# searxng-mcp

Stdio MCP for a SearXNG instance. It exposes web search through SearXNG's JSON
`/search` API. Exact tool schemas live in `cmd/searxng-mcp/tools.go`.

## Auth

`searxng-mcp` uses sherlock-managed OAuth with wallet key `searxng`, normally
through the shared Authentik `sherlock-cli` provider. It sends a fresh bearer to
the Caddy-protected SearXNG origin on every search request.

Caddy must accept that OAuth bearer for API requests. Browser SSO redirects or
session cookies alone are not enough for an MCP subprocess. SearXNG must also
enable JSON output for `/search?format=json`.

Config is `[services.searxng]` with provider or inline OAuth identity plus
`base_url`. `sherlock logout searxng` clears the session.

## Operation

When `searxng-mcp` is installed, `sherlock <agent>` includes it in the generated
MCP config. The first tool call authenticates lazily. `searxng-mcp --probe`
verifies auth against Caddy and one SearXNG JSON search without an agent.