output: A checklist of environment, permission, dependency, license, host-conflict, quality risk, and unknown items. ```text Based on risk_card, boundaries, and quick_start_candidates, give me a pre-install risk pre-check list. Do not run commands for me; only explain what I should check, why, and what impact a failure would have. ``` ### Host AI kickoff instruction - Goal: Turn the project context into a host AI instruction for the start of a conversation. - Expected output: A pre-work instruction with clear boundaries and clear evidence citations, suitable to copy to a host AI. ```text Based on the AI Context Pack for web-search-mcp, generate a pre-work instruction I can paste to my host AI. This instruction must obey not_runtime=true and must not claim the project has been installed, run, or produced real results. ``` ## Role / Skill Index - Indexed 3 role / Skill / project-doc entries. - **web search mcp** (project_doc): A local MCP server exposing a unified search web tool that queries configured search backends, normalizes results into a shared schema, and returns an evidence-friendly payload for a downstream LLM agent — plus fetch url static page fetch + main-content extraction and search health provider connectivity / auth / mode-availability report . Activation hint: Reference this when the user needs to understand the project's structure, install path, or boundaries. Evidence: `README.md` - **Follow-ups - out-of-scope items for operator triage** (project_doc): Follow-ups - out-of-scope items for operator triage Activation hint: Reference this when the user needs to understand the project's structure, install path, or boundaries. Evidence: `FOLLOW_UPS.md` - **NOTES** (project_doc): Observations and "while I'm here" candidates surfaced during Phase 1 implementation, to be decided by the product owner before acting on them. Activation hint: Reference this when the user needs to understand the project's structure, install path, or boundaries. Evidence: `NOTES.md` ## Evidence Index - Indexed 32 evidence entries. - **web search mcp** (documentation): A local MCP server exposing a unified search web tool that queries configured search backends, normalizes results into a shared schema, and returns an evidence-friendly payload for a downstream LLM agent — plus fetch url static page fetch + main-content extraction and search health provider connectivity / auth / mode-availability report . Evidence: `README.md` - **Follow-ups - out-of-scope items for operator triage** (documentation): Follow-ups - out-of-scope items for operator triage Evidence: `FOLLOW_UPS.md` - **NOTES** (documentation): Observations and "while I'm here" candidates surfaced during Phase 1 implementation, to be decided by the product owner before acting on them. Evidence: `NOTES.md` - **Per-request timeout seconds for provider HTTP calls.** (source_file): Per-request timeout seconds for provider HTTP calls. Valid: any positive number. Example: 5, 10, 15. SEARCH TIMEOUT SECONDS=10 Evidence: `.env.example` - **Docker Compose** (source_file): services: web search mcp: build: . ports: - "127.0.0.1:8000:8000" env file: .env environment: - MCP TRANSPORT=http restart: unless-stopped networks: - default - mcp internal web search mcp chatgpt: build: . ports: - "127.0.0.1:8010:8000" env file: .env environment: - MCP TRANSPORT=http restart: unless-stopped networks: - default networks: mcp internal: external: true Evidence: `docker-compose.yml` - **Search Result** (source_file): @dataclass class RawSearchResult ⋮---- provider: str raw rank: int title: str url: str snippet: str published date: Optional str = None extra: dict = field default factory=dict ⋮---- @dataclass class NormalizedResult ⋮---- domain: str providers: list str provider overlap: int published date: Optional str content type: str confidence: float ⋮---- rank score: Optional float = None ⋮---- raw ranks: dict = field default factory=dict ⋮---- def to dict self - dict Evidence: `models/search_result.py` - **Init** (source_file): log = get logger name ⋮---- def build providers config: Config - list SearchProvider ⋮---- providers: list SearchProvider = ⋮---- all = "build providers" Evidence: `providers/__init__.py` - **Base** (source_file): @runtime checkable class SearchProvider Protocol ⋮---- name: str Evidence: `providers/base.py` - **Brave exposes age short form like "2 days ago" and, on** (source_file): log = get logger name ⋮---- class BraveProvider ⋮---- name = "brave" ⋮---- url = f"{self. api base}/res/v1/web/search" params: dict str, str int = { ⋮---- headers = { ⋮---- warnings: list str = ⋮---- resp = await client.get url, params=params, headers=headers ⋮---- body = resp.text or "" .strip .replace "\n", " " :200 body clause = f" body={body!r}" if body else "" ⋮---- payload = resp.json ⋮---- web = payload.get "web" or {} raw = web.get "results" if isinstance web, dict else None ⋮---- results: list RawSearchResult = ⋮---- link = entry.get "url" or "" ⋮---- title = entry.get "title" or "" description = entry.get "description" or "" Brave exposes age short form like "2 days ago" and, on ⋮… Evidence: `providers/brave.py` - **Exa** (source_file): log = get logger name ⋮---- class ExaProvider ⋮---- name = "exa" ⋮---- url = f"{self. api base}/search" body = { headers = { ⋮---- warnings: list str = ⋮---- resp = await client.post url, json=body, headers=headers ⋮---- body = resp.text or "" .strip .replace "\n", " " :200 body clause = f" body={body!r}" if body else "" ⋮---- payload = resp.json ⋮---- raw = payload.get "results" ⋮---- results: list RawSearchResult = ⋮---- link = entry.get "url" or "" ⋮---- title = entry.get "title" or "" highlights = entry.get "highlights" ⋮---- snippet = " ... ".join str h for h in highlights if h ⋮---- snippet = "" published = entry.get "publishedDate" or None ⋮---- class ExaError RuntimeError Evidence: `providers/exa.py` - **Serper provides a 1-based position . Fall back to enumeration** (source_file): log = get logger name ⋮---- class SerperProvider ⋮---- name = "serper" ⋮---- url = f"{self. api base}/search" body = { headers = { ⋮---- warnings: list str = ⋮---- resp = await client.post url, json=body, headers=headers ⋮---- body text = resp.text or "" .strip .replace "\n", " " :200 body clause = f" body={body text!r}" if body text else "" ⋮---- payload = resp.json ⋮---- raw = payload.get "organic" ⋮---- results: list RawSearchResult = ⋮---- link = entry.get "link" or "" ⋮---- title = entry.get "title" or "" snippet = entry.get "snippet" or "" Serper provides a 1-based position . Fall back to enumeration index when absent so raw rank stays well-defined. position = entry.get "position" raw… Evidence: `providers/serper.py` - **Pyproject** (source_file): project name = "web-search-mcp" version = "0.1.0" description = "Add your description here" readme = "README.md" requires-python = " =3.11" dependencies = "fastmcp =3.4.5, =0.28.1", "python-dotenv =1.2.2", "trafilatura =2.1.0", Evidence: `pyproject.toml` - **Server** (source_file): log = get logger "web search mcp.server" ⋮---- config = load config providers = build providers config ⋮---- mcp = FastMCP name="web search mcp" ⋮---- @mcp.tool async def fetch url url: str - dict ⋮---- @mcp.tool async def search health - dict ⋮---- def main - None ⋮---- transport = os.environ.get "MCP TRANSPORT", "stdio" port = int os.environ.get "MCP PORT", "8000" Evidence: `server.py` - **SSRF guard is explicitly disabled; skip DNS and pinning entirely.