ihor-sokoliuk/mcp-searxng v1.13.0

on GitHub

Added

• FlareSolverr-primary failover to Byparr: Operators can configure FLARESOLVERR_URL, BYPARR_URL, or both. Dual mode always tries FlareSolverr first, advances to Byparr only for busy or transient-unavailable acquisition, and uses one uncached direct fetch only after every configured provider is busy or unavailable. Persistent 4xx, cancellation, solution-integrity failures, and solved non-2xx target status stop the chain. Provider timeouts and concurrency remain independent, cache entries use the winning provider, and canonically duplicate endpoints fail closed. Verified provider versions remain FlareSolverr 3.5.0 and Byparr 2.1.0 from 2026-07-30. (#220, #223, #224)

  Migration note: Browser-solver endpoints are now validated during startup. A FLARESOLVERR_URL containing userinfo, a query, a fragment, or a non-HTTP(S) scheme now prevents startup instead of failing only when a URL read first uses it.

• Bounded PDF text extraction: web_url_read now extracts text-layer content from application/pdf responses using the new production unpdf dependency in a resource-limited worker. Input and output are capped at the lower of URL_READ_MAX_CONTENT_LENGTH_BYTES and 16 MiB, documents above 500 pages are rejected, parsing has a separate 30-second budget, and at most two extractions run concurrently. OCR is not supported. This supersedes the v1.10.0 behavior that rejected PDF responses. (#221)

• Expanded operator and client guidance: New documentation covers self-hosted and public SearXNG instances, MCP client configuration, evidence-focused research workflows, and measured deployment profiles. (#214, #215, #216, #217, #218)

Fixed

• HTTP rate-limit settings now honor the strict integer-validation contract: MCP_RATE_WINDOW_MS, MCP_RATE_INIT_MAX, and MCP_RATE_SESSION_MAX reject fractional, unit-suffixed, exponent, non-decimal, non-positive, and unsafe values instead of accepting numeric prefixes. Invalid values fall back with a raw-value-free warning. Because previously accepted numeric prefixes may have produced a different effective limit, the documented default may be looser or stricter until the operator corrects the setting. (#219)

• Solver and PDF documentation now matches runtime boundaries: Security and deployment guidance consistently describes browser-solver disclosure, acquisition fallback, PDF parsing limits, and timeout behavior. (#222)

Full Changelog: v1.12.1...v1.13.0