ihor-sokoliuk/mcp-searxng v1.6.0

on GitHub

This release rolls up everything since v1.4.0. Note: 1.5.0 was published to npm and Docker Hub on 2026-06-12 but never received a GitHub release — those changes are included below alongside the new 1.6.0 work.

✨ Added

• engines parameter on searxng_web_search — a comma-separated list (e.g. google,bing,duckduckgo) routes a search to specific SearXNG engines instead of the category defaults.
• Validated & normalized categories / engines — values are trimmed and matched case-insensitively against the connected instance's live /config, and canonical names are sent to SearXNG. Unknown values are rejected up front with the available options listed, fixing silent search degradation from miscased names.
• Configurable URL cache controls — CACHE_TTL_MS (default 24 h) and CACHE_MAX_ENTRIES (default 500).
• Bounded URL cache eviction — entries track hit counts and use LFU eviction with oldest-entry tie-breaking.
• searxng_suggestions tool — returns search autocomplete suggestions from the instance.
• searxng_instance_info tool — discovers instance capabilities (engines, categories, languages, safe-search).
• JSON response format — searxng_web_search accepts response_format ("text" | "json") for programmatic result processing.
• Search metadata in text output — answers, spelling corrections, infoboxes, and suggestions surface alongside ranked results.

🔧 Changed

• URL cache TTL default raised from 60 s to 24 h within a running server (entries still expire/evict).

🐛 Fixed

• Metadata (answers, corrections, infoboxes) is preserved in text output even when min_score filters out all web results.
• Unresponsive engines are no longer listed in text output.
• searxng_suggestions and searxng_instance_info now route through the configured search proxy and default TLS dispatcher.

🔒 Security

• Least-privilege Docker workflow permissions — security-events: write is isolated to a dedicated image-scan job in both the publish and rebuild workflows, with id-token: write confined to the publish/sign job and workflow-level permissions kept read-only.
• Patched bundled hono — pinned the transitive hono dependency to ≥ 4.12.25 (npm overrides) to resolve CVE-2026-54290 (CORS middleware origin reflection) in the published Docker image.

🏗️ Build / CI

• Added a CI workflow running lint plus unit and integration tests on every pull request and push to main.

Full Changelog: v1.4.0...v1.6.0