** (source_file): log = get logger name ⋮---- THIN TEXT THRESHOLD CHARS = 200 ⋮---- MAX REDIRECT HOPS = 5 ⋮---- EXTRACTABLE CONTENT TYPES = "text/html", "application/xhtml+xml" ⋮---- CGNAT NET = ipaddress.ip network "100.64.0.0/10" ⋮---- robots cache: dict tuple str, str, int , Optional RobotFileParser = {} ⋮---- class FetchDeadlineExceeded Exception ⋮---- def remaining deadline: float - float ⋮---- remaining = deadline - time.monotonic ⋮---- def effective port parts - int ⋮---- def ip is blocked ip: ipaddress.IPv4Address ipaddress.IPv6Address - bool ⋮---- @contextlib.contextmanager def pin dns hostname: str, pinned ip: str ⋮---- real = socket.getaddrinfo ip obj = ipaddress.ip address pinned ip is v6 = isins… Evidence: `tools/fetch_url.py` - **Canonical provider order for report entries matches the** (source_file): log = get logger name ⋮---- PROBE QUERY = "ping" PROBE MAX RESULTS = 1 ⋮---- PROVIDER ERRORS = BraveError, ExaError, SerperError HTTP CODE RE = re.compile r"returned HTTP \d{3} " AUTH FAILURE CODES = {401, 403, 422} ⋮---- Canonical provider order for report entries matches the build providers registration order in providers/ init .py . PROVIDER ORDER = "brave", "exa", "serper" ⋮---- def enabled map config: Config - dict str, bool ⋮---- def mode availability config: Config - dict str, dict ⋮---- enabled = {name for name, on in enabled map config .items if on} modes: dict str, dict = {} ⋮---- present = wanted & enabled missing = sorted wanted - enabled entry: dict = {"available": bool present… Evidence: `tools/search_health.py` - **Search Web** (source_file): log = get logger name ⋮---- Mode = Literal "balanced", "recall", "precision" ALLOWED MODES = {"balanced", "recall", "precision"} ⋮---- MODE ROUTING: dict str, frozenset str = { ⋮---- PROVIDER REQUIRED ENV: dict str, str = { ⋮---- DOMAIN DIVERSITY THRESHOLD = 0.70 PROVIDER DOMINANCE THRESHOLD = 0.90 ⋮---- CONF OVERLAP BOOST = 0.2 CONF TRUSTED BOOST = 0.1 CONF RECENT BOOST = 0.1 ⋮---- def clamp max results requested: int, default: int, upper bound: int - int ⋮---- def normalize mode mode: str - Mode ⋮---- wanted = MODE ROUTING mode available names = {p.name for p in available} selected = p for p in available if p.name in wanted missing = sorted wanted - available names ⋮---- warnings: list st… Evidence: `tools/search_web.py` - **Fetch Cache** (source_file): CacheKey = str ⋮---- store: dict CacheKey, dict = {} ⋮---- def make key url: str - CacheKey ⋮---- def get key: CacheKey - Optional dict ⋮---- value = store.get key ⋮---- def set key: CacheKey, value: dict - None ⋮---- def clear - None ⋮---- def size - int Evidence: `utils/fetch_cache.py` - **.python-version** (source_file): 3.11 Evidence: `.python-version` - **Dockerfile** (source_file): FROM python:3.11-slim WORKDIR /app COPY pyproject.toml uv.lock ./ RUN pip install uv && uv sync --frozen --no-dev COPY . . EXPOSE 8000 CMD "uv", "run", "python", "server.py" Evidence: `Dockerfile` - **Canonicalize** (source_file): EXACT TRACKING PARAMS = frozenset ⋮---- TRACKING PREFIXES = "utm ", ⋮---- def is tracking name: str - bool ⋮---- def canonicalize url url: str - str ⋮---- parts = urlsplit url ⋮---- scheme = parts.scheme.lower ⋮---- netloc = parts.netloc.lower ⋮---- path = parts.path ⋮---- path = path.rstrip "/" or "/" ⋮---- query pairs = query = urlencode query pairs, doseq=True Evidence: `fusion/canonicalize.py` - **fromisoformat accepts "Z" only from 3.11+; normalize defensively.** (source_file): def first non empty values: list str - str ⋮---- def parse iso value: str - Optional datetime ⋮---- s = value or "" .strip ⋮---- fromisoformat accepts "Z" only from 3.11+; normalize defensively. dt = datetime.fromisoformat s.replace "Z", "+00:00" ⋮---- dt = dt.replace tzinfo=timezone.utc ⋮---- def merge published date values: list - Optional str ⋮---- non null = v for v in values if v is not None ⋮---- parsed: list tuple datetime, str = ⋮---- dt = parse iso v ⋮---- groups: dict str, list NormalizedResult = {} order: list str = ⋮---- key = canonicalize url r.url ⋮---- merged: list NormalizedResult = ⋮---- group = groups key head = group 0 ⋮---- providers union: list str = seen: set str = set… Evidence: `fusion/dedupe.py` - **Normalize** (source_file): SUFFIX CATEGORY: dict str, str = { ⋮---- DOMAIN CATEGORY: dict str, str = { ⋮---- def extract domain url: str - str ⋮---- netloc = urlparse url .netloc.lower ⋮---- netloc = netloc 4: ⋮---- def classify content type domain: str - str ⋮---- def