mcp-server-searxng

The project transparently discloses a critical security consideration: authentication credentials (`auth_username`, `auth_password`) are stored unencrypted in Zed's `settings.json` file and passed as environment variables, making them visible in process lists. Recommendations are provided to mitigate this risk (e.g., self-hosting without authentication or using a reverse proxy). Strong input validation is implemented for URLs, User-Agents, and proxy settings, including SSRF protection (configurable) and path traversal checks. The `mcp-searxng` npm dependency is version-pinned (0.8.0) to enhance supply chain security. Despite the plaintext credential storage, the comprehensive validation and clear disclosure indicate a strong focus on security best practices where possible.