Tavily MCP Server: Setup, OAuth vs API Key, and Security (Oct 2026)

Q: What's the Tavily MCP URL?

https://mcp.tavily.com/mcp. Connect it with OAuth. Avoid the ?tavilyApiKey= form.

Q: How do I set default search options?

Tavily supports a DEFAULT_PARAMETERS setting: a header on the hosted server or an environment variable for the local one, holding JSON such as {"include_images": true}. See the README for the exact format.

On this page

Tavily MCP Server: Setup, OAuth vs API Key, and Security (Oct 2026)

The Tavily MCP server is Tavily's official server for web search, page extraction, site maps, crawling and research. TrustedMCP grades it A. The short version: connect the hosted server with OAuth, not with your API key in the URL, and treat every page it fetches as untrusted text.

What it connects

Tavily's MCP docs list these tools:

tavily_search: searches the web for current sources.
tavily_extract: pulls clean content from one or more URLs.
tavily_crawl: reads many pages across a site.
tavily_map: discovers a site's structure.
tavily_research: runs multi-source research and returns a detailed answer.

You can use the hosted server at https://mcp.tavily.com/mcp, or run it locally with npx. Both are in the tavily-mcp repo.

If you came here for the Tavily API itself: the MCP server is a thin layer over the same API, so the same account, keys and credits apply.

Setup

These snippets are copied from the tavily-mcp README.

Claude Code (hosted, OAuth):

claude mcp add --transport http tavily https://mcp.tavily.com/mcp

Then start claude, type /mcp, select Tavily and finish the sign-in in your browser.

Local server (stdio, API key) for clients that use a JSON config such as Claude Desktop:

{
  "mcpServers": {
    "tavily-mcp": {
      "command": "npx",
      "args": ["-y", "tavily-mcp@latest"],
      "env": {
        "TAVILY_API_KEY": "your-api-key-here"
      }
    }
  }
}

Don't paste your real key there. Reference it from your environment instead, as shown in keeping API keys out of your MCP config. Consider pinning an exact version instead of @latest.

Cursor: Tavily's docs offer an "Add to Cursor" button that installs the hosted server with OAuth.

OAuth or API key?

Tavily supports three ways to authenticate the hosted server: OAuth, the API key as a tavilyApiKey URL parameter, or the key in an Authorization: Bearer header.

Avoid the URL parameter. It is the first option in Tavily's README, but a key in a URL ends up in shell history, client config files and sometimes in logs. The MCP spec itself says access tokens "MUST NOT be included in the URI query string". If your client can't do OAuth, use the header.

Know which key OAuth uses. Tavily's docs say OAuth requests use a key named mcp_auth_default:

If you have a personal or team key with that name, it's used. A personal key wins if both exist.
If neither exists, your personal default key is used, and if that's missing too, the first available key.

So create a dedicated key named mcp_auth_default for MCP use. That way you can see its usage and revoke it without breaking your other apps.

To sign out of OAuth for clients that use mcp-remote, Tavily's docs say to delete the ~/.mcp-auth directory.

Security notes

Fetched pages are untrusted input. Extract, crawl and research pull text from any URL the model chooses. A page can contain instructions aimed at your agent ("ignore previous instructions and…"). Keep tool approval on for any other server that can write, so injected text can't act through it.

The key is account-wide. Tavily's OAuth maps to an API key, not to scoped permissions. Anyone with the key can spend your credits. Use the dedicated mcp_auth_default key above and rotate it if it leaks.

Crawls cost credits. A broad crawl can make many requests. Ask for specific pages or a limited depth.

See the 5-minute safety check for the general process.

Why it grades A

Authentication: 18 of 30. OAuth is available but optional, and it maps to an account-wide key with no scopes. The setup shown first puts the key in the URL.
Maintenance: 25 of 25. Open source and very active.
Known CVEs: 25 of 25. No advisories on record.
Transport: 20 of 20. The hosted server uses HTTPS, and fetching happens on Tavily's servers, not your machine.

Full breakdown on the Tavily MCP listing; the method is in how TrustedMCP scores servers.

Frequently asked questions

Is the Tavily MCP server free?

The server itself is free and open source. Searches use your Tavily account, which you can sign up for free. Tavily's MCP page doesn't list prices or credit amounts, so check your Tavily dashboard for current limits.

What's the Tavily MCP URL?

https://mcp.tavily.com/mcp. Connect it with OAuth. Avoid the ?tavilyApiKey= form.

Tavily MCP vs Exa or Brave Search?

All three are official search servers we grade. See the best MCP server for SEO and search for a comparison, or the listings for Exa and Brave Search.

How do I set default search options?

Tavily supports a DEFAULT_PARAMETERS setting: a header on the hosted server or an environment variable for the local one, holding JSON such as {"include_images": true}. See the README for the exact format.

Why did my agent follow instructions from a web page?

Because the page text came back through Tavily as tool output, and the model read it. That's prompt injection, not a Tavily bug. Keep approval on for tools that write, and see MCP tool annotations explained for why labels alone don't protect you.

More: MCP security best practices · Search category