compute confidence raw rank: int - float ⋮---- def normalize raw: RawSearchResult - NormalizedResult ⋮---- domain = extract domain raw.url ⋮---- def normalize all raws: list RawSearchResult - list NormalizedResult Evidence: `fusion/normalize.py` - **Rank** (source_file): log = get logger name ⋮---- TRUSTED EXACT DOMAINS: set str = {"wikipedia.org", "arxiv.org"} TRUSTED SUFFIX PATTERNS: set str = { ⋮---- OVERLAP BONUS = 2.0 TRUSTED BONUS = 1.0 RECENT BONUS = 1.0 ⋮---- def is trusted domain domain: str - bool ⋮---- d = domain.lower ⋮---- def parse published value: str - Optional datetime ⋮---- s = value.strip ⋮---- normalized = s.replace "Z", "+00:00" dt = datetime.fromisoformat normalized ⋮---- dt = dt.replace tzinfo=timezone.utc ⋮---- dt = parse published published date ⋮---- reference = now or datetime.now tz=timezone.utc delta = reference - dt ⋮---- def base score result: NormalizedResult - float ⋮---- best rank = min result.raw ranks.values ⋮---- now = d… Evidence: `fusion/rank.py` - **Two distinct URLs so they survive dedupe as separate results.** (source_file): SERPER API BASE = os.environ.get "SERPER API BASE", "https://google.serper.dev" SERPER PROBE QUERY = "latest AI news" SEARCH TIMEOUT SECONDS = float os.environ.get "SEARCH TIMEOUT SECONDS", "10" ⋮---- def pass label: str, detail: str = "" - None ⋮---- suffix = f" — {detail}" if detail else "" ⋮---- def fail label: str, detail: str - None ⋮---- def warn label: str, detail: str - None ⋮---- def assertion i fastmcp tool registration api - bool ⋮---- label = " i FastMCP installs and exposes a tool-registration API" ⋮---- required = {"tool", "add tool", "list tools", "run stdio async"} missing = m for m in required if not hasattr FastMCP, m ⋮---- version = getattr fastmcp, " version ", "unknown"… Evidence: `probes/phase-1-probe.py` - **The fast coroutine must return its marker; the slow must surface as** (source_file): BRAVE API BASE = os.environ.get "BRAVE API BASE", "https://api.search.brave.com" BRAVE PROBE QUERY = "python" SEARCH TIMEOUT SECONDS = float os.environ.get "SEARCH TIMEOUT SECONDS", "10" ⋮---- SLOW SLEEP = min SEARCH TIMEOUT SECONDS + 2.0, 12.0 ⋮---- def pass label: str, detail: str = "" - None ⋮---- suffix = f" — {detail}" if detail else "" ⋮---- def fail label: str, detail: str - None ⋮---- def warn label: str, detail: str - None ⋮---- def assertion i brave key present - tuple bool, bool ⋮---- """Returns passed, key present .""" label = " i BRAVE API KEY env var presence" key = os.environ.get "BRAVE API KEY" or None ⋮---- redacted = f"{key :4 }…{key -4: }" if len key = 8 else "set" ⋮----… Evidence: `probes/phase-2-probe.py` - **Phase 3 Probe** (source_file): EXA API BASE = os.environ.get "EXA API BASE", "https://api.exa.ai" EXA PROBE QUERY = "python" SEARCH TIMEOUT SECONDS = float os.environ.get "SEARCH TIMEOUT SECONDS", "10" ⋮---- def pass label: str, detail: str = "" - None ⋮---- suffix = f" — {detail}" if detail else "" ⋮---- def fail label: str, detail: str - None ⋮---- def warn label: str, detail: str - None ⋮---- def assertion i exa key present - tuple bool, bool ⋮---- """Returns passed, key present .""" label = " i EXA API KEY env var presence" key = os.environ.get "EXA API KEY" or None ⋮---- redacted = f"{key :4 }…{key -4: }" if len key = 8 else "set" ⋮---- def assertion ii exa json key present: bool - bool ⋮---- label = " ii Exa /searc… Evidence: `probes/phase-3-probe.py` - **Phase 4 Probe** (source_file): LIVE FETCH URL = os.environ.get ⋮---- REPO ROOT = os.path.abspath os.path.join os.path.dirname file , ".." ⋮---- FIXTURE HTML = ⋮---- ROBOTS DISALLOW ALL = "User-agent: \nDisallow: /\n" ⋮---- def pass label: str, detail: str = "" - None ⋮---- suffix = f" — {detail}" if detail else "" ⋮---- def fail label: str, detail: str - None ⋮---- def warn label: str, detail: str - None ⋮---- def red label: str, detail: str - None ⋮---- def phase4 modules missing - bool ⋮---- import tools.fetch url noqa: F401 import tools.search health noqa: F401 ⋮---- def synthetic config overrides ⋮---- """Build a Config with all keys unset unless overridden.""" ⋮---- base = dict ⋮---- def assertion i list tools missi… Evidence: `probes/phase-4-probe.py` - **Diag** (source_file): REPO ROOT = os.path.abspath os.path.join os.path.dirname file , ".." ⋮---- def main - int ⋮---- command = sys.argv 1 ⋮---- config = load config ⋮---- response = asyncio.run run fetch url sys.argv 2 , config ⋮---- providers = build providers config response = asyncio.run run search health config, providers Evidence: `scripts/diag.py` - **Query** (source_file): REPO ROOT = os.path.abspath os.path.join os.path.dirname file , ".." ⋮---- def main - int ⋮---- query = sys.argv 1 max results = int sys.argv 2 if len sys.argv 2 else 5 mode = sys.argv 3 if len sys.argv 3 else "balanced" ⋮---- config = load config providers = build providers config response = asyncio.run Evidence: `scripts/query.py` - **Cache** (source_file): CacheKey = tuple str, str, int ⋮---- store: dict CacheKey, dict = {} ⋮---- def make key query: str, mode: str, max results: int - CacheKey ⋮---- def get key: CacheKey - Optional dict ⋮---- def set key: CacheKey, value: dict - None ⋮---- def clear - None ⋮---- def size - int Evidence: `utils/cache.py` - **Config** (source_file): DEFAULT SEARCH TIMEOUT SECONDS = 10.0 DEFAULT MAX RESULTS = 5 MAX RESULTS UPPER BOUND = 10 DEFAULT BRAVE API BASE = "https://api.search.brave.com" DEFAULT BRAVE SAFESEARCH = "moderate" DEFAULT RECENCY WINDOW DAYS = 30 BRAVE MAX RESULTS CEILING = 20 DEFAULT EXA API BASE = "https://api.exa.ai" DEFAULT EXA NUM RESULTS CEILING = 10 DEFAULT SERPER API BASE = "https://google.serper.dev" DEFAULT SERPER NUM RESULTS CEILING = 10 DEFAULT FETCH URL TIMEOUT SECONDS = 15.0 DEFAULT FETCH URL MAX BODY BYTES = 2 000 000 ⋮---- DEFAULT FETCH URL USER AGENT = "web search mcp/0.4 +fetch url " ⋮---- @dataclass frozen=True class Config ⋮---- search timeout seconds: float default max results: int brave api base:… Evidence: `utils/config.py` - **Logging** (source_file): CONFIGURED = False ⋮---- def configure logging level: int = logging.INFO - None ⋮---- handler = logging.StreamHandler stream=sys.stderr ⋮---- root = logging.getLogger ⋮---- CONFIGURED = True ⋮---- def get logger name: str - logging.Logger Evidence: `utils/logging.py` ## Rules the Host AI Must Follow - **Treat this asset as pre-work context, not a runtime environment.**: The AI Context Pack contains only an evidence-backed understanding of the project, not the project's executable state. Evidence: `README.md`, `FOLLOW_UPS.md`, `NOTES.md` - **When answering the user, distinguish what can be previewed from what can only be verified after install.**: The consumer value of the pre-install experience comes from reducing bad installs and misjudgments, not from pretending to be a real run. Evidence: `README.md`, `FOLLOW_UPS.md`, `NOTES.md` ## Questions the User Should Answer First - Which host AI or local environment do you plan to use it in? - Do you just want to experience the workflow first, or are you ready to actually install? - What matters most to you: install cost, output quality, or conflicts with your existing rules? ## Acceptance Checks - Every capability claim can be traced back to a file path in evidence_refs. - AI_CONTEXT_PACK.md does not package previews as a real run. - The user can understand who it fits, what it can do, how to start, and the risk boundaries within 3 minutes. --- ## Doramagic Context Augmentation The following sections strengthen the repository context for a host AI. Human Manual data is a reading route, and pitfall notes become operating constraints. ## Human Manual Outline Usage rule: this is only a reading route and salience signal, not factual authority. Concrete claims must still return to repo evidence or Claim Graph. Host AI hard rules: - Do not treat page titles, section order, summaries, or importance values as factual project evidence. - When explaining the Human Manual outline, state that it is only a reading route or salience signal. - Capability, installation, compatibility, runtime state, and risk claims must cite repo evidence, source paths, or Claim Graph. - **Project Overview and Status**: importance `high` - source_paths: README.md, NOTES.md, FOLLOW_UPS.md - **Architecture and Module Layout**: importance `high` - source_paths: server.py, providers/__init__.py, providers/base.py, models/__init__.py, models/search_result.py - **Search Fusion Pipeline and Provider Adapters**: importance `high` - source_paths: tools/search_web.py, tools/search_health.py, providers/brave.py, providers/exa.py, providers/serper.py - **Fetch Tool, Deployment, and Operations**: importance `high` - source_paths: tools/fetch_url.py, utils/fetch_cache.py, Dockerfile, docker-compose.yml, .env.example ## Repo Inspection Evidence - repo_clone_verified: true - repo_inspection_verified: true - repo_commit: `d1b28df7493a27006761212a107e73bc1b2f46d2` - inspected_files: `Dockerfile`, `README.md`, `docker-compose.yml`, `pyproject.toml`, `uv.lock` Host AI hard rules: - Without repo_clone_verified=true, do not claim that the source code has been read. - Without repo_inspection_verified=true, do not write README, docs, or package-file conclusions as facts. - Without quick_start_verified=true, do not claim that the Quick Start path has run successfully. ## Doramagic Pitfall Constraints These rules come from Doramagic discovery, validation, or compilation findings. The host AI must treat them as operating constraints, not background notes. ### Constraint 1: Capability evidence risk requires verification - Trigger: README/documentation is current enough for a first validation pass. - Host AI rule: Reproduce the official install and quickstart path in an isolated environment. - Why it matters: May increase setup, validation, or first-run risk for the user. - Evidence: capability.assumptions | https://github.com/jimmytbc/web_search_mcp - Hard boundary: Do not present this pitfall as solved, verified, or ignorable unless later evidence explicitly closes it. ### Constraint 2: Security or permission risk requires verification - Trigger: no_demo - Host AI rule: Reproduce the official install and quickstart path in an isolated environment. - Why it matters: May increase setup, validation, or first-run risk for the user. - Evidence: downstream_validation.risk_items | https://github.com/jimmytbc/web_search_mcp - Hard boundary: Do not present this pitfall as solved, verified, or ignorable unless later evidence explicitly closes it. ### Constraint 3: Security or permission risk requires verification - Trigger: no_demo - Host AI rule: Reproduce the official install and quickstart path in an isolated environment. - Why it matters: May increase setup, validation, or first-run risk for the user. - Evidence: risks.scoring_risks | https://github.com/jimmytbc/web_search_mcp - Hard boundary: Do not present this pitfall as solved, verified, or ignorable unless later evidence explicitly closes it. ### Constraint 4: Maintenance risk requires verification - Trigger: issue_or_pr_quality=unknown。 - Host AI rule: Reproduce the official install and quickstart path in an isolated environment. - Why it matters: May increase setup, validation, or first-run risk for the user. - Evidence: evidence.maintainer_signals | https://github.com/jimmytbc/web_search_mcp - Hard boundary: Do not present this pitfall as solved, verified, or ignorable unless later evidence explicitly closes it. ### Constraint 5: Maintenance risk requires verification - Trigger: release_recency=unknown。 - Host AI rule: Reproduce the official install and quickstart path in an isolated environment. - Why it matters: May increase setup, validation, or first-run risk for the user. - Evidence: evidence.maintainer_signals | https://github.com/jimmytbc/web_search_mcp - Hard boundary: Do not present this pitfall as solved, verified, or ignorable unless later evidence explicitly closes it.